The European Data Protection Board adopted “Guidelines on the processing of personal data based on Article 6(1)(b) GDPR in the context of online services” at its ninth plenary session on April 9, 2019. According to Press release of the Federal Commissioner for Data Protection and Freedom of Information in Germany, the EDSA restricts the possibility for companies to base the processing of users’ data on the legal basis of “contract performance”. In particular, social network providers are to be prevented from circumventing the strict requirements of consent by including data processing that actually has nothing to do with the provision of an online service in the text of the contract. According to the EDSA press release in this context, explanations on the general data protection principles, on other legal grounds and, above all, probably on the prohibition of tying are to be expected.
After completion of the formal, legal and linguistic review, the new guidelines will be published on the EDSA website. They will be open to comment by interested parties through a public consultation.
Article 6 (1) b DSGVO reads as follows:
Article 6
Lawfulness of the processing
(1) Processing shall be lawful only if at least one of the following conditions is met:
[…]
(b) processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the data subject’s request;