Article 23
Restrictions
Chapter 3
|
Rights of Data Subjects
|
📖 5 min read
1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
(a) national security;
(b) defence;
(c) public security;
(d) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
(e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security;
(f) the protection of judicial independence and judicial proceedings;
(g) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
(h) a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);
(i) the protection of the data subject or the rights and freedoms of others;
(j) the enforcement of civil law claims.
2. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:
(a) the purposes of the processing or categories of processing;
(b) the categories of personal data;
(c) the scope of the restrictions introduced;
(d) the safeguards to prevent abuse or unlawful access or transfer;
(e) the specification of the controller or categories of controllers;
(f) the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;
(g) the risks to the rights and freedoms of data subjects; and
(h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.
Practical Application
Example 1 - National Security (Valid):
A Member State passes legislation allowing intelligence agencies to process personal data for national security without fulfilling Article 15 access requests when disclosure would compromise ongoing operations. The law specifies data categories, oversight mechanisms, storage limits, and delayed notification to subjects. This is a valid Article 23 restriction.
Example 2 - Tax Investigations (Valid):
Tax authority legislation restricts Article 15 access rights during active tax fraud investigations to prevent destruction of evidence. The law specifies that access can be deferred until investigation concludes, with notification afterward. Controllers must document reasons for each deferral.
Example 3 - Corporate Policy (Invalid):
A company policy states employees cannot exercise access rights regarding performance reviews. This is INVALID - restrictions must be by legislative measure, not company policy.
Example 4 - Criminal Investigation (Valid with Safeguards):
Legislation allows police to defer breach notifications (Article 34) when notification would compromise criminal investigations. The law requires: judicial oversight, maximum deferral period of 6 months, mandatory subsequent notification, and documentation of reasons.
Example 5 - Civil Claims (Valid):
Law restricts erasure rights (Article 17) for personal data needed to establish, exercise, or defend legal claims. Data can be retained until claim is resolved, even if otherwise subject to erasure.
Example 6 - Professional Ethics (Valid):
Legislation restricting access rights for lawyers under investigation for professional misconduct, to prevent interference with the investigation. Must include oversight by independent professional body.
What Article 23 Does NOT Allow:
- Blanket exemptions from all GDPR obligations
- Restrictions by executive orders or company policies
- Indefinite restrictions without safeguards
- Disproportionate limitations (e.g., denying all rights for minor public interest)
- Restrictions that eliminate the essence of fundamental rights
Implementation for Affected Organizations:
- Identify applicable restrictive legislation in your jurisdiction
- Document the legal basis for any restrictions applied
- Implement safeguards required by the legislation
- Train staff on when restrictions apply
- Maintain logs of restriction applications
- Inform data subjects when legally permissible
- Review restrictions periodically - lift when no longer necessary