The right to protection of personal data is not an absolute right, but must be balanced against other fundamental rights, in accordance with the principle of proportionality [see Tile …]. The right to informational self-determination “must be balanced against the freedom to gather, process and use information for one’s own purposes, including for changing purposes” [BVerfG, Order of 6 November 2019 - 1 BvR 16/13 -, para. 87].
This multidimensionality of fundamental rights is insufficiently recognised by the GDPR as a whole. Among the rights and freedoms of natural persons that the GDPR seeks to protect, the fundamental rights of the controller are hardly explicitly taken into account.
Therefore, the fundamental rights of the Charter of Fundamental Rights must be used directly for the interpretation of the term "rights and freedoms". If the processing serves the purpose of the controller to assemble or unite with others, the data controller can rely on Art. 12 I CFR for this purpose:
“Everyone has the right to freedom of peaceful assembly and to freedom of association at all levels, in particular in political, trade union and civic matters, which implies the right of everyone to form and to join trade unions for the protection of his or her interests.”
In Germany, freedom of assembly is guaranteed by Art. 8 GG and freedom of association by Art. 9 GG.
Example: Anyone who calls for a demonstration against a politician is exercising their right to assemble freely and peacefully with others.
However, only a few provisions of the GDPR explicitly take into account that the processing of personal data may be necessary for the exercise of freedom of association or assembly:
Art. 9 II d: “activities by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim”
Art. 14 V d: “statutory obligation of secrecy”
Rec. 45 (6): “professional association”
Rec. 51 (6): “certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms”
Rec. 56: “processing personal data on people's political opinions by parties”
In the absence of provisions in the GDPR that are adequate for fundamental rights, the principle of proportionality (Art. 52 I CFR) must be applied in order to weigh up the rights of the data subject against the right of the controller to freedom of association or assembly (see Practical Concordance, Tile P.04). Cf. furthermore Art. 1 II GDPR and especially Rec. 4 (2) GDPR:
“The right to the protection of personal data is not an absolute right; it must be […] balanced against other fundamental rights, in accordance with the principle of proportionality.” [see also Tile CO.01].