social networks.
19 As regards internet intermediaries, it is noteworthy that pursuant
to article 2(4) the GDPR is without prejudice to the application of Directive 2000/31/
EC on electronic commerce,
20 in particular of the rules on the limitation of liability
of intermediary service providers laid down in Articles 12–15 of that Directive.
However, the latter provisions do not establish rules on the protection of personal
data.
21
The processing of personal data is only deemed lawful on the basis of at least one
of the grounds listed in Article 6 GDPR: (a) the data subject has given consent to the
processing of his or her personal data for specific purposes; (b) processing is
necessary for the performance of a contract to which the data subject is party or in
order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the
controller is subject; (d) processing is necessary in order to protect the vital interests
of the data subject or of another natural person; (e) processing is necessary for the
performance of a task carried out in the public interest or in the exercise of official
authority; (f) processing is necessary for the purposes of the legitimate interests
pursued by the controller or by a third party, except where such interests are
overridden by the interests or fundamental rights of the data subject.
Where processing is based on the data subject’s consent, the controller has to be
able to demonstrate that consent has been given [Art. 7(1) GDPR]. Consent is not
being regarded as freely given if the data subject is unable to refuse consent without
detriment. Consent requires a clear affirmative act by the data subject establishing a
freely given, specific, informed and unambiguous indication of his or her agreement
to the processing of personal data. Therefore, Recital 32 to the GDPR acknowledges
that consent may be given by electronic means, such as by ticking a box when
visiting an internet website or choosing technical settings for information society
services. However, pre-ticked boxes or inactivity are not regarded as appropriate
since they do not clearly indicate the data subject’s acceptance.
The principles of transparency and fair processing require that the data subject be
informed of the purposes of the processing. Under the GDPR the specific purposes
for which personal data are processed have to be explicit and determined at the time
of the collection of the personal data. Otherwise consent by the data subject can not
be regarded as informed. Consent is to be given for all purposes in those situations
where processing has multiples purposes. The processing has to be restricted to
personal data which are adequate and relevant and limited to what is necessary for
the purposes for which they are processed. Personal data should be processed only if
the purpose of the processing could not reasonably be fulfilled by other means.
19 See, e.g., Article 29 Working Party on Data Protection, Opinion 5/2009 on online social
networking, WP 163, adopted on 12 June 2009.
20 Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain
legal aspects of information society services, in particular electronic commerce, in the Internal
Market (‘Directive on electronic commerce’) (OJ L 178, 17.7.2000, p. 1).
21 De Miguel Asensio (2015), pp. 218–383.
Data Protection in the Internet: A European Union Perspective
463
19 As regards internet intermediaries, it is noteworthy that pursuant
to article 2(4) the GDPR is without prejudice to the application of Directive 2000/31/
EC on electronic commerce,
20 in particular of the rules on the limitation of liability
of intermediary service providers laid down in Articles 12–15 of that Directive.
However, the latter provisions do not establish rules on the protection of personal
data.
21
The processing of personal data is only deemed lawful on the basis of at least one
of the grounds listed in Article 6 GDPR: (a) the data subject has given consent to the
processing of his or her personal data for specific purposes; (b) processing is
necessary for the performance of a contract to which the data subject is party or in
order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the
controller is subject; (d) processing is necessary in order to protect the vital interests
of the data subject or of another natural person; (e) processing is necessary for the
performance of a task carried out in the public interest or in the exercise of official
authority; (f) processing is necessary for the purposes of the legitimate interests
pursued by the controller or by a third party, except where such interests are
overridden by the interests or fundamental rights of the data subject.
Where processing is based on the data subject’s consent, the controller has to be
able to demonstrate that consent has been given [Art. 7(1) GDPR]. Consent is not
being regarded as freely given if the data subject is unable to refuse consent without
detriment. Consent requires a clear affirmative act by the data subject establishing a
freely given, specific, informed and unambiguous indication of his or her agreement
to the processing of personal data. Therefore, Recital 32 to the GDPR acknowledges
that consent may be given by electronic means, such as by ticking a box when
visiting an internet website or choosing technical settings for information society
services. However, pre-ticked boxes or inactivity are not regarded as appropriate
since they do not clearly indicate the data subject’s acceptance.
The principles of transparency and fair processing require that the data subject be
informed of the purposes of the processing. Under the GDPR the specific purposes
for which personal data are processed have to be explicit and determined at the time
of the collection of the personal data. Otherwise consent by the data subject can not
be regarded as informed. Consent is to be given for all purposes in those situations
where processing has multiples purposes. The processing has to be restricted to
personal data which are adequate and relevant and limited to what is necessary for
the purposes for which they are processed. Personal data should be processed only if
the purpose of the processing could not reasonably be fulfilled by other means.
19 See, e.g., Article 29 Working Party on Data Protection, Opinion 5/2009 on online social
networking, WP 163, adopted on 12 June 2009.
20 Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain
legal aspects of information society services, in particular electronic commerce, in the Internal
Market (‘Directive on electronic commerce’) (OJ L 178, 17.7.2000, p. 1).
21 De Miguel Asensio (2015), pp. 218–383.
Data Protection in the Internet: A European Union Perspective
463