Derogations from the rights of data subjects exist with regard to the rights to information pursuant to Art. 12 -14 GDPR:
- Under Art. 32 I 6°, the data subject must not only be informed of his/her customary data protection rights, but also of the fate of his/her personal data after his/her death.
- 32 IV provides that if personal data collected is made anonymous within a short period of time by a procedure previously authorized by the CNIL, only the identity of the data controller and the purpose of the processing must be disclosed.
- Art 32 V provides that in the case of processing of personal data by public authorities in connection with state security, state defense or public security, no informing obligations are to be fulfilled vis-à-vis the data subjects if the restriction of information rights is justified by the purposes of the processing.
