Material scope: matters outside EU law and the household exemption
Even an in-scope organisation has some processing carved out of the GDPR by Article 2. Article 2(2)(a) excludes activities outside the scope of Union law - public security, defence and national security. Article 2(2)(b) excludes member state activities under the EU's common foreign and security policy. The household exemption in Article 2(2)(c) exempts processing by a natural person in the course of a purely personal or household activity (e.g. correspondence, address books). The CJEU reads it narrowly: in Lindqvist, publishing parish data on the internet was not domestic; in Ryneš, home CCTV capturing a public footpath was not 'purely' household. Recital 18 newly extends the exemption to social networking/online activity used for social and domestic purposes.
Article 2(2)(a) excludes processing in the course of an activity outside the scope of Union law - covering public security, defence and national security. Article 2(2)(b) excludes member state activities under the EU's common foreign and security policy. Note: data first collected for commercial purposes but later used for security purposes may fall within these exemptions. In the UK, processing by the intelligence services is governed by Part 4 of the Data Protection Act 2018, not the UK GDPR.
The household exemption (Article 2(2)(c)) covers processing by a natural person in a purely personal or household activity - e.g. correspondence and address books, even if they incidentally concern others, provided use is personal and not connected to professional or business activities. The GDPR still applies to the platform/controller that provides the means for such personal processing.
| Case | Facts | Held |
|---|---|---|
| Lindqvist (C-101/01) | A volunteer published personal data about parish colleagues on her personal website | Not covered - data made accessible to an indefinite number of people, so not a private/family activity |
| Ryneš (C-212/13) | Home security camera captured images of a public footpath outside the house | Not a 'purely' personal/household activity - exemption is narrowly construed |
Recital 18 newly states social networking and online activities used for social and domestic purposes fall within Article 2(2)(c). But the WP29 called the narrow case-law reading 'unrealistically narrow', and it remains unclear how far Recital 18 actually widens the exemption, since the Article's wording itself is unchanged from the Directive.
Key terms - quick answers
What is “Article 2”?
What is “Article 2(2)(a)”?
What is “Article 2(2)(b)”?
What is “Household exemption”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.