EDSA: Gui­de­li­nes on the inter­pre­ta­ti­on of Art. 6 para. 1 b GDPR adopted

The Euro­pean Data Pro­tec­tion Board adop­ted “Gui­de­li­nes on the pro­ces­sing of per­so­nal data based on Arti­cle 6(1)(b) GDPR in the con­text of online ser­vices” at its ninth ple­na­ry ses­si­on on April 9, 2019. Accord­ing to Press release of the Federal Com­mis­sio­ner for Data Pro­tec­tion and Free­dom of Infor­ma­ti­on in Ger­ma­ny, the EDSA restricts the pos­si­bi­li­ty for com­pa­nies to base the pro­ces­sing of users’ data on the legal basis of “con­tract per­for­mance”. In par­ti­cu­lar, social net­work pro­vi­ders are to be pre­ven­ted from cir­cum­ven­ting the strict requi­re­ments of con­sent by inclu­ding data pro­ces­sing that actual­ly has not­hing to do with the pro­vi­si­on of an online ser­vice in the text of the con­tract. Accord­ing to the EDSA press release in this con­text, explana­ti­ons on the gene­ral data pro­tec­tion princi­ples, on other legal grounds and, abo­ve all, pro­bab­ly on the pro­hi­bi­ti­on of tying are to be expected.

After com­ple­ti­on of the for­mal, legal and lin­gu­istic review, the new gui­de­li­nes will be published on the EDSA web­site. They will be open to com­ment by inte­re­sted par­ties through a public consultation.

Arti­cle 6 (1) b DSGVO reads as follows:

Arti­cle 6

Law­ful­ness of the processing

(1) Pro­ces­sing shall be law­ful only if at least one of the fol­lo­wing con­di­ti­ons is met:

[…]

(b) pro­ces­sing is necessa­ry for the per­for­mance of a con­tract to which the data sub­ject is par­ty or for the imple­men­ta­ti­on of pre-con­trac­tu­al mea­su­res taken at the data subject’s request;