On 8 October 2019, the EEA Data Protection Authorities and the European Data Protection Supervisor, assembled in the European Data Protection Board (EDPB) have adopted their "Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects" (Guidelines 2/2019, Version 2). These Guidelines concern the scope and application of Article 6(1)(b) GDPR in the context of information society services.

Content

The Guidelines 2/2019 focus on the applicability of Article 6(1)(b) GDPR to processing of personal data in the context of contracts for online services, irrespective of how the services are financed. For that purpose the Guidelines: 

• outline the elements of lawful processing under Article 6(1)(b) GDPR and
• consider the concept of ‘necessity’ as it applies to ’necessary for the performance of a contract’ (pages  8-14).

The Guidelines include general observations regarding data protection principles and the interaction of Article 6(1)(b) GDPR with other lawful bases.

In addition, the Guidelines contain guidance on the applicability of Article 6(1)(b) GDPR in case of bundling of separate services and termination of contract.

EDPB, "Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects", Version 2, 8 October 2019