Contractual Necessity processing of Personal Data is necessary to enter into a contract with User, to perform Company's contractual obligations to the User under the terms of Use ("TOU"), to provide the Services, to respond to requests from the User, or to provide the User with customer support;
Contractual Necessity. Generally, consent is not the only legal basis for digital service providers to process consumer data. Article 6
(1) (b) GDPR allows the processing of personal data when this is “necessary for the performance of a contract”.1287 This provision considers that sometimes contracts cannot be performed, and services cannot be provided if the consumer does not provide personal data.1288 This is when a consumer pays with a credit card for a product available on an online marketplace and requests its delivery to their home address.1289 In this case, Article (6)(1)(b) GDPR allows the online marketplace to process the consumer’s card details and address based on this clause.1290 On May 25, 2018, when the GDPR came into force with strengthened requirements for consent, Meta updated its terms and conditions, stating that it processed the consumer personal data under Article 6(1)(b) GDPR because such data was necessary to perform “core service” of Meta’s platforms (Facebook, Instagram), now framed as “personalized experience”, including personalized advertisement.1291 On the same day, Noyb, a digital rights organization that can be said to act as the “private prosecutor” for enforcing the GDPR,1292 filed a complaint with the Austrian DPA.1293 Xxxx argued that Xxxx attempted to bypass the GDPR’s strict consent requirements and engaged in illegitimate OBA.1294 As Meta’s EU head office is located in Ireland, the Austrian DPA transferred the case to the Irish DPA.1295 1286 See Digital Content Directive, supra note 940, rec. 24. 1287 General Data Protection Regulation, supra note 44 at art 6(1)(b). 1288 EUROPEAN DATA PROTECTION BOARD, Guidelines 2/2019 on the Processing of Personal Data under Article 6(1)(b) GDPR in the Context of the Provision of Online Services to Data Subjects, 2 (2019). 1289 Id. at 35. 1290 Id. 1291 See BREAKING: Meta Prohibited from Use of Personal Data for Advertising, NOYB (2023), xxxxx://xxxx.xx/en/breaking-meta-prohibited-use-personal-data-advertising (last visited May 2, 2023). 1292 Noyb stands for “none-of-your-business”. Full name of this organization is European Center for Digital Rights. See CPDPConferences, supra note 945. 1293 See noyb, Xxxx.Xx Filed Complaints over “Forced Consent” against Google, Instagram, WhatsApp and Facebook, NOYB (2023), xxxxx://xxxx.xx/en/noybeu-filed-complaints-over-forced- consent-against-google-instagram-whatsapp-and-facebook (last visited May 2, 2023). 1294 See Id. 1295 Decision of the Data Protection Commission ...
Contractual Necessity. This lawful basis applies to most of our processing activities in relation to personal data belonging to our customers/clients. It applies both during the pre-contractual stages of our relationship (when you are signing up) as well as once the contractual agreement(s) are in place. We are subject to other legal obligations other than the Data Protection Legislation, which may require us to process personal data. For example, we are required to retain information in accordance with record-keeping requirements under applicable legislation. Further we may need to carry out certain investigations, customer due diligence, and reporting for the purposes of anti-money laundering (including counterterrorist and proliferation financing) legal and/or regulatory requirements.
