Right to restriction of processing
A restriction of data processing can mean that data is temporarily blocked, deleted from a website or transferred to another processing system. This is similar to having data deleted, but it is usually a short-term measure: For example, data subjects can request the restriction of data processing if they question the accuracy of their data and the data controllers first have to check this issue. Another case is when data subjects object to the processing, but it must still be considered whether or not the legitimate interest of data controllers might prevail.
If data processing is restricted, data may only be processed with consent, in the sense of a public interest or to assert legal claims.
In Germany, however, exceptions to the right of restriction apply: A restriction is not possible if it hinders scientific research or statistical purposes as well as archiving purposes in the public interest (see Research purposes).
Article 18 GDPR (Right to restriction of processing)
1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
(a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
(b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
(c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
(d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
2. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.
Source: Regulation (EU) 2016/679 (see also recital 67)
Section 27(2) BDSG (Data processing for purposes of scientific or historical research and for statistical purposes)
The rights of data subjects provided in Articles 15, 16, 18 and 21 of Regulation (EU) 2016/679 shall be limited to the extent that these rights are likely to render impossible or seriously impair the achievement of the research or statistical purposes, and such limits are necessary for the fulfilment of the research or statistical purposes. Further, the right of access according to Article 15 of Regulation (EU) 2016/679 shall not apply if the data are necessary for purposes of scientific research and the provision of information would involve disproportionate effort.
Source: German Federal Data Protection Act
Section 28(4) BDSG (Data processing for archiving purposes in the public interest)
The rights provided in Article 18 (1) (a), (b) and (d) and in Articles 20 and 21 of Regulation (EU) 2016/679 shall not apply as far as these rights are likely to render impossible or seriously impair the achievement of the archiving purposes in the public interest, and the exceptions are necessary to fulfil those purposes.
Source: German Federal Data Protection Act
Section 35(2) BDSG (Right to erasure)
(2) In addition to Article 18 (1) (b) and (c) of Regulation (EU) 2016/679, subsection 1, first and second sentences shall apply accordingly in the case of Article 17 (1) (a) and (d) of Regulation (EU) 2016/679 as long and as far as the controller has reason to believe that erasure would adversely affect legitimate interests of the data subject.
The controller shall inform the data subject of the restriction of processing if doing so is not impossible or would not involve a disproportionate effort.
