31 May, 2019

ETNO Comments on EDPB draft Guidelines on Article 6(1)(b) GDPR

Introduction

On 9th April, the European Data Protection Board (EDPB) released its draft Guidelines on the processing of personal data under the contractual necessity legal basis (Article 6(1)(b) GDPR) in the context of the provision of online services to data subjects. EDPB has invited interested stakeholders to comment on the draft Guidelines until 24th May 2019. ETNO welcomes the opportunity to submit comments to the EDPB on this important topic, but regrets the static interpretation given by EDPB on the “contractual necessity” legal ground.

- EDPB aims to provide guidance on Article 6(1)(b) as a legal basis for processing personal data when such processing is necessary for the performance of a contract and its application to online services.

- The Guidelines focus on what constitutes “contractual necessity” and emphasises the narrow scope of the contractual necessity legal basis and how it applies to pre-contractual steps and termination of contract.
- For applicability of Article 6(1)(b) GDPR, it is necessary that the processing is objectively necessary for a purpose that is integral to the delivery of that contractual service to the data subject. If the controller cannot demonstrate such necessity, it must consider another legal basis for processing the personal data.

Read the full document below.