A’ 137/29.08.2019 GOVERNMENT GAZETTE sector, regardless of the validity of the contract, as well as job applicants and former workers. Article 28 Processing and freedom of expression and information 1. To the extent necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression, the processing of personal data is allowed where: (a) the data subject has given his or her explicit consent, (b) it relates to personal data which are manifestly made public by the data subject, (c) the right to freedom of expression and the right to information override the right to the protection of the data subject’s personal data, in particular on matters of general interest or where it relates to personal data of public figures, and (d) where it is limited to what is necessary to ensure freedom of expression and the right to information, in particular with regard to special categories of personal data, criminal proceedings, convictions and related security measures, taking into account the right of the data subject to his or her private and family life. 2. To the extent necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression, the following shall not apply: (a) Chapter II of the GDPR (principles), except for Article 5, (b) Chapter III of the GDPR (rights of the data subject), c) Chapter IV of the GDPR (controller and processor), except for Articles 28, 29 and 32, (d) Chapter V of the GDPR (transfer of personal data to third countries or international organisations), (e) Chapter VII of the GDPR (cooperation and consistency) and f) Chapter IX of the GDPR (specific data processing situations)”. Article 29 Processing of personal data for archiving purposes in the public interest 1. By way of derogation from Article 9(1) of the GDPR, the processing of special categories of personal data within the meaning of Article 9(1) of the GDPR shall be allowed where it is necessary for archiving purposes in the public interest. The controller shall have the obligation to take suitable and specific measures to protect the data subject's legitimate interests. Such measures may include, as far as possible, in particular: (a) access rights restrictions to controllers and processors; (b) pseudonymisation of personal data; (c) encryption of personal data; (d) designation of a DPO. 2. By way of derogation from Article 15 of the GDPR, the data subject’s right of access to data relating to him or her may be restricted where the exercise of that right is likely to render impossible or seriously impair the achievement of the objectives referred to in paragraph 1, and the exercise 3387 of the right would entail a disproportionate effort. 3. By way of derogation from Article 16 of the GDPR, the data subject shall not have the right to have the personal data relating to him or her rectified where the exercise of that right is likely to render impossible or seriously impair the achievement of the objectives referred to in paragraph 1 or the exercise of the rights of others. 4. By way of derogation from subparagraphs (a), (b) and (d) of Article 18(1), and from Articles 20 and 21 of the GDPR, the rights of the data subject shall be restricted where their exercise is likely to render impossible or seriously impair the achievement of the objectives referred to in paragraph 1 and where such limitations are deemed to be necessary for the achievement of such objectives. Article 30 Processing of personal data for scientific or historical research purposes or for the collection and maintenance of statistical information 1. By way of derogation from Article 9(1) of the GDPR, the processing of special categories of personal data, within the meaning of Article 9(1) of the GDPR, shall be allowed without the consent of the data subject where the processing is necessary for scientific or historical research purposes, or for the collection and maintenance of statistical information, and the interest of the controller is overriding the interest of the data subject in not having his or her personal data processed. The controller shall have the obligation to take suitable and specific measures to protect the data subject's legitimate interests. Such measures may include, in particular: (a) access rights restrictions to controllers and processors; (b) pseudonymisation of personal data; (c) encryption of personal data; (d) designation of a DPO. 2. By way of derogation form the provisions of Articles 15, 16, 18 and 21 of the GDPR, the rights of the data subject shall be limited where their exercise is likely to render impossible or seriously impair the achievement of the objectives referred to in paragraph 1 and where such limitations are deemed to be necessary for their achievement. For the same reason, the data subject’s right of access provided for in Article 15 of the GDPR shall not apply where personal data are necessary for scientific purposes and the provision of information would entail a disproportionate effort. 3. In addition to what is referred to in paragraph 1, special categories of personal data, where processed for the purposes of paragraph 1 shall, unless it is contrary to the legitimate interest of the data subject, be anonymised as soon as the scientific or statistical purposes allow. Until then, the characteristics that can be used to match individual details associated with personal or real situations of an identified or identifiable person must be stored separately. These characteristics can only be combined with individual details if required for research or statistical purposes. 4. The controller may publish personal data processed in the context of research, if the data subjects have given their consent in writing or the publication is necessary for