The rights of the data subject are not absolute rights:

German Federal Constitutional Court: “The guarantee of this right to ‘informational self-determination’ is not entirely unrestricted. Individuals have no right in the sense of absolute, unrestricted control over ‘their’ data” (Judgement of 15 December 1983 – 1 BvR 209/83 et al -, para. 150).

 

European Court of Justice: “The right to the protection of personal data is not an absolute right” (Judgement of 24 November 2019 - C-507/17 -, para. 60).

The rights of the data subject are limited by the rights of others [Tile CO.01] and by public interest:

German Federal Constitutional Court: “Individuals must therefore in principle accept restrictions on their right to informational self-determination in the overriding public interest” (Judgement of 15 December 1983 – 1 BvR 209/83 et al -, para. 150).

The reasoning of the German Federal Constitutional Court in this 1983 census ruling was that the individual is a personality that develops within the social community and is dependent on communication. Information is a reflection of social reality that cannot be attributed exclusively to the data subject. There is a tension between the individual and the community. This is resolved in our legal system in favour of the Gemeinschaftsbezogenheit (i.e. being related to the community) and Gemeinschaftsgebundenheit (i.e. being bound to the community) [according to BVerfG, Judgement of 15 December 1983 - 1 BvR 209/83 and others -, para. 150].

It follows from Article 52 I CFR that limitations on the exercise of the rights and freedoms recognised in the Charter (and thus also on the right to private life and the right to data protection) may be made if they meet objectives of general interest recognised by the Union. The limitation must be provided for by law, respect the essence of the fundamental right concerned and be necessary in compliance with the principle of proportionality.

The GDPR contains only a few provisions that directly regulate the admissibility of data processing in the public interest. As a rule, specific provisions in the law of the Union or the Member States are required (cf. Art. 6 III 1 GDPR). These provisions can provide fo

- Processing obligations in the public interest (Art. 6 I c GDPR)

- Processing obligations because of tasks in the public interest (Art. 6 I e Alt. 1 GDPR)

- Processing authorisations in the public interest (Art. 6 I e Alt. 2 GDPR)

Moreover, the GDPR contains numerous references to the public interest in general and to specific public interests, which are shown on the tiles of this page.