EDRi’s proposed new recital
The simple fact that two purposes both relate to the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties does not necessarily mean that they are compatible. For example, information about victims of crime should not be used for investigating them for unrelated crimes they might have committed. However, there are cases in which further processing for incompatible purposes should be possible if necessary to comply with a legal obligation to which the controller is subject, in order to protect the vital interests of the data subject or another person, or for the prevention of an immediate and serious threat to public security. Member States should therefore be able to adopt national laws providing for such derogations to the extent strictly necessary. Such national laws should contain a requirement of an individual assessment taking into account all circumstances of the case and provide for adequate safeguards, such as for example judicial authorisation.
This new recital reflects the splitting of Article 7 into two parts, with the new Article 7a containing derogations from the general principles for lawfulness of processing. To this end, this new recital further explains the notion of (in)compatible further processing.