The Contractual Basis for Data Processing

The contractual basis for data processing under the GDPR is one of the six lawful bases for processing personal data.

To get data protection, understanding the legal basis for processing personal data is paramount. Article 6(b) of the General Data Protection Regulation (GDPR) sets out when data processing for the performance of a contract is lawful. Let’s delve into the depths of Article 6(b), deciphering its key terms and shedding light on essential steps for lawful data processing under this provision.

Contents

• What Does the GDPR Say?

• What Does This Mean?

• Key Steps for Compliant Contractual Data Processing

• Additional Considerations

• The Right to be Informed

• Examples of When Data is Processed for a Contract

What Does the GDPR Say?

Article 6b of the GDPR reads data processing is lawful if “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;”

What Does This Mean?

Necessary for the Performance of a Contract means the processing must be indispensable, directly tied to the fulfillment of a contractual obligation.

Article 6(b) permits the processing of personal data only if it’s an absolute requirement for the performance of a contract. This goes beyond mere convenience; it signifies an essential and integral connection between data processing and contractual obligations.

However, as the GDPR goes on to explain, it does not have to be for a contract that already exists. It can be a contract that you and the data subject may enter into.

Performance covers all stages of the contractual relationship, from initial negotiations to post-fulfillment follow-up. So, collecting data to evaluate a potential gym client’s fitness goals falls under this provision.

Contract: Not all agreements qualify. The contract must be legally binding, with clearly defined rights and obligations for both parties. A casual “Let’s grab coffee sometime” wouldn’t suffice.

Key Steps for Compliant Contractual Data Processing

There are a number of steps that need to be taken to ensure the contractual basis for data processing is correctly complies with.

1. Identify Essential Data: Pinpoint the specific data genuinely needed to fulfill the contract. Avoid collecting extraneous information. If you need to process additional data you will need another lawful basis, such as consent.

2. Minimise and Limit: Collect the minimum amount of data possible and retain it only for the contract’s duration. Remember, less is more when it comes to personal data. The data privacy principles still apply regardless of the lawful basis used. Learn more about data minimisation here.

3. Transparency is Key: Inform individuals clearly about what data you collect, why you need it, and how long you’ll keep it. Be transparent and avoid hidden clauses.

4. Data Subject Rights: Respect data subject rights to access, rectify, and erase their personal data as set out in the GDPR.

Additional Considerations

There are a number of factors to consider when relying on this lawful basis:

• Third-Party Processors: If you share data with third parties, ensure they offer the same level of data protection as your organisation. Choose reliable partners, not risky companies.

• Data Security: Implement robust security measures (encryption, access controls, incident response plans) to safeguard the data you collect.

• Regular Reviews: Don’t assume your contractually-collected data is permanently yours. Regularly review its necessity and consider data minimisation strategies.

It is also important to remember that you cannot reuse data collected for the performance of a contract for other purposes such as marketing. Therefore you will need to find an additional lawful basis for wider data processing, such as consent or legitimate interest.

Contracts and Children

The contractual basis for data processing under the GDPR applies to children. This means people under 18 can enter into contracts but you must be careful to ensure these children can understand the contract’s terms, which may require an assessment of individual competence.

Special Category Data

If special category data are to be processed under the contract this needs to be specified clearly and distinctly within the contract.

Remember, even under Article 6(b), organisations must still conduct data protection impact assessments for high-risk processing and implement appropriate security measures to safeguard personal data.

Learn more about special category data here.

The Right to Object

Under the contractual lawful basis people do not have the right to object to data processing. This is because if you stopped processing their data, they could no longer receive the products or services they contracted with you to provide.

The Right to be Informed

For organisations navigating Article 6(b), transparency is non-negotiable. Data subjects must be informed about how their data will be used within the contractual context. This involves providing a clear and easily understandable privacy statement which explains when personal data will be used for the performance of a contract.

Examples of When Data is Processed for a Contract

There are a number of examples when the contractual basis for processing personal data may be appropriate.

1. Online Retailer:

• Data Collected: Name, address, payment information, purchase history.

• Lawful Basis: Necessary for processing orders, delivering goods, managing returns, and providing customer service.

• Key Points: Data is essential for fulfilling the contract of purchase and is minimised to just what’s required.

2. Gym Membership:

• Data Collected: Fitness data (weight, heart rate, exercise preferences), emergency contact information.

• Lawful Basis: Necessary for creating personalised training plans, monitoring progress, and ensuring safety during workouts.

• Key Points: Data directly links to fulfilling the contract’s purpose, and its retention is limited to the membership duration.

3. Job Application:

• Data Collected: CV, interview transcripts, references.

• Lawful Basis: Necessary for assessing candidate suitability, making hiring decisions, and managing the recruitment process.

• Key Points: Data collected is relevant to the job and is not retained beyond the recruitment stage unless the candidate is hired.

4. Loan Agreement:

• Data Collected: Income information, credit score, employment details.

• Lawful Basis: Necessary for assessing creditworthiness, determining loan terms, and managing repayments.

• Key Points: Data is crucial both to decide whether to offer the loan (enter into the contract) and for contract execution but should be minimised to financial specifics and securely protected.

5. Software Subscription:

• Data Collected: User login information, usage data, technical device details.

• Lawful Basis: Necessary for providing access to the software, troubleshooting technical issues, and improving individual user experience.

• Key Points: Data collection should be transparent and clearly linked to providing the subscribed service.

By understanding these examples, you can navigate data processing under Article 6(b) of the GDPR with confidence and ensure your practices are both legally compliant and respectful of individual privacy.