1. Member States may adopt specific rules to set out the powers of the supervisory authorities laid down in points (e) and (f) of Article 58(1) in relation to controllers or processors that are subject, under Union or Member State law or rules established by national competent bodies, to an obligation of professional secrecy or other equivalent obligations of secrecy where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy. Those rules shall apply only with regard to personal data which the controller or processor has received as a result of or has obtained in an activity covered by that obligation of secrecy.
Article 90 GDPR - Obligations of secrecy
2. Each Member State shall notify to the Commission the rules adopted pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.
Relevant Recitals
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Paragraph 1 permits Member States to adopt specific rules setting out the powers of supervisory authorities under points (e) and (f) of Article 58(1) in relation to controllers or processors bound by professional secrecy or equivalent obligations. Such rules are admissible only where necessary and proportionate to reconcile the protection of personal data with the obligation of secrecy.
Only the investigative powers to obtain access to personal data and information under point (e) of Article 58(1) and to obtain access to premises, including data processing equipment, under point (f). The corrective powers of Article 58(2) and the other investigative powers of Article 58(1) are not covered.
No. The second sentence of paragraph 1 limits the national rules to personal data which the controller or processor has received as a result of, or has obtained in, an activity covered by the obligation of secrecy. Data held outside that activity, such as the professional's own staff records, remains subject to the full powers of Article 58.
The obligation must arise under Union or Member State law or under rules established by national competent bodies, and it must be an obligation of professional secrecy or an equivalent obligation. A purely contractual confidentiality undertaking does not meet this threshold.
Yes. Paragraph 2 required each Member State to notify the Commission of the rules adopted under paragraph 1 by 25 May 2018, and any subsequent amendment affecting them must be notified without delay.