October 21, 2019

On 9 and 9 October, the European Data Protection Board (EDPB) met for its fourteenth plenary session, in which it adopted a final version of its guidelines on the scope and application of Article 6(1)(b) GDPR in the context of information society services.

Article 6(1)(b) allows processing where it is “necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.

Following public consultation, points of clarification were included in the text. In its guidelines, the EDPB makes general observations regarding data protection principles and the interaction of Article 6(1)(b) with other lawful bases. In addition, the guidelines contain guidance on the applicability of Article 6(1)(b) in the case of bundling of separate services and termination of contract. To access the guidelines, click here.