Article 6 GDPR

← Article 6: Lawfulness of processing →
Chapter 1: General provisions Article 1: Subject-matter and objectives Article 2: Material scope Article 3: Territorial scope Article 4: Definitions Chapter 2: Principles Article 5: Principles relating to processing of personal data Article 6: Lawfulness of processing Article 7: Conditions for consent Article 8: Conditions applicable to child’s consent in relation to information society services Article 9: Processing of special categories of personal data Article 10: Processing of personal data relating to criminal convictions and offences Article 11: Processing which does not require identification Chapter 3: Rights of the data subject Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Article 13: Information to be provided where personal data are collected from the data subject Article 14: Information to be provided where personal data have not been obtained from the data subject Article 15: Right of access by the data subject Article 16: Right to rectification Article 17: Right to erasure (‘right to be forgotten’) Article 18: Right to restriction of processing Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing Article 20: Right to data portability Article 21: Right to object Article 22: Automated individual decision-making, including profiling Article 23: Restrictions Chapter 4: Controller and processor Article 24: Responsibility of the controller Article 25: Data protection by design and by default Article 26: Joint controllers Article 27: Representatives of controllers or processors not established in the Union Article 28: Processor Article 29: Processing under the authority of the controller or processor Article 30: Records of processing activities Article 31: Cooperation with the supervisory authority Article 32: Security of processing Article 33: Notification of a personal data breach to the supervisory authority Article 34: Communication of a personal data breach to the data subject Article 35: Data protection impact assessment Article 36: Prior consultation Article 37: Designation of the data protection officer Article 38: Position of the data protection officer Article 39: Tasks of the data protection officer Article 40: Codes of conduct Article 41: Monitoring of approved codes of conduct Article 42: Certification Article 43: Certification bodies Chapter 5: Transfers of personal data Article 44: General principle for transfers Article 45: Transfers on the basis of an adequacy decision Article 46: Transfers subject to appropriate safeguards Article 47: Binding corporate rules Article 48: Transfers or disclosures not authorised by Union law Article 49: Derogations for specific situations Article 50: International cooperation for the protection of personal data Chapter 6: Supervisory authorities Article 51: Supervisory authority Article 52: Independence Article 53: General conditions for the members of the supervisory authority Article 54: Rules on the establishment of the supervisory authority Article 55: Competence Article 56: Competence of the lead supervisory authority Article 57: Tasks Article 58: Powers Article 59: Activity reports Chapter 7: Cooperation and consistency Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned Article 61: Mutual assistance Article 62: Joint operations of supervisory authorities Article 63: Consistency mechanism Article 64: Opinion of the Board Article 65: Dispute resolution by the Board Article 66: Urgency procedure Article 67: Exchange of information Article 68: European Data Protection Board Article 69: Independence Article 70: Tasks of the Board Article 71: Reports Article 72: Procedure Article 73: Chair Article 74: Tasks of the Chair Article 75: Secretariat Article 76: Confidentiality Chapter 8: Remedies, liability and penalties Article 77: Right to lodge a complaint with a supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against a controller or processor Article 80: Representation of data subjects Article 81: Suspension of proceedings Article 82: Right to compensation and liability Article 83: General conditions for imposing administrative fines Article 84: Penalties Chapter 9: Specific processing situations Article 85: Processing and freedom of expression and information Article 86: Processing and public access to official documents Article 87: Processing of the national identification number Article 88: Processing in the context of employment Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes Article 90: Obligations of secrecy Article 91: Existing data protection rules of churches and religious associations Chapter 10: Delegated and implementing acts Article 92: Exercise of the delegation Article 93: Committee procedure Chapter 11: Final provisions Article 94: Repeal of Directive 95: /46: /EC Article 95: Relationship with Directive 20: 02: /58: /EC Article 96: Relationship with previously concluded Agreements Article 97: Commission reports Article 98: Review of other Union legal acts on data protection Article 99: Entry into force and application

Legal Text

Article 6 - Lawfulness of processing

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

2. Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.

3. The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

(a) Union law; or

(b) Member State law to which the controller is subject.

The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.

4. Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:

(a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;

(b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;

(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;

(d) the possible consequences of the intended further processing for data subjects;

(e) the existence of appropriate safeguards, which may include encryption or pseudonymisation.

Relevant Recitals

Recital 39: Principles of Data Processing

Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used. That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed. Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing. In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing.

Recital 40: Lawfulness of Data Processing

In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis, laid down by law, either in this Regulation or in other Union or Member State law as referred to in this Regulation, including the necessity for compliance with the legal obligation to which the controller is subject or the necessity for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Recital 41: Legal Basis or a Legislative Measure

Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament, without prejudice to requirements pursuant to the constitutional order of the Member State concerned. However, such a legal basis or legislative measure should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the case-law of the Court of Justice of the European Union (the ‘Court of Justice’) and the European Court of Human Rights.

Recital 42: Proof and Requirements for Consent

Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. In accordance with Council Directive 93/13/EEC a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

Recital 43: Freely Given Consent

In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

Recital 44: Processing in the Context of a Contract

Processing should be lawful where it is necessary in the context of a contract or the intention to enter into a contract.

Recital 45: Legal Basis in Union or Member State Law

Where processing is carried out in accordance with a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, the processing should have a basis in Union or Member State law. This Regulation does not require a specific law for each individual processing. A law as a basis for several processing operations based on a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority may be sufficient. It should also be for Union or Member State law to determine the purpose of processing. Furthermore, that law could specify the general conditions of this Regulation governing the lawfulness of personal data processing, establish specifications for determining the controller, the type of personal data which are subject to the processing, the data subjects concerned, the entities to which the personal data may be disclosed, the purpose limitations, the storage period and other measures to ensure lawful and fair processing. It should also be for Union or Member State law to determine whether the controller performing a task carried out in the public interest or in the exercise of official authority should be a public authority or another natural or legal person governed by public law, or, where it is in the public interest to do so, including for health purposes such as public health and social protection and the management of health care services, by private law, such as a professional association.

Recital 46: Vital Interest of a Natural Person

The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject or that of another natural person. Processing of personal data based on the vital interest of another natural person should in principle take place only where the processing cannot be manifestly based on another legal basis. Some types of processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian emergencies, in particular in situations of natural and man-made disasters.

Recital 47: Overriding Legitimate Interests

The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing. Given that it is for the legislator to provide by law for the legal basis for public authorities to process personal data, that legal basis should not apply to the processing by public authorities in the performance of their tasks. The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.

Recital 48: Data Transfers Within a Group of Undertakings

Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data. The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected.

Recital 49: Network and Information Security as a Legitimate Interest

The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.

Recital 50: Compatible Purpose for Further Processing

The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. In such a case, no legal basis separate from that which allowed the collection of the personal data is required. If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations. Where the data subject has given consent or the processing is based on Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard, in particular, important objectives of general public interest, the controller should be allowed to further process the personal data irrespective of the compatibility of the purposes. In any case, the application of the principles set out in this Regulation and in particular the information of the data subject on those other purposes and on his or her rights including the right to object, should be ensured. Indicating possible criminal acts or threats to public security by the controller and transmitting the relevant personal data in individual cases or in several cases relating to the same criminal act or threats to public security to a competent authority should be regarded as being in the legitimate interest pursued by the controller. However, such transmission in the legitimate interest of the controller or further processing of personal data should be prohibited if the processing is not compatible with a legal, professional or other binding obligation of secrecy.

Recital 171: Repeal of Directive 95/46/EC and Transition Phase

Directive 95/46/EC should be repealed by this Regulation. Processing already under way on the date of application of this Regulation should be brought into conformity with this Regulation within the period of two years after which this Regulation enters into force. Where processing is based on consent pursuant to Directive 95/46/EC, it is not necessary for the data subject to give his or her consent again if the manner in which the consent has been given is in line with the conditions of this Regulation, so as to allow the controller to continue such processing after the date of application of this Regulation. Commission decisions adopted and authorisations by supervisory authorities based on Directive 95/46/EC remain in force until amended, replaced or repealed.

Commentary

Article 6(1) GDPR is based on Article 7 of the previous Data Protection Directive 95/46/EC. As a general rule, personal data may not be processed without complying with on of six exceptions ('legal basis').

Article 6(2) and (3) GDPR deals with the options for Member States to implement laws that make processing under 6(1)(c) and (e) necessary.

Article 6(4) GDPR is actually linked to the 'purpose limitation' principle in Article 5(1)(b) GDPR and further expands on what a 'compatible purpose' is.

(1) Legal basis for processing

Overview

Prohibition - with six exceptions

Article 6(1) GDPR generally prohibits processing operations ("processing shall be lawful only if") unless at least one of the six legal basis under (a) to (f) are fulfilled.

The general prohibition of data processing flows from the fact that under Article 8 of the Charter, the right to data protection is a fundamental rights ('data must be processed ... on the basis of the consent of the person concerned or some other legitimate basis laid down by law'). The system of Article 6(1) as a general prohibition, unless there is a justification is criticized in some Member States, but not unusual for a fundamental right. Just like other fundamental rights (e.g. the right to property, freedom of expression or the right to physical integrity), the default position is, that others may not interfere with a data subject's right to data protection, unless there is a justification.

No hierarchy

Given that this is the type of legal basis that the average data subject is confronted with the most consent is usually seen as more prominent than the other five legal basis. In fact, there is no hierarchy between the various legal basis. It is a matter controllers to choose the legal basis they wish to rely on. Each legal basis has specific features, upsides and downsides from the perspective of controllers and data subjects.

Multiple legal bases

While at least one legal basis has to be fulfilled, it is possible that there are multiple legal basis that a controller can rely at the same time ("at least one").

Using multiple legal basis may however raise transparency issues under Article 5(1)(a), if a data subject for example thinks that personal data is processed solely based on consent (which can be withdrawn at any time), while in fact the controller also relies on another legal basis like a legal obligation (which does not allow for a withdrawal by the data subject). The data subjects would the be tricked into thinking that they have more agency than they really have.

(a) Consent

Like other rights, the right to data protection can be waived by the data subject, by providing consent to the processing of their personal data. Given that data subjects are usually the weaker party in any transaction, the GDPR foresees a number of conditions that controllers have to comply with to obtain valid consent. This approach is very similar to other protections when fundamental rights are waived (e.g. gifting real estate may need the involvement of a notary, surgeries require detailed information and consent under Article 3(2) of the Charter). Compared to the waiver of other fundamental rights, consenting to data procession is has however become rather ubiquitous.

Consent is the most prominent legal basis, as it is the only one that data subjects are regularly confronted with. However, it is not the prime or even the most desirable legal basis. Typically consent is the 'last option', as Article 6(1)(b) to (e) GDPR provide for a legal basis for most daily processing operations, without the need to seek consent.

Example: Josephine is the new data protection officer for an online shop. She realizes that the check-out page requires consent under Article 6(1)(a) to the processing of personal data for processing the payment and for delivering the products. As this is already covered by 'necessary for the performance of a contract' under Article 6(1)(b), she removes this consent clause. This is not just more transparent for data subjects, as they are not tricked to believe that they can withdraw the consent, but it also makes the online form quicker to click through.

Consent is regularly criticized in the legal literature and by the public. Criticism seems to be largely fed by bad consent practices, but not necessarily by shortcomings of the letter of the law. If the conditions for consent are properly applied, it allows data subjects to exercise their right to informational self-determination. While it is correct that data subjects can be overwhelmed with these decisions, a liberal legal order requires that data subjects have agency over their rights, which includes waiving them. Given that Article 8(2) of the Charta explicitly foresees consent as one of the legal bases for data processing, consent is here to stay.

Joint reading of provisions

To ensure that consent is not only a legal fiction ("click fatigue"), the GDPR introduces a number of conditions that are meant to ensure that data subjects have a genuine choice when it comes to the processing of their data. Unfortunately the relevant elements are spread over different Articles of the GDPR:

• According to the available definition provided in Article 4(11) GDPR, consent must be freely given, specific, informed, and unambiguous.

• Furthermore, under Article 7 GDPR, a controller must be able to demonstrate that consent was given, consent must be distinguishable from other matters in any written declaration, can be withdrawn at any time and the provision of a contract may not be made conditional on consent.

• Finally, Article 8 GDPR stipulates that specific requirements must be respected when consent is given by children.

Consequently, the conditions for valid consent are split between Articles 4(11), 6(1)(a), 7 and 8 GDPR and require a joint reading of the different articles. See the commentary on Articles 7 and 8 GDPR for further details.

There is a slightly different concept of "explicit consent" in Articles 9(1)(a), 22(2)(c) and 49(1)(a) GDPR. See the commentary on Article 9(1)(a) GDPR for explicit consent.

Capacity

Generally, consent must be given directly by the data subject or a nominated representative. National law determines if a data subject lacks the legal capacity to make legally binding declarations. In the case of minors acting in the online context, Article 8(1) GDPR provides a minimum age of 16 while Member States may not reduce that age limit to below 13.

Freely given

Consent has to be freely given, which means that the data subjects must have the option to freely and genuinely choose to say 'yes' to the processing of their personal data. Just like other legally relevant declaration, consent is void if the data subject was for example physically forced to consent. However, the notion of 'freely given' is much broader under Article 6(1)(4) GDPR, as illustrated by the rules in Articles 4(11), 7 or 8 GDPR, as well as Recital 43. If consent is 'freely given' under the GDPR requires a wholistic and also economic analysis of the options for a data subject. The wholistic approach should lead to better results than previous approaches, but also uses vaguer concepts.

Power imbalance

Whether the option to refuse is genuinely given depends on the processing operation and service as well as the respective roles of the controller and the data subject in a given transaction. Not every abstract power imbalance makes consent invalid, however typical examples can be derived:

• Relationships with public authorities
• Employer-employee-relationships
• Use of major digital services with limited alternatives, for example because of a 'network effect'.

In other words, employers, governments or companies (especially those with a dominant market position) will typically be able to force data subjects to consent against their true wishes. In this perspective, Recital 43 GDPR highlights that if there is a "clear imbalance between the data subject and the controller" consent should not be considered a valid legal basis for the processing.

Example: A sales representative has to 'consent' that his mobile phone is tracked to ensure that he does not cheat on his time sheet and does not use the company car for private trips. Obviously the employee will be able to challenge the consent, if he only agreed to keep his job.

Conditional consent

Recital 43 and Article 7(4) GDPR further deal with the situation of 'bundled consent', i.e. when the performance of a contract is made conditional on consent. While such bundled consent is not automatically void, the law requires that 'utmost account shall be taken' if the provision of a contract is made conditional on consent.

Example: An app that costs € 1,99 per month requires that any new users agree to the terms and conditions when singing up. On the next screen the users must also consent to the sharing of their personal data with third parties for advertisement reasons. The use of personal data is not necessary for using the app. Necessary processing to use the core functions of the app can however be based on Article 6(1)(b) GDPR.

For further indications on the issue of bundled consent and the criteria to assess the freely given requirement, see Article 7(4) GDPR.

Informed

Consent must be informed. This is especially challenging in highly complex technological environments. Aa controller may have the technical, practical and legal knowledge to understand the relevant processing information and take months or years to develop this understanding, while an average data subject may not have any relevant education or knowledge but most make a choice within seconds or at best minutes. Under the GDPR, the controller must overcome this information asymmetry to get valid consent.

Content of information

Beyond the specific purpose, Articles 4(11) and 6(1)(a) GDPR do not specify which exact information must be provided to the data subject when asking for consent. Article 7(3) GDPR requires to inform the data subject about their right to withdraw consent prior to giving consent. Recital 42 adds the identity of the controller, but also clarifies that this is a minimum standard: "For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended."

Further information may depend on the specific purpose and processing operations that consent is sought for. Articles 13 and 14 GDPR can be seen as instructive, insofar as relevant for the processing operation. When personal data is shared, it may be necessary to inform about the individual recipients.

Form of information

Consent should be sought using clear and plain language and be provided in an intelligible and easily accessible form.

Case Law: According to C‑61/19 - Orange România, information must not only be provided but also 'digested' by the data subject. In particular, data subjects must be able to understand the circumstances of the processing of their personal data to estimate the consequences and implications of giving their consent. This seems to give information a more substantive and functional role.

Under Article 7(2) GDPR information to the data subject in the moment of consent under Article 6(1)(a) must be distinguished from any other matter. Just adding a link to the very broad information that needs to be provided under Articles 13 and 14 GDPR is therefor not leading to valid consent. Simply linking to a lengthy privacy policy is also not making information 'easily accessible', as data subjects will hardly find the relevant information needed to make a decision on the specific processing that is based on consent.

Specific

In accordance with the principle of transparency from Article 5(1)(b) GDPR consent must be provided for specific and legitimate purposes. When the processing has multiple purposes, consent should be given for all of them separately. A blanket consent to all kinds of purposes is therefore not valid. For example, "I agree to the processing of my data for advertisement, product improvement and the sharing with business partners" is not specific and therefore invalid.

Example: An online shop has a checkout page, where users must "consent to the privacy policy". The privacy policy lists all the various processing operations of the online shop, including the use of data for advertisement, the sharing of data with a non-EEA provider and with other individually listed partners. Any consent to the entire privacy policy, would usually fail the 'specific' element required for consent.

The principle of specificity of consent in Article 4(11) GDPR is confirmed by Article 6(1)(a) which requires consent to be given for “for one or more specific purposes”. This seems in line with the case law of the Court of Justice of the EU, according to which consent must refer to specific processing activities, clearly identified, also in order to allow the user to effectively understand the operations being carried out.

Unambiguous

Consent must be given unambiguously in the form of clear and affirmative action, however no specific form is required. Consent must be an unambiguous act, including any oral, written or other form of signifying the agreement to have personal data processed. In a digital environment consent is typically given by checking a box ("opt-in"), choosing technical settings that indicate the data subject’s acceptance of the proposed processing or clicking a button.

Example: At a wedding, the photographer asks a group to stand underneath the tree if they want to be on the picture, which will go to the couple's wedding website. Marcel and Alex make their way underneath the tree and waive at the camera. They have given unambiguous consent.

Conversely, silence, pre-ticked boxes or inactivity should not constitute consent. This has been stressed through recent case law by the Court of Justice where a pre-checked checkbox which the user had to deselect in order to refuse their consent cannot show any active behaviour. Similarly, actions which are not clearly affirmative include the simple use of a webpage. A user may simply ignore that a webpage uses data in a certain way. This ambiguity extends to assigning certain actions a legal meaning through a disclaimer (e.g. "by using our webpage you agree to X"). Accordingly, it is in practice impossible to ascertain whether a user had actually given their consent by not deselecting the pre-ticked checkbox or had just not noticed the information provided.

Case Law: In C‑673/17 - Planet49 a pre-checked checkbox which the data subject had to deselect in order to refuse their consent was not seen as valid consent, because not deactivating the box cannot be seen as active behaviour.

Withdrawal

Consent can be withdrawn at any time. Withdrawing of consent shall be as easy as it was giving it. The controller has to inform the data subject on the possibility to withdraw consent prior to the processing. For further information, see the commentary on Article 7(3) GDPR.

Example: An fitness app allows customers to opt-in to share their sports data online with a simple button. To stop the online sharing, the app requires sending an email to the app provider, including the app ID and a verification that the sender is actually the data subject.

Demonstration of consent

Article 7(1) GDPR further requires that a controller can demonstrate that the data subject has given consent.

(b) Contract

The execution of a contract between two or more parties often involves some processing of personal data.

Take, for instance, a data subject who buys a product in an online shop. Performance of this contract by the seller may well require processing of personal data. For example, the data subject's credit card number may be transferred to financial institutions for payment verification purposes. The buyer’s name and physical address can be shared with the shipment service for product delivery. In these cases, (i.e. when processing activities are necessary for the performance of the contract), Article 6(1)(b) GDPR is applicable and no further action from the data subject is required (for example, obtaining their consent to share the data with financial institutions).  legal basis applies if two conditions are met: (i) the contract between data subject and controller is valid and (ii) the (specific) processing is necessary for the performance of the contract.

Existence of a Valid Contract

A contract under Article 6(1)(b) must be valid. Void contracts cannot serve as a legal basis under Article 6(1)(b) GDPR.

It is a matter of applicable contract law if a specific contract or clause is valid. While some contractual elements are regulated on a European level (for example the minimum requirements under the Unfair Terms Directive 93/13/EEC for terms and conditions), civil law is generally a matter of each Member State. Especially in the consumer context, a contract may be subject to the laws of the Member State where each consumer resides (see e.g. Articles 17 to 19 of the Brussles-Ia Regulation (EU) No 1215/2012).

Example: A Spanish controller and a French consumer concluded a contract that is void under the applicable French law. The lack of any valid contract means there is no legal basis under Article 6(1)(b).

However, certain contractual defects seem to be common to many European legal traditions: for example, intention, misrepresentation and duress. However, beyond such standard cases there are circumstances in which a breach does not necessarily lead to a contract being void, but only allows contract partners to successfully challenge the contract. The EDPB Guidelines 2/2019 have clarified that these rules must be taken into account in assessing the validity of a national contract: “contracts and contractual terms must comply with […] consumer protection laws in order for processing based on those terms to be considered fair and lawful”. In conclusion, in order to understand whether a contract is valid or not, a controller must first identify the applicable law and, second, verify whether the contract is valid under that law (including any applicable EU law).

Necessary for the Performance of the Contract

The necessity of a processing operation for the performance of the contract is one of the most controversial legal bases existing under the EU’s data protection framework. Contractual necessity can be either a very logical and meaningful basis for processing (see the example of the e-commerce provided above) or, according to some, the perfect tool to bypass the application of more stringent and transparent legal bases (for instance, consent or legitimate interest), if not the whole GDPR. The concept of “necessity” must be interpreted in the light of applicable European law: “what is at issue is a concept [necessity] which has its own independent meaning in Community law and which must be interpreted in a manner which fully reflects the objective of that Directive, [Directive 95/46], as laid down in Article 1(1) thereof”.

From a systematic point of view, the contract (and to be accurate, all other legal bases) constitutes an exemption to the general prohibition of data processing (“Processing shall be lawful only if and to the extent that at least one of the” legal bases applies, Article 6(1) GDPR). As such, the exemption itself and all the wording it carries, including the “necessity” requirement, should be interpreted narrowly. This was confirmed by CJEU in the Rīgas case: “As regards the condition relating to the necessity of processing personal data, it should be borne in mind that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary”. Now, if “necessity” under Article 6(1)(b) must fully reflect the objectives of the GDPR, then further (normative) factors contribute to its definition, such as the principles of purpose and data minimization, fairness and transparency. The concept of “necessity” therefore seems to imply that, in deciding which specific processing method a controller may want to implement, they should take into account all the alternative, less intrusive measures available.

Drawing on the above, the EDPB has clarified that assessing what is “necessary” involves a factual analysis of the processing operations and their purpose(s) and whether less intrusive alternatives that achieve the same goal exist. If there are realistic, less intrusive processing operations, then the other more intrusive ones must be excluded – i.e. they are not “necessary” following a GDPR-oriented interpretation. Thus, Article 6(1)(b) does not “cover processing which is useful but not objectively necessary for performing the contractual service”. Moreover, the EDPB's position seems in perfect accordance with a previous Working Party 29 document which provided for a strict interpretation of necessity. In particular, it was argued, necessity does not cover situations where the processing “is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller. Also the fact that some processing is covered by a contract does not automatically mean that the processing is necessary for its performance”. To this end, “It is important to determine the exact rationale of the contract, i.e. its substance and fundamental objective, as it is against this that it will be tested whether the data processing is necessary for its performance”.

In practice, the assessment should be driven by questions such as: what is the nature of the service being provided to the data subject? What are its distinguishing characteristics? What is the exact rationale of the contract (i.e. its substance and fundamental object) and essential elements? What are the mutual perspectives and expectations of the parties to the contract? How is the service promoted or advertised to the data subject? Would an ordinary user of the service reasonably expect that, considering the nature of the service, the envisaged processing will take place in order to perform the contract to which they are a party?

Pending issues

According to Buchner and Petri, the EDPB’s guidance provides clear in-principle support in “traditional” cases “such as a purchase or work contract, [where necessity] can be easily determined […] For example, it is undisputed that personal data such as name, address and payment data […] must be processed in order to execute an online purchase order” [unofficial translation]. At the same time, however, it does not seem particularly helpful in case of complex contracts whose "ultimate" meaning is not immediately available. The above seems confirmed by the EDPB’s unclear views on online behavioral advertising. If, on the one hand, the EDPB states that “As a general rule, processing of personal data for behavioural advertising is not necessary for the performance of a contract for online services” and that “[n]ormally, it would be hard to argue that the contract had not been performed because there were no behavioural ads”, on the other, it admits that “Within the boundaries of contractual law, and if applicable, consumer law, controllers are free to design their business, services and contracts”, and that “In some cases, a controller may wish to bundle several separate services or elements of a service with different fundamental purposes, features or rationale into one contract”.

In conclusion, in light of available information, it does not seem easy to understand what the limit to controllers contractual freedom is, especially where the processing of personal data is in some way instrumental to the controller's general business model (and contracts). In such cases, the question boils down to the degree to which freedom to conduct a business may be limited in pursuance of other protected interests, including data protection. That said, Article 16 of the EU Charter states that “the freedom to conduct a business in accordance with Community law and national laws and practices is recognised”. It is apparent from this wording that the controller’s contractual freedom is not absolute, but must be viewed in relation to its social function. Indeed, “the freedom to conduct a business may be subject to a broad range of interventions on the part of public authorities which may limit the exercise of economic activity in the public interest”. Further, in Sky Österreich, the CJEU has clarified that, in accordance with Article 52(1) of the Charter, any limitation on the exercise of the rights and freedoms recognised by the Charter “must be provided for by law and respect the essence of those rights and freedoms and, in compliance with the principle of proportionality, must be necessary and actually meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others”.

From this angle, the “necessity” clause stipulated in Article 6(1)(b) constitutes a good example of a legal limit to the controller’s contractual freedom. Two arguments support this interpretation. First, any other interpretation would make no sense of the word of the law. If a controller could arbitrarily arrange the scope of its contracts as to make any processing activity “necessary”, then the reference to “necessity” itself would become absolutely useless (and contracts would become, indeed, a tool to bypass the Regulation). Second, the limitation respects the threshold set up by the CJEU as it does not prohibit data processing based on contractual necessity and therefore does “affect the core content of the freedom to conduct a business”. It also seems proportionate because, by indirectly calling into action the GDPR and its guiding principles, it does not “exceed the limits of what is appropriate and necessary in order to attain the objectives legitimately pursued by the legislation in question [the GDPR, in this case]”.

That being said, a general and conclusive answer does not seem possible. Rather, the necessity assessment must be based on a case-by-case analysis. It goes without saying that such an assessment will only be possible if both the services provided and the related “necessary” processing are well defined. At the moment, however, there seems to be no answer to these long-standing questions, and this is why a preliminary referral to the CJEU by the Austrian Supreme Court seems of particular interest as meant to clarify the relationship between Article 6(1)(a) and 6(1)(b) GDPR.

Termination of Contract

Where the processing is based on the performance of a contract, full termination of the latter involves the complete interruption of the processing activities. Furthermore, under Article 17(1)(a) GDPR, the erasure of data is mandatory when it is no longer required in relation to the purposes for which it was collected. Of course, the same data can be still be processed for other purposes including compliance with a legal obligation, establishment, exercise or defense of legal claims and other legal purposes.

Necessary for Taking Steps prior to Entering into a Contract

Under Article 6(1)(b) GDPR, data processing may also be lawful in pre-contractual situations at the request of the data subject, for example where data is processed to prepare an offer for a package tour. As noted by Kotschy, although such data processing could be based on explicit consent or legitimate interest, “mentioning it under Article 6(1)(b) GDPR makes a difference as to the consequences, as in case of Article 6(1)(b) GDPR the data subject cannot terminate lawful processing either by withdrawing consent or by objecting” (see Articles 7(3) and 21(1) GDPR). The EDPB points out that “this provision would not cover unsolicited marketing or other processing which is carried out solely on the initiative of the data controller, or at the request of a third party”.

(c) Legal obligation

The GDPR recognises that under countless European and national laws controllers may be obliged to collect, store, and otherwise process personal information. Under Article 6(1)(c), such processing operations are considered lawful if they are necessary for the fulfilling of the obligation. This happens to be the case, for instance, when an employer processes personal data for social insurance purposes, or when a bank carries out processing required by money laundering legislation.

The legal obligation to which the controller is subject must originate directly from the law and not from a contractual arrangement. Such law does not have to be parliamentary law (or at least, not entirely). According to Kotschy, “Article 6(1)(c) would also cover situations where the obligation is not entirely specified in a law but by an additional legal act under public law such as secondary or delegated legislation or even by a binding decision of a public authority in a concrete case”.

The legal provision which defines the legal obligations for the controller does not need to be specific to each individual processing. It must, however, be sufficiently clear, precise and foreseeable and, in particular, define the purposes of the processing. Processing that goes beyond these legal obligations is not lawful under this provision. Any obligation to process data under another law must itself be proportionate (Article 7 and 8 EU Charter of Fundamental Rights) and in compliance with Article 6(2) and (3) GDPR.

(d) Vital Interest

A data processing may also be lawful if it is necessary to protect the vital interests of the data subject or of another natural person. The underlying assumption here is that the right to life takes precedence over data protection. Recital 46 clarifies that a vital interest is one which is "essential for the life" of the data subject. It follows that data processing on this ground “requires that a situation of concrete and imminent danger exists for the data subject or a third (natural) person”.

It seems undisputed that the survival of an individual is a legitimate interest. According to Kotschy, if a controller processes personal data of an individual in order to protect the survival of a third person, this is “a clear case of processing on the basis of Article 6(1)(f)” - and one with a perfect balance of interests because “As long as processing data for the vital interests of a third person respects proportionality concerning the interference with the rights of the data subject, all legitimate interests at stake in such a situation are properly taken care of”.

This interpretation should be welcomed for two reasons. First, since Article 6(1)(f) only applies to private sectors controllers, it allows vital interests be taken into account by public bodies as well. Second, it helps to prevent a rather controversial interpretation of Article 9(2)(c) GDPR. For example, this provision (“processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent”) applies when the treatment of an unconscious car accident victim requires the processing of their personal data and there is no time or possibility to ask their previous consent (for example, regarding the transmission of their blood values to a third party, ​​or the health data of a child must be shared in the absence of their parents’ authorization).

The same clause, however, could be misunderstood as providing the data subject with the power to decide about the life and death of another individual by granting or refusing consent to the processing of their data (“processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent”). According to Kotschy, “Irrespective of its formulation, the last part of Article 9(2)(c), prioritising consent, must be read as referring only to the case of 'vital interests of the data subject as the legitimate interest of a third person in survival clearly overrides the data protection interests of the data subject”.

(e) Public interest

Data controllers can rely on this legal basis for lawful processing if the data is processed for public sector purposes. Such purposes include tasks that are traditionally performed by the state and carried out administratively. Though, the provision follows a functional approach, meaning that private entities could also, in theory, rely on this legal basis. For example, one can think of a private operator of an electricity supply network, who is responsible for the performance and reducing overall consumption of electricity, uses smart meters to do so. However, this is rarely the case, since, typically, private entities would rely on Article 6(1)(f). Since there are many exceptions as to who can rely in which case, it is essential to reflect on the exact wording of the provision, and to analyse each part.

Necessary for

In order to determine whether this requirement is met, one must assess whether the purpose of the processing is in line with Articles 7 and 8 CFR. Moreover restrictions to these rights must be proportionate. This is not the case if there are less intrusive alternatives to reach the same objective. Ultimately, restrictions and limitations to the rights must be limited to ‘what is strictly necessary’. Following the CJEU in Huber, it seems that the threshold of ‘necessity’, is met if data processing leads to a more efficient application of regulations.

Performance of a task carried out in the public interest or in the exercise of official authority

The use of the word ‘or’, rather than ‘and’, suggests two things. First, the provision seems to include private bodies, vested to perform a task which serves the public interest. Second, it is up to the legislator, whether these private bodies are also granted ‘official authority’. After all, it could be that the private body operates without this ‘official authority’, but still processes to perform a task that benefits the public. For instance, if a company pursues a commercial purpose that can also be seen as a public interest, i.e., a telecommunication provider.

Vested in the controller  

Kotschy states that the English version of the provision creates uncertainty since it is unclear whether the part “vested in the controller” relates to “a task”, or to “in the exercise of official authority”. By comparing the text to the German version, which places a comma right before “vested in the controller”, he concludes that this part relates to “a task”. This means that a controller can only rely on this legal basis if this task has been “entrusted to the controller”, which is only the case if this follows from a legal provision.

(f) legitimate interest

The legal basis in Article 6(1)(f) GDPR often requires a delicate balancing of relevant interests. In general terms, the controller may adopt this legal basis whenever its own interests in performing a certain processing operation override those of the data subject. The balancing act in question is “not a straightforward balancing test which would simply consist of weighing two easily quantifiable and easily comparable 'weights' against each other”. The WP29,in the only and now outdated guidance on the point, suggests a multi-step procedure. First, controllers ought to verify whether their interest is actually “legitimate”. Second, they need to identify the data subject’s interests, rights and freedoms. Third, they have to establish (through an appropriate balancing operation) whether the controller’s (presumably, legitimate) interests are overridden by those of the data subject.

Whether the Interest is Legitimate

In the view of the Working Party, the notion of interest [A distinction must first be made between interest and purpose. Interest is the general objective that a controller intends to pursue (i.e. ensuring the occupational safety of its employees). The purpose, on the other hand, is the specific aim of a certain processing activity (for instance, implementation of specific access control procedures to only allow trained personnel in certain areas of the workplace] can include a broad range of activities, whether trivial or very compelling, straightforward or more controversial. In general terms, an interest is “legitimate” if the controller can legitimately pursue it and thus in accordance with the GDPR and any applicable law. As to what “law” means in this case, in the absence of updated guidance, reference should be made to the instructions provided by the WP29 in Opinion 3/2013 on purpose limitation, according to which the notion of "law" must be interpreted in an extensive manner, including all forms of written or common law, as interpreted by the competent courts and supplemented by other official sources. The above seems to be confirmed by the recent guidelines on contract-based treatment. There, the EDPB clarified that the contract (and thus, by analogy, the legitimate interest) must be valid i.e. “must comply with the requirements of contract laws and, as the case may be for consumer contracts, consumer protection laws in order for processing based on those terms to be considered fair and lawful”.

Pursued by the Controller or by a Third Party

The interest at stake must also be “pursued by the controller”. This requires a real and present interest, instrumental to the controller’s current activities or benefits expected in the very near future. In other words, interests that are too vague or speculative will not be sufficient. According to Article 6(1)(f) the processing can also lawfully take place for the legitimate interests pursued by a third party. This is “secondary use” of data (or “further processing”) per Article 5(1)(b) GDPR and, under Article 6(4) GDPR, in the absence of consent or a law explicitly allowing it, “is permitted only if it is compatible with the purpose of the initial processing”. It follows that the third party’s interest must fulfill two conditions: it shall be “legitimate” and “compatible” with the purpose of the initial processing.

Interests or fundamental rights and freedoms of the data subject

In general, the definition of “fundamental rights and freedom” includes all the traditional rights foreseen in the European constitutions, the Charter of Fundamental Rights of the EU as well as the European Convention on Human Rights. This obviously includes the right to the protection of personal data, personal and family life, freedom of expression and human dignity. In addition to the fundamental rights of the data subject, other “freedoms or interests” must also be taken into account. This includes the interest not to suffer any economic disadvantages, regardless of whether the damage occurs following the publication of personal data or in another way, such as via a discriminatory personalized pricing policy.

Finally, it is important to note that unlike the case of the controller’s interests, the adjective “legitimate” is not used here to precede the ‘interests’ of the data subjects. This implies a wider scope to the protection of individuals’ interests and rights. It follows that even individuals engaged in illegal activities should not be subject to disproportionate interference with their rights and interests. For example, “an individual who may have perpetrated theft in a supermarket could still see his interests prevailing against the publication of his picture and private address on the walls of the supermarket and/or on the Internet by the owner of the shop”. [WP29, ‘Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC’ 844/14/EN WP 217, 9 April 2014, p. 30 (available here).]

Balancing test (“overridden by”)

The fact that the controller has such a legitimate interest in the processing of certain data does not mean that it can necessarily rely on Article 6(1)(f) as a legal ground for the processing. The legitimacy of the data controller’s interest is just a starting point, while the overall lawfulness of the entire processing operation based on legitimate interests will depend on the outcome of the balancing test between the two opposed positions. To do so, the WP29 suggests a four-step test which includes (a) assessing the controller’s legitimate interest, (b) evaluating the impacts of such interest on the data subjects, (c) striking a provisional balance and, should the situation still be uncertain, (d) applying additional safeguards to reduce any negative impact on the data subjects.

Assessing the controller’s legitimate interest

The WP29 points out that a controller’s legitimate interest may be justified by their freedom of expression and information, academic and scientific research, right of access to documents, as well as the right to liberty and security, freedom of thought, conscience and religion, the freedom to conduct a business, the right to property and to an effective judicial remedy or the presumption of innocence. In other cases, the controller may even invoke the public interest, for instance when it enforces policies that ensure the safety of an online community.

Evaluating the Impact on the Data Subject

Once the controller´s interest has been assessed, the impact of the processing on the data subject´s interests or fundamental rights should be evaluated. Several elements can be useful at this stage, including the likelihood that a risk can materialise, the severity of its consequences, the number of individuals potentially impacted as well as the nature of the data. In general, it appears that the more sensitive the information involved is, the more consequences for the data subject there may be.

Also of relevance is the way the information is being processed, whether it is shared with a large number of actors or persons or combined with other data sets. Finally, the reasonable expectations of the data subjects and the status of the controller should be considered (Recital 47). In particular, it is important to evaluate whether the status of the data controller, the nature of the relationship or the service provided, or the applicable legal or contractual obligations (or other promises made at the time of collection) could give rise to reasonable expectations of stricter confidentiality and stricter limitations on further use.

In C-708/18, TK, para. 53-59, the CJEU elaborated on the criteria for the balancing of interests. In a case involving the lawfulness of a CCTV surveillance system, the Court considered different factors including whether the data to be processed were retrieved from publicly accessible sources or were rather related to the data subject’s private life; the nature of the data, particularly their sensitiveness; and the modalities of processing, including the number of persons having access to the data. As Kotschy points out, the Court also “took implicitly into account recital 47,17 which stresses the importance of the reasonable expectations of the data subjects based on the time and context of the processing, and indicates that conflict with these expectations could, in certain cases, ‘override’ a controller’s interest in ‘further processing’”.

Provisional balance

The essence of the balancing act is not clarified by the WP29´s opinion (nor does the GDPR provide any general instruction on the matter). It follows that, in accordance with the principle of accountability, the balancing act is entirely in the hands of the data controller who, taking into account the elements described above, must proceed in one direction or another, assuming full responsibility for the choice. It goes without saying that the controller should document and be able to demonstrate the reasoning used to reach their conclusions. These assessments must therefore be made on a case-by-case basis. However, this does not mean that, where possible, certain official guidelines may not be used to draw useful indications with respect to processing operations having common characteristics.

Additional safeguards

In cases where it is not clear which way the balance should be struck, the controller may consider whether it is possible to introduce additional safeguards.  For example, these may include the “strict limitation on how much data is collected, or immediate deletion of data after use. While some of these measures may already be compulsory under the Directive, they are often scalable and leave room for controllers to ensure better protection of data subjects” as well as “providing an easily workable and accessible mechanism to ensure an unconditional possibility for data subjects to opt-out of the processing”. These additional measures may in some cases help tip the balance and help ensure that the processing can be based on Article 6(1)(f), whilst simultaneously protecting the rights and interests of the data subjects.

Children

Article 6(1)(f) GDPR explicitly mentions situations "in particular where the data subject is a child". This seems to indicate that a balancing test needs to take the specific interests and expectations of a child into account.

(2) In case of processing under Article 6(1)(c) and (e) specific national rules are possible

This provision gives Member States more competence in the public sector, since it allows them to adopt, or keep, their own (material) rules that regulate in which instances a controller can rely on the legal bases provided for in Article 6(1)(c) and Article 6(1)(e). Member States can do so by providing specific requirements for the processing (including provisions relating to specific processing situations), to, ultimately, ensure that this processing is more lawful and fair. Through this wording it is apparent that these national provisions must stay within, and cannot go beyond the framework of the GDPR. Since this provision allows Member States to enact denser regulation, as well as more concrete requirements for controllers. Frenzel notes this can lead to conflicts, not only between a Member State and the Commision (since the latter monitors the application of Union law), but also in case of different processing situations by the same controller or vis-à-vis the same data subject.

(3) In case of processing under Article 6(1)(c) and (e) specific national rules must follow the GDPR instructions

According to Article 6(3), the legal basis for processing under Article 6(1)(c) (legal obligation) and Article 6(1)(e) (public interest) shall be laid down by (a) Union, or (b) Member State law. Contrary to Article 6(1)(c), however, the public interest processing does not have to be expressly laid down in a legal basis. It suffices if the processing is necessary to fulfil a task which serves the public interest, or in the exercise of official authority, and the task is described in a specific and clear manner.

Moreover, the provision allows Member States to implement specific provisions contained in this legal basis, and suggests, inter alia, the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures. These concretisations are non-exhaustive and non-binding, but are certainly permissible specific provisions. Lastly, the constituent element ‘Member State law’ refers to all material law of that Member State.

Relationship 6(2) and 6(3): unclear and grounds for dispute

It is important to set out that it remains unclear how Articles 6(2) and 6(3) relate to one another, legally and systematically. The exact relationship between the two clauses remains disputed. Some authors ascribe a more ‘declaratory nature’ to Article 6(2), and see Article 6(3) as the clause that offers the actual competence to enact material-specific data protection regulation. Other authors state that Article 6(2) does permit Member States to adopt material-specific regulation, and see Article 6(3) as a clause that sets out concrete requirements for this regulation. And then there is even another group of authors that does not see these requirements as ‘additional’, but cumulative. Hence, the only thing that is clear, is that the exact relationship between the two clauses remains disputed.

(4) Further processing

Article 6(4) GDPR prescribes certain factors to be taken into account where a controller wishes to further process personal data for a purpose other than that for which it was collected, where no other legal basis applies. This is only possible where the original and further purposes are "compatible". The factors set out in Article 6(4)(a)-(c) GDPR are not exhaustive.

Kotschy notes two key issues emerging from the factors in Article 6(4)(a)-(c) GDPR. The first regards the relationship between the initial and further purpose. Notably, the new purpose does not need to be a "sub purpose" of the initial one. Rather, compatibility can exist where the initial and further purpose are “pursued ‘together’ in close vicinity” or where the further purpose is “a logical consequence of the initial purpose”. Recital 50 GDPR adds that "the reasonable expectations of data subjects based on their relationship with the controller" should be considered. As Kotschy argues, "compatibility" therefore largely rests on “what is usual and what is to be expected in certain circumstances”. For example, where a customer receives further marketing information from an organisation they recently purchased from, this would classify as compatible further use, as customer relationship management “is a usual activity resulting from the customer relationship."

The second issue regards the assessment of risk that may stem from processing, prescribed in Article 6(4)(c)-(e) GDPR. Importantly, further processing “must not result in a substantially higher risk than the initial lawful processing.” The presence of sensitive personal data is specifically mentioned as a risk factor. Risks may be mitigated by various safeguards, such as encryption or pseudonymisation. To rely on further processing compatibility, controllers must be able to demonstrate that an assessment of all relevant risks was done. The potential to lawfully process information for a purpose that does not directly correlate with the original, but where there is a very high level of safeguards in place, is not yet clear from the law or relevant jurisprudence. It will have to be decided by future jurisprudence whether Article 6(4) “might justify an assumption of ‘compatibility’ also in cases where the new purpose does not specifically ‘correlate’ to the initial purpose, but where a very high standard of risk containment is implemented”.

Decisions

→ You can find all related decisions in Category:Article 6 GDPR