Skip to the text
Text as of 4 May 2016 · Consolidated version of 4 May 2016 · Same wording as today’s text.Today’s text

Article 23 — Restrictions

Consumer protectionLevel 1RegulationGDPRStage: AdoptedOfficial source

23(1)

1.Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

Copy link
23(1)(a)
(a)national security;
Copy link
23(1)(b)
(b)defence;
Copy link
23(1)(c)
(c)public security;
Copy link
23(1)(d)
(d)the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
Copy link
23(1)(e)
(e)other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;
Copy link
23(1)(f)
(f)the protection of judicial independence and judicial proceedings;
Copy link
23(1)(g)
(g)the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
Copy link
23(1)(h)
(h)a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);
Copy link
23(1)(i)
(i)the protection of the data subject or the rights and freedoms of others;
Copy link
23(1)(j)
(j)the enforcement of civil law claims.
Copy link
23(2)

2.In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:

Copy link
23(2)(a)
(a)the purposes of the processing or categories of processing;
Copy link
23(2)(b)
(b)the categories of personal data;
Copy link
23(2)(c)
(c)the scope of the restrictions introduced;
Copy link
23(2)(d)
(d)the safeguards to prevent abuse or unlawful access or transfer;
Copy link
23(2)(e)
(e)the specification of the controller or categories of controllers;
Copy link
23(2)(f)
(f)the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;
Copy link
23(2)(g)
(g)the risks to the rights and freedoms of data subjects; and
Copy link
23(2)(h)
(h)the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.
Copy link