Performance of Contract
The processing of personal data may be necessary for the performance of a contract with the data subject as a contracting party or for taking steps prior to entering into a contract. This legality fact refers to both contracts and contract-like constellations that are based on voluntary declarations by the data subject (e.g. relationships of convenience).
A contract is subject to a general prohibition of tying. This means that the contract must not impair the voluntary aspect of consent and the personal data processing must be necessary.
The contractual partner and the data controller do not have to be the same person. If processing of personal data by uninvolved third parties is required, this may also be legitimized within the scope of the contract.
If there is a change to the contract, this results in a “new” contract.
The processing of personal data is also subject to the standard of necessity for a contract or for steps prior to entering into a contract. Necessity also refers to the possible alternatives to the contract that are available to the controller. It is examined whether they are reasonable and, for example, whether consent is a more adequate basis for processing, as this is subject to the right of withdrawal and is therefore in the interests of the data subject.
There must be a direct connection between the processing and the specific purpose of the contract. The data collected is subject to the processing principle of data minimization and storage limitation.
The processing of personal data in the context of steps prior to entering into a contract is also legitimate if no contract is concluded.
Related Comments
#6
Based On
Art. 6 Para. 1 lit. b
Art. 7 Para. 4
Art. 49 Para. 1 lit. b
Comm. Art. 6 Para. 1 SubPara. 1 lit. b Rn. 40-47
References
Coupling Prohibition
Data Minimization
Consent
Obligation to Inform
Accountability
Principles Relating to Processing
Legality Facts
Storage Limitation
Purpose Limitation
Contract
Steps prior Entering a Contract
Performance of Contract
The processing of personal data may be necessary for the performance of a contract with the data subject as a contracting party or for taking steps prior to entering into a contract. This legality fact refers to both contracts and contract-like constellations that are based on voluntary declarations by the data subject (e.g. relationships of convenience).
A contract is subject to a general prohibition of tying. This means that the contract must not impair the voluntary aspect of consent and the personal data processing must be necessary.
The contractual partner and the data controller do not have to be the same person. If processing of personal data by uninvolved third parties is required, this may also be legitimized within the scope of the contract.
If there is a change to the contract, this results in a “new” contract.
The processing of personal data is also subject to the standard of necessity for a contract or for steps prior to entering into a contract. Necessity also refers to the possible alternatives to the contract that are available to the controller. It is examined whether they are reasonable and, for example, whether consent is a more adequate basis for processing, as this is subject to the right of withdrawal and is therefore in the interests of the data subject.
There must be a direct connection between the processing and the specific purpose of the contract. The data collected is subject to the processing principle of data minimization and storage limitation.
The processing of personal data in the context of steps prior to entering into a contract is also legitimate if no contract is concluded.
Related Comments
#6
Based On
Art. 6 Para. 1 lit. b
Art. 7 Para. 4
Art. 49 Para. 1 lit. b
Comm. Art. 6 Para. 1 SubPara. 1 lit. b Rn. 40-47
References
Coupling Prohibition
Data Minimization
Consent
Obligation to Inform
Accountability
Principles Relating to Processing
Legality Facts
Storage Limitation
Purpose Limitation
Contract
Steps prior Entering a Contract