Processing for archiving purposes in the GDPR International

Processing for archiving purposes in the GDPR International congress of the State Archives of Belgium “Right to be forgotten versus right to remember” 10 Octobre 2016

Content Articles 5, 9 and 14 GDPR Article 17 GDPR Article 89 GDPR 2

3

Art. 5 GDPR • Derogation to the purpose limitation: further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes • Derogation to the storage limitation: personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject Art. 6 DIR 95/46 • Derogation to the purpose limitation: further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that MS provide appropriate safeguards • Derogation to the storage limitation: MS shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use. 5

Principle • Racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership And the processing of • Genetic data, biometric data (in order to uniquely identify a person) or data concerning health or sex life and sexual orientation PROHIBITED The processing of personal data revealing

1 of the Exceptions The processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued and provide for suitable and specific measures to safeguard the fundamental rights of the DS. DIR 95/46: no such an explicit legal basis for sensitive data.

Art 14 GDPR Indirect collection (not been obtained from the DS) 8

Article 11. 2 Dir 95/46 “It shall not apply where, in particular for processing for statistical purposes or for the purposes of historical or scientific research, the provision of such information proves impossible or would involve a disproportionate effort or if recording or disclosure is expressly laid down by law. In these cases MS shall provide appropriate safeguards” 9

1 of the Cases is: ONLY APPLICABLE TO ART. 14 • the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as it is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available; 10

Note that DIR 95/46 provides in its article 13 for possible derogation to the right of erasure. This is only applicable to scientific research 11

1 of the Exemption s= • to the extent that processing of the personal data is necessary for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes in accordance with article 89. 1 in so far as erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing => Broader exception in comparison with the Directive 95/46 12

13

DIR 95/46 foresees derogations but only for data are processed solely for purposes of scientific research or statistics and when there is clearly no risk of breaching the privacy of the data subject Derogations apply to the rights provided for in Article 12 DIR 95 (= access, rectification, erasure or blocking of data) DIR 95/46 also provides for specific safeguards: “Subject to adequate legal safeguards, in particular that the data are not used for taking measures or decisions regarding any particular individual” 14

Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. 15

AIM OF THE SAFEGUARDS PSEUDONYMISATION • The aim of the safeguards is to “ensure that technical and organizational measures are in place in particular in order to ensure respect for the principle of data minimization”. • GDPR gives the example of the use of pseudonymisation as a measure to use to fulfill that aim. (Provided that the purposes can be fulfilled in that manner. ) ANONYMISATION • GDPR adds that a preference goes to further processing which does not permit or no longer permits the identification of data subjects where those purposes can be fulfilled in that manner => Close to what is currently in our Belgian Royal Decree 16

What • Personal data processed for archiving purposes in the public interest • derogations from the rights referred to in Articles 15 (right of access), 16 (Right to rectification), 18 (right to restriction of processing), 19 (Notification obligation regarding rectification or erasure), 20 (right to data portability) and 21 (right to object) HOW • By Union or MS law • in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. • subject to the conditions and safeguards referred to in 89. 1 17

18