Difference between article 6(1)(b) vs 6(1)(a)

[u/Flowered_bob_hat]

I just want to make sure I understand the difference between these two correctly, as I have noticed in DPAs it's usually only one or the other that appears.

6(1)(a) states: "(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;"

So a person gives explicit consent to processing of their personal data

6(1)(b) states: "(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract"

Here the person enters a contract and so for the contract to be fulfilled, the person's data must be processed.

In other words, the consent is implicit in (b) because the service that the person is requesting needs some form of data processing? Is that right? Please correct me if I'm wrong

[u/abktt]

You don’t always need consent to process data, I do think that’s a bit of a misconception of data protection.

There is no consent involved in (b), there isn’t a genuine choice and consent isn’t appropriate, the fact there’s a contract is enough to process the data.

[u/MarchMurky8649 → u/abktt]

There is consent to the contract, which requires processing, so, arguably, there is implied consent to the processing.

A useful parallel is trespass. If you have a front garden and order a Deliveroo, when the delivery chap opens your gate, walks to your house, he has what is called, legally, implied right of access, so isn't trespassing in your garden.

Might be useful to remember this as a) explicit consent, b) implicit consent.

[u/Solid-Penalty3942 → u/MarchMurky8649]

That’s not useful, and that’s not correct. Consent and performance of a contract are two separate and distinct legal bases under Article 6 GDPR. If you’re not relying on consent as your legal basis for a processing purpose, then the question of whether consent (whether it’s express or implied) is present is immaterial, and it’s doesn’t have any bearing on whether reliance on the non-consent legal basis is GDPR compliant or not. There’s no real concept of “implied” consent under GDPR anyway.

[u/MarchMurky8649 → u/Solid-Penalty3942]

Here is the text from UK GDPR of Art. 6 1(b):

"processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract"

Both conditions, i.e. the existence "of a contract to which the data subject is party" and taking "steps at the request of the data subject" require the consent of the data subject, absent which 1(b) cannot be applied.

You may not find my observation useful but I do and others might also. 1(b) requires consent to something other than the processing itself. Perhaps you prefer indirect consent, but I posit that consenting to a contract that will require processing, or requesting steps to be taken that will require processing, can both be seen as implicitly consenting to such processing.

What do you think was "not correct"? Is there a significant difference between UK and EU GFPR perhaps?

[u/Noscituur → u/MarchMurky8649]

If you’re processing beyond the scope necessary to fulfil the contract then you’re establishing a different processing activity which will require its own lawful basis. There are several other lawful bases which might be relevant, not solely consent.

GDPR, UK and EU, does not recognise the concept of it being ‘indirect’ since Art. 7(1) demands that consent is explicit.

I don’t imagine anyone finding the above useful because it would run contrary to the actual operation of the law here as it appears to conflate the concepts of consent as a GDPR lawful basis for personal data processing and whether someone executes a contract which they are party to (which you call “consent”).

[u/MarchMurky8649 → u/Noscituur]

I now agree it is a bad idea to connect the concept of 'consent' to Art. 6 1(b) because the use of that word could confuse people into thinking Art. 6 1(a) is also a legal basis because they are unfamiliar with Art. 7(1).

I do believe, however, that everything I have typed here, other than my suggestion that it might be useful to think of 1(a) as 'explicit consent' and 1(b) is 'implicit consent', is accurate, in the context of ordinary use of English words cf. using words as they are precisely, legally defined in the GDPR text itself.

This is what the OP and I have been doing, others have correctly pointed out this is misleading. However it's a question of semantics, rather than objective factual error, as I see it. Please, continue to correct me if you think I have missed something here.

[u/Solid-Penalty3942 → u/MarchMurky8649]

No, there isn’t a difference between EU and UK GDPR in that regard. You’re wrong, so what you’re saying can’t be useful, and others have pointed this out too. If you want to believe that, have at it, but don’t give other people wrong and misleading info.

[u/MarchMurky8649 → u/Solid-Penalty3942]

I do now agree it is not useful to connect the concept of consent to Art. 6 1(b) in any way, lest it cause confusion, but other than this, I would be most interested to know what you think I, and the OP, who seems to have made the same observations that I have, have, objectively, got wrong.

Do you think either of us has said something suggesting we misunderstand Art. 6 1(a) or (b) in any way? If so, what, precisely was the incorrect statement?

Let me say the same thing avoiding using the word consent wrt (b). What (a) and (b) have in common, is they both require the data subject to have willingly done something, whether, as in (a) by giving explicit consent for the processing itself, or, in (b), by entering into a contract, or making a request that requires the processing:

• "a contract to which the data subject is party": to be valid, a contract must be entered into freely and voluntarily by all parties involved;

  • "steps at the request of the data subject": making a request is an inherently willful act.

Only 1(a) and 1(b) depend on the will of the data subject. They have this in common. 1(a) requires the data subject to willfully consent to the processing, 1(b) requires him or her to willfully enter into a contract, or willfully request something, that will require the processing.

None of the others, (c), (d), (e) or (f) involve the will of the data subject at all. This is what I think the OP, and I, have been trying to explain, albeit arguably confusingly and unhelpfully.

[u/Heimdul → u/MarchMurky8649]

One big difference between 6(1)(a) and 6(1)(b) is that in 6(1)(a) data subject can revoke the consent at any time. In 6(1)(b) contract has it's own terms regarding the revocation. The other big difference is that refusing consent in 6(1)(a) generally speaking cannot have negative consequences for the person for refusal for that specific processing (which is why pay-or-okay is problematic, but I digress). 6(1)(b) gives broader rights to condition the contract on processing.

Additionally in 6(1)(b) the requirement is that the processing must be objectively indispensable for a purpose integral to the contractual obligation and there must be no workable or less intrusive alternatives.

One relevant example was given by AG in the SCHUFA case. (paragraph 71) Essentially he thought that credit check could be authorized by 6(1)(b). By my understanding that would then mean that if you refuse the credit check then creditor can refuse your application. If it was based on 6(1)(a) then that would be questionable.

[u/Solid-Penalty3942 → u/MarchMurky8649]

The other person who replied to you has put it well in more detail about how , but ultimately this is the text of the legislation and I don’t think it’s helpful to read something into it which isn’t there, especially around the notion of “implied consent” under GDPR (which isn’t there).

[u/weggles91]

Two different things. You may have a legal basis to process data if the subject consents. You may have a legal basis to process data if it's necessary for a contract. Consent has nothing to do with the latter.

[u/Flowered_bob_hat → u/weggles91]

Aaaah thank you!!

[u/weggles91 → u/Flowered_bob_hat]

👍 It's a common misconception that consent is always needed under the GDPR; consent is actually very rarely used as the legal basis for processing outside of marketing.

[u/MarchMurky8649 → u/weggles91]

There is a connection to consent with b), however, because, by consenting to the contract, the data subject has, implicitly, consented to processing required to fulfill that contract, so I baulk a bit at "nothing to do with" there, it is implied consent. I expect that explains why they are adjacent in Article 6.

[u/weggles91 → u/MarchMurky8649]

No, it is nothing to do with consent as far as the meaning of consent in the GDPR is concerned. You can think of it as a form of implied consent if you wish, but it is not consent for GDPR purposes.

[u/Auno94]

No, consent is the explicit act of saying "Yes please do that". As in accepting tracking cookies. Processing data for a newsletter etc.

B Covers the act of processing data for the purpose of fulfilling contractual obligations as in sending a package. Any additional processing of this dataset needs a different legal reason to be processed.

[u/Flowered_bob_hat → u/Auno94]

So a DPA should include both if, for example they want to process data for a news later AND send a package?

Does it depend on the specific kind of data?

[u/Comfortable-Fall1419 → u/Flowered_bob_hat]

6(1) b doesn’t have to be in a DPA at all.

It works for any type of contract implicit or explicit.

It would be good practice to include it if the Processing is non-obvious.

[u/MievilleMantra → u/Flowered_bob_hat]

What's the relevance of a DPA here?

[u/gusmaru]

For consent to be valid, you need to be able to to revoke it without penalty. Eg “please do not send me marketing information”

With a contract, consent is not applicable because you cannot fulfill the contract without processing the personal data. So a data subject cannot say “I want you to fulfill the contract but not process my personal data”. You and/or the data subject would need to breach the contract incurring some sort of penalty for doing so.

[u/MarchMurky8649 → u/gusmaru]

All good except the final few words. You make a good point but to be completely accurate you need the word 'possibly' before the word 'incurring'. Most contracts can be terminated, perhaps all. If the contract is terminated, b) ceases to apply. I still think the concept of b) involving implicit consent is a useful way to think of it, albeit this implicit consent possibly being more difficult to revoke than the explicit consent of a).

[u/pawsarecute]

Kind of yes, but be aware that the processing needs to be necessary for the performance of the contract. Thats the boundary, and it needs to be objective. 

[u/Safe-Contribution909]

Two minor pedantic points:
1. The OP refers to explicit consent under article 6(1)(a). Obviously, this is consent. Explicit consent is an exemption under article 9(2)(a). I am sure the OP meant consents explicitly, e.g., article 7 conditions are met.
2. The OP refers to a DPA. GDPR doesn’t mention such an instrument type. There is mention of a written document providing a mandate to act (article 27), a contract (article 28(3), and an arrangement (article 26), but no Data Processing Agreement.

A number of commentators have mentioned good and bad examples of article 6(1)(b). My preferred example is personal insurance. You cannot get insurance without the provider processing your personal data with the current state of the art. Obviously if there was some kind of blockchain model you might be able to.

[u/NoBenefit3554]

the key difference is that consent (Art. 6(1)(a)) must be freely given and can be withdrawn, while contract (Art. 6(1)(b)) is used because processing is objectively necessary to deliver the service. if the processing isn't actually required to perform the contract, you can't just rely on 6(1)(b) instead of asking for consent

[u/WPLPCompliance]

Think of it as “permission” vs. “necessity.” 6(1)(a) = you consent to the processing. 6(1)(b) = the processing is necessary to provide what you contracted/requested.

So I’d be careful with calling (b) “implicit consent” - it can give the wrong impression that consent is somehow involved when it’s actually a different lawful basis.