Digital Omnibus proposal· Recital 44g

The simple display of contextual advertising does not typically require access to or storing of information on a user or subscriber’s device. Contextual advertising is placed solely on the basis of the immediate content displayed on the subscriber or user’s online interface – such as a website or an app - during an individual visit or on the basis of a single search query. Such advertising does not involve the processing of personal data, and it is not based on profiling, and it does not involve retention or link with an individual’s past of future activity. At the same time, the effectiveness of such advertising often relies on the possibility to measure the display and the performance of the advertisement displayed such as capping cookies and advertising measurement cookies. Such measurement of the display and performance of contextual advertising should be lawful without the consent of the user where it is carried out by the provider of an online service, including jointly with others, or on behalf of that provider, provided that data collected are pseudonymised after collection, as a key security measure, and are not processed for another purpose including profiling or providing programmatic advertising, and that the measurement does not involve any profiling nor processing of data relating to the subscriber or user’s past or future activity, including activity across sites, apps or services.

For the further processing of personal data for other compatible purposes than those defined in the limitative list, Article 6 and, where relevant, Article 9 of Regulation (EU) 2016/679 should be applied. It is the responsibility of the controller in the light of the principle of accountability to choose the appropriate legal basis for the intended processing. In order to be able to rely on legitimate interest under Article 6(1), point f, of Regulation (EU) 2016/679 as a ground for the further processing of personal data, the controller must show that it pursues the controller’s or third parties’ legitimate interest, the processing is necessary in order to achieve the purpose of that legitimate interest, and the interests or fundamental rights of the data subject do not override the interests pursued by the controller. In this context, controllers should take outmost account of the following elements: whether the data subject is a child; the reasonable expectations of data subject; the impact on the individual either because of the scale of data processed or the sensitivity of the data processed; the scale of the processing at issue in the sense that the processing cannot be particularly extensive either because of their amount or the range of categories of data; the processing should be based on data limited to what is necessary and cannot be based on monitoring of large parts of the online activity of the data subjects; and other relevant factors as appropriate. The processing should not give rise to the continuous monitoring of the data subject’s private life.