Objectively indispensable”, that’s how the CJEU describes the threshold for processing of personaldata to be necessary for performance (or conclusion) of a contract under Art. 6(1)(b) GDPR.
In its new Meta judgment (case 252/21), the Court of Justice examined many points of law, but it may be useful to other organisations to look at paragraphs 97 & following of today’s judgment. (also relevant re legitimate interests)
I find it personally awkward that the CJEU says that in its view personalisation of content “does not appear necessary to provide to [the] user the services of the online social network”. If a service is built as a personalised one, will the CJEU’s judgment be interpreted as implying an obligation to create a new, non-personalised service?
At the very least companies may wish to prepare documentation to show why they only have chosen to offer a personalised service – and if they once offered a non-personalised one, the objective reasons that led them to discontinue it.
And of course, we are happy to help out.
Judgment (currently only available in French and German – machine translation excerpts will be included in the comments): https://lnkd.in/emA2qamE
data protection
Did this analysis get you thinking? Reach out!
DataLaws.net is entirely open-access, and instead of getting your data in exchange for this content, how about another trade? If this commentary saved you research time or sparked an idea, feel free to invite me over for tea, chai or a hot chocolate next time you are around Brussels or Antwerp - or invite me over to your offices for a chat!
Get in touch ↗ Let's connect on LinkedIn ↗