CJEU Rules Member States Cannot Expand GDPR Derogations Beyond Article 85(2)
Written by AI from the linked story. Not reviewed by an editor. How this works
The CJEU clarified that national Member States do not have the authority to create data protection exemptions beyond those explicitly permitted under GDPR Article 85(2), which covers journalistic, academic, artistic, and literary expression. Organizations and legislators who assumed broader national derogations were permissible now face significant legal exposure if their processing activities relied on those extended exemptions. Critically, the ruling reaffirms that data subjects retain full access to GDPR Chapter VIII remedies — including complaints and legal proceedings — even when sensitive data such as criminal convictions is published online, and cannot be restricted to defamation law alone. This matters because it closes a loophole that some publishers and data processors may have exploited to avoid accountability under the GDPR's robust enforcement framework.
Tactical Insight
Immediate Actions
- Audit all data processing activities that rely on national derogations to confirm they fall strictly within GDPR Article 85(2) permitted categories.
- Review any internal policies or legal opinions that assumed broader national exemptions were valid and update them to reflect this ruling.
Compliance & Legal Improvements
- Ensure data subject rights procedures — including complaint and remedy pathways under GDPR Chapter VIII — are fully operational and not restricted to defamation or other narrow legal channels.
- Engage legal counsel to assess whether current data processing for publishing or media activities complies with the narrowly defined Article 85(2) derogations.
- Update privacy notices and Records of Processing Activities (RoPA) to accurately reflect the lawful basis for any sensitive data processing.
Governance & Training Measures
- Train legal, compliance, and editorial teams on the boundaries of GDPR derogations to prevent inadvertent non-compliance.
- Establish a regulatory monitoring process to track CJEU and national court rulings that affect GDPR interpretation and enforcement.