personal data is thus generally prohibited unless permitted by law or the previous
consent of the data holder, Art. 6 GDPR. In case of permission by the law, no
consent is necessary as far as the data processing is covered by that legal permission.
Conditions of previous consent are named in Art. 7 GDPR and by the definition in
Art. 4 para. 11 GDPR. Art. 9 para. 1 of the proposed ePR refers to the understanding
of consent in terms of the GDPR. Art. 9 para. 2 of the proposed ePR offers the
possibility of expressing consent by using appropriate technical settings of a software application.
The GDPR contains a comprehensive set of rules under which processing without
previous consent is allowed, Art. 6 para. 1 lit. b)–f) GDPR. A major role in the
internet sector play Art. 6 para. 1 lit. b) and f) GDPR. Art. 6 para. 1 lit. b) allows the
processing necessary for the performance of a contract to which the data subject is
party or in order to take steps at the request of the data subject prior to entering into a
contract. Art. 6 para. 1 lit. f) permits the processing necessary for the purposes of the
legitimate interest pursued by a private body as controller or by a third party, except
where such interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal data, in particular
where the data subject is a child. Moreover, in the last case the data subject has a
right to object the data processing under certain conditions, Art. 21 GDPR.
Processing of Personal Data Limited to Specific Purposes
As the electronic processing is determined by general rules,
38 it is not generally
limited to specific purposes or specific types of data. However, consent has to be
given only for specific and specified purposes
39 and under all legal permissions
procession is only allowed for the purposes for which the data processing is
permitted, so-called principle of purpose limitation.
40
Import criteria, if the processing is lawful, are the necessity of the processing, so
called principle of data minimization.
41 This is even more significant in the context
of electronic processing as risks and interests of the data subjects are affected
somewhat stronger. The processing shall consequently always be proportional to
the concrete purpose of the processing.
38 See the section “The Role of Previous Consent of the Data Subject”.
39 See Art. 6 para. 1 lit. a) GDPR.
40 The principle of purpose limitation is laid down in Art. 5 para. 1 lit. b) GDPR.
41 The principle of data minimization is laid down in Art. 5 para. 1 lit. c) GDPR; see also the wording
of Art. 6 para. 1 lit. b)–f) GDPR.
190
C. Breunig and M. Schmidt-Kessel
consent of the data holder, Art. 6 GDPR. In case of permission by the law, no
consent is necessary as far as the data processing is covered by that legal permission.
Conditions of previous consent are named in Art. 7 GDPR and by the definition in
Art. 4 para. 11 GDPR. Art. 9 para. 1 of the proposed ePR refers to the understanding
of consent in terms of the GDPR. Art. 9 para. 2 of the proposed ePR offers the
possibility of expressing consent by using appropriate technical settings of a software application.
The GDPR contains a comprehensive set of rules under which processing without
previous consent is allowed, Art. 6 para. 1 lit. b)–f) GDPR. A major role in the
internet sector play Art. 6 para. 1 lit. b) and f) GDPR. Art. 6 para. 1 lit. b) allows the
processing necessary for the performance of a contract to which the data subject is
party or in order to take steps at the request of the data subject prior to entering into a
contract. Art. 6 para. 1 lit. f) permits the processing necessary for the purposes of the
legitimate interest pursued by a private body as controller or by a third party, except
where such interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal data, in particular
where the data subject is a child. Moreover, in the last case the data subject has a
right to object the data processing under certain conditions, Art. 21 GDPR.
Processing of Personal Data Limited to Specific Purposes
As the electronic processing is determined by general rules,
38 it is not generally
limited to specific purposes or specific types of data. However, consent has to be
given only for specific and specified purposes
39 and under all legal permissions
procession is only allowed for the purposes for which the data processing is
permitted, so-called principle of purpose limitation.
40
Import criteria, if the processing is lawful, are the necessity of the processing, so
called principle of data minimization.
41 This is even more significant in the context
of electronic processing as risks and interests of the data subjects are affected
somewhat stronger. The processing shall consequently always be proportional to
the concrete purpose of the processing.
38 See the section “The Role of Previous Consent of the Data Subject”.
39 See Art. 6 para. 1 lit. a) GDPR.
40 The principle of purpose limitation is laid down in Art. 5 para. 1 lit. b) GDPR.
41 The principle of data minimization is laid down in Art. 5 para. 1 lit. c) GDPR; see also the wording
of Art. 6 para. 1 lit. b)–f) GDPR.
190
C. Breunig and M. Schmidt-Kessel