Opening Clause for Member State Law (Article 9(4) GDPR)

Article 9(4) GDPR allows the Member States to introduce or maintain further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health. The opening clause gives the national legislature latitude in an area in which the GDPR is particularly closely interwoven with sector-specific legislation.

1 Overview

1.1 Subject matter and scope

Article 9(4) GDPR attaches only to three of the nine categories set out in Article 9(1) GDPR: genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning health. For the remaining categories (for example, political opinions or trade union membership) there is no corresponding general opening; there, the Member State is confined to the ground-specific opening clauses in Article 9(2) GDPR (points (b), (g), (h), (i) and (j)).

1.2 Independent scope alongside paragraph 3

Where processing is based on Article 9(2)(h) GDPR, Article 9(3) GDPR specifies the requirements relating to the persons involved (professional secrecy, obligations of secrecy). Alongside this, Article 9(4) GDPR retains an independent scope: it permits requirements that go beyond professional secrecy, such as the technical and organizational measures laid down in § 22(2) BDSG, in so far as these are also extended to point (h).

1.3 Direction of the clause: stricter rules, possibly also relaxations

Whether Article 9(4) GDPR supports only stricter rules or also relaxations of the lawfulness requirements is disputed.

Arguments against relaxations:

• Wording: "conditions, including limitations" points toward stricter rules rather than a lowering of standards.
• Recital 53 GDPR: the free movement of data within the Union must not be impeded by national provisions. A lowering of standards at national level would run counter to harmonization.
• Recital 54, fourth sentence, GDPR: the power to legislate relates to the processing and the conditions attaching to it, not to the rights of data subjects.

The opposing view. Part of the literature considers that provisions expanding processing powers are also permissible, provided that appropriate safeguards remain in place, for instance in order to facilitate the secondary use of data concerning health in research. The provision is worded without any preconditions, an argument invoked in support of this view.

The approach that is robust in practice. Irrespective of the doctrinal dispute, every national provision adopted under Article 9(4) GDPR must be suitable, necessary and proportionate to the protective purpose pursued. A relaxation of the lawfulness requirements that holds up under constitutional and Union law can be constructed at most within narrow limits and with compensating safeguards. The safe strategy in practice remains to read Article 9(4) GDPR as an authorization to impose stricter rules; provisions that expand processing powers should primarily be based on the ground-specific opening clauses in paragraph 2.

2 German implementation

2.1 Central provision: § 22 BDSG

The central implementing provision for Article 9(2)(b), (g), (h) and (i) GDPR is § 22 BDSG; § 22(1) No. 1(b) BDSG at the same time transposes the requirements of Article 9(3) GDPR. § 22(2) BDSG sets out the required "appropriate safeguards" by way of example and in flexible terms: the catalog serves as guidance and leaves the controller room for implementation appropriate to the context. The requirements of § 22(2) BDSG that "go beyond" the level of protection under Article 9(3) GDPR are based on the opening clause in Article 9(4) GDPR.

2.2 Further processing: § 23(2) BDSG

For the further processing of sensitive data, § 23(2) BDSG makes clear that, in addition to the general requirements of § 23(1) BDSG (transposing Article 6(4) GDPR), an exception under Article 9(2) GDPR or under § 22 BDSG is always required as well. The cumulative assessment is thus expressly carried forward to changes of purpose.

2.3 Employment context: § 26(3) BDSG

§ 26(3) BDSG governs the processing of sensitive data for the purposes of the employment relationship and is based in part on Article 9(2)(b) GDPR. It tightens the requirements for the validity of consent in the employment context and prescribes a balancing of interests for special categories. Account must be taken of the way it is embedded in the limits applicable under Article 88 GDPR to national rules on employee data protection.

2.4 Research, statistics and archiving: §§ 27, 28 BDSG

§§ 27, 28 BDSG were adopted (also) in implementation of Article 9(2)(j) GDPR and give concrete form to the appropriate safeguards for processing for scientific or historical research purposes and for statistical and archiving purposes.

2.5 Sector-specific provisions

In Germany, Article 9(4) GDPR is given content above all by sectoral specialized legislation. The most important areas:

• Genetic data: the German Genetic Diagnostics Act (GenDG), in particular § 8 GenDG on consent to genetic testing, with requirements that go beyond Article 9(2)(a) GDPR. In addition: §§ 81e-81h of the German Code of Criminal Procedure (StPO) on molecular genetic testing in criminal proceedings, § 3a of the German Embryo Protection Act (ESchG) on preimplantation genetic diagnosis, and § 1598a of the German Civil Code (BGB) on the determination of biological paternity.
• Data concerning health: the books of the German Social Code (SGB I, V, VI, VII, X, XI), the German Infection Protection Act (in particular §§ 6 et seq. IfSG), the German Transplantation Act (§ 7 TPG), the German Medicinal Products Act (AMG), the German Medical Devices Act (MPG), the German Transfusion Act (§ 14 TFG), the cancer registry acts of the Federation and of the Länder, the German Fiscal Code (§ 30 AO) and a barely manageable number of further special statutes. § 213 of the German Insurance Contract Act (VVG) (collection of data concerning health by insurers from third parties) may be maintained pursuant to Article 9(2)(h) GDPR in conjunction with paragraph 4.
• Biometric data: the German Identity Cards Act (§ 5(5) and (9) PAuswG), the German Passport Act (§ 4(4) PaßG), residence law (§ 49(1) of the German Residence Act (AufenthG)), the German Asylum Procedure Act (§ 16(1a) AsylVfG), the German Code of Criminal Procedure (§ 81b StPO), police acts (for example, § 24 of the German Federal Police Act (BPolG)). At European level, the Eurodac Regulation.

Specifically for social data protection, § 67b(1), third sentence, SGB X lays down a transmission proviso that takes precedence: by way of derogation from Article 9(2)(b) and (d) to (j) GDPR, the transmission of biometric, genetic or health data is permissible only in so far as there is a statutory power of transmission under §§ 68-77 SGB X or under another provision of that Code; § 22(2) BDSG applies accordingly.

In addition, there are special European legal acts in the health and data space context, including the Data Governance Act and the planned regulation on a European Health Data Space (EHDS). The EHDS builds on Article 6(1) and Article 9(2) GDPR and is intended to displace national law within its scope; to that extent, Article 9(4) GDPR is restricted as the earlier law. In future, national tightening will have to operate within the framework of the EHDS.

3 Practical implications

3.1 Federalism and problems of oversight

The opening clauses of the GDPR, and Article 9(4) GDPR in particular, give rise to a web of European and national rules. In federally structured Member States such as Germany, Länder legislation is added to the mix (including health data protection in the hospital acts, cancer registry acts and police acts of the Länder). For legal practice this means that controllers must examine three levels:

3.2 Typical pitfalls

• The requirements of § 22(2) BDSG also apply to grounds that contain no express safeguards clause in Article 9 GDPR itself, in so far as § 22 BDSG refers to the ground in question. The independent basis in Article 9(4) GDPR has to be borne in mind here.
• In the case of genetic data, the stricter requirements of the GenDG (form of consent, medical information duties, confidentiality obligations) must be complied with cumulatively alongside the GDPR requirements. Genetic diagnostic research is not yet regulated in its own right; persistent regulatory gaps remain here.
• For biometric data in the field of public identity documents, sector-specific provisions with a narrow purpose linkage apply: use for extraneous purposes is not permissible, even if Article 9(2) GDPR would supply another exception. Biometric passport rules are tenable under Union law only where there is strict purpose limitation and a high standard of technical security.
• Collective agreements under Article 88 GDPR may impose additional requirements in the employment context that go beyond the statutory protective regime.
• As regards the research privilege in Germany, researchers still have no dedicated right to refuse to give evidence and no dedicated protection against seizure ("research confidentiality"); the interplay with § 27 BDSG and the research clauses in Länder and sector-specific statutes is complex.

3.3 Internal market aspect

Anyone processing sensitive data across borders must examine whether the national tightening measures applicable in each case are compatible with Union law. Absolute prohibitions of processing without any proportionality reservation, or with a discriminatory effect, are open to challenge under Union law; legitimate tightening measures to protect highly sensitive categories (for example, genetic data) have so far been recognized by the CJEU where they are proportionate and neutral as regards the internal market.