gdpr legal-terms
What does &quot;necessary&quot; mean with regards GDPR and cookie consent
<p>The GDPR makes use of the word &quot;necessary&quot;. For example <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">article 6. Lawfulness of processing 1. (f)</a> says &quot;processing is necessary for the purposes of the legitimate interests pursued by the controller&quot;.  This is frequently used for cookie consent (including by stack exchange) to have a minimum set of cookies that one cannot refuse.</p>
<p><a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/" rel="nofollow noreferrer">The ICO defines necessary as</a>:</p>
<blockquote>
<p>When is processing 'necessary'?</p>
<p>Many of the lawful bases for processing depend on the processing being “necessary”. This does not mean that processing has to be absolutely essential. However, it must be more than just useful, and more than just standard practice. It must be a targeted and proportionate way of achieving a specific purpose. The lawful basis will not apply if you can reasonably achieve the purpose by some other less intrusive means, or by processing less data.</p>
<p>It is not enough to argue that processing is necessary because you have chosen to operate your business in a particular way. The question is whether the processing is objectively necessary for the stated purpose, not whether it is a necessary part of your chosen methods.</p>
</blockquote>
<p>In logic discussions, and I think common english, necessary is synonymous with essential in that A is a necessary/essential condition for B if B cannot occur without A.  While the paragraph above indicates that there is a legal difference between these two terms, it does say what this difference is.</p>
<p>In the case of cookies it is quite easy to objectively define a minimum for how much influence they have the functionality of a site.  I could for example, crawl this site twice, once while respecting cookies and once while not returning any cookies provided (I could even repeat this for individual cookies).  It would be correct to say that cookies are not <strong>essential</strong> for any functionality that is returned by both crawls.  From a logic point of view <strong>necessary</strong> would be synonymous with <strong>essential</strong> in that statement.  What does necessary mean in this context from a legal point of view?</p>

<p>Reality is complex and nuanced, so it doesn't make sense to interpret words in the same strict sense as they would be used in formal logic.</p>
<p>GDPR legal bases relate to processing purposes, i.e. goals that shall be achieved via the processing of personal data. The GDPR has principles such as <em>data protection by design and by default</em> and <em>data minimization</em>. These principles tell us that we should only process the minimum data necessary to achieve the purpose, and should use the most privacy-friendly means to do so. The use of the word “necessary” in Art 6(1) GDPR is an expression of these principles, and restricts which means we can use towards these purposes.</p>
<p>The word “necessary” was at the heart of the Munich “Google Fonts” case. A website operator claimed that they had a legitimate interest for embedding fonts from a third party server (Google) on their website. The court did not even consider whether that legitimate interest was valid. Because even if it was valid, there would be the question whether embedding fonts from a third party server was necessary to achieve those interests. The court found that this was not necessary, as there would be more privacy-friendly means to achieve the same interest, namely self-hosting the fonts.</p>
<p>The word “necessary” also appears in the context of the ePrivacy Directive, which regulates the use of client-side storage such as cookies. The default is that accessing or storing information on a client-side device requires GDPR-consent. However, there is an exception, in case that access or storage is strictly necessary to provide a service that was explicitly requested by the user. Here, the words such as “strictly”, “necessary”, and “explicitly” all help to show that this exception must be interpreted fairly narrowly. The main point of debate in this context is then which services were “requested”, i.e. which services of an app or website are core parts of the offering, and which are optional. This becomes tricky in particular when such client-side storage is strictly necessary for providing the service in a safe and scaleable manner (e.g. cookies for load balancing, bot detection, rate limiting), even though the service could technically work without them. It is thus not always possible to draw a bright line, though regulatory guidance has made some aspects perfectly clear. For example, ads are never strictly necessary for providing a service in the sense of the ePrivacy Directive, even though they might be necessary for a website's business model. Whether cookies are necessary must always be considered from the perspective of the user.</p>
<p>A note on word choice in EU law:
Drafting EU laws is a linguistically challenging process because the law must be translated into all member state's languages, and all of these versions are the authoritative document. Thus, they must express the <em>exact</em> same meaning. It is more preferable that the different versions are aligned in word choice and sentence structure, than making sure that the English version has elegant prose. Also, laws tend to use a formal and neutral linguistic register.</p>
<p>Words like “necessary” or “required” are useful here, given their plain meaning with few distracting connotations. Also, “necessary” has exactly equivalent words in Romance languages.</p>
<p>The word “essential” is more complicated. It is more difficult to find exact equivalents in other languages. It has potentially distracting metaphysical and biochemical connotations. While it is also used in formal writing, it has a more argumentative tone there, similar to “imperative”. For example, a business memo might use emotive language like “It is essential that we achieve our KPIs for this quarter”, where the word carries more emphasis than the more neutral “necessary”. That linguistic register would be inappropriate for laws.</p>
<p>The GDPR and ePrivacy directive do use the word “essential”, but the GDPR only uses it in the recitals (which <em>argue</em> why the law is necessary), and the ePrivacy Directive uses it in the sense of “relating to core aspects”. The GDPR also uses the word “essence” in three articles, where it is used in the “central aspects” sense. For example Art 23 GDPR contains both relevant words which perhaps highlights their not-quite-interchangeability:</p>
<blockquote>
<p>Union or Member State law […] may restrict [data subject rights], when such a restriction respects the <strong>essence</strong> of the fundamental rights and freedoms and is a <strong>necessary</strong> and proportionate measure in a democratic society […]</p>
</blockquote>
<p>Of course, the phrase “necessary in a democratic society” is borrowed from the ECHR and has <em>substantial</em> amounts of case law around it.</p>

<p><sup>Since the meaning given to the word &quot;necessary&quot; seems apparent in the material you quoted, I first thought you might be looking for examples, but you have criticized amon's answer for merely providing examples. So, I now understand you to be asking a question that appears to be actually answered in the material you quoted.</sup></p>
<p>You quote:</p>
<blockquote>
<p>Many of the lawful bases for processing depend on the processing being “necessary”. This does not mean that processing has to be absolutely essential. However, it must be more than just useful, and more than just standard practice. It must be a targeted and proportionate way of achieving a specific purpose. The lawful basis will not apply if you can reasonably achieve the purpose by some other less intrusive means, or by processing less data.</p>
</blockquote>
<ul>
<li>This makes it clear that &quot;necessary&quot; <em>does not</em> mean &quot;essential&quot; in this context.</li>
<li>Necessary falls somewhere between &quot;just useful&quot;/&quot;standard practice&quot; and &quot;essential&quot;.</li>
<li>For a use to be &quot;necessary&quot; it must have a specific purpose and be a &quot;targetted and proportionate way&quot; of achieving that purpose.</li>
<li>If that purpose was &quot;reasonably&quot; achievable by &quot;less intrusive means&quot; then the use of the cookie would not be considered necessary.</li>
</ul>
<p>I agree with amon that the latter concepts (of proportionality, targetting, consideration of less intrusive means) are borrowed from international human rights norms and there is a large body of jurisprudence applying this kind of balancing.</p>

<h2><a href="https://www.gdprsummary.com/necessary-under-the-gdpr/" rel="nofollow noreferrer">Necessary</a> is legally broader than essential</h2>
<p>Something is essential if the process will simply not work without it; something is necessary if, without it, the process becomes inefficient, uncommercial or overly complex.</p>
<p>So, for example, it is necessary for an online sales of physical products to collect your address (personal information) in order to deliver the goods to you. It is not essential because they could instead have a huge network of collection centres where customers could collect the goods - just like a bricks and mortar retailer. Both that is inefficient, uncommercial and overly complex.</p>
<p>While it’s necessary to have the address for the delivery it’s not necessary to keep it indefinitely. Once the delivery has been made and for a reasonable period after that to allow to correct delivery errors, the address should be deleted unless consent has been given to keep it for the next delivery.</p>
