EDRi’s proposed new Article
Article 7a – Further processing for incompatible purposes
1. Member States may adopt legislative measures allowing further processing for incompatible purposes if such processing is strictly necessary:
(a) for compliance with a legal obligation to which the controller is subject; or
(b) in order to protect the vital interests of the data subject or of another person; or
(c) for the prevention of an immediate and serious threat to public security.
2. Legislative measures referred to in paragraph 1 shall provide for:
(a) an individual assessment taking into account all relevant circumstances of the case; and
(b) adequate safeguards for the rights of the data subject.
Following the logic of the Directive, Article 7 should only deal with grounds for lawfulness for the initial purpose of a processing operation, while points (b) to (d) of the Commission proposal should be moved to a self-standing provision, i.e. this newly proposed Article 7a. Its scope is further clarified in recital 20a.