The GDPR may be restricted in order to safeguard the state or its citizens in the case of:
- National security, defence and public security
- In cases where it is necessary for the prevention, investigation, detection or prosecution of criminal offences
- In cases where it is necessary in the execution of criminal penalties, including safeguarding against and the prevention of threats to public security
- Other important objectives of general public interest of the European Union or of a Member State, particularly important economic or financial interests such as monetary, budgetary and taxation matters
- Issues of public health and social security of the European Union or of a Member State
- The protection of judicial independence and judicial proceedings.
Furthermore, in the case of personal data processed by or on behalf of a court when acting in its judicial capacity, the data subject's rights and the obligations of the controller of that personal data as referred to in section 158(1) of the Data Protection Act 2018 (link) are restricted to the extent that the restrictions are necessary and proportionate to safeguard judicial independence and court proceedings.
The following rules have been made under section 158(3) of the Data Protection Act 2018 for the purpose of ensuring the effective application of a restriction under section 158(1):
Persons wishing to have access to a court record in court proceedings to which they are a party should firstly make inquiries of the court office concerned.
The following rules apply to requests to access personal data contained in a court record by bona fide members of the press or broadcast media:
The following rules have been made governing the processing on behalf of a court of personal data controlled by that court when acting in its judicial capacity:
Processing of personal data contained in a record of the Supreme Court, Court of Appeal or High Court
Processing of personal data contained in a record of the Circuit Court
Processing of personal data contained in a record of the District Court
Processing of personal data, other than a court record, controlled by a court when acting in its judicial capacity