Komplett Bank ASA

What happened

The Norwegian DPA held that Article 6(1)(b) GDPR «Necessary for the performance of a contract» can not be used as a lawful basis for direct marketing purposes, when direct marketing is not the main subject-matter of the contract in question.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 6Lawfulness of processing6(1)(b)Read →
• Art. 12Transparent information, communication and modalities for the exercise of the rights of the data subject12(1) · 12(3)Read →
• Art. 13Information to be provided where personal data are collected from the data subject13(1)(c) · 13(2)(b)Read →
• Art. 21Right to object21(3) · 21(4)Read →

• Data subject rights
• Transparency
• Unlawful processing