Confidentiality Obligations and Requirements

Confidentiality Obligations and Requirements

Legal Framework

Confidentiality obligations in EU data protection law operate across multiple instruments. Article 39 GDPR imposes independence and confidentiality requirements on the Data Protection Officer (DPO), who must perform tasks without receiving instructions from the controller or processor and cannot be dismissed or penalized for how those tasks are carried out. The DPO must possess sufficient professional expertise in data protection law and practice, calibrated to the processing activities and the level of protection required for the data involved. Any additional duties held by the DPO must not create conflicts of interest — meaning senior management positions involving determination of processing purposes and means are incompatible with the DPO role.

Article 90 GDPR addresses professional secrecy obligations, while Article 84 of the Digital Services Act (DSA) imposes professional secrecy on the Commission, the Board, competent national authorities, and all persons working under their supervision, including auditors and experts appointed under Article 72(2) DSA. These provisions prevent disclosure of information obtained or exchanged under the respective regulations where that information falls within the scope of professional secrecy.

Under the AI Act, confidentiality requirements extend to the protection of personal and sensitive data used in AI system training, testing, and deployment, reinforcing the GDPR's confidentiality architecture.

Key Developments

The case law reveals a structured approach to confidentiality conflicts. In the Dutch bar association complaint proceedings, the dean refused data subject access requests by invoking the confidentiality obligation under Article 45a(2) of the Advocatenwet, illustrating how statutory secrecy duties can override GDPR access rights. The court confirmed that judicial review remains possible through Article 8:29 of the General Administrative Law Act (Awb), which allows a confidentiality chamber to restrict disclosure to the court alone — preserving both effective judicial control and secrecy obligations.

In the tax inspector case, the inspector successfully invoked Article 8:29 Awb to restrict access to address history records, grounding the request in both GDPR privacy rights and statutory confidentiality duties. The court accepted that disclosure would violate third parties' privacy and breach professional secrecy.

The company doctor case established that a functional privilege against testifying (functioneel verschoningsrecht) under Article 165(2)(b) of the Dutch Code of Civil Procedure applies to persons bound by professional secrecy. Notably, the employee's waiver of confidentiality did not automatically dissolve the privilege — the court retains discretion to assess whether grounds exist to uphold it, reflecting the broader public interest in maintaining professional secrecy.

The EDPS ruling against the European Parliament confirmed that transferring medical data to a third party — even another EU institution — constitutes an interference with Article 8 ECHR rights, requiring justification under the necessity test.

Practical Guidance

• Ensure DPO independence structurally: Document that the DPO receives no instructions regarding task performance and holds no conflicting roles; avoid assigning DPO duties to positions that determine processing purposes or means, as this violates Article 39 GDPR.

• Map statutory confidentiality duties against GDPR access rights: Where sectoral secrecy obligations (legal, medical, tax) conflict with data subject requests under Articles 15–17 GDPR, use procedural mechanisms such as Article 8:29 Awb or equivalent national tools to allow judicial review without breaching confidentiality.

• Implement confidentiality-by-design for AI systems: Training data, test outputs, and human review logs containing personal data must be subject to access controls and secrecy protocols that satisfy both GDPR Article 32 security requirements and AI Act confidentiality provisions.

• Train personnel on functional privilege boundaries: Staff bound by professional secrecy must understand that individual data subject consent does not automatically waive confidentiality obligations — courts retain discretion to uphold secrecy in the broader public interest.

• Restrict cross-institutional data transfers: Transferring sensitive personal data between entities requires a documented necessity assessment; mere institutional affiliation does not suffice to justify the interference with privacy rights.