Article 6 GDPR

Summary

This article details the interpretation and application of Article 6 of the GDPR, focusing on the legal bases for processing personal data. It highlights the strict interpretation of 'necessity,' emphasizing that only realistic alternatives to data processing should be considered, and 'useful' but not objectively 'necessary' processing is disallowed. The text also delves into the 'legitimate interest' basis, stressing the controller's responsibility to demonstrate compliance and the importance of considering data subjects' reasonable expectations, which may differ from common industry practices.

Full text

Help Article 6 GDPR: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 07:31, 17 July 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators140 edits Tag: Visual edit← Older edit Latest revision as of 09:34, 20 August 2026 view source Mba (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators969 editsm Tag: Visual edit Line 277: Line 277: [...][...] That solution would make it possible for the members concerned, in accordance with the data minimisation principle referred to in paragraph 43 of the present judgment, to retain control over the disclosure of their personal data and thus to limit the disclosure of those data to what is in fact necessary and relevant in relation to the purposes for which those data are transmitted and processed [...]".|CJEU - C‑621/22 - Koninklijke Nederlandse Lawn Tennisbond|51 et seq.}}That solution would make it possible for the members concerned, in accordance with the data minimisation principle referred to in paragraph 43 of the present judgment, to retain control over the disclosure of their personal data and thus to limit the disclosure of those data to what is in fact necessary and relevant in relation to the purposes for which those data are transmitted and processed [...]".|CJEU - C‑621/22 - Koninklijke Nederlandse Lawn Tennisbond|51 et seq}} Despite the narrow interpretation of strict necessity, a controller is not prohibited from using personal data, just because there is a theoretical alternative that does not include the use of personal data, only realistic alternative must be considered. Processing that is "useful" but not objectively "necessary" is not covered and hence not allowed.<ref>Bucher, Petri, DS-GVO BDSG, Article 6 GDPR, margin numbers 15 (C.H. Beck 2024, 4th Edition); Kastelitz; Hötzendorfer; Tschohl, in Knyrim, DatKomm, Article 6 GDPR, margin numbers 19 (Manz 2020).</ref></blockquote>For example [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22019-processing-personal-data-under-article-61b_en EDPB Guidelines 2/2019 on Article 6(1)(b)] have clarified that assessing what is "necessary" involves a factual analysis of the processing operations and their purpose(s) and whether less intrusive alternatives that achieve the same goal exist. If there are realistic, less intrusive processing operations, then the other more intrusive ones must be excluded – i.e. they are not "necessary" under EU law.<ref>EDPB, ‘Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, 8 October 2019’ (Version 2.0), p. 8 (available [https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines-art_6-1-b-adopted_after_public_consultation_en.pdf here]).</ref> Despite the narrow interpretation of strict necessity, a controller is not prohibited from using personal data, just because there is a theoretical alternative that does not include the use of personal data, only realistic alternative must be considered. Processing that is "useful" but not objectively "necessary" is not covered and hence not allowed.<ref>Bucher, Petri, DS-GVO BDSG, Article 6 GDPR, margin numbers 15 (C.H. Beck 2024, 4th Edition); Kastelitz; Hötzendorfer; Tschohl, in Knyrim, DatKomm, Article 6 GDPR, margin numbers 19 (Manz 2020).</ref></blockquote>For example [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22019-processing-personal-data-under-article-61b_en EDPB Guidelines 2/2019 on Article 6(1)(b)] have clarified that assessing what is "necessary" involves a factual analysis of the processing operations and their purpose(s) and whether less intrusive alternatives that achieve the same goal exist. If there are realistic, less intrusive processing operations, then the other more intrusive ones must be excluded – i.e. they are not "necessary" under EU law.<ref>EDPB, ‘Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, 8 October 2019’ (Version 2.0), p. 8 (available [https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines-art_6-1-b-adopted_after_public_consultation_en.pdf here]).</ref> Line 479: Line 479: In accordance with the accountability principle under Article 5(2) GDPR, a controller invoking this legal basis is responsible for, and has to be able to demonstrate, compliance with each of those cumulative conditions. Therefore, the controller should document the performance of the legitimate interest assessment accordingly. Also, if a Data Protection Officer is appointed by the controller, they should be involved by the controller in this assessment.<ref>EDPB, 'Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 45 (available [https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202401_legitimateinterest_en.pdf here]).</ref>In accordance with the accountability principle under Article 5(2) GDPR, a controller invoking this legal basis is responsible for, and has to be able to demonstrate, compliance with each of those cumulative conditions. Therefore, the controller should document the performance of the legitimate interest assessment accordingly. Also, if a Data Protection Officer is appointed by the controller, they should be involved by the controller in this assessment.<ref>EDPB, 'Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 45 (available [https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202401_legitimateinterest_en.pdf here]).</ref> It should be pointed out that, according to the CJEU, a controller who wants to invoke the pursuit of a legitimate interest to allow the processing of personal data pursuant to Article 6(1)(f) GDPR, the controller has to comply with all its other obligations under the GDPR.<ref>CJEU, Case C-621/22, ''Koninklijke Nederlandse Lawn Tennisbond,'' 4 October 2024, margin number 50 (available [https://gdprhub.eu/CJEU_-_C%E2%80%91621/22_-_Koninklijke_Nederlandse_Lawn_Tennisbond here])</ref> If a controller wants to rely on legitimate interest under Article 6(1)(f) GDPR for the processing of personal data for various purposes, the controller has to assess the validity of this legal basis for each of those purposes.<ref>EDPB, 'Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 10 (available [https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202401_legitimateinterest_en.pdf here]).</ref>If a controller wants to rely on legitimate interest under Article 6(1)(f) GDPR for the processing of personal data for various purposes, the controller has to assess the validity of this legal basis for each of those purposes.<ref>EDPB, 'Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 10 (available [https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202401_legitimateinterest_en.pdf here]).</ref> Line 507: Line 509: <u>First</u>, the interest hast so be lawful, i.e. the controller can legitimately pursue it and it is not contrary to EU or national law. However, it is not necessary that the interest is determined or enshrined in law.<ref>EDPB, '1/2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 17 (available [https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202401_legitimateinterest_en.pdf here]); CJEU, Case C-621/22, ''Koninklijke Nederlandse Lawn Tennisbond,'' 4 October 2024, margin number 40 (available [[CJEU - C‑621/22 - Koninklijke Nederlandse Lawn Tennisbond|here]]).</ref> For example, the CJEU did not rule out th

Entities