Personal Data & Research
European Citizens have a fundamental right to privacy. It is important for organisations, which process personal data to be cognisant of this right. Therefore GDPR also applies to any research that uses personal data, including scientific research and studies in the arts and humanities. This may include public health research, studies on health outcomes, epidemiology, social sciences, politics and modern history.
Under GDPR data controllers are required to specify the purpose or purposes of processing and for how long data will be retained. Data controllers are also not allowed to do any further processing, beyond the original purpose.
GDPR recognises that in the context of research it will not always be possible to be so specific from the outset. GDPR also recognises that frequently in a research context secondary processing of personal data collected will be required to achieve the research goals.
Therefore, to address this challenge, Article 6(4) allows for subsequent processing operations that are ‘compatible’ with the primary purpose without having to seek renewed consent. Recital 50 specifies that further processing for research purposes ‘should be considered to be compatible’.
The GDPR creates an exemption to the principle of purpose limitation for research. Article 5(1)(b) states, “further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes.” Article 89 sets out the safeguards that controllers must implement in order to further process personal data for research.