SkarpChapter 16 of 16
Special Processing Contexts and the GDPR's Final Legal Settlement
The closing chapters test how the general framework operates alongside expression, public access, employment, research, secrecy, and religious governance before settling delegated powers, repeal, review, and application. The binding clause and cited instruments then place the GDPR within the wider Union legal order, revealing how its rights, duties, institutions, and enforcement mechanisms form one directly applicable system.
1. Reading the GDPR's Closing Architecture
The closing chapters
Chapters IX-XI show how the GDPR works in special contexts, how Union delegated and implementing action is controlled, and how the Regulation reached its final legal settlement.
A three-layer map
Think of the provisions as three layers: Chapter IX supplies context-specific bridges; Chapter X governs Commission action; Chapter XI addresses repeal, review, application, and legal effect.
Read conditions precisely
These Articles often use conditions such as if necessary, where, in so far as, and provided that. Each condition limits the rule; none should be treated as automatic.
2. Article 85: Expression and Information
The legal task
Article 85(1) says: "Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information".
When derogations are required
For journalism and academic, artistic, or literary expression, Member States shall provide exemptions or derogations from listed GDPR chapters if they are necessary for reconciliation.
Notification matters
A Member State shall notify the Commission of provisions adopted under Article 85(2), and notify without delay any later amendment law or amendment affecting those provisions.
3. Articles 86-88: Public Documents, Identifiers, and Employment
Official documents: Article 86
Personal data in qualifying official documents may be disclosed under applicable Union or Member State law, but only to reconcile public access with protection of personal data.
Identifiers: Article 87
Member States may set specific conditions for national identification numbers or general identifiers. If they do, use shall occur only under appropriate GDPR safeguards.
Employment: Article 88
Employee-data rules may be made by law or collective agreement, but shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights.
4. Article 89: Research, Statistics, and Archiving
Safeguards come first
Article 89(1) provides that research, statistics, and qualifying archiving "shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject."
Minimise and de-identify where possible
Safeguards shall ensure technical and organisational measures for data minimisation. Pseudonymisation may be used; where identification is no longer needed, the purposes shall be fulfilled that way.
Derogations have three limits
A legal derogation requires Article 89(1) safeguards, a likelihood that rights would make the purpose impossible or seriously impair it, and necessity for fulfilment of that purpose.
5. Apply Article 89: Choose the Narrowest Route
Thought exercise: a university health-history study
A university holds identifiable patient records for a historical study. The researchers can answer most research questions with coded records, but a small validation team may need to reconnect some codes to named individuals. The university also wants to use the same database for a future commercial service.
Work through the Article 89 sequence:
- Purpose: Is the relevant processing for scientific or historical research, statistics, or archiving in the public interest?
- Safeguards: What technical and organisational measures are in place? Does the design respect data minimisation?
- Pseudonymisation: Can the purposes be fulfilled with pseudonymised data? If yes, Article 89 says measures may include it.
- No identification where possible: Can a part of the purpose be fulfilled by processing that does not permit, or no longer permits, identification? If so, that part shall be fulfilled in that manner.
- Possible derogation: If a law provides a derogation from a listed right, are the Article 89(1) safeguards present? Is the right likely to make the purpose impossible or seriously impair it? Is the derogation necessary?
- Mixed purpose: The planned commercial service is another purpose. Under Article 89(4), any research-related derogation applies only to the processing for the purposes in Article 89(2) or (3), not automatically to the commercial use.
Your answer: Identify one processing operation that should use non-identifying data and one operation that may still require pseudonymised data with controlled re-identification.
6. Articles 90-91: Secrecy and Religious Governance
Professional secrecy
Article 90 permits specific national rules about certain supervisory powers only where necessary and proportionate to reconcile personal-data protection with professional or equivalent secrecy.
A confined scope
The secrecy rules apply only to personal data received or obtained in an activity covered by the relevant secrecy obligation. They do not create a general secrecy exception.
Church rules and supervision
Existing comprehensive church rules may continue only if aligned with the GDPR. Bodies using them shall be supervised by an independent authority meeting Chapter VI conditions.
7. Articles 92-93: Delegated Acts and Committee Procedure
Delegation duration
For Articles 12(8) and 43(8), the delegated power "shall be conferred on the Commission for an indeterminate period of time from 24 May 2016."
Revocation and objection
The delegation may be revoked at any time by Parliament or Council. A delegated act needs no objection within three months, subject to a possible three-month extension.
Implementing procedure
"The Commission shall be assisted by a committee." Article 93 connects that committee to Regulation (EU) No 182/2011 and its specified procedures.
8. Articles 94-96: Repeal, ePrivacy, and Existing Agreements
Repeal with continuity
"Directive 95/46/EC is repealed with effect from 25 May 2018." References to that repealed Directive are construed as references to the GDPR.
The ePrivacy boundary
Article 95 says the GDPR shall not impose additional obligations where electronic-communications processing is already subject to specific same-objective obligations under Directive 2002/58/EC.
Existing transfer agreements
Qualifying Member State agreements concluded before 24 May 2016 and compliant with prior applicable Union law shall remain in force until amended, replaced, or revoked.
9. Articles 97-99: Review, Application, and Direct Effect
Review cycle
"By 25 May 2020 and every four years thereafter" the Commission shall submit public evaluation-and-review reports to Parliament and the Council.
Entry and application
The GDPR entered into force on the twentieth day after Official Journal publication, while Article 99 says: "It shall apply from 25 May 2018."
Direct applicability
The concluding legal formula is: "This Regulation shall be binding in its entirety and directly applicable in all Member States."
10. Quiz: Research Derogations
Test the conditions in Article 89 before moving on.
Under Article 89(2), when may Union or Member State law provide a derogation from listed data-subject rights for scientific, historical, or statistical purposes?
- Whenever an organisation labels its project as research.
- Only where the Article 89(1) conditions and safeguards apply, the rights are likely to make the purpose impossible or seriously impair it, and the derogation is necessary.
- Whenever the controller pseudonymises the data, without any further condition.
- Only when every data subject has waived all GDPR rights.
Show Answer
Answer: B) Only where the Article 89(1) conditions and safeguards apply, the rights are likely to make the purpose impossible or seriously impair it, and the derogation is necessary.
Article 89(2) requires all three elements: the paragraph 1 conditions and safeguards, likely impossibility or serious impairment caused by the rights, and necessity of the derogation. Pseudonymisation may be a measure, but it does not by itself satisfy Article 89(2).
11. Quiz: Delegated Act Scrutiny
Identify the correct Article 92 sequence.
Which statement accurately reflects Article 92(5)?
- A delegated act always enters into force immediately when the Commission adopts it.
- A delegated act enters into force only if neither Parliament nor Council objects within three months of notification, or both notify the Commission before then that they will not object; either institution may initiate a three-month extension.
- The Council alone may object, and it has one month to do so.
- A revocation decision invalidates all delegated acts already in force.
Show Answer
Answer: B) A delegated act enters into force only if neither Parliament nor Council objects within three months of notification, or both notify the Commission before then that they will not object; either institution may initiate a three-month extension.
Article 92(5) sets a three-month objection period, permits early confirmation of no objection by both institutions, and allows a three-month extension at Parliament's or the Council's initiative. Article 92(3) separately says revocation does not affect the validity of delegated acts already in force.
12. Flashcards: Final-Chapter Recall
Flip each card and state the condition, deadline, or legal effect before checking the answer.
- Article 85(1): What must Member States do?
- They shall by law reconcile personal-data protection under the GDPR with freedom of expression and information, including journalism and academic, artistic, or literary expression.
- Article 88(2): What must employment rules include?
- Suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights.
- Article 89(1): What is the safeguard baseline?
- Processing shall be subject to appropriate safeguards for rights and freedoms, including technical and organisational measures for data minimisation.
- Article 91(1): When may comprehensive church rules continue?
- They may continue to apply provided that they are brought into line with the GDPR.
- Article 92: What is the objection period?
- Three months from notification of the delegated act, extendable by three months at Parliament's or the Council's initiative.
- Article 94: What happened on 25 May 2018?
- Directive 95/46/EC was repealed with effect from that date.
- Article 97: What is the review cycle?
- The first report was due by 25 May 2020, and further reports are due every four years thereafter.
- Article 99: What is the GDPR's legal effect?
- It is binding in its entirety and directly applicable in all Member States.
Key Terms
- Chapter V
- The GDPR chapter concerning transfers of personal data to third countries or international organisations.
- derogation
- A departure that Union or Member State law may provide only within the Article's stated conditions and safeguards.
- Chapter VII
- The GDPR chapter concerning cooperation and consistency.
- delegated act
- An act adopted by the Commission under delegated power, subject in Article 92 to notification, objection, extension, and revocation arrangements.
- implementing act
- An act made through an implementing-power procedure; Article 93 provides that the Commission shall be assisted by a committee.
- pseudonymisation
- A possible Article 89 safeguard where the relevant purposes can be fulfilled in that manner; Article 89 also requires non-identifying processing where the purposes can be fulfilled that way.
- directly applicable
- The Article 99 description of the GDPR's legal effect in all Member States.
- professional secrecy
- A secrecy obligation under Union or Member State law, or rules of national competent bodies, which may justify narrowly tailored Article 90 rules.