menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Spain) language
Contact our local member in Spain mail_outline
Visit the website of RPCC Estudio Jurídico account_balance

arrow_backPrevious Article
Article 90
Next Articlearrow_forward

Obligations of secrecy

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 90 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 90 keyboard_arrow_up
Show the recitals of the Regulation related to article 90 keyboard_arrow_down Hide the recitals of the Regulation related to article 90 keyboard_arrow_up

(164) As regards the powers of the supervisory authorities to obtain from the controller or processor access to personal data and access to their premises, Member States may adopt by law, within the limits of this Regulation, specific rules in order to safeguard the professional or other equivalent secrecy obligations, in so far as necessary to reconcile the right to the protection of personal data with an obligation of professional secrecy. This is without prejudice to existing Member State obligations to adopt rules on professional secrecy where required by Union law.

There is no recital in the Directive related to article 90.

The GDPR

For the record, pursuant to Article 58, paragraph 1, points e) and f), the supervisory authorities have investigative powers allowing them access to the processed data, the processing means, and to the premises of the controller which can cause difficulties when the controller or the intended processor is subject to a duty of professional secrecy.

It is therefore logical that Article 90 allows Member States to adopt specific rules to protect the professional secret or other equivalent obligations of secrecy in such cases.

Each Member State must consider if such rules are necessary and proportionate for reconciling the right to personal data protection and the obligation of secrecy.

The rules on confidentiality that can be adopted by the Member States in order to define the powers of the supervisory authorities are limited to the personal data that the controller or the processor has received or obtained as part of an activity covered by the obligation of secrecy.

Finally, Article 90 (2) imposes on the Member States the obligation to notify the Commission of the rules adopted pursuant to this provision within two years after the publication of the Regulation in the Official Journal of the European Union; any subsequent amendment to these rules must be notified without delay to the Commission.

The Directive

The Directive included no similar provision.

Potential issues

Again, there is no harmonisation of the law made by the Regulation as it is up to the Member States to define such rules as they see fit.

arrow_back Previous Article • Article 90 • Next Article arrow_forward
arrow_back Previous Article • Article 90 Next Article arrow_forward
arrow_back Previous Article • Article 90 Next Article arrow_forward
Retour au sommaire
arrow_back Previous Article • Article 90 Next Article arrow_forward
Regulation
1e 2e

Art. 90

1.   Member States may adopt specific rules to set out the powers of the supervisory authorities laid down in points (e) and (f) of Article 58(1) in relation to controllers or processors that are subject, under Union or Member State law or rules established by national competent bodies, to an obligation of professional secrecy or other equivalent obligations of secrecy where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy. Those rules shall apply only with regard to personal data which the controller or processor has received as a result of or has obtained in an activity covered by that obligation of secrecy.

2.   Each Member State shall notify to the Commission the rules adopted pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.
1st proposal close

Art. 84 

1. Within the limits of this Regulation, Member States may adopt specific rules to set out the investigative powers by the supervisory authorities laid down in Article 53(2) in relation to controllers or processors that are subjects under national law or rules established by national competent bodies to an obligation of professional secrecy or other equivalent obligations of secrecy, where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy. These rules shall only apply with regard to personal data which the controller or processor has received from or has obtained in an activity covered by this obligation of secrecy.

2. Each Member State shall notify to the Commission the rules adopted pursuant to paragraph 1, by the date specified in Article 91(2) at the latest and, without delay, any subsequent amendment affecting them.
2nd proposal close

Art. 84 

1. (…) Member States may adopt specific rules to set out the (…) powers by the supervisory authorities laid down in points (da) and (db) of Article 53(1) in relation to controllers or processors that are subjects under Union or Member State law or rules established by national competent bodies to an obligation of professional secrecy, other equivalent obligations of secrecy or to a code of professional ethics supervised and enforced by professional bodies, where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy. These rules shall only apply with regard to personal data which the controller or processor has received from or has obtained in an activity covered by this obligation of secrecy.

2. Each Member State shall notify to the Commission the rules adopted pursuant to paragraph 1, by the date specified in Article 91(2) at the latest and, without delay, any subsequent amendment affecting them.
Directive close

No specific provision
Spain
compare_arrows
visibility Old law

No specific Spanish provision; GDPR Article applies directly
Old law close

Article 35.3.- Nature and legal status.- Organic Law 15/1999 on the Protection of Personal Data.-

The posts in the bodies and services belonging to the Data Protection Agency shall be filled by officials of the public administrations and by staff recruited to this end, in accordance with the functions assigned to each post. The staff is obliged to keep secret any personal data of which they acquire knowledge in the performance of their task.

 

 
Norway close

Ingen tilsvarende bestemmelse
arrow_back Previous Article • Article 90 Next Article arrow_forward
close

2016 - www.itiplaw.eu.