European Economic Area: Lawful Processing & Special Data

All processing must rest on one of the six exhaustive lawful bases in Art. 6(1)(a)–(f) GDPR. Following CJEU Case C-252/21 Meta Platforms v Bundeskartellamt, Case C-621/22 Koninklijke Nederlandse Lawn Tennisbond (4 October 2024, confirming a purely commercial interest can constitute a legitimate interest under Art. 6(1)(f) if strictly necessary and balanced), and EDPB Opinion 28/2024 on AI Models (17 December 2024), controllers relying on Art. 6(1)(f) must satisfy a rigorous three-step test (legitimate interest, strict necessity / data minimisation, and balancing against reasonable expectations) supplemented by unconditional opt-out safeguards. Consent under Art. 4(11) and Art. 7 must be freely given, specific, informed, and unambiguous; under EDPB Opinion 08/2024 on 'Consent or Pay' deployed by Large Online Platforms (17 April 2024), binary 'pay or consent to behavioural advertising' models without a genuinely equivalent tracking-free third option generally fail the 'freely given' requirement. Special category data under Art. 9(1) requires an Art. 9(2) derogation (where Member State law may maintain or introduce further conditions for genetic, biometric, or health data under Art. 9(4)), and in Case C-446/21 Schrems v Meta Platforms (4 October 2024) the CJEU held that a user's public statement about their own sexual orientation at a panel discussion does not authorize a platform under Art. 9(2)(e) ('manifestly made public') to aggregate off-platform special category data for personalised advertising. On pseudonymisation, the CJEU Grand Chamber in Case C-413/23 P EDPS v SRB (4 September 2025) held that whether pseudonymised data is personal data is assessed from the perspective of the recipient ('relative approach'), though the disclosing controller's own transparency duties under Art. 13/15 remain assessed at the point of collection before transmission. Separately, the Commission's proposed Digital Omnibus Regulation (COM(2025) 837 final, 19 November 2025; legislative proposal, NOT yet in force) proposes codifying the SRB relative identifiability test in Art. 4(1) GDPR and introducing specific AI training provisions under Art. 9(2)(k) and Art. 88c.