“Differing rights
always need to be balanced against each other, whereas this paragraph
goes a long way in suggesting that the freedom to conduct a business
is a higher-ranking norm than the right to privacy (..) In our view,
the statement seems to be too biased towards business interests
This section contradicts earlier advice and guidance of the Article
29 Working Party, for example. Opinion 06, 2014.
Therefore, we refer to our second comment to this draft.
This version of the text may be a dead end.
We have an issue with the fact that the following section
clearly contradicts previous Article 29 working party guidance on the matter .
There is no reference to Opinion six 2014, which notably states
that provision must be interpreted strictly and does not cover situations
where the processing is not generally necessary
for the performance of a contract,
but rather unilaterally imposed on the data subject by the controller.
We know
that the examples in this version have changed completely.
We will not comment with track changes at the stage as a general direction
and scope of the paper should be agreed on first.
It will be obvious from our comments of this paper
that we prefer to continue to work on the previous version of the document.
We would go even further and say that the company cannot legitimately
rely on Article 61 B for the building of a profile, in particular,
if this profile is meant to be used for targeted advertisment.
We note that 90% of all work
on analyzing this concept in the previous version has been deleted,
including relevant ECJ case-law,
draft examples and specific sections on the element
that typically occur in the social media and online services sector.
This entire section has been deleted in the version sent by the Irish DPC.
We don't agree with the deletion of this entire section,
and we would like to reiterate our suggestion that necessity should also
be appreciated from the data subject's point of view.
We believe this is a wrong quote of the case. The CJEU in Huber stated
What is at issue is a concept necessity which had its own independent
meaning in community law, and which must be interpreted in a manner
which fully reflects the objective of that directive,
as laid down in Article one thereof.
This quote, which is a part of the previous concept,
is a general explanation
of the concept of necessity and should be the basis of the paper.
Therefore, necessity requires a consideration of the right
to protection of personal data, as well as an assessment
of processing activities in light of the terms of a contract.
The quote in this concept is a specific application of processing
for compliance with a legal obligation, which is not relevant.
Data subject do not freely enter into these contracts.
There is a take it or leave it situation and contracts
are often unbalanced.
Controllers cannot freely specify processing of personal data
in the contract.
This document does not concern what services businesses can provide,
nor how they define their services in the contracts,
which is largely a matter of contractual freedom.
It does, however, concern under which circumstances
it is lawful to collect personal data, which is regulated by EU regulation.
EU regulations take precedence for that reason.
A contract in itself cannot legitimize the processing of personal data.
Rather, the
processing must have a basis in Article six.
The contract cannot legitimately
try to undermine or circumvent a new regulation.
Its wording, spirit or system.
Know, Article 61 B states that the processing
must be necessary for the performance of a contract
that is, can this contract or service be still provided without the processing?
Now this is conceptually different from stating that a contract can stipulate
data processing requirements, for example, to follow in a later comment.
The approach suggested will circumvent other legal basis,
if anything could be freely specified in the contract, then controllers
would not need to collect consent nor perform balancing tests.
Remember that in many or most jurisdictions,
terms of service may constitute valid contracts.
Also, this could be read as condoning the use
of personal data as counter performance, which we do not support.
We don't agree with this sentence, which does not take into account
the fact that most of contracts with online services are non-negotiable.
These statement skips the fact that in online services,
the natural persons are forced to accept whatever is in the agreement
confront debates relating to the unfair business practices.
See our common mind above.
We believe the first step must be to identify the key elements of the contract.
The second step is to take the assessment where
the processing activities are necessary
for the contract, mostly from the perspective of the users.
In this concept, the most important element of Article 6 (1) (b)
necessity has been totally undermined.
The fact that it is specifically mentioned in the contract is irrelevant.
The Working Party 29 opinion on behavioral advertising
clearly states that even if these processing activities
are specifically mentioned in the small print of the contract, this fact alone
does not make them necessary for the performance of the contract.
They're working party,
29 stated, in their opinion, 06/2014
that were data processing is rarely referenced in a contract.
This of itself is not enough to bring to processing in question
within the scope of this legal basis.
And since the GDPR didn't change the lawful
basis of processing where it is necessary in the context of a contract,
we believed a view of the working party 29 is still relevant
and should be the starting point in the concept again.
Here you are stating that controllers can specify that processing personal data
can be required as an element of performance of the contract.
This seems to accept monetization of personal data
and circumventing the other legal basis.
We think that this interpretation undermines the system and spirit of the GDPR.
We don't agree with the sentence.
This is not in line with this transparency principle.
How can we expect a data subject to be aware of the wider
context of the agreement and to carefully assess
what is reasonably necessary into the agreement?
How do you articulate the statement with obligation clarified in Recital 39?
In particular, the specific purposes for which personal data are processed
should be explicit, legitimate
and determined at the time of the collection of the personal data.
We don't agree with this approach, which is definitely too wide.
It could include fraud, marketing data transmission
to third parties needed to fund the website, etc.
Yes, it does.
Otherwise, it's not really necessary.
Disagree.
This undermines the meaning of necessary, as explained in CJEU case law.
Does this mean that processing, which lacks
connection to the matters agreed, are OK?
This statement also goes against the principles laid down in Article five.
No this is misleading.
The focus is not on what is a valid contract to focus
must be on distinguishing what data processing operations are necessary
to perform the contract so that they can be based on Article 6(1)(b).
And on the other hand,
the data used that is not necessary for the performance of the contract.
For the latter, the controller must either seek a different lawful basis
or must consider altering his actions to ensure compliance with the GDPR.
But according to your logic, this can easily be resolved
by just specifying the processing of personal data in the contract.
Right.
This shows why the approach suggested, in our view,
is neither appropriate nor legally accurate.
This shows how this version of the paper has completely turned upside
down the perspective of the previous version.
In an EDPB position paper
This should not be a starting point.
We object against this entire paragraph 19 in support of views expressed earlier.
I disagree.
This reduces the GDPR to a pro forma instrument,
as long as you remember to include all kinds of requirements and provisions
in a contract, which the data subject is in no position to negotiate
and that market powers cannot correct due to oligopolies,
controllers can do as they like.
And there is no need for consent or a balancing of interests.
How, then do we make sure that data subjects
do not have all aspects of their lives monitored?
How do we ensure that derogations from the right to privacy are proportionate?
This seems to be contrary to the fairness principle.
According to the GDPR,
the processing must be necessary for the performance of a contract.
In other words, it must not be possible
to provide a contract or service without the processing.
Is it possible to provide social media accounts without tracking or profiling?
Yes. In fact it is.
Therefore, tracking or profiling
is not necessary for the performance of the contract.
We suggest deleting this paragraph.
The terms not only need to indicate that behavior tracking, etc.
will take place, but these processing must be a necessary element of the contract .
Stating the opposite contradicts every papers of the working party
29 and EDPB in the matter.
In addition, the data controller should explain why the processing
of personal data is necessary for the performance of the contract.
The guidelines on consent clearly state
that the purpose of personal data processing should not be disguised
nor bundled with the provision of a contract service,
which these personal data are not necessary.
In addition, there might be a typo here.
It was probably meant to write on
whether the processing of personal data is a contractual requirement.
We don't agree with this example.
Does this mean that monitoring of their behavior can be based
on the contract, how to deal with the right to object in such a case?
In addition, this consent would not even be valid
insofar as it was clearly state that the monitoring of their behavior
will take place for personalized advertisment.
The wording should, as a minimum, include the element of personalized advertising,
as stated in Page five of the Opinion 16,
2011 on behavioral advertising.
It should also explain that this monitoring
will take place via tracking technologies.
Furthermore, all the examples seem to relate to social networks.
The SMSG is currently developing a paper
on targeted advertisement of social media users.
We believe that we should therefore limit our examples on social media and keep,
for example, the example of the online ride sharing application,
which was present in the previous version of the paper.
Contrary to everything, we believe in showing that it's true
as well as previous Article 29 working party guidance, is it possible to provide
social media accounts without tracking and profiling?
Yes. In fact, it is therefore
tracking or profiling is not necessary for the performance of the contract.
We suggest removing
this example as it refers again to social media.
In addition, the monitoring of user behavior cannot
be held as reasonably necessary to perform the contract.
This has never been the opinion of the Article 29 working party, and it
cannot be the one of the EDPB.