Restrictions of data subjects’ rights
Article 41(1) UAVG allows controllers to disregard the data subjects’ rights (Art. 12- 21 GDPR) and the obligation of breach communication to the data subject (Art. 34 GDPR) to the extent necessary and proportionate to ensure the following:
- national and security
- national defense
- public safety;
- the prevention, investigation, detection and prosecution of criminal offenses or the enforcement of sanctions, including the protection and prevention of threats to public security;
- other important public interest objectives of general interest of the European Union or of the Netherlands, in particular an important economic or financial interest of the European Union or of the Netherlands, including monetary, budgetary and fiscal matters, public health and social security;
- the protection of the independence of the court and legal proceedings;
- the prevention, investigation, detection and prosecution of breaches of professional rules for regulated professions;
- a task in the field of supervision, control or regulation which, although incidentally, involves the exercise of official authority;
- the protection of the data subject or of the rights and freedoms of others;
- the collection of civil claims.
In deciding to disregard the above-mentioned obligations and rights, the controller shall take into account several factors listed in Article 41 (2) UAVG, such as: the purposes of the processing or categories of processing, the categories of personal data, the risks to the rights and freedoms of those involved, etc.
Processing of personal data for the purposes of scientific research or statistics
Further, the rights to access, rectification and restriction of processing do not apply where processing is carried out solely for the purposes of scientific research or statistics (Article 44 UAVG).
Processing of personal data for the purposes of archiving in the public interest
Where the processing is carried out for the purposes of archiving in the public interest, the right to access, rectification, restriction of processing (when the accuracy of data is contested) and portability may not be granted (Article 45 UAVG).
Exceptions for public registers
Pursuant to Article 47 UAVG, public registers may further restrict some rights of data subjects, namely the right to access, rectification and restriction of processing. In such cases, also the notification obligation of Article 19 GDPR, regarding rectification or erasure of data or restriction of processing does not apply. Moreover, there is no right to object to registers established by law.
