Article 32i

Public sector bodies allowing the re-use of data and documents under this Chapter shall apply appropriate technical and organisational measures to prevent the re-identification of pseudonymised data, personal data breaches, and any unlawful acquisition, use, disclosure or transfer of the data. Where the data are made available in pseudonymised or anonymised form, state-of-the-art privacy-preserving and privacy-enhancing techniques shall be applied to that effect. Data and documents relating to natural persons, or protected by trade secrets or by a legal obligation of confidentiality relating to legal persons, shall be made available for re-use only where they have been anonymised or, where anonymisation is not possible, subject to appropriate safeguards, including such techniques and binding conditions on the re-user preventing any re-identification or misuse.'

This Regulation does not create any obligation on public sector bodies to allow the re-use of data, nor does it release public sector bodies from their confidentiality obligations under Union or national law.'

(1a)This Regulation does not create any obligation on public sector bodies to allow the re-use of data, nor does it release public sector bodies from their confidentiality obligations under Union or national law.

A public sector body that has allowed the re-use of data and documents in accordance with this Chapter, and that has applied the measures referred to in paragraph 11, shall not be held liable for any unlawful use, re-identification, disclosure or onward transfer of the data carried out by the re-user or by any third party to whom the re-user has made the data available. The re-user shall ensure that its re-use of the data, and any onward transfer of the data, complies with this Chapter and with Union and national law, including Regulation (EU) 2016/679. The re-user shall be liable for any misuse, unlawful re-identification or unauthorised transfer of the data carried out by it or by such third parties. This paragraph is without prejudice to the liability of the public sector body for a failure to comply with its own obligations under this Chapter.'

1b.This Regulation does not create a legal basis for the processing of personal data, nor does it affect any of the rights and obligations set out in Regulation (EU) 2016/679.'

(da)data and documents of the armed forces, intelligence services, police and law enforcement authorities, public prosecutors’ offices and courts, tax and customs authorities, health and social services authorities, population registers, migration and asylum authorities, as well as data of minors, biometric or genetic data and communication data, unless their re-use is explicitly allowed by a specific national law;’

aa.data or documents whose disclosure would reveal trade secrets within the meaning of Directive (EU) 2016/943, or information otherwise protected by a legal obligation of confidentiality relating to legal persons.'

ga.data or documents containing personal data relating to the health, tax or financial situation, residence, or civil status of natural persons, as well as personal data covered by a legal or professional obligation of confidentiality, in particular medical confidentiality or the confidentiality of judicial decisions, the re-use of which is liable to harm the rights and freedoms of the persons concerned or to enable their identification.'

This Chapter shall not create a legal basis or obligation for the processing, disclosure, access to, or re-use of personal data. Nothing in this Chapter shall be interpreted as limiting the rights of data subjects or the obligations of controllers and processors under Regulations (EU) 2016/679 and (EU) 2018/1725.'

In the case of mixed datasets, Regulation (EU) 2016/679 applies. Personal data shall not be made available for re-use unless a valid legal basis exists under that Regulation and appropriate safeguards are applied.'