Author: Domingos Farinho
(3) ‘Restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future;
I.Introduction
The GDPR introduces the right to “restriction of processing” under Art. 18 and the legislator also deemed it relevant to include a definition, under Art. 4 no. 3. However, this definition raises some issues not only when put against the regime of Art. 18, but also due to technical considerations introduced by recital 67.
II.Legal background
Although the restriction of processing as a right is a novelty of the GDPR, one can trace the current mechanism back to “blocking” as foreseen in the DPD.[1] This is especially clear in the Comm Proposal for the DPD, when explaining the definition of “processing”: “The reference to blocking relates to data to which access is blocked using more stringent security measures than is normally the case, but stopping short of erasure”.[2] The Comm has recognised such antecedent explicitly in its Comm-P when referring to the new right to restriction of processing, stating that it avoids “the ambiguous terminology of ‘blocking’”.[3]
Blocking was also foreseen in Regulation 45/2001[4] in terms much like those adopted in the GDPR. This is especially clear when comparing Art. 15 of Regulation 45/2001 and Art. 18 of the GDPR. It becomes clear that “blocking” under Regulation 45/2001 was aimed at the same goals that are envisaged by the restriction of processing under the GDPR, however the legislator did not provide any definition or recital elaborating on the notion of blocking. It should nevertheless be noted that under Art. 15 para. 2 of Regulation 45/2001 it is foreseen that “[t]he fact that the personal data are blocked shall be indicated in the system in such a way that it becomes clear that the personal data may not be used”. Although the Comm deemed the term “blocking” ambiguous, this provision shows clearly that blocked personal data cannot be processed other than stored. This particular characteristic seems to have been carried over to the GDPR.
III. Analysis
As mentioned above, the GDPR definition of “restriction of processing” is in direct connection with the right to restriction of processing (see Art. 18, mn. 2 and 18). The restrictions are thus linked to the reasons provided under Art. 18 para. 1 and the scope of the restriction is determined by the reasons applicable to each case, upon request from the data subject. When processing is restricted, the only processing operation allowed is the storage of personal data, unless the reasons set out in Art. 18 para. 2 apply. Taking Art. 18 into consideration when analysing the definition of restriction of processing under Art. 4 no. 3 seems to reveal an incomplete definition.[5]
Marking means signalling and highlighting with the aim of (i) distinguishing such data from any other personal data that may remain in full, complete processing and, as such, (ii) prevent their use.[6] This shows that the restriction of processing encompasses more than the marking of information. In order to restrict the processing of personal data, other technical procedures may have to performed on the data. This is confirmed by recital 67 when it offers examples of “methods by which to restrict the processing of personal data”, such as “temporarily moving the selected data to another processing system, making the selected personal data unavailable to users, or temporarily removing published data from a website”.
[…]
[1]See Art. 2 lit. b, Art. 12 lit. b, Art. 28 para. 3 and Art. 32.
[2]See Commission of the European Communities, Proposal for a Council Directive, COM (90), 314 final, 13 September 1990, p. 20.
[3]See Comm-P, p. 9.
[4]See Art. 2 lit. b, Art. 15, Art. 17, Art. 25 para. 2 lit. f and Art. 47 para. 1 lit. e.
[5]See Dix, ‘Art. 4 Nr. 3’ in Simitis/Hornung/Spiecker gen. Döhmann, p. 305, mn. 1.
[6]See Tosoni, ‘Art. 4(3)’, in Kuner/Bygrave/Docksey, p. 125.