The conceptualization of data control as the right for data subjects to control data processing-incurred risks to the autonomous exercise of their fundamental rights and freedoms, heavily relies on the notion of ‘purpose‘ as a means to understand and circumvent such risks. Consensually described in the legal literature as a (or even the ) cornerstone of data protection, this notion had been little addressed head on by the Court until recently. In its recent case law, the Court has addressed both the constitutive criteria of purpose and the functions of purpose as per the GDPR. At this point, it is therefore necessary to evaluate how this case law impacts on the conceptualization of data control and especially whether it calls for a re-examination of the above findings. I conduct this analysis against the background of data commodification.

First, I recapitulate how ‘purpose‘ plays out in the GDPR namely, by general opinion, as a (if not squarely the) cornerstone of it, before I turn to the recent case law of the Court, which deals with ‘purpose‘ in two distinct ways. A first line of inquiry is the new strand of the case law of the Court that, first arising in the context of controllership, amounts to a shift in focus from purpose to data processing operations. The second line of inquiry is the case law on the constitutive criteria for the notion of purpose, to determine such purposes that the GDPR deems acceptable.