On April 9, 2019 the European Data Protection Board (EDPB) issued the Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects (the Guidelines), which are currently under public consultation (the comments are required by May 24, 2019 at the latest). Such Guidelines represent an important contribution to the definition of one of the most used legal bases introduced by the General Data Protection Regulation 2016/679 (GDPR). 

As clarified by the Guidelines, information society services are defined as “any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services” but, as clarified by the EDPB, this definition applies also to the online services provided for free, such as online services funded through advertising.

After the GDPR entered into force, data controllers have tried to identify the correct legal basis for their processing activities; some grey areas of activities, however, are currently dealt with differently, depending on the data controllers’ choices. In order to address some of these uncertain activities, the EDPB has stated that improving the service provided to the customers (as well as developing new functions within an existing service) shall entail processing of their personal data in the case of the legitimate interest of the data controller occurs or the data subjects’ consent has been collected. The EDPB does not believe that such activity can be considered as within the performance of a contracted activity.

Also, an interesting indication has been given in relation to online behavioral advertising. The Guidelines confirm a well-established EU approach, according to which online behavioral advertising, used to finance online services, is not to be included in the contractual relationship between the service provider and the customers. This is supported by two main elements: (a) data subjects hold the right to object to processing of their data for direct marketing; and (b) the mere circumstance that such processing supports the delivery of the service does not entail that it is necessary for the performance of the contract.

The EDPB also states that “considering that data protection is a fundamental right guaranteed by Article 8 of the Charter of Fundamental Rights, and taking into account that one of the main purposes of the GDPR is to provide data subjects with control over information relating to them, personal data cannot be considered as a tradeable commodity. Data subjects can agree to processing of their personal data, but cannot trade away their fundamental rights”. Such a concept is extremely interesting, because many websites currently require that users consent to provide their data (which is used for targeted advertising) in order to access the content of the website for free.

The meaning of “performance of a contract”

In order to ensure that the legal basis recalled in the Guidelines occurs in the situation at stake, the data controller shall identify whether the processing is taking place in the context of a valid contract with the data subject and the processing is necessary to perform that contract. Therefore, the data controller is required to ensure that a “double” assessment is carried out: (a) the contract needs to be valid and enforceable; and (b) the processing needs to be as limited as necessary to provide the service subject matter of the contract. The assessment of whether a valid and enforceable contract is entered into between the parties shall be carried out by controllers’ legal counsels; instead, the assessment of whether the processing is necessary to provide the service under the contract requires also an in-depth de facto analysis. The Guidelines provide an interesting list of questions that may support data controllers in carrying out such an assessment:

• what is the nature of the service being provided to the data subject? What are its distinguishing characteristics?
• what is the exact rationale of the contract (i.e. its substance and fundamental objective)?
• what are the essential elements of the contract?
• what are the mutual perspectives and expectations of the parties to the contract? How is the service promoted or advertised to the data subject? Would an ordinary user of the service reasonably expect that, considering the nature of the service, the envisaged processing will take place in order to perform the contract to which they are a party? 

Many data controllers believe that by offering a bunch of services together, they have the right to process the data subjects’ personal data on the basis of Article 6(1)(b) GDPR: in this respect, EDPB Guidelines states that the applicability of such a legal basis needs to be assessed in the context of the services and, therefore, “certain processing activities may not be necessary for the individual services requested by the data subject but rather necessary for the controller’s wider business model” (and, in such a case, the Article 6(1)(b) GDPR legal basis shall not apply, so that other legal bases need to be identified).

The termination of the contract makes the processing no longer legitimate according to the Article 6(1)(b) GDPR legal basis, unless other legal bases have been identified and included in the information notice to the data subjects (e.g. the legal obligation to retain certain personal data, or, depending on circumstances, the controller’s legitimate interest to carry out business intelligence activities, such as developing of new services / IT platforms, where possible using aggregate / anonymized data).

The meaning of “taking steps prior to entering into a contract”

Before entering into a contract, the parties may require to share certain personal data: such processing is necessary in order to ensure that the parties agree on the contractual relationship. However, such sharing of personal data might not be considered as meeting the Article 6(1)(b) GDPR legal basis. The Guidelines provides an interesting example to be taken into account: “In some cases, financial institutions have a duty to identify their customers pursuant to national laws. In line with this, before entering into a contract with data subjects, a bank requests to see their identity documents. In this case, the identification is necessary for a legal obligation on behalf of the bank rather than to take steps at the data subject’s request. Therefore, the appropriate legal basis is not Article 6(1)(b), but Article 6(1)(c)”.

Let us know if you want to discuss this topic in further detail. Please contact our Dentons Italy TMT Team at tmtbites.italy@dentons.com and do not forget to sign up to our TMT Bites Newsletter!