Bodobalazs: 1 revision imported: GDPRHUB import 2023 04 18

2023-04-18T15:01:43Z

1 revision imported: GDPRHUB import 2023 04 18

New page

{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
![[Article 88 GDPR|←]] Article 89 - Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes [[Article 90 GDPR|→]]
|-
|style="padding: 20px; background-color:#003399;"|[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
|-
|

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 1 GDPR|Article 1: Subject-matter and objectives]]<br />
[[Article 2 GDPR|Article 2: Material scope]]<br />
[[Article 3 GDPR|Article 3: Territorial scope]]<br />
[[Article 4 GDPR|Article 4: Definitions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
<div class="mw-collapsible-content">
<small>
[[Article 5 GDPR|Article 5: Principles relating to processing of personal data]]<br />
[[Article 6 GDPR|Article 6: Lawfulness of processing]]<br />
[[Article 7 GDPR|Article 7: Conditions for consent]]<br />
[[Article 8 GDPR|Article 8: Conditions applicable to child’s consent in relation to information society services]]<br />
[[Article 9 GDPR|Article 9: Processing of special categories of personal data]]<br />
[[Article 10 GDPR|Article 10: Processing of personal data relating to criminal convictions and offences]]<br />
[[Article 11 GDPR|Article 11: Processing which does not require identification]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
<div class="mw-collapsible-content">
<small>
[[Article 12 GDPR|Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject]]<br />
[[Article 13 GDPR|Article 13: Information to be provided where personal data are collected from the data subject]]<br />
[[Article 14 GDPR|Article 14: Information to be provided where personal data have not been obtained from the data subject]]<br />
[[Article 15 GDPR|Article 15: Right of access by the data subject]]<br />
[[Article 16 GDPR|Article 16: Right to rectification]]<br />
[[Article 17 GDPR|Article 17: Right to erasure (‘right to be forgotten’)]]<br />
[[Article 18 GDPR|Article 18: Right to restriction of processing]]<br />
[[Article 19 GDPR|Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing]]<br />
[[Article 20 GDPR|Article 20: Right to data portability]]<br />
[[Article 21 GDPR|Article 21: Right to object]]<br />
[[Article 22 GDPR|Article 22: Automated individual decision-making, including profiling]]<br />
[[Article 23 GDPR|Article 23: Restrictions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
<div class="mw-collapsible-content">
<small>
[[Article 24 GDPR|Article 24: Responsibility of the controller]]<br />
[[Article 25 GDPR|Article 25: Data protection by design and by default]]<br />
[[Article 26 GDPR|Article 26: Joint controllers]]<br />
[[Article 27 GDPR|Article 27: Representatives of controllers or processors not established in the Union]]<br />
[[Article 28 GDPR|Article 28: Processor]]<br />
[[Article 29 GDPR|Article 29: Processing under the authority of the controller or processor]]<br />
[[Article 30 GDPR|Article 30: Records of processing activities]]<br />
[[Article 31 GDPR|Article 31: Cooperation with the supervisory authority]]<br />
[[Article 32 GDPR|Article 32: Security of processing]]<br />
[[Article 33 GDPR|Article 33: Notification of a personal data breach to the supervisory authority]]<br />
[[Article 34 GDPR|Article 34: Communication of a personal data breach to the data subject]]<br />
[[Article 35 GDPR|Article 35: Data protection impact assessment]]<br />
[[Article 36 GDPR|Article 36: Prior consultation]]<br />
[[Article 37 GDPR|Article 37: Designation of the data protection officer]]<br />
[[Article 38 GDPR|Article 38: Position of the data protection officer]]<br />
[[Article 39 GDPR|Article 39: Tasks of the data protection officer]]<br />
[[Article 40 GDPR|Article 40: Codes of conduct]]<br />
[[Article 41 GDPR|Article 41: Monitoring of approved codes of conduct]]<br />
[[Article 42 GDPR|Article 42: Certification]]<br />
[[Article 43 GDPR|Article 43: Certification bodies]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
<div class="mw-collapsible-content">
<small>
[[Article 44 GDPR|Article 44: General principle for transfers]]<br />
[[Article 45 GDPR|Article 45: Transfers on the basis of an adequacy decision]]<br />
[[Article 46 GDPR|Article 46: Transfers subject to appropriate safeguards]]<br />
[[Article 47 GDPR|Article 47: Binding corporate rules]]<br />
[[Article 48 GDPR|Article 48: Transfers or disclosures not authorised by Union law]]<br />
[[Article 49 GDPR|Article 49: Derogations for specific situations]]<br />
[[Article 50 GDPR|Article 50: International cooperation for the protection of personal data]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
<div class="mw-collapsible-content">
<small>
[[Article 51 GDPR|Article 51: Supervisory authority]]<br />
[[Article 52 GDPR|Article 52: Independence]]<br />
[[Article 53 GDPR|Article 53: General conditions for the members of the supervisory authority]]<br />
[[Article 54 GDPR|Article 54: Rules on the establishment of the supervisory authority]]<br />
[[Article 55 GDPR|Article 55: Competence]]<br />
[[Article 56 GDPR|Article 56: Competence of the lead supervisory authority]]<br />
[[Article 57 GDPR|Article 57: Tasks]]<br />
[[Article 58 GDPR|Article 58: Powers]]<br />
[[Article 59 GDPR|Article 59: Activity reports]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
<div class="mw-collapsible-content">
<small>
[[Article 60 GDPR|Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned]]<br />
[[Article 61 GDPR|Article 61: Mutual assistance]]<br />
[[Article 62 GDPR|Article 62: Joint operations of supervisory authorities]]<br />
[[Article 63 GDPR|Article 63: Consistency mechanism]]<br />
[[Article 64 GDPR|Article 64: Opinion of the Board]]<br />
[[Article 65 GDPR|Article 65: Dispute resolution by the Board]]<br />
[[Article 66 GDPR|Article 66: Urgency procedure]]<br />
[[Article 67 GDPR|Article 67: Exchange of information]]<br />
[[Article 68 GDPR|Article 68: European Data Protection Board]]<br />
[[Article 69 GDPR|Article 69: Independence]]<br />
[[Article 70 GDPR|Article 70: Tasks of the Board]]<br />
[[Article 71 GDPR|Article 71: Reports]]<br />
[[Article 72 GDPR|Article 72: Procedure]]<br />
[[Article 73 GDPR|Article 73: Chair]]<br />
[[Article 74 GDPR|Article 74: Tasks of the Chair]]<br />
[[Article 75 GDPR|Article 75: Secretariat]]<br />
[[Article 76 GDPR|Article 76: Confidentiality]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
<div class="mw-collapsible-content">
<small>
[[Article 77 GDPR|Article 77: Right to lodge a complaint with a supervisory authority]]<br />
[[Article 78 GDPR|Article 78: Right to an effective judicial remedy against a supervisory authority]]<br />
[[Article 79 GDPR|Article 79: Right to an effective judicial remedy against a controller or processor]]<br />
[[Article 80 GDPR|Article 80: Representation of data subjects]]<br />
[[Article 81 GDPR|Article 81: Suspension of proceedings]]<br />
[[Article 82 GDPR|Article 82: Right to compensation and liability]]<br />
[[Article 83 GDPR|Article 83: General conditions for imposing administrative fines]]<br />
[[Article 84 GDPR|Article 84: Penalties]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
<div class="mw-collapsible-content">
<small>
[[Article 85 GDPR|Article 85: Processing and freedom of expression and information]]<br />
[[Article 86 GDPR|Article 86: Processing and public access to official documents]]<br />
[[Article 87 GDPR|Article 87: Processing of the national identification number]]<br />
[[Article 88 GDPR|Article 88: Processing in the context of employment]]<br />
[[Article 89 GDPR|Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes]]<br />
[[Article 90 GDPR|Article 90: Obligations of secrecy]]<br />
[[Article 91 GDPR|Article 91: Existing data protection rules of churches and religious associations]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
<div class="mw-collapsible-content">
<small>
[[Article 92 GDPR|Article 92: Exercise of the delegation]]<br />
[[Article 93 GDPR|Article 93: Committee procedure]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 94 GDPR|Article 94: Repeal of Directive 95: /46: /EC]]<br />
[[Article 95 GDPR|Article 95: Relationship with Directive 20: 02: /58: /EC]]<br />
[[Article 96 GDPR|Article 96: Relationship with previously concluded Agreements]]<br />
[[Article 97 GDPR|Article 97: Commission reports]]<br />
[[Article 98 GDPR|Article 98: Review of other Union legal acts on data protection]]<br />
[[Article 99 GDPR|Article 99: Entry into force and application]]<br />
</small>
</div>
</div>
|}

== Legal Text ==
<br /><center>'''Article 89 - Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes'''</center>

<span id="1">1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.</span>

<span id="2">2. Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.</span>

<span id="3">3. Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.</span>

<span id="4">4. Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs.</span>

==Relevant Recitals==
{{Recital/27 GDPR}}{{Recital/33 GDPR}}{{Recital/156 GDPR}}{{Recital/158 GDPR}}{{Recital/159 GDPR}}{{Recital/161 GDPR}}{{Recital/162 GDPR}}{{Recital/163 GDPR}}

== Commentary ==

Article 89 GDPR regulates the processing of personal data for four distinct purposes: (i) archiving in the public interest, (ii) scientific research, (iii) historical research and (iv) statistical purposes. In many instances, collecting large quantities of personal data is a key component, if not a prerequisite, for achieving such purposes. For example, clinical trials or political polls are both based on the large-scale collection and analysis of sensitive personal data. Because of the broad scope of such processing operations, as well as the risks they entail, the EU legislator has introduced specific safeguards in Article 89(1) GDPR to protect the rights and freedoms of data subjects. At the same time, overburdening controllers with legal obligations may ultimately impede research, or even defeat the very purpose of the processing. This, in turn, may become detrimental for society, as many societal advances are based on archiving systems, scientific and historical research, or statistical studies. Hence, Article 89(2) and (3) GDPR also allow for specific derogation to the GDPR for these purposes, as further detailed below.

=== (1) Mandatory Appropriate Safeguards for Archiving Purposes in the Public Interest, Scientific or Historical Research Purposes, or Statistical Purposes ===
Article 89(1) GDPR provides that when processing operations take place for (i) archiving in the public interest, (ii) scientific or historical research or (iii) statistical purposes, appropriate safeguards for the rights and freedoms of the data subject must be implemented. After defining each of these purposes, the safeguards that controllers must be in place will be discussed.
===== Archiving Purposes in the Public Interest =====
According to Recital 158 GDPR, processing for archiving purposes in the public interest can be defined as any operation “''to acquire, preserve, appraise, arrange, describe, communicate, promote, disseminate and provide access to records of enduring value for general public interest''”. This means that personal or family archives, or company records will generally not be covered by Article 89 GDPR, unless they also fulfil the criteria of being kept in the “''public interest''”.<ref>See, ''Wiese Svanberg,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also points out that the requirement that archiving "''must take place 'in the public interest' should be regarded as satisfied as long as any individual archiving activity is set out-even broadly in Member State law. Thus, the GDPR does not limit the extent to which Member States can delimit what materials are of sufficient historical interest to warrant subjecting them to archiving rules''”.</ref>

===== Scientific Research Purposes =====
Recital 159 GDPR states that “''the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research''”. Recital 157 GDPR makes it clear that scientific research also includes processing generating “''new knowledge of great value with regard to widespread medical conditions such as cardiovascular disease, cancer and depression''. […] ''Within social science, research on the basis of registries enables researchers to obtain essential knowledge about the long-term correlation of a number of social conditions such as unemployment and education with other life conditions''”. The GDPR as a whole, and Article 89 GDPR in particular, do not distinguish between scientific research pursuing public interests and that pursuing private or purely commercial ones. It follows that, if the applicable requirements are met, "''purely private or commercial interests can be pursued through the processing of personal data for scientific research purposes''”.<ref>See, ''Wiese Svanberg,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also specifies that any other relevant legislation (such as legislation on clinical trials in the case of medical or scientific research) may also apply.</ref> Clinical trials conducted by pharmaceutical companies, for example, would therefore fall within the scope of Article 89 GDPR. Similarly, scientific research conducted by a university or a public institution would also fall within the scope of Article 89 GDPR.

===== Historical Research Purposes =====
Under Recital 160 “[w]''here personal data are processed for historical research purposes, this Regulation should also apply to that processing. This should also include historical research and research for genealogical purposes, bearing in mind that this Regulation should not apply to deceased persons''”. In ruling out data relating to deceased persons, this Recital confirms Recital 27 GDPR, according to which the GDPR “''does not apply to the personal data of deceased persons''”. However, it should be noted that genealogy research may relate to living relatives as well, in which case the GDPR would still apply to protect the rights and freedoms of those individuals.<ref>''Eichler'', in BeckOK DatenschutzR, Article 89 GDPR, margin number 6a (C.H. Beck 2020, 36th edition).</ref>

===== Statistical Purposes =====
According to Recital 162 GDPR, “''statistical purposes''” include “''any operation of collection and the processing of personal data necessary for statistical surveys or for the production of statistical results''”. Recital 162 GDPR specifies that “''the result of processing for statistical purposes is not personal data, but aggregate data",'' and that ''"this result or the personal data are not used in support of measures or decisions regarding any particular natural person''”. This sentence seems to suggest that aggregated data are never, by definition, personal data, with the concomitant non-application of the GDPR. From a logical point of view, this conclusion seems to be correct. However, the main assumption must be true: in particular, that aggregated data are actually anonymous and therefore not referable to any data subject. In practice however, given the high threshold required by the WP29 to achieve true anonymisation, it seems rather unlikely that all aggregated data would systematically fall outside of the scope of the GDPR.<ref>WP29, Opinion 05/2014 on Anonymisation Techniques, 10 April 2014 (available [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf here]).</ref> The risk of re-identification is indeed inherent to the processing of large amounts of data.<ref>''Rocher et al.'', Estimating the success of re-identifications in incomplete datasets using generative models. ''Nature Communications'' 10 (2019).</ref> For these reasons, scholars have convincingly argued that “''a better reading of recital 162 is that it is only intended to make clear that data processed for statistical purposes remain personal data (subject to the GDPR) until they are anonymised through aggregation (i.e. until the 'result' of the statistical processing operation is achieved)''”.<ref>''Wiese Svanberg,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1250 (Oxford University Press 2020).</ref>

==== Obligation to implement appropriate safeguards ====
According to Article 89(1) GDPR, controllers and processors must implement appropriate safeguards to protect the rights and freedom of data subjects whose personal data are collected and further processed for the aforementioned purposes. More specifically, technical and organisational measures must be implemented to ensure, in particular, respect for the principle of data minimisation, as set in [[Article 5 GDPR|Article 5(1)(c) GDPR]]. This means that the collection of personal data should from the outset be limited to what is appropriate, relevant and necessary for the purpose pursued. The far-reaching derogations granted under Article 89(2) and (3) GDPR can only be justified under this strictly applicable premise.<ref>''Eichler'', in BeckOK DatenschutzR, Article 89 GDPR, margin number 12-13 (C.H. Beck 2020, 36th edition).</ref> Among the organisational and technical measures that controllers or processors should put in place, Article 89(1) GDPR specifically mentions pseudonymisation and anonymisation.<ref>The GDPR uses this wording: “''Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner''”, generally understood as anonymization.</ref> This list is of course non-exhaustive, and there may well be other suitable measures that adequately reduce the risks associated with the processing of personal data in those areas.<ref>For example, use of encryption, employees’ confidentiality obligations, sufficiently specific work instructions and computer access authorizations are to be checked even more strictly in these cases.</ref>
===== Pseudonymisation =====
Under [[Article 4 GDPR|Article 4(5) GDPR,]] pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately. Pseudonymised data are thus personal data, since the individuals to whom they relate remain identifiable (Recital 26 GDPR). Through pseudonymisation, controllers are therefore not exempted from complying with the GDPR, but are simply reducing the overall risks linked to the processing of personal data.

===== Anonymisation =====
According to Recital 26 GDPR, anonymisation is the process of rendering personal data anonymous, in the sense that the data subject is no longer identified or identifiable. The anonymisation process must be robust enough to prevent any risk of reidentification. Hence, the technical requirements of anonymisation may vary from one case to another depending on the data available, and may become increasingly difficult to achieve as re-identification techniques evolve in parallel.<ref>WP29, Opinion 05/2014 on Anonymisation Techniques, 0829/14/EN, 10 April 2014, p. 4, 8 and in general throughout the Opinion (available [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf here]).</ref> While Article 89(1) GDPR states that pseudonymisation "''may''" be used as a technical measure, anonymisation becomes mandatory when it does not prevent or defeat the purpose of the processing. For example, if a public authority orders a statistical survey on water consumption to improve water management in a specific city, the study should be based on anonymised data if identifying the respondents is not necessary to reach valid findings. By contrast, conducting a clinical trial may require the collection and monitoring of personal data of identified patients. In that case, anonymisation would therefore neither be possible, nor required under Article 89(1) GDPR. All in all, it can be concluded that anonymisation only becomes a mandatory technical measure if the research purpose allows for it.<ref>''Eichler'', in BeckOK DatenschutzR, Article 89 GDPR, margin number 15 (C.H. Beck 2020, 36th ed.). See also Recital 156 which states that “''The further processing of personal data for archiving purposes'' […] ''is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist''”.</ref>

===== Other measures =====
As previously said, anonymisation and pseudonymisation are only two examples of technical measures that can be put in place by the controllers or processors when conducting research for scientific, historical or statistical purpose. Other measures and safeguards should also be considered. At the national level, Member States have sometimes established more specific obligations in that respect.

In Luxembourg, for example, Article 65 of the Act of 1st October 2018 on the processing of personal data specifically requires controllers to put in place twelve organisational or technical measures, including anonymisation and pseudonymisation, when processing personal data for scientific or historical research, archiving purposes or statistical purposes. Among the other measures listed in that article, one may for example find the appointment of a Data Protection Officer (DPO) to supervise the processing of the personal data, the obligation to conduct a Data Protection Impact Assessment (DPIA), the encryption of the personal data with state-of-the-art key management, restrictions on data access within the organisation of the controller, or raising the awareness of the staff with respect to professional secrecy and personal data protection. The same article further specifies that the controller must document and justify for each project the exclusion, where applicable, of one or more of the measures listed in that article.

Other Member States have adopted similar provisions. Thus, besides the minimum requirements set in Article 89(1) GDPR, controllers involved in the processing of personal data for scientific or historical research, archiving purposes or statistical purposes should also pay due attention to possible additional requirements under national legislation.
=== (2) Derogations Possible for Scientific or Historical Research Purposes or Statistical Purposes ===
Under Article 89(2) GDPR, where personal data are processed for statistical purposes, Union or Member State law may provide for derogations from the rights referred to in [[Article 15 GDPR|Articles 15]] (right of access by the data subject), [[Article 16 GDPR|16]] (right to rectification), [[Article 18 GDPR|18]] (right to restriction of processing) and [[Article 21 GDPR|21]] GDPR (right to object). Such derogations nonetheless remain subject to the conditions and safeguards referred to in Article 89(1) GDPR. Furthermore, two other requirements have to be simultaneously met in order for these derogations to apply: first, the exercise of the data subjects’ rights would render impossible or seriously impair the achievement of the specific purposes; second, such derogations must be necessary for the fulfilment of those purposes. It therefore follows that derogations only apply when strictly necessary for achieving the purpose of the processing.

=== (3) Derogations are Possible for Archiving Purposes in the Public Interest ===
Under Article 89(3) GDPR, where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in [[Article 15 GDPR|Articles 15]] (right of access by the data subject), [[Article 16 GDPR|16]] (right to rectification), [[Article 18 GDPR|18]] (right to restriction of processing), [[Article 19 GDPR|19]] (notification obligation regarding rectification or erasure of personal data or restriction of processing), [[Article 20 GDPR|20]] (right to data portability) and [[Article 21 GDPR|21]] (right to object) GDPR. The same conditions as provided under Article 89(2) GDPR also applies to these derogations. In other words, these derogations are only allowed when necessary for achieving the archiving purpose at stake, and when the exercise of the data subject's rights would render impossible or seriously impair the achievement of that purpose.

=== (4) Derogations do not Extend to Other Purposes that Require the Same Processing ===
Article 89(4) GDPR makes it clear that the derogations to the GDPR are only available for processing specified in Article 89 GDPR, and not for any other purposes that may be pursued at the same time on the same dataset.

== Decisions ==
→ You can find all related decisions in [[:Category:Article 89 GDPR]]

== References ==
<references />

[[Category:Article 89 GDPR]] [[Category:GDPR Articles]]

Article 89 GDPR - Revision history

Bodobalazs: 1 revision imported: GDPRHUB import 2023 04 18