CURIA - Documents
14 of 58
http://curia.europa.eu/juris/document/document_print.jsf?docid=2320...
‘1.
Union or Member State law to which the data controller or processor is subject may restrict
by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to
22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and
obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the
fundamental rights and freedoms and is a necessary and proportionate measure in a democratic
society to safeguard:
(a)
national security;
(b)
defence;
(c)
public security;
(d)
the prevention, investigation, detection or prosecution of criminal offences or the execution
of criminal penalties, including the safeguarding against and the prevention of threats to
public security;
(e)
other important objectives of general public interest of the Union or of a Member State, in
particular an important economic or financial interest of the Union or of a Member State,
including monetary, budgetary and taxation … matters, public health and social security;
(f)
the protection of judicial independence and judicial proceedings;
(g)
the prevention, investigation, detection and prosecution of breaches of ethics for regulated
professions;
(h)
a monitoring, inspection or regulatory function connected, even occasionally, to the exercise
of official authority in the cases referred to in points (a) to (e) and (g);
(i)
the protection of the data subject or the rights and freedoms of others;
(j)
the enforcement of civil law claims.
2.
In particular, any legislative measure referred to in paragraph 1 shall contain specific
provisions at least, where relevant, as to:
(a)
the purposes of the processing or categories of processing;
(b)
the categories of personal data;
(c)
the scope of the restrictions introduced;
(d)
the safeguards to prevent abuse or unlawful access or transfer;
(e)
the specification of the controller or categories of controllers;
(f)
the storage periods and the applicable safeguards taking into account the nature, scope and
purposes of the processing or categories of processing;
(g)
(h)
28
the risks to the rights and freedoms of data subjects; and
the right of data subjects to be informed about the restriction, unless that may be prejudicial
to the purpose of the restriction.’
Under Article 79(1) of that regulation:
‘Without prejudice to any available administrative or non-judicial remedy, including the right to
2/15/2021, 4:58 PM