The rights of the data subject are not absolute rights. This evident legal fact is confirmed by the case law of the highest courts:

German Federal Constitutional Court: “The guarantee of this right to ‘informational self-determination’ is not entirely unrestricted. Individuals have no right in the sense of absolute, unrestricted control over ‘their’ data” (Judgement of 15 December 1983 – 1 BvR 209/83 et al -, para. 150).

 

European Court of Justice: “The right to the protection of personal data is not an absolute right” (Judgement of 24 November 2019 - C-507/17 -, para. 60).

On the one hand, the rights of the data subject are restricted by public interests:

Art. 52 I 2 CFR: “Subject to the principle of proportionality, limitations may be made […] if they are necessary and genuinely meet objectives of general interest recognised by the Union […].”

 

German Federal Constitutional Court: “Individuals must therefore in principle accept restrictions on their right to informational self-determination in the overriding public interest” (Judgement of 15 December 1983 – 1 BvR 209/83 et al -, para. 150).

On the other hand, the rights of the data subject are restricted by the rights of others:

Art. 52 I 2 CFR: “Subject to the principle of proportionality, limitations may be made […] if they are necessary and genuinely meet […] the need to protect the rights and freedoms of others.”

 

German Federal Constitutional Court: The right to informational self-determination “must be balanced against the freedom to gather, process and use information for one’s own purposes, including changing purposes” (Decision of 6 November 2019 - 1 BvR 16/13 -, para. 87).

 

European Court of Justice: “The right to the protection of personal data […] must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality” (Judgement of 24 November 2019 - C-507/17 -, para. 60).

Accordingly, the data subject’s rights contain various exemptions. A couple of these rights provide for numerous exemptions, others contain no exemptions at all. The Tiles on this page show which aspects according to the GDPR justify exemptions. Roughly summarised, these are:

• Rights and freedoms of others (esp. freedom of expression and information)
• Expectations of confidentiality
• Prosecution of legal claims
• Impossibility and disproportionality
• Impairing the achievement of processing
• Risk considerations
• Public interest
• Union law or Member State law

There is no recognisable system behind the exemptions. On the contrary, the exemptions are highly incoherent. Especially those provisions that do not take into account the rights of other persons than the data subject’s rights could well be regarded as disproportionate and thus contrary to primary law.

In order to avoid this legal consequence, the fundamental rights of the Charter of Fundamental Rights may have to be used directly to justify exemptions for the purpose of balancing the rights of the data subject against those of the controller and other persons. Cf. also Art. 1 II and Rec. 4 (2) GDPR.