The European Data Protection Board (EDPB) met for its ninth plenary session on 9 and 10 April 2019. The EDPB discussed a number of issues concerning the application of the General Data Protection Regulation 2016/679 (GDPR), outlined in the agenda.

One of the key developments was the adoption of draft guidelines by the EDPB on the scope and application of GDPR Article 6(1)(b) which is largely known as ‘contractual necessity’ or ‘performance of a contract’ legal basis. GDPR Article 6(1)(b) provides a lawful basis for processing where “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.

The guidelines offer important clarification on what may be considered “necessary”, as well as useful guidance for processing in the context of online services to ensure that this legal basis is only relied upon when appropriate.

Continue Reading EDPB guidelines on processing personal data under GDPR, Article 6(1)(b)