Article 7a*
EDRi’s proposed new Article
Article 7a – Further processing for incompatible purposes1. Member States may adopt legislative measures allowing further processing for incompatible purposes if such processing is strictly necessary: (a) for compliance with a legal obligation to which the controller is subject; or (b) in order to protect the vital interests of the data subject or of another person; or (c) for the prevention of an immediate and serious threat to public security. 2. Legislative measures referred to in paragraph 1 shall provide for: (a) an individual assessment taking into account all relevant circumstances of the case; and (b) adequate safeguards for the rights of the data subject. |
Justification
Following the logic of the Directive, Article 7 should only deal with grounds for lawfulness for the initial purpose of a processing operation, while points (b) to (d) of the Commission proposal should be moved to a self-standing provision, i.e. this newly proposed Article 7a. Its scope is further clarified in recital 20a.

