> Unfortunately, national security services are not subject to GDPR or LED at all
They are AFAIK, but can be exempt of articles 12 to 22 under national law. What did I miss?
They are AFAIK, but can be exempt of articles 12 to 22 under national law. What did I miss?
Article 4 of the Treaty on European Union states that "competences not conferred upon the Union in the Treaties remain with the Member States" and "[i]n particular, national security remains the sole responsibility of each Member State".
Article 2(2) of the GDPR states that "This Regulation does not apply to the processing of personal data [] in the course of an activity which falls outside the scope of Union law".
Article 3(3) of the LED includes similar text (with the word "Directive" replacing the word "Regulation").