Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

Statistics

In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗

Version history 2

2016-05-04in force CELEX 02016R0679-20160504
2016-04-27 CELEX 32016R0679

1.

Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.¶

Statistics Pseudonymization Retention Period 97
2.

Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.¶

Statistics Personal Data 14
3.

Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.¶

Personal Data 2
4.

Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs.¶

Connections by provision

89(1) 37 Case Law 8 Enforcement 51 Guidance 1 Literature .md

Case Law 37

RW v Österreichische Post AG Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums UZ v Bundesrepublik Deutschland Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) Nemzeti Adatvédelmi és Információszabadság Hatóság v UC État belge v Autorité de protection des données Amt der Tiroler Landesregierung v Datenschutzbehörde BVwG - W137 2334047-1 +29 more

Enforcement 8

AEPD (Spain) - EXP202102529 Finnish DPA finds 12-year retention of rental applicant data violates minimisation NAIH (Hungary) - NAIH-450-7-2026 AEPD admits claim against Securitas Direct for failure to handle access and erasure ¶4 AEPD (Spain) - EXP202102529 ¶0 Finnish DPA finds 12-year retention of rental applicant data violates minimisation ¶60 NAIH (Hungary) - NAIH-450-7-2026 ¶3 AEPD admits claim against Securitas Direct for failure to handle access and erasure

Guidance 51

EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1) EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( Guidelines 05/2020 on consent under Regulation 2016/679 Study on the secondary use of personal data in the context of scientific research Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria +43 more

Literature 1

If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation

89(2) 2 Case Law 11 Guidance 1 Literature .md

Case Law 2

National court annuls DPA sanction against KFC Spain over website privacy information ¶85 National court annuls DPA sanction against KFC Spain over website privacy information

Guidance 11

Coordinated Enforcement Action, Statement 1/2023 on the first review of the functioning of the adequacy decision for Japan Guidelines 01/2022 on data subject rights - Right of access Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak ¶35 Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak ¶9 Statement 1/2023 on the first review of the functioning of the adequacy decision for Japan ¶36 Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak ¶3 Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak +3 more

Literature 1

If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation

89(3) 2 Guidance .md

Guidance 2

Guidelines 01/2022 on data subject rights - Right of access ¶171 Guidelines 01/2022 on data subject rights - Right of access

Related across sources

C-77/21 Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság In this preliminary ruling, the CJEU interpreted Articles 5(1)(b) and 5(1)(e) GDPR in proceedings between Digi Távközlési és Szolgáltató Kft. and the Hungarian National Authority… First Chamber Oct 20, 2022 Retention Period Storage Limitation Personal Data

C-175/20 SIA 'SS' v Valsts ieņēmumu dienests In Case C-175/20, the Court of Justice of the EU interpreted GDPR Articles 5 and 6 in response to a preliminary ruling from the Latvian Regional Administrative Court concerning a… Fifth Chamber Feb 24, 2022 Retention Period Personal Data Legitimate Interest

HvJ EU 9 januari 2025, C‑394/23 (Mousse) Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20… HvJ EU 9 januari 2025, C‑394/23 (Mousse). Jan 9, 2025 IP Address Retention Period Identification

C-654/23 Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) Het Hof van Justitie van de EU (Eerste Kamer) beantwoordt een prejudiciële vraag over de uitleg van artikel 13 van Richtlijn 2002/58/EC (ePrivacy) en de verhouding tot de GDPR,… Mar 27, 2025 Telecommunications Personal Data Marketing

C-169/23 Nemzeti Adatvédelmi és Információszabadság Hatóság v UC In Case C-169/23, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Kúria (Hungary) concerning whether the Budapest Metropolitan… Third Chamber Nov 28, 2024 Personal Data Legitimate Interest Supervision

C-439/19 Latvijas Republikas Saeima (Penalty points) C-439/19 - Latvijas Republikas Saeima (Penalty points) An individual lodged a constitutional complaint reference on the national Law on Road Traffic is consistent with the fundamental right to respect for private life. The… Jun 22, 2021 Personal Data Identification Statistics