Data Protection in Contractual Relationships (Art. 6 (1) (b) GDPR)

The General Data Protection Regulation (GDPR) sets forth that a justification is required for a company (the "controller") to process personal data. The list of justification grounds in Art. 6 (1) GDPR is exhaustive. Art. 6 (1) (b) GDPR provides that the controller acts justifiably if the processing of personal data is necessary for the performance of a contract to which the data subject is party. The use of this legal justification ground makes recourse to Art. 6 (1) (f) GDPR (legitimate interests) or Art. 6 (1) (a) GDPR (consent) unnecessary. This leads to the accusation from data protection authorities and members of the data protection community that companies relying on Art. 6 (1) (b) GDPR could undermine data protection. Companies are accused of trying to circumvent the purportedly "proper" and "correct" standards of data protection. Behind this is the notion that data protection consent is the "gold standard" of effective data protection. The following monograph challenges this view. It is based on the thesis that effective data protection in contractual relationships can and must be realized above all through an appropriate design of the contractual relationships. A consent requirement downstream of the conclusion of the contract does not strengthen the digital autonomy of the data subjects, but ultimately contributes to its weakening. The level of protection envisaged by Article 8 CFR cannot be achieved by constantly increasing the number of consent requirements in the digital world - this only leads to "consent fatigue". The monograph describes in detail which specific requirements arise from this for the understanding of Art. 6 (1) (b) GDPR.