# Standards and Regulatory References

## Primary Legislation

### GDPR Article 6 — Lawfulness of Processing
- **Art. 6(1)(a)**: Consent of the data subject for one or more specific purposes.
- **Art. 6(1)(b)**: Necessary for performance of a contract with the data subject or pre-contractual steps at their request.
- **Art. 6(1)(c)**: Necessary for compliance with a legal obligation to which the controller is subject.
- **Art. 6(1)(d)**: Necessary to protect vital interests of the data subject or another natural person.
- **Art. 6(1)(e)**: Necessary for a task carried out in the public interest or in exercise of official authority.
- **Art. 6(1)(f)**: Necessary for legitimate interests of the controller or third party, except where overridden by data subject rights.
- **Art. 6(2)-(3)**: Member State law may introduce more specific provisions for processing under (c) and (e).
- **Art. 6(4)**: Compatibility test for further processing beyond original purpose.

### GDPR Article 7 — Conditions for Consent
- **Art. 7(1)**: Controller must be able to demonstrate that consent was given.
- **Art. 7(2)**: Written consent requests must be clearly distinguishable, intelligible, and easily accessible.
- **Art. 7(3)**: Right to withdraw consent at any time; withdrawal must be as easy as giving consent.
- **Art. 7(4)**: Consent is not freely given if contract performance is conditional on consent to unnecessary processing.

### GDPR Article 9 — Special Categories of Personal Data
- **Art. 9(1)**: Prohibits processing of racial/ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, sex life/orientation.
- **Art. 9(2)**: Exhaustive list of exceptions: (a) explicit consent, (b) employment/social security law, (c) vital interests, (d) not-for-profit bodies, (e) manifestly public data, (f) legal claims, (g) substantial public interest, (h) healthcare, (i) public health, (j) archiving/research.

## Regulatory Guidance

### ICO (UK) Lawful Basis Interactive Guidance Tool
The Information Commissioner's Office provides a lawful basis interactive tool that walks controllers through a structured assessment for each processing activity. Key guidance points:
- Consent should not be the default; consider other bases first.
- Contract performance is limited to what is objectively necessary, not everything in the contract.
- Legitimate interest requires a documented three-part assessment (LIA).
- Document the chosen basis before processing begins.

### EDPB Guidelines 2/2019 on Processing of Personal Data under Article 6(1)(b)
Adopted 9 April 2019, these guidelines clarify:
- The notion of "necessity" is an autonomous concept of EU law, interpreted objectively.
- Bundling multiple services does not mean all processing is necessary for the bundled contract.
- Pre-contractual processing must be at the data subject's request, not the controller's initiative.
- Personalisation or profiling is generally not necessary for contract performance.

### EDPB Guidelines 05/2020 on Consent under the GDPR
Adopted 4 May 2020, these guidelines clarify:
- Cookie walls constitute a denial of genuine choice and vitiate consent.
- Scrolling or continued browsing does not constitute valid consent.
- Granularity: separate consent for separate purposes.
- Controllers must be able to demonstrate consent was obtained.

### WP29 Opinion 06/2014 on Legitimate Interests (Art. 6(1)(f))
Adopted 9 April 2014, this opinion (still endorsed by the EDPB) provides:
- Framework for the three-part legitimate interest test.
- Examples of legitimate interests: fraud prevention, direct marketing, network security, employee monitoring (with proportionality).
- Factors for the balancing test: nature of interests, impact on data subject, additional safeguards, reasonable expectations of data subjects.

## Relevant Recitals

- **Recital 32**: Conditions for valid consent (clear affirmative act, no silence/pre-ticked boxes).
- **Recital 40**: Lawfulness requires at least one basis; each basis has specific conditions.
- **Recital 44**: Contract performance — processing should be necessary, not merely useful.
- **Recital 46**: Vital interests — last-resort basis when no other basis is available.
- **Recital 47**: Legitimate interests — direct marketing may constitute a legitimate interest; reasonable expectations of data subjects are relevant.
- **Recital 50**: Further processing for compatible purposes does not require a separate lawful basis.

## Enforcement Precedents

- **Austrian DPA (DSB) — Decision D155.027, 2018-004 (2018)**: Consent deemed invalid due to pre-ticked box, requiring affirmative action per Art. 7 and Recital 32.
- **CJEU — Planet49 GmbH (C-673/17, 1 October 2019)**: Pre-ticked checkbox does not constitute valid consent for cookies.
- **CJEU — Orange Romania (C-61/19, 11 November 2020)**: Consent not freely given when contract was pre-filled with consent clause requiring active opt-out.
- **Irish DPC — WhatsApp Ireland (September 2021, EUR 225 million)**: Transparency failures related to lawful basis for processing, including failure to adequately inform data subjects about reliance on legitimate interests.