RegSol Blog


EDPB Statement on data subject rights in connection to the state of emergency in Member States.

June 2020

The European Data Protection Board (EDPB) is an independent European body, which contributes to the consistent application of data protection rules throughout the European Union, and promotes cooperation between the EU’s data protection authorities. 

The statement was issued by the EDPB after the adoption by the Hungarian government of a decree on 4th of May 2020.  As per this decree “ ….. all measures following data subject’s request exercising the rights based on Articles 15 to 22 of the GDPR are suspended until the end of the state of danger….”

The statement outlines that data protection does not impede the fight against the COVID-19 pandemic and Article 23 of the GDPR allows under specific conditions, restrictions by way of  legislative measures, to the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34.  

A restriction must  “… respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard, inter alia, important objectives of general public interest of the Union or of a Member State, in particular public health.”

The EDPB is very clear that “ …even in these exceptional times, the protection of personal data must be upheld in all emergency measures,….”

It is evident that while we deal with this unexpected pandemic the rights enshrined in GDPR must be complied with by data controllers and processors and any restrictions must be limited in their duration and scope. 

The EDPB has issued various statements since the pandemic began and the tone of all of them is that the pandemic does not allow the rights in detailed in the Charter of Fundamental Rights of the European Union and under GDPR to be swept aside in order to tackle COVID-19.

To read the article in full click HERE 

To read all of the EDPBs articles and statements visit HERE


By Éilish Larkin - Regulatory Consultant