<iframe src="//www.googletagmanager.com/ns.html?id=GTM-5T7PGR" height="0" width="0" style="display:none;visibility:hidden">


About Froriep Blog

No matter what part you play in the economy, our blog will provide you with a wealth of up-to-date and interesting articles, resources and checklists from the various areas of law.

The blog’s authors are all partners and employees of our firm, ensuring you benefit not only from the best legal knowledge, but also from examples drawn from their many years of practical experience.

Subscribe to the Blog

15 April 2019

The EDPB is limiting the application of certain lawful bases for data processing around online services – what you need to know

The European Data Protection Board (EDPB) has published guidelines on the use of processing of personal data necessary for the performance of a contract as a legal basis under Art. 6.1 lit. b General Data Protection Regulation (GDPR). The guidelines are now in the public consultation phase.

EDPB-lawful-basis-data-processing-benz-mattigThe Charter of Fundamental Rights of the European Union and the GDPR require that data has to be processed in a fair manner, for a specified purpose and on the basis of a legitimate ground. One of the recognised grounds is the necessity of processing for the performance of a contract. When opting for this or any other ground for processing, a controller always has to take into account the impact on the data subject as well as the principle of fairness. This also includes the principle of transparency.

Against the backdrop of today's society, the always-on mobile internet and wide variety of connected devices that foster the development of online services such as social media, e-commerce and internet searches financed by advertisement, the EDPB considered it appropriate to draft guidelines regarding the use of Art. 6 lit. b GDPR in the context of online services. The guidelines shall ensure that controllers only rely upon the legal ground of processing necessary for performance of a contract where that is appropriate and fair.

The newly published "Guidelines 2/2019 on the processing of personal data under Art. 6.1 lit. b GDPR in the context of the provision of online services to data subjects" restrict the use of this lawful basis in the context of online services substantially. The guidelines are applicable to the processing of personal data in the context of contracts for online services irrespective of where their funding comes from. In particular, they focus on the following issues:

  • The interaction of Art. 6 lit. b GDPR with other lawful bases for processing. In particular, the EDPB considers that where processing is not in fact necessary for the performance of a contract, the controller should rely upon another lawful basis.
  • The scope of Art. 6.1 lit. b GDPR and the term necessity. The EDPB states in this regard that "necessity" does not simply mean what is permitted by or written in the contract.
  • 6.1 lit. b GDPR together with the accountability principle requires that the processing takes place in the context of a valid contract and that the processing is necessary so that the particular contract with the data subject can be performed.
  • The effects of the termination of a contract on processing, a point that has to be anticipated by the controller when the contract enters into effect.
  • The necessity for taking steps prior to entering into a contract should not cover unsolicited marketing or other processing activities which are carried out solely on the initiative of the data controller or at the request of a third party.
  • The application of Art. 6.1 lit. b GDPR to specific situations.

For more information, please do get in touch with us or click on the button below for the full text of the guidelines in English.



If you liked this article, you might be interested in reading about:

Shedding some light on the territorial scope of the GDPR, by Nicola Benz and Cornelia Mattig

Checklist for a controller and processor agreement under the GDPR, by Nicola Benz and Ronald Kogens

Checklist Privacy Policy under the GDPR, by Nicola Benz and Cornelia Mattig

Simple in theory, complex in practice: the dual role as controller and processor under the General Data Protection Regulation, by Nicola Benz and Ronald Kogens 

Check for GDPR Compliance and receive a customised list of next steps for free, by Ronald Kogens and Nicola Benz


Photo by Josh Sorenson/Pexels

Topics: Data Privacy  Intellectual Property 

Share or Print this blog post:


Leave a comment here