Article 87 GDPR: Difference between revisions

From GDPRhub
Line 195: Line 195:
Article 87 GDPR further provides that if a member state decides to adopt specific measures regarding the processing of NON, it also has to implement appropriate safeguards to ensure the protection of the rights and freedoms of citizens.<ref>Van Eecke/Simkus, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 87 GDPR, p. 1224 (Oxford University Press 2020).</ref> Article 87 GDPR does not specific which additional safeguards should be implemented, leaving once again full discretion to Member States in this respect.   
Article 87 GDPR further provides that if a member state decides to adopt specific measures regarding the processing of NON, it also has to implement appropriate safeguards to ensure the protection of the rights and freedoms of citizens.<ref>Van Eecke/Simkus, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 87 GDPR, p. 1224 (Oxford University Press 2020).</ref> Article 87 GDPR does not specific which additional safeguards should be implemented, leaving once again full discretion to Member States in this respect.   


In line with this provision, Member States around the EU have adopted different strategies. Belgium or Sweden, for example, have been following a system of general application, as already permitted under Article 8(7) DPD. By contrast, Austria or Portugal for example have adopted more specific rules regarding the processing of NIN by limiting its use by or within the public sector.<ref>Van Eecke/Simkus, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 87 GDPR, p. 1225 (Oxford University Press 2020).</ref>   
In line with this provision, Member States around the EU have adopted different strategies in relation to the processing of NIN. Belgium, for example, has adopted a specific law in this respect (''[https://www.ejustice.just.fgov.be/cgi_loi/change_lg.pl?language=fr&amp;la=F&amp;cn=1983080836&amp;table_name=loi Loi du 8 aout 1983 organisant un registre national des personnes physiques]''), completed by several royal decrees, which specifically identify the actors which can process NIN, as well as the conditions for such processing to take place. Similar laws have been adopted in Austria, Finland, France, the Netherlands, or Portugal, to name a few. In many Member States, the use of NIN is therefore more strictly regulated, beyond the general rules set in the GDPR.<ref>Van Eecke/Simkus, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 87 GDPR, p. 1225 (Oxford University Press 2020).</ref>   


== References ==
== References ==

Revision as of 13:16, 29 November 2021

Article 87 - Processing of the national identification number
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 87 - Processing of the national identification number

Member States may further determine the specific conditions for the processing of a national identification number or any other identifier of general application. In that case the national identification number or any other identifier of general application shall be used only under appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation.

Commentary

National identification numbers (NIN) as understood in Article 87 GDPR are used as a unique and trustworthy method by state authorities for identifying a particular person, so that public services might be provided to that person while also respecting their right to privacy.[1] Member States can choose whether they want to adopt a system of multiple numbers which could be used either by all state authorities for any public administration purpose, or only by specific authorities for limited purposes.

The complexity and sensitivity of the issue, which is linked to that of state sovereignty, has led the EU legislator not to fully harmonize these rules under the GDPR. Since there are no specific rules in this respect at the EU level, it is up to each Member State to determine the conditions under which these NIN can be processed in compliance with the GDPR. The NIN is for example not ibso facto characterized as sensitive data in the sense of Article 9 GDPR. Yet, each Member State has the possibility to characterize NIN as sensitive personal data at the national level, and to impose additional conditions on controllers or processors that need or wish to process NIN. This was already the case under Article 8(7) of the DPD, i.e. the precursor of Article 87 GDPR.

Article 87 GDPR further provides that if a member state decides to adopt specific measures regarding the processing of NON, it also has to implement appropriate safeguards to ensure the protection of the rights and freedoms of citizens.[2] Article 87 GDPR does not specific which additional safeguards should be implemented, leaving once again full discretion to Member States in this respect.

In line with this provision, Member States around the EU have adopted different strategies in relation to the processing of NIN. Belgium, for example, has adopted a specific law in this respect (Loi du 8 aout 1983 organisant un registre national des personnes physiques), completed by several royal decrees, which specifically identify the actors which can process NIN, as well as the conditions for such processing to take place. Similar laws have been adopted in Austria, Finland, France, the Netherlands, or Portugal, to name a few. In many Member States, the use of NIN is therefore more strictly regulated, beyond the general rules set in the GDPR.[3]

References

  1. Van Eecke/Simkus, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 87 GDPR, p. 1226 (Oxford University Press 2020).
  2. Van Eecke/Simkus, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 87 GDPR, p. 1224 (Oxford University Press 2020).
  3. Van Eecke/Simkus, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 87 GDPR, p. 1225 (Oxford University Press 2020).