---
title: "Art. 6 GDPR: Lawfulness of processing"
canonical: "https://dposchool.com/gdpr/article/6"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_6"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 6 GDPR · Chapter II: Principles

# Article 6 GDPR: Lawfulness of processing

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Summary (not the official text)

Processing is lawful only if at least one of six grounds applies: consent, contract, legal obligation, vital interests, public interest or official authority, or legitimate interests. The article also sets out how Union or Member State law can lay down a basis for processing, and what the controller must take into account when data are processed for a new purpose without consent or such a law.

## Official text

### Article 6(1)

**1.** Processing shall be lawful only if and to the extent that at least one of the following applies:

#### Article 6(1)(a)

**(a)** the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

#### Article 6(1)(b)

**(b)** processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

#### Article 6(1)(c)

**(c)** processing is necessary for compliance with a legal obligation to which the controller is subject;

#### Article 6(1)(d)

**(d)** processing is necessary in order to protect the vital interests of the data subject or of another natural person;

#### Article 6(1)(e)

**(e)** processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

#### Article 6(1)(f)

**(f)** processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

### Article 6(2)

**2.** Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.

### Article 6(3)

**3.** The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

#### Article 6(3)(a)

**(a)** Union law; or

#### Article 6(3)(b)

**(b)** Member State law to which the controller is subject.

The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.

### Article 6(4)

**4.** Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:

#### Article 6(4)(a)

**(a)** any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;

#### Article 6(4)(b)

**(b)** the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;

#### Article 6(4)(c)

**(c)** the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;

#### Article 6(4)(d)

**(d)** the possible consequences of the intended further processing for data subjects;

#### Article 6(4)(e)

**(e)** the existence of appropriate safeguards, which may include encryption or pseudonymisation.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 6 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_6)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 40](https://dposchool.com/gdpr/recital/40)
- [Recital 41](https://dposchool.com/gdpr/recital/41)
- [Recital 42](https://dposchool.com/gdpr/recital/42)
- [Recital 43](https://dposchool.com/gdpr/recital/43)
- [Recital 44](https://dposchool.com/gdpr/recital/44)
- [Recital 45](https://dposchool.com/gdpr/recital/45)
- [Recital 46](https://dposchool.com/gdpr/recital/46)
- [Recital 47](https://dposchool.com/gdpr/recital/47)
- [Recital 48](https://dposchool.com/gdpr/recital/48)
- [Recital 49](https://dposchool.com/gdpr/recital/49)
- [Recital 50](https://dposchool.com/gdpr/recital/50)

## Court of Justice judgments

### [C-474/24, AR and Others v Österreichische Datenschutzbehörde and Others](https://dposchool.com/gdpr/case/c-474-24)

Judgment of 14 July 2026 · ECLI:EU:C:2026:579

Publishing the names and sanctions of athletes who broke anti-doping rules falls within the GDPR; it is not in principle health data unless the substance or method reveals health information; national law may require publication if it allows an individual balancing and excludes recreational athletes, vulnerable persons and whistleblowers.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-474/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0474)

### [C-484/24, NTH Haustechnik GmbH v EM](https://dposchool.com/gdpr/case/c-484-24)

Judgment of 18 June 2026 · ECLI:EU:C:2026:496

National procedural rules that require courts to consider all evidence submitted by the parties can be a valid legal basis for processing personal data in that evidence, provided clear and foreseeable national case-law sets the conditions for its use.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-484/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0484)

### [C-394/23, Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect](https://dposchool.com/gdpr/case/c-394-23)

Judgment of 9 January 2025 · ECLI:EU:C:2025:2

Making customers state a title (Mr or Ms) to buy a train ticket is not necessary for the contract and cannot rest on legitimate interest where customers were not told of that interest, the data are not strictly necessary, or the risk of discrimination outweighs it; the right to object does not change the necessity test.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-394/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0394)

### [C-65/23, MK v K GmbH](https://dposchool.com/gdpr/case/c-65-23)

Judgment of 19 December 2024 · ECLI:EU:C:2024:1051

Works agreements on employee data must meet Arts. 5, 6(1) and 9 as well as Art. 88(2), and courts can fully review whether processing under them is necessary.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-65/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0065)

### [C-621/22, Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens](https://dposchool.com/gdpr/case/c-621-22)

Judgment of 4 October 2024 · ECLI:EU:C:2024:858

A purely commercial interest, such as selling members' data to sponsors, can be a legitimate interest if it is lawful, but the processing must be strictly necessary and pass the balancing test.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-621/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0621)

### [C-17/22, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV](https://dposchool.com/gdpr/case/c-17-22)

Judgment of 12 September 2024 · ECLI:EU:C:2024:738

Giving one investor the contact details of all indirect investors in a fund can be necessary for the contract only if objectively indispensable to it; it may otherwise rest on legitimate interest if strictly necessary and the balance favours it.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-17/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0017)

### [C-667/21, ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts](https://dposchool.com/gdpr/case/c-667-21)

Judgment of 21 December 2023 · ECLI:EU:C:2023:1022

A medical service may process an employee's health data to assess work capacity under Art. 9(2)(h), but it also needs an Art. 6(1) basis; compensation under Art. 82 is compensatory, not punitive, and requires fault-based liability with a presumption of fault.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-667/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0667)

### [C-26/22, UF and AB v Land Hessen](https://dposchool.com/gdpr/case/c-26-22)

Judgment of 7 December 2023 · ECLI:EU:C:2023:958

Credit agencies may not keep insolvency-discharge data longer than the public register; a person who objects can obtain erasure absent overriding grounds; and supervisory authority decisions on complaints are subject to full judicial review.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-26/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0026)

### [C-634/21, OQ v Land Hessen](https://dposchool.com/gdpr/case/c-634-21)

Judgment of 7 December 2023 · ECLI:EU:C:2023:957

Automated credit scoring by a credit agency is itself an automated individual decision under Art. 22(1) where a third party, such as a bank, draws strongly on the score to decide whether to contract with the person.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-634/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0634)

### [C-319/22, Gesamtverband Autoteile-Handel e.V. v Scania CV AB](https://dposchool.com/gdpr/case/c-319-22)

Judgment of 9 November 2023 · ECLI:EU:C:2023:837

Vehicle-type rules create a legal obligation (Art. 6(1)(c)) on car manufacturers to make vehicle identification numbers available to independent operators as controllers; the Court also explained that a VIN can be personal data for someone who can reasonably link it to the vehicle's keeper.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-319/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0319)

### [C-252/21, Meta Platforms Inc and Others v Bundeskartellamt](https://dposchool.com/gdpr/case/c-252-21)

Judgment of 4 July 2023 · ECLI:EU:C:2023:537

A competition authority may find GDPR breaches when examining abuse of dominance, in cooperation with data protection authorities; collecting off-platform data that reveal sensitive traits is special-category processing; personalised advertising from such data cannot rest on contract necessity and only narrowly on legitimate interest; dominance does not bar valid consent but weighs on whether it is freely given.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-252/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252)

### [C-34/21, Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums](https://dposchool.com/gdpr/case/c-34-21)

Judgment of 30 March 2023 · ECLI:EU:C:2023:270

National employment data rules that only repeat general GDPR conditions are not 'more specific rules' under Art. 88 and must be disapplied unless they are a valid legal basis under Art. 6(3).

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-34/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0034)

### [C-268/21, Norra Stockholm Bygg AB v Per Nycander AB](https://dposchool.com/gdpr/case/c-268-21)

Judgment of 2 March 2023 · ECLI:EU:C:2023:145

When a civil court is asked to order disclosure of a document containing third parties' personal data, the GDPR applies and the court must weigh those persons' interests, applying proportionality and data minimisation.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-268/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0268)

### [C-77/21, Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság](https://dposchool.com/gdpr/case/c-77-21)

Judgment of 20 October 2022 · ECLI:EU:C:2022:805

Copying customer data into a test database can be compatible further processing under Art. 6(4), but keeping the data there longer than needed for testing breaches storage limitation.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-77/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0077)

### [C-184/20, OT v Vyriausioji tarnybinės etikos komisija](https://dposchool.com/gdpr/case/c-184-20)

Judgment of 1 August 2022 · ECLI:EU:C:2022:601

Publishing online the declarations of interests of public officials, including names of spouses and partners, is disproportionate; data that can indirectly reveal sexual orientation are special-category data.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-184/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0184)

### [C-175/20, SIA 'SS' v Valsts ieņēmumu dienests](https://dposchool.com/gdpr/case/c-175-20)

Judgment of 24 February 2022 · ECLI:EU:C:2022:124

A tax authority that collects large amounts of personal data from a business must respect the principles in Art. 5(1); it may only derogate from them on the basis of a legislative measure under Art. 23(1).

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-175/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0175)

### [C-439/19, Proceedings brought by B](https://dposchool.com/gdpr/case/c-439-19)

Judgment of 22 June 2021 · ECLI:EU:C:2021:504

Penalty points for traffic offences are data on criminal offences under Art. 10; the GDPR precludes a law making them publicly available without the requester showing a specific interest, or passing them on to businesses for reuse.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-439/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0439)

### [C-61/19, Orange Romania SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)](https://dposchool.com/gdpr/case/c-61-19)

Judgment of 11 November 2020 · ECLI:EU:C:2020:901

The controller must prove that consent was given by active behaviour after clear information; a contract with a pre-ticked box for storing ID copies does not show valid consent, nor does a form that makes refusal harder.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-61/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0061)

### Related (earlier law or other instruments)

#### [C-597/19, Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA](https://dposchool.com/gdpr/case/c-597-19)

Judgment of 17 June 2021 · ECLI:EU:C:2021:492

Instrument: GDPR together with the IP Enforcement and ePrivacy Directives

A copyright holder's systematic recording of IP addresses of file sharers, and the internet provider's disclosure of subscribers' names for a damages claim, can rest on legitimate interest, provided the request is justified, proportionate and not abusive, and any obligation to disclose is based on a legislative measure.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-597/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0597)

#### [C-673/17, Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH](https://dposchool.com/gdpr/case/c-673-17)

Judgment of 1 October 2019 · ECLI:EU:C:2019:801

Instrument: GDPR together with the ePrivacy Directive (Art. 5(3))

A pre-ticked checkbox does not give valid consent to cookies, whether or not the data are personal data; users must be told how long cookies last and whether third parties can access them.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-673/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673)

#### [C-40/17, Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW eV](https://dposchool.com/gdpr/case/c-40-17)

Judgment of 29 July 2019 · ECLI:EU:C:2019:629

Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)

A website that embeds a social plugin is a joint controller with the plugin provider for collecting and sending visitors' data, but only for that stage; each must pursue a legitimate interest, and the site must obtain any consent and give information for the stage it controls.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-40/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040)

#### [C-582/14, Patrick Breyer v Bundesrepublik Deutschland](https://dposchool.com/gdpr/case/c-582-14)

Judgment of 19 October 2016 · ECLI:EU:C:2016:779

Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)

A dynamic IP address held by a website operator is personal data where the operator has lawful means to identify the user with additional data held by the internet access provider; national law may not exclude legitimate interest as a basis for such processing in advance.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-582/14&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0582)

## EDPB guidance

### [Guidelines 3/2025 on the interplay between the DSA and the GDPR](https://dposchool.com/gdpr/guidance/edpb-03-2025)

EDPB 03/2025 · Final · First published 12 September 2025 · Final version 17 September 2026

Version 2 is final.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-32025-on-the-interplay-between-the-dsa-and-the-gdpr_en)

### [Guidelines 03/2026 on web scraping in the context of generative AI](https://dposchool.com/gdpr/guidance/edpb-03-2026)

EDPB 03/2026 · Draft for consultation · First published 8 July 2026

Consultation open until 30 October 2026. Articles indicative.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-032026-on-web-scraping-in-the-context-of-generative-ai_en)

### [Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites](https://dposchool.com/gdpr/guidance/edpb-rec-02-2025)

EDPB Rec 02/2025 · Draft for consultation · First published 4 December 2025

Consultation closed; final not yet published.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-22025-on-the-legal-basis-for-requiring-the-creation-of_en)

### [Joint Guidelines (European Commission and EDPB) on the interplay between the Digital Markets Act and the GDPR](https://dposchool.com/gdpr/guidance/edpb-com-dma-gdpr)

EDPB-COM DMA/GDPR · Draft for consultation · First published 9 October 2025

Joint text; consultation closed 4 December 2025; final not yet published.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/joint-guidelines-on-the-interplay-between-the-digital-markets-act-and-the_en)

### [Guidelines 02/2024 on Article 48 GDPR](https://dposchool.com/gdpr/guidance/edpb-02-2024)

EDPB 02/2024 · Final · First published 3 December 2024 · Final version 5 June 2025

Version 2 is final.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-022024-on-article-48-gdpr_en)

### [Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models](https://dposchool.com/gdpr/guidance/edpb-opinion-28-2024)

EDPB Opinion 28/2024 · Final · First published 18 December 2024 · Final version 18 December 2024

Art. 64(2) opinion; date is EDPB publication date.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-282024-on-certain-data-protection-aspects-related-to_en)

### [Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR](https://dposchool.com/gdpr/guidance/edpb-01-2024)

EDPB 01/2024 · Draft for consultation · First published 9 October 2024

WP29 Opinion 06/2014 (WP217) interpreted Directive 95/46 and was not part of the EDPB's 2018 endorsement. Consultation closed 20 November 2024; as of 28 October 2026 the EDPB lists no final version.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-12024-on-processing-of-personal-data-based-on-article-61f-gdpr_en)

### [Guidelines 02/2021 on virtual voice assistants](https://dposchool.com/gdpr/guidance/edpb-02-2021)

EDPB 02/2021 · Final · First published 12 March 2021 · Final version 7 July 2021

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-022021-on-virtual-voice-assistants_en)

### [Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions](https://dposchool.com/gdpr/guidance/edpb-rec-02-2021)

EDPB Rec 02/2021 · Final · First published 19 May 2021 · Final version 19 May 2021

[Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-022021-on-the-legal-basis-for-the-storage-of-credit-card_en)

### [Guidelines 8/2020 on the targeting of social media users](https://dposchool.com/gdpr/guidance/edpb-08-2020)

EDPB 08/2020 · Final · First published 7 September 2020 · Final version 13 April 2021

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-82020-on-the-targeting-of-social-media-users_en)

### [Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications](https://dposchool.com/gdpr/guidance/edpb-01-2020)

EDPB 01/2020 · Final · First published 7 February 2020 · Final version 9 March 2021

Final version 2.0.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012020-on-processing-personal-data-in-the-context-of-connected_en)

### [Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR](https://dposchool.com/gdpr/guidance/edpb-06-2020)

EDPB 06/2020 · Final · First published 22 July 2020 · Final version 15 December 2020

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-062020-on-the-interplay-of-the-second-payment-services-directive-and_en)

### [Guidelines 05/2020 on consent under Regulation 2016/679](https://dposchool.com/gdpr/guidance/edpb-05-2020)

EDPB 05/2020 · Final · First published 4 May 2020 · Final version 4 May 2020

Supersedes WP29 WP259 rev.01. Covers children's consent under Art. 8.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en)

### [Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak](https://dposchool.com/gdpr/guidance/edpb-04-2020)

EDPB 04/2020 · Final · First published 21 April 2020 · Final version 21 April 2020

Pandemic-specific.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-042020-on-the-use-of-location-data-and-contact-tracing-tools-in-the_en)

### [Guidelines 3/2019 on processing of personal data through video devices](https://dposchool.com/gdpr/guidance/edpb-03-2019)

EDPB 03/2019 · Final · First published 12 July 2019 · Final version 30 January 2020

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-32019-on-processing-of-personal-data-through-video-devices_en)

### [Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects](https://dposchool.com/gdpr/guidance/edpb-02-2019)

EDPB 02/2019 · Final · First published 12 April 2019 · Final version 16 October 2019

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-22019-on-the-processing-of-personal-data-under-article-61b-gdpr-in_en)

## Fines

Amounts are shown in the currency in which the fine was imposed.

### [Xandr Inc.: NOK 92,000,000](https://dposchool.com/gdpr/fine/dt-xandr-2026-10)

Datatilsynet (Norwegian Data Protection Authority), Norway · Decision of 2 October 2026 · Appeal status: unknown

As an ad exchange in real-time bidding, processed Grindr users' data (revealing sexual orientation) without a legal basis, relying on Grindr's invalid consents.

[Source: the authority](https://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/)

### [Experian Nederland B.V.: EUR 2,700,000](https://dposchool.com/gdpr/fine/ap-experian-2025-10)

Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 16 October 2025 · Appeal status: not appealed

Credit-scoring business used personal data from many sources without a valid legal basis and did not inform the people concerned.

[Source: the authority](https://www.autoriteitpersoonsgegevens.nl/actueel/experian-krijgt-boete-van-27-miljoen-euro-voor-privacyovertredingen)

### [Luka Inc.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-luka-replika-2025-04)

Garante per la protezione dei dati personali, Italy · Decision of 10 April 2025 · Appeal status: unknown

AI companion chatbot ran with no identified legal basis, an inadequate privacy policy and no effective age verification despite excluding minors.

[Source: the authority](https://www.edpb.europa.eu/news/ai-the-italian-supervisory-authority-fines-company-behind-chatbot-replika_en)

### [Posti: EUR 2,400,000](https://dposchool.com/gdpr/fine/fi-posti-2024-11)

Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman, Finland), Finland · Decision of 13 November 2024 · Appeal status: unknown

Automatically opened an OmaPosti electronic mailbox for customers, tied to other services, with a pre-ticked box and without clear information.

Not fully confirmed: Confirmed on the EDPB news page. Fine for Art. 5 and 6(1); reprimand and order for Art. 13; instruction on Art. 25. Company name given only as 'Posti'.

[Source: the authority](https://www.edpb.europa.eu/news/finnish-sa-administrative-fine-imposed-on-posti-for-unlawful-processing-of-personal-data_en)

### [Foodinho s.r.l.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-foodinho-2024-11)

Garante per la protezione dei dati personali, Italy · Decision of 13 November 2024 · Appeal status: unknown

Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074601)

### [LinkedIn Ireland Unlimited Company: EUR 310,000,000](https://dposchool.com/gdpr/fine/dpc-linkedin-2024-10)

Data Protection Commission (Ireland), Ireland · Decision of 22 October 2024 · Appeal status: under appeal

Processed members' data for behavioural analysis and targeted advertising without a valid legal basis, and without fair and clear information.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-linkedin-ireland-unlimited-company-october-2024)

### [Clearview AI Inc.: EUR 30,500,000](https://dposchool.com/gdpr/fine/ap-clearview-2024-05)

Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 16 May 2024 · Appeal status: not appealed

Built a facial recognition database of billions of photos, including of people in the Netherlands, without a legal basis, and did not inform people or answer access requests.

[Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/documents/decision-fine-clearview-ai)

### [Avast Software s.r.o.: CZK 351,000,000](https://dposchool.com/gdpr/fine/uoou-avast-2024-04)

Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Czech Republic · Decision of 10 April 2024 · Appeal status: upheld

Antivirus maker passed pseudonymised browsing histories of about 100 million users to a sister company that sold insights to marketers, while telling users the data was anonymous and used only for statistics.

[Source: the authority](https://uoou.gov.cz/novinky/vse/uoou-ulozil-pokutu-351-mil-kc-za-poruseni-gdpr)

### [Amazon France Logistique: EUR 32,000,000](https://dposchool.com/gdpr/fine/cnil-amazon-france-logistique-2023-12)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 27 December 2023 · Appeal status: reduced

Warehouse employee monitoring: scanner-based productivity indicators kept in detail for 31 days, some judged to lack a legal basis, plus poor information to temporary staff and on CCTV, and weak security.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048989272)

### [EOS Matrix d.o.o.: EUR 5,470,000](https://dposchool.com/gdpr/fine/azop-eos-matrix-2023-10)

Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Croatia · Announced on 5 October 2023 · Appeal status: unknown

Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice.

[Source: the authority](https://azop.hr/agenciji-za-naplatu-potrazivanja-eos-matrix-d-o-o-izrecena-upravna-novcana-kazna-u-iznosu-od-547-milijuna-eura/)

### [Meta Platforms Ireland Limited: EUR 210,000,000](https://dposchool.com/gdpr/fine/dpc-meta-facebook-2022-12)

Data Protection Commission (Ireland), Ireland · Decision of 31 December 2022 · Appeal status: under appeal

Facebook relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-december-2022)

### [Meta Platforms Ireland Limited: EUR 180,000,000](https://dposchool.com/gdpr/fine/dpc-meta-instagram-2022-12)

Data Protection Commission (Ireland), Ireland · Decision of 31 December 2022 · Appeal status: under appeal

Instagram relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-december-2022)

### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/cnil-clearview-2022-10)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 17 October 2022 · Appeal status: unknown

Facial-recognition firm scraped photos of people in France from the web with no legal basis, ignored access and erasure requests and did not cooperate with the CNIL; ordered to stop and delete, with a daily penalty.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046444859)

### [Meta Platforms Ireland Limited: EUR 405,000,000](https://dposchool.com/gdpr/fine/dpc-instagram-2022-09)

Data Protection Commission (Ireland), Ireland · Decision of 2 September 2022 · Appeal status: under appeal

Instagram let 13 to 17 year olds run business accounts that published their phone numbers or emails, and set child accounts to public by default.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-processing-personal-data-relating-child-users-instagram-social-networking-service)

### [Clearview AI, Inc: EUR 20,000,000](https://dposchool.com/gdpr/fine/hdpa-clearview-2022-07)

Hellenic Data Protection Authority, Greece · Decision of 13 July 2022 · Appeal status: unknown

Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative.

[Source: the authority](https://www.dpa.gr/en/en/enimerwtiko/prakseisArxis/imposition-fine-clearview-ai-inc)

### [Google LLC: EUR 10,000,000](https://dposchool.com/gdpr/fine/aepd-google-2022-05)

Agencia Española de Protección de Datos (AEPD), Spain · Announced on 18 May 2022 · Appeal status: unknown

Search and video platform forwarded people's content-removal requests (identity, email, reasons, URLs) to a public third-party database without a legal basis, which frustrated the right to erasure.

Not fully confirmed: AEPD press release of 18 May 2022 (procedure PS/00140/2020). The decision date and the split of the fine between the two infringements are not confirmed.

[Source: the authority](https://www.aepd.es/en/prensa-y-comunicacion/notas-de-prensa/the-aepd-has-imposed-sanction-on-google-llc-for-transferring-personal-data-to-third-parties)

### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/garante-clearview-2022-02)

Garante per la protezione dei dati personali, Italy · Decision of 10 February 2022 · Appeal status: unknown

Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9751362)

### [IAB Europe: EUR 250,000](https://dposchool.com/gdpr/fine/apd-iab-europe-2022-02)

Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), Belgium · Decision of 2 February 2022 · Appeal status: upheld

The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO.

[Source: the authority](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr)

### [Grindr LLC: NOK 65,000,000](https://dposchool.com/gdpr/fine/dt-grindr-2021-12)

Datatilsynet (Norwegian Data Protection Authority), Norway · Decision of 13 December 2021 · Appeal status: upheld

Shared users' data (including the fact of using a gay dating app) with advertising partners without valid consent.

[Source: the authority](https://www.datatilsynet.no/en/regulations-and-tools/regulations/avgjorelser-fra-datatilsynet/2021/gebyr-til-grindr/)

### [CAIXABANK, S.A.: EUR 6,000,000](https://dposchool.com/gdpr/fine/aepd-caixabank-2021-01)

Agencia Española de Protección de Datos (AEPD), Spain · Decision of 7 January 2021 · Appeal status: unknown

Bank relied on invalid consent and its privacy information was unclear when it profiled customers and shared data across its group for commercial purposes.

Not fully confirmed: Operative part of resolution PS/00477/2019 read: EUR 2,000,000 for Articles 13 and 14 and EUR 4,000,000 for Article 6; a charge under Article 22 was dismissed. The resolution text carries no visible date; 7 January 2021 comes from a later AEPD document.

[Source: the authority](https://www.aepd.es/documento/ps-00477-2019.pdf)

### [Google LLC: SEK 75,000,000](https://dposchool.com/gdpr/fine/imy-google-2020-03)

Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), Sweden · Decision of 10 March 2020 · Appeal status: reduced

Failed to remove search results in time under the right to be forgotten, and told website owners about removals, which discouraged people from asking.

[Source: the authority](https://www.imy.se/tillsyner/google/)

### [TIM S.p.A.: EUR 27,802,946](https://dposchool.com/gdpr/fine/garante-tim-2020-01)

Garante per la protezione dei dati personali, Italy · Decision of 15 January 2020 · Appeal status: unknown

Aggressive telemarketing: calls to people who had refused or were on internal block lists, marketing without valid consent, and weak control of call-centre partners.

Not fully confirmed: Amount, date and name read in the decision (register no. 7 of 15 January 2020). Articles listed are those the decision states for its main finding (section 3.1, which also cites Article 130 of the Italian Code); later sections discuss further provisions (e.g. Articles 12 and 21), so the list may be incomplete.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9256486)

### [Google LLC: EUR 50,000,000](https://dposchool.com/gdpr/fine/cnil-google-2019-01)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 21 January 2019 · Appeal status: upheld

Information on ad personalisation was scattered and unclear, and consent to it was not specific or informed (pre-ticked, bundled), so it gave no valid legal basis.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000038032552/)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter II](https://dposchool.com/gdpr/chapter/2) / Article 6

Previous: [Art. 5 GDPR: Principles relating to processing of personal data](https://dposchool.com/gdpr/article/5)

Next: [Art. 7 GDPR: Conditions for consent](https://dposchool.com/gdpr/article/7)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents