Guidelines 02/2019 on processing of personal data under 6(1)(b) GDPR in the context of the provision of online services to data subjects

Section 3.3  Processing for online behavioural advertising

51. Online behavioural advertising, and associated tracking and profiling of data subjects, is often used to finance online services. WP29 has previously stated its view on such processing, stating:

• [contractual necessity] is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his clickstream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example.

52. As a general rule, processing of personal data for behavioural advertising is not necessary for the performance of a contract for online services. Normally, it would be hard to argue that the contract had not been performed because there were no behavioural ads. This is all the more supported by the fact that data subjects have the absolute right under Article 21 to object to processing of their data for direct marketing purposes.

53. Further to this, Article 6 (1)(b) cannot provide a lawful basis for online behavioural advertising simply because such advertising indirectly funds the provision of the service. Although such processing may support the delivery of a service, this in itself is not sufficient to establish that it is necessary for the performance of the contract at issue.The controller would need to consider the factors outlined in paragraph 33.

54. Considering that data protection is a fundamental right guaranteed by Article 8 of the Charter of Fundamental Rights, and taking into account that one of the main purposes of the GDPR is to provide data subjects with control over information relating to them, personal data cannot be considered as a tradeable commodity. Even if the data subject can agree to the processing of personal data, they cannot trade away their fundamental rights through this agreement.

55. The EDPB also notes that, in line with ePrivacy requirements and the existing WP29 opinion on behavioural advertising, and Working Document 02/2013 providing guidance on obtaining consent for cookies, controllers must obtain data subjects’ prior consent to place the cookies necessary to engage in behavioural advertising.

56. The EDPB also notes that tracking and profiling of users may be carried out for the purpose of identifying groups of individuals with similar characteristics, to enable targeting advertising to similar audiences. Such processing cannot be carried out on the basis of Article 6 (1)(b), as it cannot be said to be objectively necessary for the performance of the contract with the user to track and compare users’ characteristics and behaviour for purposes which relate to advertising to other individuals.