Referral C-585/26 (Trezor Company, 2 Jun 2026)

1. Does the transfer of personal data from a controller to a processor require a separate legal basis pursuant to Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, OJ 2016 L 119, p. 1; ‘the GDPR’)?
2. If the answer to Question 1 is in the negative:
Does consent to the receipt of a newsletter satisfy the requirement that it be ‘informed’ within the meaning of Article 4(11) of the GDPR, for the purposes of Article 6(1)(a) thereof, only if the data subject, before giving that consent, is aware that the controller intends to engage a processor, within the meaning of Article 4(8) of the GDPR, established in a third country for that processing operation (the sending of a newsletter)?