GDPR — Article 23

The article's text

Article 23
Restrictions 1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
(a) 
national security;
(b) 
defence;
(c) 
public security;
(d) 
the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
(e) 
other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;
(f) 
the protection of judicial independence and judicial proceedings;
(g) 
the prevention, investigation, detection and profull textsecution of breaches of ethics for regulated professions;
(h) 
a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred
to in points (a) to (e) and (g);
(i) 
the protection of the data subject or the rights and freedoms of others;
(j) 
the enforcement of civil law claims.
the protection of the data subject or the rights and freedoms of others;
(j) 
the enforcement of civil law claims.
2. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:
(a) 
the purposes of the processing or categories of processing;
(b) 
the categories of personal data;
(c) 
the scope of the restrictions introduced;
(d) 
the safeguards to prevent abuse or unlawful access or transfer;
(e) 
the specification of the controller or categories of controllers;
(f) 
the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;
(g) 
the risks to the rights and freedoms of data subjects; and
(h) 
the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.
CHAPTER IV
Controller and processor
Section 1
General obligations

Who wrote about this article in the consultations

Filers who named this exact article number in their own text. It is their sentence, not our reading — and not a causal claim.

NGO

business association

other

public authority

Who	Country	What they wrote
Bundesrechtsanwaltskammer	DE	lingness to pay. Access to justice and law enforcement in general therefore suffers. The GDPR does contain flexibility clauses in Article 23 (1) lit. e, i and j, which could be used to create a fair balance of interests at Member State level. ↗
Confederation of European Security Services (CoESS)	BE	The definition of necessary and proportionate restrictions of obligations resulting from GDPR to safeguard public security as per Art. 23.1.d, as well as the interpretation of data processing purposes, which are of “legitimate” or “substantial” public interest ↗
Observatorio Internacional de Derechos Humanos del Ilustre y Nacional Colegio de Abogados de México	ME	nicana (art. 80 de la Ley No 172-13, de 13 de diciembre de 2013, sobre Protecció n de Datos de Carác cter Personal). • Uruguay (art. 23 de la Ley N° 18.331 de Protecci ón de Datos Personales, Resolución N n N° 4/019, de 12 de marzo de 2019 y Resolución n ↗
5Rights Foundation	GB	2 on Dark patterns in social media platform interfaces: How to recognise and avoid them; Guidelines 10/2020 on restrictions under Article 23 GDPR; Guidelines 08/2020 on the targeting of social media users; Guidelines 4/2019 on Article 25 Data Protection by Des ↗
Verband Insolvenzverwalter und Sachwalter Deutschlands e.V.	DE	regard to the office holder’s capacities and the funds of the insolvency estate, a clarification in the sense of Art. 23 GDPR or guideline like the following should be suggested: With regard to their own data processing and data processing under their control ↗
Oplysningsforbundet May Day	DK	skyldes det, at der er behov for ensartet anvendelse og retssikkerhed i hele EU54. Overholder MitID gældende GDPR-lovgivning? Af artikel 23 i GDPR-forordningen fremgår det, at artiklerne 12-22, og 34, under visse forudsætninger, kan fraviges. ↗
Wirtschaftsprüferkammer K.d.ö.R	DE	Auskunftsanspruch missbräuchlich ausgeübt und das Zurückbehaltungsrecht umgangen werden kann. Artikel 23 Abs. 1 lit. e, i und j DSGVO enthält zwar Öffnungsklauseln, mit denen auf mitgliedstaatli- cher Ebene ein Interessensausgleich geschaffen werden könnte. Ei ↗
Hessischer Landtag	DE	on der Aufsichtsstruktur Hilfsweise würde die Möglichkeit bestehen, parlamentarische Tätigkeiten in die sog. Öffnungsklausel nach Art. 23 DSGVO einzufügen. Dieser Artikel sieht Ausnahmen aufgrund gesetzgeberischer Maßnahmen bzgl. bestimmter Pflichten, z.B. der ↗
Border Violence Monitoring Network	DE	quently, we submit that when designing the cooperation mechanism between DPAs on cross-border matters, a narrow interpretation of Article 23 be applied. ↗
noyb	AT	with this view, or otherwise request a determination by the Coordination Committee under Article 23 within two weeks. 3. The filing supervisory authority will forward the answer of the respondent to the complainant within one week, requesting a statement from ↗
Local Government Denmark	DK	ække- ligt tilgængelig måde at være understøttet i databeskyttelsesforordningens regler om viderebehandling (artikel 6, stk. 4 og artikel 23, stk, 1), der fordrer konkrete, individuelle vurderinger. KL vil opfordre til, at der ses på mulighe- derne for at ”tel ↗
—		(Art. 23.1(e)), “important grounds of public interest” (Art. 28.3(a)), “important reasons of public interest” (Art. 49.1(d)/49.5) and “reasons of substantial public interest” (Art. 9.2(g)). - Transfer of personal data aimed in Chapter V of the GDPR. It is real ↗
David Erdos	GB	ory standards may still indicate applicable tests for designating limitations where strictly necessary. In this regard, it is the article 23 ‘restrictions’ clause which is the most central, although strangely this is not acknowledged or even mentioned in GC et ↗

Source: public consultation submissions and position papers. n = 13 mentions; counted as a literal reference to the article number.

Ask about this article →