Author: Domingos Farinho
- The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
(a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
(b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
(c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
(d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
- Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
- A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.
I. Overview
The right to restriction of processing, foreseen in Art. 18 is an interesting multi-purpose right, devised to restrict the normal processing of personal data while keeping it stored for a period of time necessary to achieve certain objectives foreseen in the GDPR. Although an autonomous right of the data subject, that can be exercised on its own, it is included in the section referring to rectification and erasure, and its content links directly to these other rights, but also to the right to object pursuant to Art. 21. This can be understood directly from Art. 18 para. 1 and through a systematic interpretation of other provisions in the GDPR. Thus, Art. 18 also functions as a complement or an alternative[1] to such rights in situations where rectification or erasure are not (immediately) appropriate.[2] It offers the data subject further and varied possibilities to control personal data.
Restriction, in the sense used in the GDPR, directly connects with Art. 4 no. 2 as it implies a reduction in scope of the “processing” definition. Generally, restricted personal data can still be stored but they cannot be further processed (→ Art 18 mn. 2). As foreseen in Art. 4 no. 3, restriction of processing “means the marking of stored personal data with the aim of limiting their processing in the future”.
The right to restriction of processing is a new right under the GDPR and, although it can be said to have evolved from the right to have personal information blocked pursuant to Art. 12 lit. b of the DPD, its scope and its content go well beyond this former right.
II. Legislative history
DPD included among the section referring to the data subject’s right of access to data, and under its Art. 12, “the right to obtain from the controller […] as appropriate the rectification, erasure or block of data the processing of which does not comply with the provisions of the Directive, in particular because of the incomplete or inaccurate nature of the data” (own emphasis). Consequently, Art. 28 para. 3 prescribed that SAs were to be endowed with effective powers of ordering the blocking of personal data. Blocking was also included under the definition of “processing of personal data” in Art. 2 lit. b.
The connection between blocking of personal data and their rectification or erasure is similar to the connection between the restriction of processing of personal data and the rights to rectification and erasure, but the DPD grounded the right to have personal data blocked on the non-compliance of its provisions which presented a narrow scope when compared to the wider reasons offered in Art. 18 para. 1 of the GDPR, especially considering lit. c. This marks the evolution enacted through the GDPR. Also, it should be noted that the Comm considered that the term “blocking” was ambiguous and thus proposed “restriction” instead[3]. The Comm-P clearly confirms the intention to adopt the right to restriction of processing as an alternative to the right to erasure[4] but this was widened during the legislative process. The Comm also proposed an additional ground for restriction in connection with the right to portability,[5] but it was not adopted. In its turn, the Parl-R proposed the addition of another ground following the decision of a court or of a regulatory authority that the data concerned must be erased.[6] This was also not adopted. The Council-R later proposed that the right to restriction of processing be transferred to a separate article and the current reference to Art. 21 in Art. 18 para. 1 lit. d was added.[7]
[…]
[1]Referring to an “adjunct right” and also an alternative, see Fuster, ‘Art. 18’, in Kuner/Bygrave/Docksey, p. 485.
[2]See Dix, ‘Art. 18’, in Simitis/Hornung/Spiecker gen. Döhmann, p. 680, para. 1.
[3]See point 3.4.3.3 of the Explanatory Memorandum of the Comm-P; see also Fuster, ‘Art. 18’, in Kuner/Bygrave/Docksey, p. 489.
[4]See Art. 17 para. 4 of the Comm-P.
[5]Ibid, Art. 17 para. 4 lit. d.
[6]See Art. 17 of the EU Parliament Report on the on the proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (COM (2012) 0011).
[7]See Zanfir-Fortuna, ‘Tracing the Right to be Forgotten in the Short History of Data Protection Law: The ‘New Clothes’ of an Old Right’, in Gutwirth/De Hert, Reforming European Data Protection Law, pp. 231–232; see also Dix, ‘Art. 18’, in Simitis/Hornung/Spiecker gen. Döhmann, p. 681, para. 2.