Skip to content
GDPR Art. 23 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Restrictions

In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679
  1. 1.

    Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

    1. a)
      national security;
    2. b)
      defence;
    3. c)
      public security;
    4. d)
      the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
    5. e)
      other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;
    6. f)
      the protection of judicial independence and judicial proceedings;
    7. g)
      the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
    8. h)
      a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);
    9. i)
      the protection of the data subject or the rights and freedoms of others;
    10. j)
      the enforcement of civil law claims.
  2. 2.

    In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:

    1. a)
      the purposes of the processing or categories of processing;
    2. b)
      the categories of personal data;
    3. c)
      the scope of the restrictions introduced;
    4. d)
      the safeguards to prevent abuse or unlawful access or transfer;
    5. e)
      the specification of the controller or categories of controllers;
    6. f)
      the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;
    7. g)
      the risks to the rights and freedoms of data subjects; and
    8. h)
      the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

Enforcement

Cited in 13 fines totalling €8.2M

Top authority: 🇪🇺Spanish Data Protection Authority (aepd) (8) · median fine €8,000 · see all enforcement for Art. 23 →

Connections by provision

23(1) 38 Case Law 23 Guidance .md
Case Law 38
Judgment of the Court (Fifth Chamber) of 24 February 2022.#SIA 'SS' v Valsts ieņēmumu dienests.#Request for a preliminary ruling from the Administratīvā apgabaltiesa.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 2 – Scope – Article 4 – Concept of ‘processing’ – Article 5 – Principles relating to processing – Purpose limitation – Data minimisation – Article 6 – Lawfulness of processing – Proc Judgment of the Court (Fifth Chamber) of 17 June 2021.#Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA.#Request for a preliminary ruling from the Ondernemingsrechtbank Antwerpen.#Reference for a preliminary ruling – Intellectual property – Copyright and related rights – Directive 2001/29/EC – Article 3(1) and (2) – Concept of ‘making available to the public’ – Downloading of a file containing a protected work via a peer-to-peer network and the simultaneous GC - T-318/24 Tax data sharing from FIOD criminal probe to Tax Authority not GDPR erasure violation BVwG - W256 2227693-1 Judgment of the Court (Fourth Chamber) of 4 October 2024.#Maximilian Schrems v Meta Platforms Ireland Limited.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Online social networks – General terms of use relating to contracts concluded between a digital platform and a user – Personalised advertising – Article 5(1)(b) – Principle of purpos Judgment of the Court (First Chamber) of 7 December 2023.#UF and AB v Land Hessen.#Requests for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(a) – Principle of ‘lawfulness’ – Point (f) of the first subparagraph of Article 6(1) – Necessity of processing for the purposes of the legitimate interests pursued by the controller or by Judgment of the Court (Third Chamber) of 2 March 2023.#Norra Stockholm Bygg AB v Per Nycander AB.#Request for a preliminary ruling from the Högsta domstolen.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 6(3) and (4) – Lawfulness of processing – Production of a document containing personal data in civil court proceedings – Article 23(1)(f) and (j) – Protection of judicial independence and judicial proceedings – Enforcement of civil law clai +30 more
23(1)(a) 1 Case Law 1 Guidance .md
23(1)(d) 5 Case Law 1 Guidance .md
Case Law 5
Judgment of the Court (First Chamber) of 10 December 2020.#Land Nordrhein-Westfalen v D.-H. T. as liquidator of J & S Service UG.#Request for a preliminary ruling from the Bundesverwaltungsgericht.#Reference for a preliminary ruling – Personal data – Regulation (EU) 2016/679 – Article 23 – Restrictions to the data subject’s rights – Significant financial interest – Enforcement of civil law claims – National legislation referring to the provisions of EU law – Tax data concerning a legal person – Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶68 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶9 Judgment of the Court (First Chamber) of 10 December 2020.#Land Nordrhein-Westfalen v D.-H. T. as liquidator of J & S Service UG.#Request for a preliminary ruling from the Bundesverwaltungsgericht.#Reference for a preliminary ruling – Personal data – Regulation (EU) 2016/679 – Article 23 – Restrictions to the data subject’s rights – Significant financial interest – Enforcement of civil law claims – National legislation referring to the provisions of EU law – Tax data concerning a legal person – ¶37 Judgment of the Court (First Chamber) of 10 December 2020.#Land Nordrhein-Westfalen v D.-H. T. as liquidator of J & S Service UG.#Request for a preliminary ruling from the Bundesverwaltungsgericht.#Reference for a preliminary ruling – Personal data – Regulation (EU) 2016/679 – Article 23 – Restrictions to the data subject’s rights – Significant financial interest – Enforcement of civil law claims – National legislation referring to the provisions of EU law – Tax data concerning a legal person –
23(1)(e) 14 Case Law 1 Guidance .md
Case Law 14
Tax data sharing from FIOD criminal probe to Tax Authority not GDPR erasure violation Judgment of the Court (Fifth Chamber) of 24 February 2022.#SIA 'SS' v Valsts ieņēmumu dienests.#Request for a preliminary ruling from the Administratīvā apgabaltiesa.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 2 – Scope – Article 4 – Concept of ‘processing’ – Article 5 – Principles relating to processing – Purpose limitation – Data minimisation – Article 6 – Lawfulness of processing – Proc Judgment of the Court (Grand Chamber) of 6 October 2020.#État luxembourgeois v B and Others.#Requests for a preliminary ruling from the Cour administrative (Luxembourg).#References for a preliminary ruling – Directive 2011/16/EU – Administrative cooperation in the field of taxation – Articles 1 and 5 – Decision ordering that information be provided to the competent authority of a Member State, acting in response to a request for exchange of information from the competent authority of another Mem VG München - M 26a K 25.5210 Peter Nowak v Data Protection Commissioner CJEU - C-247/23 - Deldits Judgment of the Court (First Chamber) of 10 December 2020.#Land Nordrhein-Westfalen v D.-H. T. as liquidator of J & S Service UG.#Request for a preliminary ruling from the Bundesverwaltungsgericht.#Reference for a preliminary ruling – Personal data – Regulation (EU) 2016/679 – Article 23 – Restrictions to the data subject’s rights – Significant financial interest – Enforcement of civil law claims – National legislation referring to the provisions of EU law – Tax data concerning a legal person – ¶11 Judgment of the Court (Fifth Chamber) of 24 February 2022.#SIA 'SS' v Valsts ieņēmumu dienests.#Request for a preliminary ruling from the Administratīvā apgabaltiesa.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 2 – Scope – Article 4 – Concept of ‘processing’ – Article 5 – Principles relating to processing – Purpose limitation – Data minimisation – Article 6 – Lawfulness of processing – Proc +6 more
23(1)(f) 5 Case Law 1 Guidance .md
Case Law 5
Judgment of the Court (Third Chamber) of 2 March 2023.#Norra Stockholm Bygg AB v Per Nycander AB.#Request for a preliminary ruling from the Högsta domstolen.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 6(3) and (4) – Lawfulness of processing – Production of a document containing personal data in civil court proceedings – Article 23(1)(f) and (j) – Protection of judicial independence and judicial proceedings – Enforcement of civil law clai BGH: Court must grant unredacted file access in compulsory auctions under Art. 6(1)(e) ¶38 Judgment of the Court (Third Chamber) of 2 March 2023.#Norra Stockholm Bygg AB v Per Nycander AB.#Request for a preliminary ruling from the Högsta domstolen.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 6(3) and (4) – Lawfulness of processing – Production of a document containing personal data in civil court proceedings – Article 23(1)(f) and (j) – Protection of judicial independence and judicial proceedings – Enforcement of civil law clai ¶39 Judgment of the Court (Third Chamber) of 2 March 2023.#Norra Stockholm Bygg AB v Per Nycander AB.#Request for a preliminary ruling from the Högsta domstolen.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 6(3) and (4) – Lawfulness of processing – Production of a document containing personal data in civil court proceedings – Article 23(1)(f) and (j) – Protection of judicial independence and judicial proceedings – Enforcement of civil law clai ¶45 Judgment of the Court (Third Chamber) of 2 March 2023.#Norra Stockholm Bygg AB v Per Nycander AB.#Request for a preliminary ruling from the Högsta domstolen.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 6(3) and (4) – Lawfulness of processing – Production of a document containing personal data in civil court proceedings – Article 23(1)(f) and (j) – Protection of judicial independence and judicial proceedings – Enforcement of civil law clai
23(1)(g) 1 Guidance .md
23(1)(i) 5 Case Law 1 Guidance .md
23(1)(j) 12 Case Law 1 Guidance .md
Case Law 12
BGH: Court must grant unredacted file access in compulsory auctions under Art. 6(1)(e) Judgment of the Court (Fifth Chamber) of 17 June 2021.#Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA.#Request for a preliminary ruling from the Ondernemingsrechtbank Antwerpen.#Reference for a preliminary ruling – Intellectual property – Copyright and related rights – Directive 2001/29/EC – Article 3(1) and (2) – Concept of ‘making available to the public’ – Downloading of a file containing a protected work via a peer-to-peer network and the simultaneous Judgment of the Court (Third Chamber) of 2 March 2023.#Norra Stockholm Bygg AB v Per Nycander AB.#Request for a preliminary ruling from the Högsta domstolen.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 6(3) and (4) – Lawfulness of processing – Production of a document containing personal data in civil court proceedings – Article 23(1)(f) and (j) – Protection of judicial independence and judicial proceedings – Enforcement of civil law clai Judgment of the Court (First Chamber) of 10 December 2020.#Land Nordrhein-Westfalen v D.-H. T. as liquidator of J & S Service UG.#Request for a preliminary ruling from the Bundesverwaltungsgericht.#Reference for a preliminary ruling – Personal data – Regulation (EU) 2016/679 – Article 23 – Restrictions to the data subject’s rights – Significant financial interest – Enforcement of civil law claims – National legislation referring to the provisions of EU law – Tax data concerning a legal person – ¶10 Judgment of the Court (First Chamber) of 10 December 2020.#Land Nordrhein-Westfalen v D.-H. T. as liquidator of J & S Service UG.#Request for a preliminary ruling from the Bundesverwaltungsgericht.#Reference for a preliminary ruling – Personal data – Regulation (EU) 2016/679 – Article 23 – Restrictions to the data subject’s rights – Significant financial interest – Enforcement of civil law claims – National legislation referring to the provisions of EU law – Tax data concerning a legal person – ¶117 Judgment of the Court (Fifth Chamber) of 17 June 2021.#Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA.#Request for a preliminary ruling from the Ondernemingsrechtbank Antwerpen.#Reference for a preliminary ruling – Intellectual property – Copyright and related rights – Directive 2001/29/EC – Article 3(1) and (2) – Concept of ‘making available to the public’ – Downloading of a file containing a protected work via a peer-to-peer network and the simultaneous ¶38 Judgment of the Court (Third Chamber) of 2 March 2023.#Norra Stockholm Bygg AB v Per Nycander AB.#Request for a preliminary ruling from the Högsta domstolen.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 6(3) and (4) – Lawfulness of processing – Production of a document containing personal data in civil court proceedings – Article 23(1)(f) and (j) – Protection of judicial independence and judicial proceedings – Enforcement of civil law clai ¶38 Judgment of the Court (First Chamber) of 10 December 2020.#Land Nordrhein-Westfalen v D.-H. T. as liquidator of J & S Service UG.#Request for a preliminary ruling from the Bundesverwaltungsgericht.#Reference for a preliminary ruling – Personal data – Regulation (EU) 2016/679 – Article 23 – Restrictions to the data subject’s rights – Significant financial interest – Enforcement of civil law claims – National legislation referring to the provisions of EU law – Tax data concerning a legal person – +4 more
23(2) 8 Case Law 5 Guidance .md
Case Law 8
Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers VG München - M 26a K 25.5210 Judgment of the Court (Grand Chamber), 8 April 2014.#European Commission v Hungary.#Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — Independence — National legislation prematurely bringing to an end the term served by the supervisory authority — Creation of a new supervisory authority and appointment of another per PHR - 22/01253 ¶8 Judgment of the Court (Sixth Chamber) of 18 November 1999.#Commission of the European Communities v Council of the European Union.#Regulation (EC) nº 515/97 - Legal basis - Article 235 of the EC Treaty (now Article 308 EC) or Article 100a of the EC Treaty (now, after amendment, Article 95 EC).#Case C-209/97. ¶74 Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers ¶57 Judgment of the Court (Grand Chamber), 8 April 2014.#European Commission v Hungary.#Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — Independence — National legislation prematurely bringing to an end the term served by the supervisory authority — Creation of a new supervisory authority and appointment of another per ¶9 Judgment of the Court (Sixth Chamber) of 18 November 1999.#Commission of the European Communities v Council of the European Union.#Regulation (EC) nº 515/97 - Legal basis - Article 235 of the EC Treaty (now Article 308 EC) or Article 100a of the EC Treaty (now, after amendment, Article 95 EC).#Case C-209/97.
23(2)(a) 2 Guidance .md
23(2)(b) 1 Guidance .md
23(2)(c) 1 Guidance .md
23(2)(d) 1 Guidance .md
23(2)(e) 1 Guidance .md
23(2)(f) 1 Guidance .md
23(2)(g) 13 Case Law 1 Guidance .md
Case Law 13
Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers ¶85 Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers ¶82 Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers ¶75 Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers ¶72 Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers ¶69 Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers ¶66 Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers ¶65 Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers +5 more
23(2)(h) 3 Case Law 1 Guidance .md
Case Law 3
Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers ¶66 Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers ¶31 Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers