EU: State Secrets Exemption under GDPR

The State Secrets Exemption within the GDPR explicitly excludes the processing of personal data by Member States when such activities fall within the scope of national security or related matters, which are regulated under other frameworks, such as the Treaty on European Union (TEU).

Text of Relevant Provisions

GDPR Art.2(2)(b):

"This Regulation does not apply to the processing of personal data: (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;"

Original (Language):

"This Regulation does not apply to the processing of personal data: (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;"

Analysis of Provisions

• State Secrets Exemption: Article 2(2)(b) of the GDPR specifically exempts the processing of personal data by Member States when these activities fall under Chapter 2 of Title V of the Treaty on European Union (TEU). This chapter primarily covers the Common Foreign and Security Policy (CFSP), which includes national security, defense, and other sensitive governmental activities.
• Rationale and Scope: The rationale behind this exemption is to avoid overlap between general data protection regulations and specialized frameworks governing national security and related state activities. By excluding such activities from the GDPR, the regulation acknowledges that national security is a matter best left to individual Member States, which can enact their own rules to ensure data protection in these sensitive areas.
• Legal Separation: The exemption creates a clear legal separation between data processing activities subject to the GDPR and those governed by other legal regimes, such as the TEU or national laws related to security and defense. This ensures that the GDPR does not interfere with the Member States' ability to manage their security affairs effectively.

Implications

• For Businesses: Companies dealing with or alongside government entities in areas related to national security should be aware that their data processing activities may be exempt from the GDPR if they fall within the scope of the CFSP or similar frameworks. This could mean less stringent data protection requirements but also greater scrutiny under national security laws.
• Compliance Considerations: Businesses must carefully assess whether their activities might intersect with national security functions, which could trigger this exemption. In such cases, they should consult with legal experts specializing in national security law to ensure compliance with relevant national regulations rather than relying solely on GDPR guidelines.