---
title: "European Economic Area — Lawful Processing & Special Data | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/european-economic-area-bloc/lawful-processing-and-special-data/
source_html: /jurisdictions/european-economic-area-bloc/lawful-processing-and-special-data/index.html
description: "European Economic Area (Bloc) — Lawful Processing & Special Data (Amber, 4 sub-modules, 6 claims): Core provisions are stable and enforced, but the Digital Omnibus proposal (still in trilogue as of mid-2026) creates near-term uncertainty ov"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 75adf5928fa4a778eda34e4fe1f28f7dc58e5660a4ba281d635050a0c46468ec
generator: "fe-fleet/md-twin@1.0"
---
# European Economic Area — Lawful Processing & Special Data | Data Protection Monitor

### D2Lawful Processing & Special Data4 sub-modules6 claimsAmber▾#

Core provisions are stable and enforced, but the Digital Omnibus proposal (still in trilogue as of mid-2026) creates near-term uncertainty over consent-signal mechanics and the sensitive-data/AI derogation.

Primary framework GDPR Articles 4-11 (Regulation (EU) 2016/679); proposed amendments under the Digital Omnibus (COM(2025) 836 final)

Supervisory authority [EDPB / national DPAs (e.g. Irish DPC for Meta ad-targeting cases)](https://www.edpb.europa.eu/)

Traffic-light rationale — Amber Core provisions are stable and enforced, but the Digital Omnibus proposal (still in trilogue as of mid-2026) creates near-term uncertainty over consent-signal mechanics and the sensitive-data/AI derogation.

#### Sub-modules (4)

Category narrative 314 words

All processing must rest on one of the six exhaustive lawful bases in Art. 6(1)(a)–(f) GDPR. Following CJEU Case C-252/21 Meta Platforms v Bundeskartellamt, Case C-621/22 Koninklijke Nederlandse Lawn Tennisbond (4 October 2024, confirming a purely commercial interest can constitute a legitimate interest under Art. 6(1)(f) if strictly necessary and balanced), and EDPB Opinion 28/2024 on AI Models (17 December 2024), controllers relying on Art. 6(1)(f) must satisfy a rigorous three-step test (legitimate interest, strict necessity / data minimisation, and balancing against reasonable expectations) supplemented by unconditional opt-out safeguards. Consent under Art. 4(11) and Art. 7 must be freely given, specific, informed, and unambiguous; under EDPB Opinion 08/2024 on 'Consent or Pay' deployed by Large Online Platforms (17 April 2024), binary 'pay or consent to behavioural advertising' models without a genuinely equivalent tracking-free third option generally fail the 'freely given' requirement. Special category data under Art. 9(1) requires an Art. 9(2) derogation (where Member State law may maintain or introduce further conditions for genetic, biometric, or health data under Art. 9(4)), and in Case C-446/21 Schrems v Meta Platforms (4 October 2024) the CJEU held that a user's public statement about their own sexual orientation at a panel discussion does not authorize a platform under Art. 9(2)(e) ('manifestly made public') to aggregate off-platform special category data for personalised advertising. On pseudonymisation, the CJEU Grand Chamber in Case C-413/23 P EDPS v SRB (4 September 2025) held that whether pseudonymised data is personal data is assessed from the perspective of the recipient ('relative approach'), though the disclosing controller's own transparency duties under Art. 13/15 remain assessed at the point of collection before transmission. Separately, the Commission's proposed Digital Omnibus Regulation (COM(2025) 837 final, 19 November 2025; legislative proposal, NOT yet in force) proposes codifying the SRB relative identifiability test in Art. 4(1) GDPR and introducing specific AI training provisions under Art. 9(2)(k) and Art. 88c.

Evidence 6

Sources and claims (6)
- Confirmed[IAPP](https://iapp.org/news/a/irish-dpc-fines-meta-390m-euros-over-legal-basis-for-personalized-ads) — The Irish DPC, implementing EDPB binding decisions, fined Meta Ireland a combined €390 million (€210m Facebook, €180m Instagram) after finding that Meta could not rely on the contractual-necessity legal basis under Article 6 GDPR for behavioural-advertising processing.observed 2026-08-05
- Confirmedunavailable — The Digital Omnibus proposal introduces a new GDPR Article 88b that would allow individuals to express privacy choices automatically through technical means such as browser settings, rather than manual cookie-banner interaction.
- Probable[IAPP](https://iapp.org/news/a/can-we-solve-the-cookie-banner-problem-in-the-eu-) — In June 2026 the Council of the EU removed the proposed Article 88b automated-consent-signal provision from its negotiating position following lobbying from media and advertising industry groups, creating legislative uncertainty over the final mechanism.observed 2026-08-05
- Confirmedunavailable — The EDPB and EDPS welcomed the Digital Omnibus's proposed derogation permitting incidental and residual processing of special-category (Article 9) data in the context of developing and operating AI systems, while recommending improvements to scope and lifecycle safeguards.
- Confirmed[EDPB](https://www.edpb.europa.eu/news/news/2025/edpb-adopts-pseudonymisation-guidelines-and-paves-way-improve-cooperation_en) — EDPB Guidelines 01/2025 clarify that pseudonymised data, when attributable to an individual via additional information, remains personal data, and detail how pseudonymisation supports Articles 5, 25 and 32 compliance.observed 2026-08-05
- Confirmed[IAPP](https://iapp.org/news/a/the-edpb-s-draft-anonymization-guidelines-what-they-mean-for-your-data-strategy) — Following the CJEU's September 2025 EDPS v SRB ruling that the same dataset can be personal data for one recipient and anonymous for another, the EDPB published draft Guidelines 02/2026 on Anonymisation (7 July 2026, consultation to 30 October 2026) setting out a two-question, three-criteria (no isolation, no linkage, no inference) test for anonymisation.observed 2026-08-05