FACTS: All the parties have agreed on mutual roles and responsibilities. However, before the project launch, Sunny Soft Drinks, Crunchy Crackers, and Chewy Cheese want to create a joint website, www.bocadillo.es, so that they can collect all their personal data in one place and, at the same time, expand the amount of personal data they collect. One new feature of the joint website, in particular, uses customers' personal data to curate recipes for them that use the companies' products as recipe ingredients.

They are planning to collect the personal data of their customers (i.e., individuals who order their products or use services on their website, such as recipes). They are evaluating on which legal bases they can collect the following personal data:

• customers' delivery address, credit card details, and contact information for the purpose of selling and delivering products purchased on the website
• customer data that is gathered for the website's recipe feature:
  • gender, date of birth, allergy information, and health conditions (such as high cholesterol or high blood sugar levels) of each customer using the recipe function (e.g., by requiring registration in order to gain access) for the purpose of providing the most suitable recipes to customersand to avoid serious health issues. For example, to recommend sweeter cocktails to female-identifying customers; to offer low-sugar cocktails to people who may have diabetes, or to avoid offering crackers handled at a facility that processes nuts to people with nut allergies.
  • information about customer engagement (e.g., how long each customer spends looking at a specific recipe, whether they print it out or share via the website's sharing function, and the reviews they provide about the company) for the purpose of improving the quality of existing recipes and developing new ones.

QUESTIONS:

Using the information gained from the readings and the insights page content, draft a memorandum explaining:

1. on which legal basis in accordance with Article 6 GDPR companies may legally rely to process each type of personal data collected for each specific purpose (you may group types of personal data/purposes if the same rule applies to them)

2.For each legal basis, conduct the legal assessment necessary to demonstrate the appropriateness of the legal basis of your choice under the GDPR.

3. Indicate situations in which the company must comply with conditions of paragraph 2 of Article 9 GDPR in addition to legal bases under Article 6 GDPR.