Article 5 GDPR
Legal Text
1. Personal data shall be:
- (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
- (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);
- (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
- (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
- (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
- (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).;
2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).
Relevant Recitals
Commentary
Article 5 GDPR sets out all the guiding principles to be observed when processing personal data: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Other principles are further articulated and affirmed in different parts of the Regulation. For example, the transparency principle underlies Article 13 on which information to provide before the processing. The integrity and confidentiality principles are confirmed and estalished by Article 32 on security. The accountability principle finds its roots in Articles 24 and 25 GDPR.
(1) Principles
The principles specified by Article 5 GDPR are the main "bottleneck" for the legality of any processing operation - together with the requirement to have a legal basis under Article 6 to 10 GDPR. Any controller or processor must comply with all elements of Article 5 GDPR.[However, the data processing principles can be restricted by Union or Member State law under the conditions set forth in Article 23 GDPR.]
(a) Lawfulness, Fairness and Transparency
Lawful
In order to be “lawful”, processing should comply with Article 6 to 10 GDPR (Article 6 is headed “Lawfulness of processing”) and its requirement to base any processing operation on at least one of the six legal bases it exhaustively lists.[1] However, lawfulness is not limited to compliance with Article 6. Indeed, the European Union Agency for Fundamental Rights has affirmed that “the principle of lawful processing is also to be understood by reference to conditions for lawful limitations of the right to data protection or of the right to respect for private life in light of Article 52(1) of the Charter of Fundamental Rights of the European Union ('CPR') and of Article 8(2) ECHR”.[2] Thus, any processing that violates either the GDPR or any national provision would render the processing of data illegal.[3]
Fair
Fairness, is an overall requirement of the GDPR., Concepts like “Fairness” are inherently vague, but may serve as an interpretive tool for situation that may not be in violation of the letter of the law, but clearly not “fair”. Indeed, it is a highly contextual question whether a certain processing operation can be considered as "fair". It is for these reasons that the recent EDPB Guidelines on data protection by design and by default are particularly welcome.[4] As de Terwangne and Bygrave have correctly pointed out, the "guidelines […]cast light on how the core principles of Article 5 shall be understood and applied in various hypothetical scenarios. Especially noteworthy is the guidelines’ explanation of the criterion of ‘fairness’ in Article 5(1)(a)".[5]
In these guidelines, the EDPB provides a non-exhaustive list of certain elements of fairness which should always be respected while processing personal data. The list is particularly detailed and examples range from providing the data subject with a high level of autonomy in controlling the processing to the right to fair algorithms and human intervention. Other important elements of fairness are officially recognised, such as the data subjects' expectations to a reasonable use of their data, the right not be discriminated or exploited as a consequence of certain psychological weaknesses. The imbalance of power between the controller and data subject often existing in certain intrusive profiling and processing operations seems connected to these principles.[6]
Fairness can be especially relevant in problematic business practices, when controllers try to manipulate data subjects. This happens, for example, when a controller implements tools, such as a cookie banner, which does not provide the users with effective privacy choices (“Accept all cookies” button with no possibility to reject them) or otherwise adopts subtle psychological tricks to obtain the user consent (for instance, if the “Accept” button is displayed in a bright green and the “Refuse” one is placed in a light grey colour at the bottom of the banner). The EDPB clarifies that, in order for the processing to be “fair”, no deception is allowed in data processing and that all options should be provided in an objective and neutral way, avoiding any deceptive or manipulative language or design.[7]
Further, certain guidance on fairness may also be drawn from Recital 42 which highlights that “[i]n accordance with Council Directive 93/13/EEC a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms”. The Unfair Contract Terms Directive aims to protect consumers against unfair clauses included in pre-formulated contracts. The Directive applies to “all contracts concluded between sellers or suppliers and consumers”[8] and declares that a contractual clause “shall be regarded as unfair if, contrary to the requirement of good faith, it causes a significant imbalance in the parties’ rights and obligations arising under the contract, to the detriment of the consumer.”
From this angle, not only the terms and conditions between controller and data subject, but also the privacy policies pursuant to Articles 13 and 14 GDPR, especially if the processing is based on the legal basis of the contract pursuant to Article 6(1)(b) GDPR, as well as, more generally, all communications between controller and data subject (Recital 42), must be inspired by criteria of good contractual faith and must not generate an imbalance between the parties to the relationship.
Transparent
In general terms, the transparency principle requires that the data subject is fully aware of the processing of any personal data. Recital 39 GDPR contains a number of explanatory statements regarding the transparency principle. In particular, "it should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed." Data subjects should be "made aware of risks, rules, safeguards, and rights in relation to the processing [...] and how to exercise their rights." All information communicated should be "accessible and easy to understand" and in "clear and plain language". The transparency principle is closely linked, among the others, to Articles 12(1), 13, 14, 15 19 and 22(3) GDPR. These articles clarify that the information provided to the data subject must be timely, clear and detailed (Article 12 GDPR), provided both before the processing takes place (Articles 13 and 14 GDPR) and after the operations have begun (Article 15 GDPR).
The information in question has essentially two purposes. On the one hand, in application of the principle of foreseeability provided for by EU law, allows the data subject to direct its choices. For example, on the basis of the privacy policy ex Article 13 GDPR, the data subject can decide not to use a certain service.[9] On the other hand, it allows the data subject to verify the fairness of the processing and possibly exercise further rights under the GDPR. For example, following a request for access under Article 15 GDPR, the data subject may decide to exercise its right of rectification or objection to processing for a certain purpose. [S4]
(b) Purpose Limitation
While the controller is free to achieve any legitimate purpose, Article 5(1)(b) sets out the principle of purpose limitation in the processing of personal data. It requires that personal data be collected for specified, explicit and legitimate purposes and ensures that, after collection, data are not used for purposes that are incompatible with the original ones. Many other provisions of the GDPR refer back to the purpose of the processing activity. Just to name a few, Article 4(7) defines the controller as the natural and legal person which, alone or jointly with others, determines the “purpose” of the processing. Article 5(1)(b) GDPR itself stipulates that personal data shall be collected only for specified, explicit and legitimate “purposes”. Article 5(1)(d) determines the time data may be kept by referring to the purpose, Article 6(1)(a) GDPR allows consent for one or more “specific purposes”. This makes the proper definition of purposes a crucial step for compliance with the GDPR. Example: A data subject may share highly personal data in a medical context to get the best treatment, but may not agree that the same information is shared for the purpose of medical advertisement.
Specific
Because the purpose of processing operations is meant to limit them to a specific, pre-defined, aim, it cannot be overly broad. Purposes that are too broad would undermine the protections that the purpose limitation principle tries to establish. Broad descriptions like "improving the user experience", "marketing", "research" or "IT security" are not sufficiently defined.[10] For example, in its Guidelines on video surveillance, the EDPB clarified that monitoring purposes need to be specified for every surveillance camera in use and “[v]ideo surveillance based on the mere purpose of “safety” or “for your safety” is not sufficiently specific”.[11] While a purpose may not be too broad, there is no limitation as to how specific a purpose may be. The exact level of specificity is not objectively defined in the GDPR. In many cases it is possible to split broad purposes into multiple, more specific purposes.
Explicit
The purpose may not only be defined internally, but must be explicitly stated. This requirement is inextricably linked to the principle of transparency analysed in the previous paragraph. Indeed, a processing purpose that is made explicit (i.e. in a transparent manner) seems to be the only way to allow the data subject both a prior control (whether to accept a certain processing) and a subsequent one (hypothetically, following a request for access under Article 15 GDPR).
Legitimate
The use of personal data for the stated purpose must be legal[MS5]. This qualification includes laws beyond the GDPR and national data protection laws (like consumer or worker protection laws).
Further processing
The principle of purpose limitation shall ensure that controllers do not engage in "secondary use" ("further processing") of personal data when such processing is incompatible with the original purpose(s). For this reason, “[p]urposes for processing personal data should be determined from the very beginning, at the time of the collection of the personal data”.[12] According to the WP29 opinion, the compatibility of the further processing must be assessed taking into account various parameters such as the relationship between the original and the further purposes, the context of the data collection, the reasonable expectation of the data subject with regard to future processing, also considering the relationship between the data subject and the controller, the impact of further processing, the necessity of further processing and the existence of adequate safeguards for the data subject.[13] Failure to comply with the compatibility requirement set forth in Article 5(1)(b) of the GDPR renders the processing unlawful.
Example: a doctor may not suddenly use their patient's health data for marketing purposes, as this would be a "secondary use" that goes beyond the original purpose.
The above is true except for three types of cases. Indeed, the compatibility requirement does not need to be met if the further processing is (i) authorized by the data subject by giving consent (Article 6(4) GDPR), (ii) based on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1) GDPR or, finally, is meant for (iii) archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (Article 5(1)(b) GDPR). The purpose limitation principle extends to all recipients to whom the personal data have been disclosed. This is reflected in the notification obligation outlined in Article 19 GDPR.[14]
(c) Data Minimisation
Unlike the previous Directive 95/46/EC, under which data processing did not have to be “excessive”, the GDPR specifies that it must be “limited to what is necessary” to achieve the purpose. This principle is therefore closely related to the principle of purpose limitation and only makes sense if the latter is well defined by the controller. Once the two parameters are defined (processing and purpose), then it is possible to assess whether the processing is limited to what is necessary to achieve the purpose. If the outcome is negative (i.e. processing is excessive), the the operations are per se illegal. A controller must then review each step of a processing operation and also each data element towards the necessity to achieve the purpose. For instance, an online shop may not ask for more personal details than what is necessary to deliver the product.
In a recent decision, the CJEU had to provide some guidance on how to assess whether a certain processing (in that case, a video surveillance system) could be considered ‘necessary’ for the purposes of the legitimate interests pursued by the controller. The Court held that the the necessity of a processing operation must be examined in conjunction with the data minimisation principle which restricts the controller's options to those "adequate, relevant and not excessive in relation to the purposes for which they are collected". In conclusion, the Court clarified that the controller must, amongst other things, examine "whether it is sufficient that the video surveillance operates only at night or outside normal working hours, and block or obscure the images taken in areas where surveillance is unnecessary".[15]
Example: XXX
(d) Accuracy
Article 5(1)(d) requires that data be accurate and, where necessary, kept up to date, and that all reasonable steps be taken to delete or rectify inaccurate data promptly (Recital 39).
Accuracy of data expresses a more general principle of the correct representation of the person at the most diverse levels and in the most diverse contexts and is one of the essential prerequisites of the right to informational self-determination.[16] The WP29 points out that the principle of accuracy applies not only to facts that are processed about a person, but also to value judgments, in particular forecasts and correlations.[17] This is particularly relevant for modern forms of automated profiling, artificial intelligence-powered processing and machine-learning systems. Indeed, value judgements can also be wrong if they are based on an erroneous factual basis, assume wrong premises or are the result of incorrect conclusions (e.g. that there is a correlation between a date and a person's solvency).[18] Which way to ensure that the data is accurate depends greatly on the circumstances of the case and the type of processing being done.
Example: A public protocol is meant to record an incident of a certain day. If elements of the protocol are inaccurate, they must be corrected. At the same time, the age of the persons may not be changed every time a person turns a year older.
Some provisions of the Regulation provide precise indications on which types of intervention are possible. For example, Article 16 GDPR establishes the right of the data subject to obtain the integration of incomplete data. Article 17 allows the erasure of the data if certain conditions are met, including, for example, where the processing of that personal data is no longer necessary, or in case of revocation of consent or even if the data has been collected in an unlawful manner. However, in these cases Article 19 GDPR provides that the exercise of rights is also communicated (with similar consequences) to all those who have received the data previously.
(e) Storage Limitation
The principle of storage limitation imposes a time limit on any processing operation. It follows that once all purposes of a processing operation are fulfilled, the operation must stop. The controller must inform the data subject about the storage period (or the criteria to define it, Article 13(2)(a) and Article 14(2)(a) GDPR) as well as ensure and demonstrate compliance with this principle (Article 5(2) GDPR). Storage periods should therefore be defined internally before the processing begins.[19]
Example: XXX
Deletion or Anonymisation
Data can be deleted or anonymised by controllers. The latter means that any link between the data and the relevant person must be removed. Controllers have complied with Article 5(1)(e) once the data does not relate to an identifiable person. The GDPR imposes an active duty on the controller[20] to delete data. The controller may not wait for an action by the data subject (e.g. under Article 17 GDPR) but must proactively delete information. In practice, the principle requires that the controller implements deletion practices or automatic deletion systems. The time by which any deletion has to be executed depends on the purpose. In many cases there are fixed legal deadlines, like record keeping duties or the statute of limitations that determine the need to retain data. In other cases, the deadline depends on other factual elements (e.g. when a customer cancels a contract) that make continuous processing irrelevant for the purpose.
Exception
An exception to the principle of storage limitation is contained in the last part of Article 5(1)(d) in favour of processing for archiving, statistical, scientific and historical research purposes. In these cases, the GDPR allows "longer periods" of storage, and in so doing takes into account the social interest in research and the preservation of the collective memory. However, in order for the exception to apply, technical and organizational measures must be put in place, as set out in Article 89(1).
(f) Integrity and Confidentiality
The GDPR requires technical and organisational measures to ensure that data is neither lost nor destroyed.
Integrity
A data subject may not only be harmed by the illegitimate processing of their personal data but also as a result of the loss of data. For example, if a hospital loses the personal data of a patient, they may get an incorrect treatment. The controller must also ensure that data is not falsely deleted or altered. Threats to the integrity of personal data may come from the controller, third parties or from an accident.
Confidentiality
Confidentiality aims to protect data against unauthorised access and thus against unauthorised processing. The controller must therefore also implement technical and organisational measures to ensure that personal data is not falsely disclosed, hacked or lost. This includes that unauthorised persons neither have access to the data nor to the devices on which they are processed (Recital 39). The requirements for data security are further defined in Article 32 GDPR.
(2) Accountability
The first part of Article 5(2) highlights that the controller is responsible for complying with Article 5(1) GDPR as well as with all other relevant provisions of the GDPR. More detailed provisions about the responsibilities of the controller can be found throughout the GDPR, e.g. Article 24 GDPR. In addition to being responsible, the controller also has to be able to demonstrate compliance with the law. However, the provision does not further specify how a controller has to demonstrate compliance, as this is highly dependent on the processing operation and the type of organisation carrying it out. In most cases, written documentation will be used to demonstrate compliance. If applicable, a record of processing actives (see Article 30 GDPR) is also typically sufficient.
Decisions
→ You can find all related decisions in Category:Article 5 GDPR
References
- ↑ Herbst, in Kühling, Buchner, DS-GVO BDSG, Article 5 GDPR, margin number 8 (C.H. Beck 2020, 3rd Edition).
- ↑ de Terwangne, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 5 GDPR, p. 314 (Oxford University Press 2020).
- ↑ Herbst, in Kühling, Buchner, DS-GVO BDSG, Article 5 GDPR, margin number 9 (C.H. Beck 2020, 3rd Edition).
- ↑ EDPB, ‘Guidelines 4/2019 on Article 25 Data Protection by Design and by Default’, 20 October 2020 (Version 2.0) (available here).
- ↑ de Terwangne, Bygrave, in Kuner et al., The EU General Data Protection Regulation (GDPR) [Update of Selected Articles - May 2021] Article 5 GDPR, p. 68 (Oxford University Press 2020).
- ↑ EDPB, ‘Guidelines 4/2019 on Article 25 Data Protection by Design and by Default’, 20 October 2020 (Version 2.0), p. 18 (available here). See also CJEU, Case C-201/14, Bara, 1 October 2015, margin numbers 32, 34 (available here).
- ↑ EDPB, ‘Guidelines 4/2019 on Article 25 Data Protection by Design and by Default’, 20 October 2020 (Version 2.0), p. 18 (available here).
- ↑ This control mechanism “is not limited to specific types of contracts such as sales or services contracts. The Directive applies to contracts concluded by electronic means, for the provision of digital content and services and irrespective of the counter-performance. The Directive potentially applies to a broad range of online transactions, such as downloading a “free” app from the iStore, buying a newspaper article at Blendle, and subscribing to an online advertising-funded music streaming service.” Borgesius, Helberger, Reyna, The perfect match? A closer look at the relationship between EU Consumer Law and Data Protection Law, in Common Market Law Review, Volume 54, Issue 5 (2017) pp. 1427 – 1465
- ↑ The fact that citizens are unable to foresee the consequences of the act is incompatible with fundamental principles of EU law, such as the principles of legal certainty and the protection of legitimate expectations. The principle of legal certainty means, in essence, that the individuals concerned must be able to ascertain the scope of their rights and to foresee the consequences of their actions. See, to that effect, CJEU judgments C 313/99 § 47, and of C 480/00, C 482/00, C 484/00, C 489/00 to C 491/00 and C 497/00 to C 499/00, § 85.
- ↑ WP29, ‘Opinion 03/2013 on purpose limitation’, 00569/13/EN WP 203, 2 April 2013, p. 16 (available here).
- ↑ EDPB, ‘Guidelines 3/2019 on processing of personal data through video devices’, 29 January 2020 (Version 2.0), p. 9 (available here).
- ↑ de Terwangne, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 5 GDPR, p. 315 (Oxford University Press 2020).
- ↑ WP29, ‘Opinion 03/2013 on purpose limitation’, 00569/13/EN WP 203, 2 April 2013, p. 21 (available here).
- ↑ Frenzel, in Paal, Pauly, DS-GVO BDSG, Article 5 GDPR, margin numbers 29 (C.H. Beck 2018, 3rd Edition).
- ↑ CJEU, Case C-708/18, TK v Asociaţia de Proprietari bloc M5A-ScaraA, 11 December 2019 (rectified 13 February 2020), margin number 51 (available here).
- ↑ Resta, in Riccio, Scorza, Belisario, GDPR e Normativa Privacy - Commentario, Article 5 GDPR (Wolters Kluwer 2018), p. 59.
- ↑ WP29, ‘Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679’, 17/EN WP251rev.01, 3 October 2017 (available here).
- ↑ Schantz, in Wolff, Brink, BeckOK Datenschutzrecht, Article 5 GDPR, margin number 27 (C.H. Beck 2020, 36th Edition).
- ↑ Schantz, in Wolff, Brink, BeckOK Datenschutzrecht, Article 5 GDPR, margin number 32 (C.H. Beck 2020, 38th Edition); Herbst in Kühling, Buchner, DS-GVO BDSG, Article 5 GDPR, margin number 66 (C. H. Beck 2021, 3rd ed.).
- ↑ Schantz, in Wolff, Brink, BeckOK Datenschutzrecht, Article 5 GDPR, margin number 34 (C.H. Beck 2020, 36th Edition).
