Article 23

Restrictions

1. The scope of the obligations and rights referred to in Articles 12 to 22 and Article 34, as well as in Article 5, in so far as the provisions of those Articles correspond to the rights and obligations referred to in Articles 12 to 20, may be limited by provisions of Union or Member State law applicable to the controller or processor, provided that such limitation does not affect the substantial content of fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

   • national security;

   • national defense;

   • public safety;

   • the prevention, investigation, detection and prosecution of criminal offenses or the execution of penalties, including the protection against and prevention of threats to public safety;

   • other important objectives of general interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and fiscal matters, public health and social security;

   • the protection of judicial independence and judicial proceedings;

   • the prevention, investigation, detection and prosecution of violations of professional codes for regulated professions;

   • a monitoring, inspection or regulatory task connected, even occasionally, with the exercise of public authority in the cases referred to in paragraphs (a) through (e) and (g);

   • the protection of the data subject or the rights and freedoms of others;

   • the collection of civil claims.

2. In particular, the legislative measures referred to in paragraph 1 shall contain specific provisions concerning, as appropriate, at least:

   • The purposes of the processing or categories of processing,

   • the categories of personal data,

   • The scope of the restrictions introduced,

   • the safeguards to prevent misuse or unauthorized access or transmission,

   • the specification of the controller or categories of controllers,

   • storage periods and applicable safeguards, taking into account the nature, scope and purposes of the processing or categories of processing,

   • the risks to the rights and freedoms of data subjects, and

   • the right of data subjects to be informed of the restriction, unless this may detract from the purpose of the restriction.