GDPR has set forth ample rights which a data subject can avail of. However, these rights are not absolute and to avoid the misuse of these rights the Regulation also sets forth certain restrictions that can be imposed on the rights.
The restrictions that are valid as per the GDPR are as follows:
- Union or Member State law may introduce legislation that restricts the rights set forth in Articles 12-22, Article 34 and Article 5 provided the restriction does not infringe upon the fundamental rights and freedoms of the data subject. An important point to consider is that the restriction must be enforced in order to safeguard the following:
- “national security;
- defence;
- public security;
- the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
- other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;
- the protection of judicial independence and judicial proceedings;
- the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
- a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);
- the protection of the data subject or the rights and freedoms of others;
- the enforcement of civil law claims.”
2.The legislative measures mentioned above must contain specific provisions such as:
- “the purposes of the processing or categories of processing;
- the categories of personal data;
- the scope of the restrictions introduced;
- the safeguards to prevent abuse or unlawful access or transfer;
- the specification of the controller or categories of controllers;
- the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;
- the risks to the rights and freedoms of data subjects; and
- the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.”
Article 23 in the GDPR can act as a boon and a bane to the society. On the one hand, the GDPR is offering rights that can empower the individual but at the same time snatching away those rights by giving the power to the Union or Member State to enforce such laws. An example of misuse of this Article would be Hungary. During the coronavirus pandemic, the Government suspended all the GDPR rights. This has evoked outrage by privacy advocates stating since bringing in restrictions does not comply with the provisions as stated in point 1.
It shall be seen how this article is interpreted and till what extent the nations implement the restrictions on the data subjects.