Personal Data Processing for Behavioural Targeting: Which Legal Basis?

Abstract

• The European Union Charter of Fundamental Rights only allows personal data processing if a data controller has a legal basis for the processing. • This paper argues that in most circumstances the only available legal basis for the processing of personal data for behavioural targeting is the data subject’s unambiguous consent. • Furthermore, the paper argues that the cookie consent requirement from the e-Privacy Directive does not provide a legal basis for the processing of personal data. • Therefore: even if companies could use an opt-out system to comply with the e-Privacy Directive’s consent requirement for using a tracking cookie, they would generally have to obtain the data subject’s unambiguous consent if they process personal data for behavioural targeting.

Keywords: Behavioural advertising, cookie, consent, e-Privacy Directive, Data Protection Directive, lex specialis, profiling, Charter of Fundamental Rights of the European Union, tracking

JEL Classification: K12, K00, D10, D11, D20, D30, D40, D60, D70, L00, L11, L20, L51