The EDPB is limiting the application of certain lawful bases for data processing around online services – what you need to know

The Charter of Fundamental Rights of the European Union and the GDPR require that data has to be processed in a fair manner, for a specified purpose and on the basis of a legitimate ground. One of the recognised grounds is the necessity of processing for the performance of a contract. When opting for this or any other ground for processing, a controller always has to take into account the impact on the data subject as well as the principle of fairness. This also includes the principle of transparency.

Against the backdrop of today’s society, the always-on mobile internet and wide variety of connected devices that foster the development of online services such as social media, e-commerce and internet searches financed by advertisement, the EDPB considered it appropriate to draft guidelines regarding the use of Art. 6 lit. b GDPR in the context of online services. The guidelines shall ensure that controllers only rely upon the legal ground of processing necessary for performance of a contract where that is appropriate and fair.

The newly published “Guidelines 2/2019 on the processing of personal data under Art. 6.1 lit. b GDPR in the context of the provision of online services to data subjects” restrict the use of this lawful basis in the context of online services substantially. The guidelines are applicable to the processing of personal data in the context of contracts for online services irrespective of where their funding comes from. In particular, they focus on the following issues:

• The interaction of Art. 6 lit. b GDPR with other lawful bases for processing. In particular, the EDPB considers that where processing is not in fact necessary for the performance of a contract, the controller should rely upon another lawful basis.
• The scope of Art. 6.1 lit. b GDPR and the term necessity. The EDPB states in this regard that “necessity” does not simply mean what is permitted by or written in the contract.
• 6.1 lit. b GDPR together with the accountability principle requires that the processing takes place in the context of a valid contract and that the processing is necessary so that the particular contract with the data subject can be performed.
• The effects of the termination of a contract on processing, a point that has to be anticipated by the controller when the contract enters into effect.
• The necessity for taking steps prior to entering into a contract should not cover unsolicited marketing or other processing activities which are carried out solely on the initiative of the data controller or at the request of a third party.
• The application of Art. 6.1 lit. b GDPR to specific situations.

For more information, please do get in touch with us or click on the button below for the full text of the guidelines in English.

Guidelines