2. Article 13.1 Exemptions and Restrictions
1. Member States may adopt legislative measures to restrict the
scope of the obligations and rights provided for in Articles 6(1), 10,
11(1), 12 and 21 when such a restriction constitutes a necessary
measure to safeguard:
(a) national security;
(b) defence;
(c) public security;
(d) the prevention, investigation, detection and prosecution of
criminal offences, or of breaches of ethics for regulated professions;
3. Article 13.1 Exemptions and Restrictions
(e) an important economic or financial interest of a Member State
or of the European Union, including monetary, budgetary and
taxation matters;
(f) a monitoring, inspection or regulatory function connected, even
occasionally, with the exercise of official authority in cases referred
to in (c), (d) and (e);
(g) the protection of the data subject or of the rights and freedoms
of others.
4. Example: LOI INFORMATIQUE ET LIBERTES
CHAPTER IV SECTION 2: AUTHORISATION
Article 26(I. 1°&2°)
I. – An order of the competent Minister or Ministers shall authorise,
after a reasoned and published opinion of the CNIL , the processing
of personal data carried out on behalf of the State and:
1° which involves State security, defence or public safety; or
2° whose purpose is the prevention, investigation, or proof of
criminal offences, the prosecution of offenders or the execution of
criminal sentences or security measures.
5. Example: LOI INFORMATIQUE ET LIBERTES
CHAPTER V SECTION 1: OBLIGATIONS INCUMBENT UPON DATA
CONTROLLERS
Article 32(I & III ) EU Article 10 & 11
Article 32(V) – The provisions of Section I shall not apply to data
obtained under the conditions provided for in Section III when
processing is carried out on behalf of the State and relating to State
security, defence, or public safety, to the extent that such limitation
is necessary for the observance of the purposes pursued by the
processing.
6. Example: LOI INFORMATIQUE ET LIBERTES
CHAPTER V SECTION 2: RIGHTS OF INDIVIDUALS IN RESPECT TO THE
PROCESSING OF PERSONAL DATA
Article 41 As a derogation from Articles 39 (right of access) and 40
(right of rectification), where processing involves State security, defence
or public safety, the right of access shall be exercised in accordance with
the conditions provided for by this Article in respect of all the
information contained in that processing.
request → investigation and modification → verification
with the agreement of the data controller, that the disclosure of the
data does not undermine its purposes, State security, the defence or
public safety, these data may be disclosed to the applicant.
7. Example: LOI INFORMATIQUE ET LIBERTES
CHAPTER VI: SUPERVISION OF THE IMPLEMENTATION OF DATA
PROCESSING
Article 44(IV) EU Article 21 Publicizing of processing
operations
IV. – For processing operations that affect State security and that is
exempted from the publication of the regulatory ruling that
authorises it by virtue of Section III of Article 26, the decree taken
upon a prior opinion of the “Conseil d’Etat” which provides for such
exemption may also stipulate that the processing shall not be subject
to the provisions of this Article.
8. Article 13.2 Exemptions and Restrictions
Data are processed
Purpose of scientific research
Keep in personal form for
a period for the sole
purpose of creating
statistics
Member states may
restrict the data
subjects’ rights of
access of data if
Subject to adequate legal safeguards, in particular that the data are not used for taking
measures or decisions regarding any particular individual, Member States may, where
there is clearly no risk of breaching the privacy of the data subject, restrict by a
legislative measure the rights provided for in Article 12 when data are processed solely
for purposes of scientific research or are kept in personal form for a period which does
not exceed the period necessary for the sole purpose of creating statistics.
9. Example: LOI INFORMATIQUE ET LIBERTES
As regards to Article 13(2), the Loi Informatique et Libertes gives
specific exemptions on the data subject’s right of access in Article
6(I.2°), 32(III), 36, and 39(II), to make sure the accuracy and purity
of historical and scientific researches.
10. Some Improvements to 13.2
The exemption is broad because it does not enumerate the types
of “research purposes” to which it applies
Member States should create clear and strict limits on the ability to
use research data.
Members states should define or provide guidelines for
determining what constitutes “adequate safeguards” and “measures
or decisions”
