European Union: EDPB adopts Version 1.0 of guidelines on restrictions in Art. 23 GDPR and opens consultation

The European Data Protection Board (EDPB) has published Version 1.0 of its guidelines on assessing the meaning and scope of 'restrictions' in Art. 23 of the General Data Protection Regulation (GDPR) on 15 December 2020. On 18 December 2020, the EDPB opened a consultation as part of the publishing of the guidance. Restrictions are defined by the guidelines as any limitation of the scope of the rights and obligations in Arts. 12, 22, 34, and (where relevant) 5 of the GDPR. The guidelines contain a detailed discussion of the legitimate scope and grounds of restrictions (Art.23(1)) and the information which must be specified in a restricting law (Art.23(2)). Further, they reemphasize the exceptional nature of all restrictions under Art.23, requiring them to respect the essence of the fundamental right to data protection and the principle of proportionality. The consultation runs from 18 December 2020 to 12 February 2021.