Material scope: matters outside EU law and the household exemption
Even an in-scope organisation has some processing carved out of the GDPR by Article 2. Article 2(2)(a) excludes activities outside the scope of Union law - public security, defence and national security. Article 2(2)(b) excludes member state activities under the EU's common foreign and security policy. The household exemption in Article 2(2)(c) exempts processing by a natural person in the course of a purely personal or household activity (e.g. correspondence, address books). The CJEU reads it narrowly: in Lindqvist, publishing parish data on the internet was not domestic; in Ryneš, home CCTV capturing a public footpath was not 'purely' household. Recital 18 newly extends the exemption to social networking/online activity used for social and domestic purposes.
Article 2(2)(a) excludes processing in the course of an activity outside the scope of Union law - covering public security, defence and national security. Article 2(2)(b) excludes member state activities under the EU's common foreign and security policy. Note: data first collected for commercial purposes but later used for security purposes may fall within these exemptions. In the UK, processing by the intelligence services is governed by Part 4 of the Data Protection Act 2018, not the UK GDPR.
The household exemption (Article 2(2)(c)) covers processing by a natural person in a purely personal or household activity - e.g. correspondence and address books, even if they incidentally concern others, provided use is personal and not connected to professional or business activities. The GDPR still applies to the platform/controller that provides the means for such personal processing.
| Case | Facts | Held |
|---|---|---|
| Lindqvist (C-101/01) | A volunteer published personal data about parish colleagues on her personal website | Not covered - data made accessible to an indefinite number of people, so not a private/family activity |
| Ryneš (C-212/13) | Home security camera captured images of a public footpath outside the house | Not a 'purely' personal/household activity - exemption is narrowly construed |
Recital 18 newly states social networking and online activities used for social and domestic purposes fall within Article 2(2)(c). But the WP29 called the narrow case-law reading 'unrealistically narrow', and it remains unclear how far Recital 18 actually widens the exemption, since the Article's wording itself is unchanged from the Directive.