PL EN
Book a meeting
Chapter 2Data Subject’s Rights
  1. Chapter 1Basic Compliance
  2. Chapter 2Data Subject’s Rights
  3. Chapter 3Security
  4. Chapter 4Data Processing
  5. Chapter 5Managing Incidents and Data Breaches
  6. Chapter 6Data Protection Officer (DPO)
  7. Chapter 7The Regulator
  8. Chapter 8Legal Remedies, Liability, Administrative Sanctions
  9. Appendix IPersonal Data Protection Policy
  10. Appendix IIData Processing Agreement
  11. Appendix IIIJoint Controllership Agreement
Section 2.6
  1. 2.1Processing Data Subject’s Rights and Requests (Article 12 of the GDPR)
  2. 2.2Right to Be Informed and Privacy Information Obligation (Articles 13 and 14 GDPR)
  3. 2.3Right of Access to Data and to a Copy of Data (Article 15 GDPR)
  4. 2.4Right to Rectification of Data (Article 16 GDPR)
  5. 2.5The Right to Erasure (Right to Be Forgotten) (Article 17 GDPR)
  6. 2.6Right to Restriction of Processing (Article 18 GDPR)
  7. 2.7Obligation to Notify about Rectifying, Erasing, or Restricting of Processing of Data (Article 19 GDPR)
  8. 2.8Right to Data Portability, i.e. How to Transfer Data from One Controller to Another (Article 20 GDPR)
  9. 2.9The Right to Object (Article 21 GDPR)
  10. 2.10Profiling and Automated Decision-Making (Article 22 GDPR)

Right to Restriction of Processing (Article 18 GDPR)

Aleksander P. Czarnowski, Katarzyna Kunda, Maciej Gawronski, Michał Kibil, Michał Sztaberek & Paweł Punda

#6.1 Restriction of Processing

According to the definition given in Article 4(3) GDPR, the term ‘restriction of processing’ means ‘the marking of stored personal data with the aim of limiting their processing in the future’. Of course this is not the complete definition. The missing element can be found in Article 18(2) GDPR:

Where processing of data has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a member state.

As a result of restriction of processing, a controller can hold (store) data and only perform those operations (i) where the data subject has given consent, (ii) where the data are necessary for disputes or to protect another person’s or organisation’s rights, and (iii) where there is an important public interest.

#6.2 Right to Restriction of Processing

Under Article 18(1) GDPR, an individual can demand the restriction of processing of data concerning him/her in the following situations:

  1. a)the accuracy of the personal data is contested by the data subject – for a period enabling the controller to verify the accuracy of the personal data;
  2. b)the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
  3. c)the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defence of legal claims;
  4. d)the data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification of whether the controller has legitimate grounds and whether those grounds override those of the data subject.

The right to request the restriction of data processing means that a boundary can be drawn between the disputed data processing (dispute concerning accuracy of data, restriction of use of data, dispute over legitimacy of the objection to processing) and the areas about which there is no conflict between the data subject and the controller. It also enables the data subject to retain evidence for court proceedings.

The right to restriction of processing is a kind of a temporary measure helping to execute other rights of the data subject. If the data subject demands to restrict processing of data, initially the data controller should comply – for the time required to process a particular underlying demand or for a longer period of time if the data subject demands the preservation of evidence (Article 18(1)(c) GDPR).

#6.2.1 Restriction in the Case of a Dispute Concerning Accuracy

Where a dispute arises, the controller can probably no longer present the data subject with the option of ‘all or nothing’. If the individual requests restriction of processing of their data, the controller can only perform those operations that are not a subject of dispute between the parties.

#6.2.2 Restriction in Cases of Unlawful Processing

In cases of unlawful processing, the controller is required to cease the processing and erase the data. The data subject might, however, be considering, for example, making use of the controller’s services and prefers the controller to have the data but not perform any operations on the data for the time being. The data subject might also prefer to exercise the right of data restriction rather than erasure, especially if the controller completely erases the data and then starts processing the data again because it has forgotten that it erased the data. According to this logic, the data subject prefers the controller to have certain data concerning the data subject in its systems merely so that the data is marked in red as ‘do not touch’ (so-called Robinson lists).

#6.2.3 Restriction for the Purpose of Legal Claims

Data may serve as evidence. In such a case, the data subject may request that the controller retain the data (even if, and especially if the data are needed for a dispute with the controller) even if the controller no longer needs the data (and in fact would rather dispose of the data).

In case a car is left at a monitored parking of a shopping mall and then found damaged, the driver may demand the shopping mall to hand over a video recording of a situation. If the shopping mall is afraid of handing over the recording directly to the driver because there are other people’s personal data, the shopping mall may suggest the driver to use the right to restriction of data to request the shopping mall to keep the recording for the police.

#6.2.4 Restriction in the Case of Objection Due to a Special Situation

Objecting (Article 21(1) GDPR) to processing someone’s data due to the special situation of that person (the data subject) which overrides the legitimate grounds for the controller to process data leads directly to a dispute with the data controller.

A creditor frequently calls a debtor’s mobile nudging a debtor to pay her/his debt. A debtor objects to constant calling (so-called soft enforcement) and demands restriction of processing (i.e., not calling) until her/his objection is processed by a creditor.

#6.3 How to Restrict Processing

Under Recital 67 GDPR, the means by which a request from a data subject can be fulfilled that are applicable include:

  1. 1)temporarily moving the selected personal data to another processing system;
  2. 2)making the selected data unavailable to users or temporarily removing published data from a website;
  3. 3)in automated filing systems, restricting processing in principle by technical means in such a manner that the processed data are not subject to further processing operations and cannot be changed;
  4. 4)clearly indicating in the system that the processing of personal data is restricted.

The GDPR thus states that the controller is required to take real measures and take the appropriate technical measures to prevent processing of the restricted data.

Restriction of personal data processing can also be handled mainly in a procedural manner – for example, by drawing up a list of persons to whom the restriction applies, by flagging a particular person/record, indicating that the list of persons subject to the restriction has to be reviewed.