Data Protection in Contractual Relationships (Art. 6 (1) (b) GDPR)

The General Data Protection Regulation (GDPR) sets forth that a justificationis required for a company (the 'controller') to process personaldata. The list of justification grounds in Art. 6 (1) GDPR is exhaustive.Art. 6 (1) (b) GDPR provides that the controller acts justifiably if the processingof personal data is necessary for the performance of a contract towhich the data subject is party. The use of this legal justification groundmakes recourse to Art. 6 (1) (f) GDPR (legitimate interests) or Art. 6 (1) (a)GDPR (consent) unnecessary. This leads to the accusation from dataprotection authorities and members of the data protection communitythat companies relying on Art. 6 (1) (b) GDPR could undermine data protection.Companies are accused of trying to circumvent the purportedly'proper' and 'correct' standards of data protection. Behind this is thenotion that data protection consent is the 'gold standard' of effectivedata protection. The following monograph challenges this view. It is basedon the thesis that effective data protection in contractual relationshipscan and must be realized above all through an appropriate design ofthe contractual relationships. A consent requirement downstream of theconclusion of the contract does not strengthen the digital autonomy ofthe data subjects, but ultimately contributes to its weakening. The level ofprotection envisaged by Article 8 CFR cannot be achieved by constantlyincreasing the number of consent requirements in the digital world - thisonly leads to 'consent fatigue'. The monograph describes in detail whichspecific requirements arise from this for the understanding of Art. 6 (1) (b)GDPR.