CONCLUSIONS ........................................................................................................... 44 ANNEX 1 – FIGURES AND TABLES ...................................................................................... 45 ANNEX 2 – QUESTIONNAIRE ON RELEVANT NATIONAL LAWS AND PRACTICES .............. 53 ANNEX 3 – SOURCES OF INFORMATION ........................................................................... 63 ANNEX 4 - ACRONYMS AND ABBREVIATIONS ................................................................. 77 ANNEX 5 - ENDNOTES ........................................................................................................ 79 5 ABSTRACT The European Union (EU) has always promoted scientific research. It is increasingly a European Commission priority, particularly in the context of the current COVID-19 pandemic. Scientific research often requires the processing of personal data, including special categories of personal data (for example, in the field of medical research). To ensure that data protection law does not hinder the development of research, the General Data Protection Regulation (GDPR) provides for certain specific rules for scientific research. In particular, it facilitates the reuse of data for scientific purposes (secondary use of data). However, the term ‘scientific research’ is not defined in the GDPR and the rules concerning secondary use could be interpreted and/or implemented differently across EU Member States. The objective of this study was to investigate the secondary use of personal data in the context of scientific research (in particular in the medical domain) by providing an overview of international agreements, EU and Member States’ legislation and practices on the principles of purpose limitation and lawfulness, and the application of data subjects’ rights in light of exemptions from the transparency obligation provided in the GDPR. The methodology consisted of desk research (scientific literature, reports, position papers), supplemented by questionnaire responses on national laws from academic researchers with relevant expertise. In total, the study obtained input on 18 countries (out of the targeted 30 EU and European Economic Area (EEA) Member States). The results highlighted the lack of a uniform approach among Member States on key aspects of the secondary use of personal data for scientific research. The study recommends increased dialogue between Member States’ Supervisory Authorities (SAs), sharing of national practices and interpretations, and cooperation between SAs, European institutions and bodies and key stakeholders. In addition, the European Data Protection Board (EDPB) could adopt guidelines that specifically address the secondary use of data for scientific research. The study discusses the main issues that require guidance and proposes how they might be approached. 6 EXECUTIVE SUMMARY The objective of this study was to investigate the secondary use of personal data in the context of scientific research (in particular in the medical domain), by providing an overview of international agreements, European Union (EU) and Member State legislation and practices on the principles of purpose limitation and lawfulness, and the application of data subjects’ rights in light of exemptions from the transparency obligation provided in the General Data Protection Regulation (GDPR). The methodology consisted of desk research (review of scientific literature, reports, position papers), supplemented by questionnaire responses on national laws received from academic researchers with relevant expertise. In total, the study obtained input on 18 of the targeted 30 EU and European Economic Area (EEA) Member States. The legislation analysed was not limited to the GDPR but included international agreements or documents containing data protection rules (such as Council of Europe Convention 108+) and ethical standards (such as the World Medical Association (WMA)’s Declaration of Helsinki (DH) and EU sectoral legal frameworks (e.g. on clinical trials, biobanks). Analysis of these different legal texts and their application within the Member States examined found the following:  Two main international frameworks apply to secondary use of personal data for scientific research: data protection rules as they have evolved historically, and ethical standards. A data controller who conducts secondary use of personal data has to consider and apply both consistently. Overlaps, including in terminology (for instance, consent as an ethical requirement versus consent as one of the possible legal bases under the GDPR) make this a challenging task. Further research on the overlap between the two frameworks would be beneficial.  The notion of ‘scientific research’ is not explicitly defined in the GDPR, although some elements are provided in its Recitals. Few of the countries examined provide an overarching definition in their national legislation (with the exception of national lex specialis , e.g. for medical research). Based on the commonly accepted characteristics in EU and international legal texts, the concept of scientific research could be described or defined as: any research for a scientific purpose, financed by public authorities or the private sector, carried out in accordance with the established ethical standards and the methodology applicable in the sector concerned by the research. The scientific scope may include the development and demonstration of technologies, basic research, academic or applied research.  On the possibility to reuse personal data for scientific research, several uncertainties remain with regard to the l awfulness and purpose limitation data protection principles , and the impact of EU sectoral laws (such as the Clinical Trials Regulation (CTR) and biobank rules) on those principles. The choice of the possible legal basis (under Article 6 GDPR) and the most appropriate condition that could allow the processing of special categories of data (e.g. health data), pursuant to Article 9 of the GDPR for conducting scientific research, is a challenging task, particularly for transnational research. Members States often have divergent interpretations, with some still requiring consent, despite the European Data Protection Board (EDPB) and the European Commission’s position on clinical trials. The possibility to ground the secondary use of personal data in ‘broad consent’ (Recital 33 GDPR) is another point of divergence between Member States. ‘Secondary use’ is an established term in EU data protection legislation. It could pertain to either further compatible processing or non-compatible processing. There are different views at 7 institutional, national and scholarly level as to whether a new legal basis is required for the ‘secondary use’ of personal data. The study concluded that a legal basis is required for secondary use for scientific research purposes – this could either be the same as that for primary use or a new legal basis. Ten of the 18 countries examined had special advice available on the implementation of the presumption of compatibility of secondary use for scientific research. The views presented varied. Finland, for example, recently established a central licensing authority to facilitate secondary processing of health and social data, which is under the custody of several controllers. Such data are now centralised at national level, with a Data Permit Authority deciding on access requests.  The secondary use of personal data may impact the application of data subjects’ rights. A key issue here is how the rules on processing of personal data that do not require identification (Article 11 GDPR) fit with the transparency obligation and right to information of data subjects. Few Member States provide guidance on this topic, or on the related application of the exemption to information duty for scientific research in Article 14(5)(b) GDPR. In general, it is recommended that the transparency obligation be complied with via the assistance of the original data controller (through contractual agreements). France and Italy have both adopted a similar procedure, with authorisation required from the Data Protection Authority (DPA) prior to secondary use of personal data (including sensitive data), in cases where the controller (a third party) can rely on Article 14(5) GDPR. The analysis revealed no insights into Article 89(1) GDPR in the majority of the countries and there is no conclusive answer as to whether or not Member States alone can determine the appropriate safeguards, or whether the data controller can decide. The results showed no uniform approach/interpretation among Member States on key aspects related to the secondary use of personal data for scientific research. A distinction could be made between challenges caused by a lack of uniformity in the interpretation of key elements of the GDPR and challenges caused by divergences in Member States’ implementation of the GDPR. The study thus recommends encouraging increased dialogue between Member States’ Supervisory Authorities (SAs) and information sharing on national practices and interpretations, as well as improved cooperation between SAs, European institutions and bodies and key stakeholders. The EDPB and other European institutions and bodies could establish closer exchanges in order to align their advice on the interplay of the GDPR and other sectoral laws. The EDPB could promote the set-up of relevant codes of conduct (as per Article 40 GDPR) and stress the importance of involving all key stakeholders in the creation of such codes. It could also adopt specific guidelines on the secondary use of data for scientific research. The study discusses the main issues that require guidance and proposes how they might be approached. It also emphasises the importance of empirical research to gather the views and experiences of key stakeholders, and the need to investigate the role of ethics committees in data protection matters. 8 1 INTRODUCTION This chapter briefly outlines the background and objectives of the study (Section 1.1 ), the research questions (Section 1.2 ) and the methodology used (Section 1.3). The structure of this report is presented in Section 1.4 . 1.1 BACKGROUND AND OBJECTIVES OF THE STUDY This report addresses the specific questions raised by the European Data Protection Board (EDPB) on the topic of the secondary use of personal data in the context of scientific research. Varying legislation, practices and views exist in EU Member States with respect to the purpose limitation and lawfulness of the use of personal data for secondary research (secondary use of the data for a research purpose) 1 , especially in the medical domain. The report aims to (i) explain the issues in relation to the research questions, (ii) gather Member States relevant national provisions and interpretations, (iii) find converging approaches in Member States and (iv) propose policy recommendations for the EDPB to improve harmonisation. 1.2 RESEARCH QUESTIONS The subject of this report is the regime for the secondary use of personal data for scientific research. The study first tackles all specific concepts used in the General Data Protection Regulation (GDPR) 2 . The following questions were asked by the EDPB:  What is the meaning of ‘scientific research’ in the GDPR, in both a medical and non-medical context?  What shall be understood by ‘primary’ and ‘secondary use’ of personal data?  How is ‘scientific research’ understood in Member States? The main question in this legal study concerns the meaning of the purpose limitation and lawfulness principles in the context of the secondary use of personal data for research in a medical and non-medical context. It seeks to provide insights into the relationship between primary use and secondary (research) use of data from the point of the overarching purpose limitation principle, compatible use and the legal grounds for secondary use for research. The following sub-questions were raised by the EDPB:  How are these principles addressed in international agreements and documents?  What is the impact of EU sectoral legislation, such as the Clinical Trial Regulation and Biobank Regulation on these principles?  How are these principles addressed in legislation and guidance documentations in Member States (and EEA states)? The research focused on the secondary use of health data in the medical context. The third part of the study relates to limitations on data subjects’ rights and secondary use for research . The following areas were examined:  The relationship between Article 11 GDPR and the obligation to inform data subjects of the secondary use of personal data (Articles 13 and 14 GDPR);  The obligation of Article 89(1) GDPR to de-identify personal data for research and access by the controller/sponsor of clinical trials;  The information exception for research under Article 14(5)(b) GDPR. Finally, the research looked for converging elements in the national legislation of the 30 countries and formulated policy recommendations for the EDPB. 9 1.3 METHODOLOGY The issues (stocktaking) and questions were selected by the EDPB Secretariat and sub-groups. The results of the study are mainly based on desk research, in particular the collection, review and legal analysis of (i) national legislation , relevant scientific literature (academic and legal practice) and reports, and (ii) the questionnaire responses on Member States’ national laws received from the academic researchers in the research group and from a few selected external national experts . This questionnaire (see Annex 2) was developed for the purposes of this study, based on the stocktake of issues mentioned above. The literature selected and consulted includes not only articles in credible legal journals and recent commentaries on the GDPR, but reports and position papers published on internet platforms. The literature includes articles on the legal issues related to the use of personal data for research purposes in general and on the (re-)use of data concerning health (‘health data’ 3 ) for research. While literature on the former was rather limited, literature and reports on the use of health data for research was more widely available and pointed to many open issues and diverging national interpretations. Respondents to the questionnaires also tended to focus more on the secondary use of health data. The questionnaire was submitted to academic researchers from the research group and to several external (academic) contacts. This methodology was suitable, given the breadth and depth of international law researchers in the research team, each acquainted with the legal systems and languages of one of the 30 targeted 30 Member States and European Free Trade Association (EFTA) EEA states. This approach also avoided overburdening the national Supervisory Authorities (SAs) with requests for information. As the research team did not include internal legal researchers for all 30 European countries, the input was limited. National law input, SA guidance (e.g. if only available in a specific language, such as Swedish, Finnish, Maltese) and insights into certain countries required specific national language skills and legal system knowledge that was not available within the team . The intention was to remedy this with input from selected external experts in the remaining countries. Some excellent input was received, although the confidential nature of the study mean that not all experts could be readily contacted. A further difficulty was the lack of an incentive for these external experts to invest time in researching and completing the questionnaire, which likely reduced the replies further. The responses gave rise to other issues not covered in the research questions. Finally, the study was further limited in that the inputs gathered under national law have not been validated – this is recommended to be done with SAs through interview, for example. In total, input was gathered for 18 countries. These are not necessarily representative of the 30 EU/EEA States, however, and it is possible that some specific national positions are missing.The detailed input was structured in various tables and overviews in Excel sheets. The analysis shows general tendencies on many issues, suggesting that they could provide some insights and could usefully be examined in the remaining countries. Another approach worth further investigation (both for this and other data protection studies generally) is to review whether it is possible to cluster countries with similar traditions/views on data protection/specific data protection issues. This report aimed to formulate recommendations based on the legal issues and findings. These recommendations are mainly addressed to the EDPB, which can investigate further consistency measures. 1.4 STRUCTURE OF THE REPORT Chapter 2 discusses the scope of the analysis. Chapter 3 provides a brief overview of the key international agreements and documents that are useful in assessing the concepts of scientific research, the purpose limitation principle, and secondary use of data. Chapter 4 investigates the GDPR concept 10 of ‘scientific research’ and how it is understood in the 18 countries examined. Chapter 5 tackles the question of how to apply the purpose limitation (including compatible use) and lawfulness principles in the context of the secondary use of personal data for research. Sectoral EU legislation is briefly analysed, such as the Clinical Trial Regulation and Biobank Regulation, and the uptake and translation of these principles into national legislation and regulatory documents. The concepts of primary and secondary use are also discussed. Chapter 6 focuses on Article 11 GDPR and data subjects’ rights, including the right to information and transparency, and Article 89 GDPR. The analysis in each of the chapters comprises a short overview and analysis of relevant national legislation and guidance. Chapter 7 contains policy recommendations, with study conclusions presented in Chapter 8. 11 2 SCOPE OF ANALYSIS This chapter presents the scope of the study by presenting the legal issues analysed (Section 2.1 ) and the national jurisdictions covered (Section 2.2 ). 2.1 LEGAL ISSUES The issues analysed are described in the Terms of Reference. The most pressing questions relating to the secondary use of data for research are in the domain of ‘health data’. An important topic is the meaning and scope of the concept of ‘scientific research’ 4 , while questions are raised about the (conditions for) lawful grounds for the processing of health data for secondary use. This report discusses the purpose specification and limitation principle as a key principle that could or should play a role in further understanding the scope of scientific research intended by the legislator. This report does not address the use of personal data held in public databases for scientific research 5 . In addition, while both the report and the country inputs often mention or point to specific national regimes for genetic data and research, an in-depth analysis of specific characteristics, needs and harmonisation avenues of research based on or involving genetic data, while important, falls outside the scope of this study. Further dedicated and specific research on this topic is recommended. New technology and platforms play a role in the secondary use of data, chiefly by allowing more stakeholders to access and reuse data, depending on their roles of (joint) controllership. Again, this was not a focus of this study. 2.2 JURISDICTIONS National experts provided questionnaire responses for 18 countries, of which 17 were EU and EEA countries, i.e. Belgium, Bulgaria, Croatia, Cyprus, Denmark, France, Germany, Greece, Hungary, Italy, Latvia, Netherlands, Norway, Portugal, Romania, Slovakia and Slovenia, and one former EU Member State (United Kingdom). Of these 18 countries, 14 were covered by internal experts, i.e. researchers affiliated with the members of the consortium (KU Leuven, UNamur, Leiden University and Milieu). Three countries - France, Germany and the Netherlands - were covered by external experts known to consortium members. Denmark law was covered by internal experts, using open-access resources available in English. The study of Denmark’s legislation was thus necessarily more limited and mainly focused on the ‘Danish Data Protection Act’. Input for the UK was received from an external expert. References to the UK are considered useful, given its influence on many of the themes of data protection in recent decades. For some of the countries that were not covered via the input of national experts, desk research using scientific papers allowed an analysis of some of the relevant national legislation or interpretation of specific aspects 6 . 12 3 INTERNATIONAL AGREEMENTS AND DOCUMENTS This chapter provides a brief overview of key international agreements and documents that are useful in assessing the concepts of scientific research, the purpose limitation principle, and secondary use of data. The roots of the purpose limitation principle can be traced to various international agreements pertaining to data protection. In addition, when investigating how the principle applies in the context of scientific research, medical research provides a useful example. Therefore, this chapter presents and discusses international documents in both the field of data protection ethical standards in health research. The latter, in particular, may be seen as encoding prevailing assumptions and acceptance of (i) the scope of medical research, (ii) compatibility with initial collection(s) and (iii) expectations of society and individuals. Two general remarks are useful here. Firstly, consent as referred to in the majority of documents discussed below refers to consent as an ethical safeguard to participate in research, and should not be confused with consent as one of the possible lawful grounds based on Article 6(1)(a) GDPR (see Section 4.2) 7 . Secondly, it is commonly accepted that the purpose limitation principle consists of two building blocks: ‘purpose specification’ (personal data must be collected for specified, explicit and legitimate purposes) and ‘use limitation’ (personal data must not be further processed in a manner that is incompatible with those purposes) 8 . Both concepts are embedded in Council of Europe (binding) conventions and recommendations. Also related to ‘use limitation’ is the notion of presumed compatibility of secondary use of personal data for scientific research (Article 5(1)(b) GDPR), i.e. secondary use for the purposes of scientific research shall not be considered to be incompatible with the initial purposes. Section 3.1 discusses the conventions and recommendations adopted by the Council of Europe 9 . Sections 3.2 and 3.3 provide information about documents which have mainly an ethical character and value, i.e. those adopted by the World Medical Association (WMA) and the Organisation for Economic Development and Co-Operation (OECD). 3.1 COUNCIL OF EUROPE: (BINDING) CONVENTIONS AND RECOMMENDATIONS 3.1.1 Scientific research Council of Europe Convention 108 and 108+ Neither Convention 108 (Convention for the protection of individuals with regard to automatic processing of personal data) 10 nor 108+ (Protocol amending the Convention for the protection of individuals with regard to automatic processing of personal data) 11 defines the notion of scientific research. They do, however, provide special derogations to some duties incumbent on the data controller 12 . In the Explanatory Report, the Council of Europe mentions, just as the EU does in the GDPR, that the research must be compliant with ‘ the recognised ethical standards for scientific research’ 13 . However, Convention 108+ states that the purposes of processing the data for scientific research aims at ‘providing researchers with information contributing to an understanding of phenomena in varied scientific fields (epidemiology, psychology, economics, sociology, linguistics, political science, criminology, etc.) with a view to establishing permanent principles, laws of behaviour or patterns of causality which transcend all the individuals to whom they apply’ 14 . Council of Europe Recommendation (97)18 concerning the protection of personal data collected and processed for statistical purposes 15 Recommendation (97)18 provides a kind of definition of the concept of scientific knowledge, stating 13 that ‘ scientific knowledge consists in establishing permanent principles, laws of behaviour or patterns of causality which transcend all the individuals to whom they apply’ 16 . It also states that ‘in the biological and human sciences, much of the research process involves experimentation. In this area, personalised intervention is basic on research, even though statistical analysis may come into play at a later stage. This type of research calls for specific ethical and legal rules which have no place in the field of statistics as defined here’ 17 . 3.1.2 Purpose limitation Council of Europe Convention 108 and 108+ Both building blocks of the purpose limitation principle were introduced in Convention 108 and retained in Convention 108+. Article 5(b) of Convention 108 included the requirement that the purpose of the data processing should be specified (purpose specification) 18 . Article 9 provided for the possibility of derogations from this provision under specific conditions, thus generalising the principle that data can be processed for purposes other than the original ones only under specific circumstances (use limitation) However, Convention 108 did not provide information about the conditions under which the processing of personal data for scientific research could be allowed. 3.1.3 (Secondary) use of personal data for scientific research Council of Europe Recommendation (81)1 on medical databanks 19 In 1981, the Council of Europe adopted Recommendation (81)1, which contains principles for ’medical care, public health, management of medical care or public health services and medical research’ (Article 1(1)). As it contains specific provisions on ‘procedures for requests for use of data for purposes other than those for which they have been collected’ (Article 3(1)(k)), it complements Convention 108, which failed to specify conditions for secondary use of personal data for research. Article 5(4) seems to suggest – based on arguments a contrario - that it should be allowed to communicate and share information collected in medical databanks for the purposes of medical research 20 . Article 5(5) seems to confirm this conclusion, as it allows that data on the same individual from different databanks can be linked for the purposes of medical care, public health or medical research, in accordance with the relevant regulations. However, sharing and linking information is limited, i.e. it must be covered either by a shared obligation to ‘medical secrecy’ or the ‘expressed and informed consent’ of the individual 21 . Council of Europe Recommendations R(97)5 and CM/Rec(2019)2 on protection of health-related data 22 In 1997, Council of Europe Recommendation R(97)5, on the use of health data, mentioned secondary use for research purposes, thus providing more explicit requirements than Recommendation (81)1. It included a provision that explicitly allowed secondary use for research purposes. In additionn to informed consent for one or more purposes, authorised disclosure by a designated body for a ‘defined scientific research project concerning an important public interest’ or law providing for scientific research as ‘a necessary measure for public health reasons’ 23 , the healthcare professional (e.g. treating physician) has a unique position in that they are allowed to ‘further process’ medical data from their patients ‘ to carry out their own medical research ’, ‘subject to complementary provisions determined by domestic law’, on the condition that the data subject has been informed and was given the opportunity to opt-out (Article 12(3)) 24 . This addition of ‘own medical research’ of healthcare professionals based on laws on the use of medical data suggests that such ‘own medical research’ of the healthcare professional is not considered incompatible, whereby domestic law would presumably provide the legal ground and/or safeguards . In other words, this addition could be seen as codification of reasonable expectations of society and data subjects at that time, allowing this type of research, provided it is transparent and consenting. The distinction between medical research conducted by the treating physician and that conducted by others was initially made in 1997, raising the question of whether it remains relevant or the reasonable expectation of the patient has changed 25 . In other words, whether data subjects should be aware of or 14 expect that in order to facilitate scientific progress in the interest of society, health data need to be further processed by several people with different expertise. The issue of multidisciplinary research was reflected in the 2019 Recommendations by the Council of Europe, which replaced Recommendation (97)5 26 . It is now indicated that not only ’healthcare professionals who are entitled to carry out their ‘ own medical research’ , but also ‘ other scientists in other disciplines ’ should be able to use the health related data ‘which they hold’ for research purposes, as long as the data subject has been informed of the possibility beforehand and appropriate safeguards are in place (e.g. explicit consent or the assessment of a competent body)(Article 15(8)). The impact of this provision on the purpose specification and use limitation principle should be considered carefully. While it may broaden the number and type of people who may gain access to a certain dataset and, as such, affect the use limitation principle (the second building block of purpose limitation), it should not cause a shift in the requirement for purpose specification (the first building block). Council of Europe Recommendations of 2016(6) on research on biological materials of human origin 27 The Recommendation states that the interests and welfare of the human being shall prevail over the sole interest of society or science 28 . Obtaining and storage of biological materials for future research can be based on either consent or authorisation, prior to which the individual concerned should be provided with comprehensible information (Article 10). Biological materials can only be used in a research project if the latter is within the scope of the consent or authorisation given by the individual (Article 21(1)). For uses not in the scope of the original consent/authorisation, reasonable efforts should be made to contact the person concerned and obtain consent/authorisation (Article 22(2)(a)). If the attempt to contact the person is unsuccessful, an exception may be made where the research addresses an important scientific interest and is in accordance with the principle of accountability (Article 22(2)(b)(ii)). 3.2 WORLD MEDICAL ASSOCIATION (WMA) Declaration of Helsinki (1964-2013-…) 29 The principal international document on medical research - which is also a form of self-regulation by healthcare professionals - is the Declaration of Helsinki (DH). Initially proclaimed in 1964 by the WMA, and with regular updates (most recently in 2013), it aims to set moral and ethical medical research principles and standards 30 . Its principles have broad scope and are applicable in many domains, including clinical trials and the use of human material stored in biobanks 31 . It should be noted, however, that the Clinical Trials Regulation (CTR) 32 refers to an older version of the DH (2008), see Recital 80 CTR. The primary purpose of medical research involving human subjects is to generate new knowledge - more specifically, to understand, improve and evaluate 33 . However, the interest of the individual will always prevail, and participation shall be voluntary. This translates, in principle, to ‘ informed consent ’ (Article 25 et seq. DH). As for the use of identifiable human material or data, such as research on material or data in biobanks or similar repositories , consent shall be sought, unless if impossible or impracticable , in which case research ethics committees will have to consider or approve their use (Article 32 DH 2013). The notion of medical research has a well-developed meaning in documents such as the DH, imposing requirements on its purpose, methodology, and publicity of results (Articles 6, 35-36 DH). It is worth examining the extent to which the DH may influence other regulations. In particular, whether the conditions and understanding of the concept of medical research as presented in the DH may impact on the notion of scientific research under the GDPR. Another key question is whether the replacement of consent by ethics committees’ approval for identifiable human material has consequences, or is to have an effect under data protection 34 . 15 A third and most important question in relation to data protection is whether medical research, as understood in the DH, is (i) to be considered secondary use, and thus (ii) requiring a new legal basis, which could be different from explicit consent. Declaration of Tapei on ethical considerations regarding health databases and biobanks (2002- 2016- …) 35 The Declaration of Taipei (DT) is a complement to the DH 36 . The DT is unique in that it focuses on health databases and biobanks together and thus achieves a new level of standardisation in the field 37 . The DT provides a definition of biobanks 38 and supports broad consent by specifying the criteria for its validity 39 . Some authors have criticised the DT for being too committed to individual patient consent (as opposed to a public health ethics approach) 40 . Although the DT contains a waiver-of-consent provision, its scope is much more restricted than that of Article 32 of the DH. Namely, Paragraph 16 of the DT specifies that ‘in the event of a clearly identified, serious and immediate threat where anonymous data will not suffice, the requirements for consent may be waived to protect the health of the population. An independent ethics committee should confirm that each exceptional case is justifiable.’ Additionally, critics noted the uncertainty as to how the DT applies to secondary research 41 , with Ballantyne observing that ‘If the Declaration is intended to apply to this research, the ethical approach is remarkably restrictive. If the Declaration does not apply to this research, its scope of application is severely limited’ 42 . 3.3 ORGANISATION FOR ECONOMIC CO-OPERATION AND DEVELOPMENT (OECD) The 2009 OECD Guidelines for Human Biobanks and Genetic Research Databases (HBGRD Guidelines) 43 represent an important political commitment on the part of the member countries. Principle 4.B states that ‘ prior, free and informed consent’ should be obtained for each participant in a biobank/genetic research database. This consent for participation in a biobank is not the consent foreseen in the GDPR as a legal basis (Article 6(1)(a) GDPR). However , the biobank may also provide for ‘ obtaining consent/authorisation from an appropriate substitute decision-maker , or for obtaining waiver of consent from a research ethics committee or an appropriate authority, in accordance with applicable law and ethical principles pertaining to the protection of human subjects’ 44 . Upcoming national legislation is likely to address this, such as the Belgian Biobank Act 45 . In conclusion , there are two main frameworks that apply to secondary use of personal data for scientific (medical) research: (i) the data protection rules as they have evolved historically; and (ii) ethical standards, such as those defined by the DH (Sections 4.1.1-4.1.3). Even if the majority of the international documents are not binding, they could be considered to have important impacts on understandings of secondary use 46 . Consideration of both frameworks is important, given their intersecting nature. Firstly, ‘research’ has a well-developed meaning in ethical standards, such as the DH. This could be of use when seeking to define ‘scientific research’ under the GDPR, which lacks such definition. Secondly, in order to conduct secondary use, a data controller has to comply with the ethical requirements (e.g. consent as an ethical safeguard or authorisation from a competent body, such as an ethics committee) and the rules on purpose limitation as specified in GDPR (the roots of which can be traced to Convention 108 and 108+, and Council of Europe Recommendations 81(1) and 2019(2), for example). Overlaps, including in terminology (e.g. consent as an ethical requirement versus consent as one of the possible legal bases under GDPR) complicate this task and increase the need to consider and analyse both frameworks together. Further research on the overlaps of the two frameworks would be beneficial. 16 4 LEGAL ANALYSIS OF THE NOTION ‘SCIENTIFIC RESEARCH’ IN THE GDPR Section 4.1 presents legal analysis of the notion of ‘scientific research’ within the GDPR. Section 4.2 deals with the interpretation of the concept of ‘scientific research’ by European countries. The chapter closes with a proposed description of the concept of ‘scientific research’. 4.1 ‘SCIENTIFIC RESEARCH’ IN THE GDPR Although the EDPB asked that the negotiations occurring during the adoption of the GDPR be considered here, such documentation is not fully publicly accessible and is highly sensitive, complicating its review for this purpose 47 . Article 4 of the GDPR, on definitions, does not give any definition of the concept of scientific research. However, Recital 159 gives some elements: ‘ For the purposes of this Regulation, the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research.[…] Scientific research purposes should also include studies conducted in the public interest in the area of public health.[…] ’. This Recital also refers to Article 179(1) of the Treaty on the Functioning of the European Union (TFEU), which, unfortunately, does not give any further elements. Recital 33 also deals with scientific research, stating that ‘[…] Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research’, as does Recital 161, which states that ‘for the purpose of consenting to the participation in scientific research activities in clinical trials, the relevant provisions of Regulation (EU) No 536/2014 of the European Parliament and of the Council (1) should apply.’ It follows that scientific research is a concern, in particular in the medical domain, and should be seen as encompassing the various aspects of science, without, however, specifying the persons (physical or legal) who may carry out such research. Clearly, this is not limited to academic research organisations (universities, research centres, etc.) and research carried out by private entities with a commercial scope, such as pharmaceutical companies, could be qualified as scientific, providing ethical standards are followed (see below). The text also refers to other existing legislation, including the CTR (Recital 156 in fine GDPR) and national legislation and standards. In order to qualify as scientific, the research must be compliant with the ethical standards for scientific research. This may be a start of the definition of the concept. In 2018, the Article 29 Working Party (WP) considered that ‘ the notion may not be stretched beyond its common meaning and understands that “scientific research” in this context means a research project set up in accordance with relevant sector-related methodological and ethical standards, in conformity with good practice’ 48 . This is in line with the concept of compliance with ethical standards. At the same time, if the definition of scientific research makes no clear reference to objectives of (general) public interest (e.g. the European Data Protection Supervisor (EDPS) mentioned ‘the aim of growing society’s collective knowledge’ in its Preliminary Opinion on scientific research) 49 , the GDPR reintegrates a ‘public interest requirement’ in different recitals and indirectly in Article 6 (on compatiblity between primary and secondary use of personal data) 50 . 17 4.2 OVERVIEW AND ANALYSIS OF NATIONAL LEGISLATION AND GUIDANCE ON THE NOTION OF ‘SCIENTIFIC RESEARCH’ Based on the findings and analysis of 18 Member States in this study 51 , the vast majority of the countries examined do not provide a unique general and overarching definition of the term ‘scientific research’ in their national legislation. In fact, an umbrella definition of the term ‘scientific research’ is provided in the legal framework of only five countries: Bulgaria, France, Greece, Romania and Slovenia. The German courts have attempted to interpret the term ‘scientific research’ and define it in terms of the methodologies used and the goals pursued 52 . Nevertheless, definitions exist in 10 countries for specific types of scientific research in a ‘ lex specialis ’ context, such as legislation relating to the health sector or the medical sector: Belgium, Bulgaria, France, Greece, Italy, Latvia, the Netherlands, Portugal, Slovakia and Norway 53 . In Bulgaria and France, there is a common definition of scientific research, which can be found in sector-specific legislation. In Portugal, research is defined with reference to the Frascati Manual of the Organisation for Cooperation and Development. Additionally, the Netherlands has a commonly accepted definition for ‘scientific research’ explicitly in the health sector, as provided by soft law provisions (i.e. code of conduct) 54 . Germany, Italy and Portugal provide constitutional protection to scientific research, with no definition but a broad interpretation. In Finland, scientific research is distinguished from knowledge management and from development and innovation activities, for example 55 . Finally, Croatia and Cyprus appear to have neither general definitions nor sector-specific definitions for the term ‘scientific research’. In Denmark, scientific research may only be done on data mentioned in Article 9(1) GDPR if the study is ‘of significant importance to society’. Table 1 in Annex 1 presents an overview of the definition of scientific research in national legislation . The concept of scientific research could usefully be described or defined as follows: ‘ Scientific research is any research for a scientific purpose, financed by public authorities or the private sector, carried out in accordance with the established ethical standards and the methodology applicable in the sector concerned by the research. The scientific scope may include the development and demonstration of technologies, basic research, academic or applied research .’ It would have been useful to have a definition, or at least a description, of the characteristics of what the GDPR intends by the wording ‘scientific research’, as processing for scientific research entails specific rules on some data protection principles and data subjects’ rights, as provided by Article 89, that must be analysed with Recitals 156, 157 and 159 (see Section 5). 18 5 IMPACT OF EU SECTORAL AND NATIONAL LEGISLATION ON THE PRINCIPLES OF PURPOSE LIMITATION AND LAWFULNESS IN SCIENTIFIC RESEARCH Chapter 5 discusses purpose limitation, compatible use and lawfulness of personal data processing in the case of scientific research. It first addresses EU sectoral legislation, such as the frameworks applicable to clinical trials and biobanks (Section 5.1 ), and then examines the impact of specific frameworks (with a focus on clinical research) on the lawfulness principle, by presenting the difficulty in choosing a legal basis for (transnational) research and discussing a possible role for ethics committees in data protection matters (Section 5.2). Section 5.3 tackles purpose limitation and compatible use by delineating the concept of broad consent, followed by a discussion of the concepts of primary and secondary use of personal data and the need (or not) to use a new legal basis when processing data for secondary use. 5.1 CLINICAL TRIALS REGULATION AND THE HUMAN TISSUE AND CELLS DIRECTIVES The CTS and the Human Tissue and Cells Directives are discussed below. Clinical Trials Regulation (CTR) The CTR is set to replace the Clinical Trials Directive (EC) 2001/20/EC (CTD) 56 . The recitals, articles and Chapter V of the CTR contain multiple references to the need for consent. Most importantly, informed consent is needed from the subject for participation in a clinical trial 57 . Taking into account Recital 29, if data are collected for ‘future scientific research’, such as medical, natural or social science research, outside the clinical trial protocol by ‘universities and other research institutions’ , this shall be in accordance with data protection legislation (Article 28(2) al 2), and consent is required (see Recital 29) 58 . The European Commission’s ‘Questions and Answers on the interplay between the CTR and the GDPR’, and the EDPB in its Opinion 3/2019 of January 2019 on these Q&A 59 aimed to provide clarity on several key issues 60 , 61 . The EDPS added to the discussion with a Preliminary Opinion on data protection and scientific research 62 . The field of clinical research is under the close scrutiny of other bodies, in particular the national SAs (usually the Ministry of Health) and ethics committees. The authorisation and oversight of clinical trials is the responsibility of Member States and this will not change with the entry into force of the CTR. This lack of regulatory harmonisation reportedly creates challenges for pan-European research, in particular 63 . Biobank rules While the EU legal framework for conducting clinical trials is moving towards harmonisation 64 , this is not yet the case for biobanking 65 . Beier and Lenk classify the Member States into three groups for biobank regulation 66 : countries with a specific law (e.g. Belgium 67 ), countries with composite regulations, often accompanied by soft law (e.g. Denmark 68 ), and countries with no specific regulation (e.g. Bulgaria 69 ). A discussion about biobanks requires consideration of the so-called Human Tissue and Cells Directives 70 , which were adopted to reshape the regulatory landscape for storage and exchange of tissue 71 . The Directives put a key emphasis on informed consent for tissue donation but do not specify any substantive consent requirements. Scientific research is not within their scope, as they relate to human tissue and cells intended solely for application to humans and treatment purposes 72 . However, national laws put in place to implement the Human Tissue and Cells Directives are often applicable to research and biobanks 73 . Due to the considerable divergence in national approaches, biobank regulations will only be referenced 19 with respect to the concept of informed consent. 5.2 LAWFULNESS PRINCIPLE Data controllers can choose between six legal bases (Article 6 GDPR) on which to base the primary use of personal data. The bases are not ranked; however, in the context of clinical trials and in relation to primary use, the EDPB and the European Commission focused on a limited number of lawful grounds under Article 6 GDPR and discussed them in conjunction with the conditions for the processing of special categories of data (Article 9 GDPR). The EDPB distinguished between two main categories of processing activities - both of which fall under the concept of primary use in clinical trials - and recommended the use of different legal bases for every category. First, processing operations related to reliability and safety purposes, and second, processing operations purely related to research activities. Processing activities related to reliability and safety purposes The focus of this section will be on the legal bases recommended by the EDPB in relation to the second type of processing operations (for scientific research purposes). However, in the interest of completeness, it must be specified that the EDPB considered the processing operations related to reliability and safety purposes as falling under Article 6(1)(c) GDPR – ‘legal obligation(s) to which the controller is subject’, in conjunction with Article 9(2)(i) GDRPR – ‘processing is necessary for reasons of public interest in the area of public health’. As examples of such obligations, the EDPB has given safety reporting 74 and disclosure of clinical trial data to the national competent authorities in the course of an inspection 75 . To date, there appears to be no EU or national law that provides an obligation to conduct medical research, in particular clinical trials. However, if such a law does exist or is enacted in the future, it would be valuable to consider the use of Article 6(1)(c) GDPR. Processing purely related to research activities 1 Explicit consent of the data subject (Article 6(1)(a), in conjunction with Article 9(2)(a) GDPR); 2 A task carried out in the public interest (Article 6(1)(e), in conjunction with Article 9(2)(i) or (j) GDPR); or 3 The legitimate interests of the controller (Article 6(1)(f), in conjunction with Article 9(2)(i) or (j) GDPR) 76 . In its most recent guidelines issued in the context of the COVID-19 pandemic, the EDPB reaffirmed these same legal bases 77 . These grounds are discussed below 78 – firstly, the legal bases under Article 6(1) GDPR, and secondly, a short discussion of some of the possible justifications under Article 9(2) GDPR. 5.2.1 Legal bases under Article 6(1) GDPR 5.2.1.1 Explicit consent Consent for clinical trial participation and biological material donation: an ethical and legal requirement different from data protection requirements As the CTR rightfully points out, the Charter of Fundamental Rights of the European Union requires that any intervention in the field of biology and medicine cannot be performed without the free and informed consent of the individual concerned 79 . The consent required in Article 28(1)(c) of the CTR must be seen in this context of human participation in a clinical trial and not as the consent required or as providing a consent or other legal basis for the processing of personal data. The EDPB and the European Commission have agreed that the CTR requirement for informed consent for human participation must not be confused with consent as a legal basis for data processing under the GDPR 80 , 81 . Indeed, there are two different levels: one linked to the protection of the integrity and self-determination of the individual, and the other to the protection of their data. A parallel can be drawn with a patient 20 attending their doctor: in Belgium, for example, a doctor must obtain consent from their patient before carrying out any medical act, as provided by the Law of 22 August 2002 on patient rights 82 . The doctor will process data without requesting explicit consent, but using Article 9(2)(h) of the GDPR. The Human Tissue and Cells Directives and the consent required to donate biological material is to some extent similar, as the consent required is to be distinguished from any consent possibly required for data processing . Consent for the processing of personal data in the clinical trial context The EDPB emphasised that, depending on the circumstances, consent may not be the most adequate legal basis 83 . This appears to be the case in the context of primary use for clinical trials, as consent may not adequately satisfy the requirement to be ’ freely given’, due to the imbalance of power between the participants and the sponsor/investigator 84 . A similar difficulty arises with the possibility to withdraw consent versus the archiving obligations imposed by the CTR 85 . Under EU law, it is clear that personal data will be kept and processed even after the withdrawal of consent. Verhenneman has provided a compelling academic analysis of why the use of consent as a legal basis under GDPR should be carefully considered and may not always be the most suitable option for medical research in general 86 . Other international guidance and national laws, however, contradict this view .  The Council of Europe recently pointed to consent as the preferred legal basis for the processing of health data 87 . However, it went on to specify that ‘the law may provide for the processing of health-related data for scientific research without the data subject’s consent’ . While the recommendations of the Council are not legally binding, they create political pressure for the acceptance of specific standards. If the recommendation is implemented in the national laws of the Council’s member states (which include all EU Member States), this could conflict with the EU’s guidance on the matter. At the same time, it may be argued that this would not be in breach of EU law, given the Article 9(4) GDPR possibility for Member States to maintain or introduce further conditions, including limitations , with regard to the processing of data concerning health 88 .  The reasoning shall be carefully assessed . The report of July 2019 for the Panel for the Future of Science and Technology of the European Parliament (STOA) found the arguments of the EDPB ‘illogical’, in particular the idea that a study participant who consents to participate in a trial might not be able to consent to data processing due to a potential power imbalance 89 . Nevertheless, if a patient can freely consent to the participate in a clinical trial, they cannot choose to participate in the trial without their personal data being processed. Participation is only possible when they also consent to data processing. In addition, there is no valuable alternative, especially in last resort cases, which is a criterion that is generally used to assess the level of freedom in consent.  The argument against consent as a legal basis in the clinical trial field is not necessarily valid in other types of research . A clear distinction can be made between situations in which there is an appropriate power balance and those in which there is not. Van Veen notes that for some types of research with health data (e.g. observational studies that start with completing questionnaires), consent would, in fact, be the most appropriate legal basis 90 . Consent has also been reported as the preferred legal basis for the majority of patient preference studies , as the data collection occurs exclusively via qualitative techniques such as semi-structured interviews 91 . The same remains to be seen for biological material and research, for example.  Scholars are divided: while consent as a legal basis has long been considered the ‘default’ option for researchers 92 , arguments in favour of the use of other legal bases are steadily being put forward, taking into account recent technological developments and the realities of modern medical research, especially clinical research 93 . At the same time, one of the most prominent voices in support of consent is Hallinan, who stresses that consent under GDPR is the ‘ concrete mechanism giving voice’ to the underlying rationale of the legislation, i.e. providing the individual with informational self-determination 94 . Interestingly, representatives of the pharmaceutical industry have voiced the opposite opinion, that consent often provides ‘the illusion of self-determination and protection, while the individual may actually not always read the information provided, may not always understand this information, and may not be in a position to refuse anyway’ 95 . From a practical point of view , there is an argument that companies engaged in cross-border research 21 would struggle, in practice, to switch to a legal basis other than consent 96 . Finally, consent as (not the preferred) legal basis for research in the context of clinical trials, should be examined in the precise context of particular research, taking into account the nature of the data (e.g. genetic data). The power imbalance is less easily distinguished in genomic research and biobanking, except in a clinical trial (see below). According to expert in genomic research, Hallinan, consent should have primacy over other legal grounds , including the research exception (Article 9(2)(j) GDPR). This discussion – and indeed all related arguments – should be viewed against the background of the Council of Europe recommendations 97 and binding Council of Europe conventions 98 . Research is, within limits, seen as compatible with the primary use of health data in the doctor-patient relationship for therapeutic purposes, but also for own medical research, except where there is an objection (see above and Council of Europe Rec(97)5 and Rec(2019); see also Rec(81)1). The Council of Europe Convention 108+ also allows compatible use for research, provided there is a legal basis, which shall not necessarily be consent. These Council of Europe recommendations and conventions thus appear support legal bases other than consent. Consent for biological material, genomic research and biobanking As mentioned above, Hallinan argues that consent should have primacy over other legal grounds , including the research exception (Article 9(2)(j) GDPR). His position may have to be seen in the context of his research in the area, however. Overview and analysis of national legislation and guidance on explicit consent Based on the findings and analysis of the 18 countires by the researchers 99 , the majority of the countries examined do not impose the use of ‘explicit consent’ in the context of scientific research via case-law, codes of conduct, SA guidelines, other binding or non-binding instruments, and/or practices at national level. Only six countries - Belgium, France, Greece, Italy, the Netherlands and Romania - have related binding /non-binding instruments in place. Table 2 in Annex 1 presents explicit consent requirements for personal data processing in scientific research. The majority of countries distinguish consent for human participation in clinical trials from consent under the GDPR . The majority of countries do not impose consent as the legal basis for the processing of personal data 100 . However, there are cases where such a requirement is enshrined in law. In France 101 and Italy 102 , consent is imposed for genetic research. Germany 103 is the only country which imposes consent under the GDPR in the context of clinical trials. However, it was reported that in France it is common for sponsors of clinical trials to themselves decide to use consent, even though it is not mandated by law 104 . The researchers who provided input for Germany and Italy observed that the situation may change in light of EDPB Opinion 3/2019 105 . In Romania, participants must agree that their personal data will be examined during inspections by the National Medicines Agency 106 . A recommendation for further research would be to investigate the decision-making process of stakeholders involved in international research when choosing a legal basis, including they challenges they face. The consultation initiated by the European Medicines Agency (EMA) could potentially provide answers to these questions 107 . 5.2.1.2 A task carried out in the public interest (or official authority) Article 6(3) GDPR requires that the basis for the processing referred to in Article 6(1)(e) shall be laid down by Union or Member State law, which shall meet an objective of public interest and be proportionate to the legitimate aim pursued 108 .This implies that relying on Article 6(1)(e) has substantially different obligations, depending on the Member State concerned. The task carried out should be conveyed by legal provisions 109 . Broadly speaking, this is the general 22 legal basis for data processing for public sector purposes 110 . A specific law is not needed for each individual clinical trial 111 . However, Article 6(1)(e) is not limited to processing operations of public authorities but also extends to processing by private bodies who have been entrusted with a task in the public interest 112 . There is disagreement in the literature as to whether or not commercial entities may make use of this legal basis. According to Kramer, they may not, even if such bodies operate in the public interest 113 . Other authors make no such distinction 114 . It appears, however, that they may, provided that their processing fulfills a public interest and the law specifies the entities vested with such a task in the public interest. One potential challenge with using Article 6(1)(e) GDPR as a legal basis may become apparent in the context of transnational research, as the choice of legal basis influences the application of the one-stop- shop mechanism (Article 56 et seq GDPR) 115 . The one-stop-shop is crucial for controllers who conduct cross-border processing of data, allowing them to benefit from a single point of contact 116 . However, pursuant to Recital 128 of the GDPR, the rules on the lead supervisory authority and one-stop-shop mechanism should not apply where the processing is carried out by public authorities or private bodies in the public interest 117 . Although recitals are not legally binding, this proposition is reaffirmed in Article 55(2) GDPR, which states that Article 56 does not apply to processing carried out by public authorities or private bodies on the basis of point (c) or (e) of Article 6(1) GDPR. The use of the ground mentioned above should also be viewed against the background of the Council of Europe recommendations 118 and binding Council of Europe conventions 119 , as well as other international documents adopted. Reference to this legal basis of Article 6(1)(e) GDPR in combination with Article 9(2)(i) GDPR could be seen as being in line with Council of Europe Recommendation (2019)2 on the Protection of Medical Data (see Article 15). There remains some doubt for commercial sponsors to use this legal basis of ‘public interest’ allowing ‘compatible’ scientific research, at least in the clinical trial context. In addition, Article 6(1)(e) GDPR may not be the best fit for pan-European studies, depending on the specific circumstances with regard to (joint) controllership 120 . Article 6(1)(e) GDPR is a legal basis that best suits public research institutions operating at national level 121 . 5.2.1.3 Legitimate interests of the controller This legal basis is applicable only to private sector controllers 122 and where ‘legitimate interest’ refers to an interest which is ‘ visibly, although not explicitly, recognised ’ by Union or Member State law 123 . Processing for research purposes is not explicitly listed under Article 6(1)(f) GDPR, but WP29 included scientific research as a legitimate interest 124 . In order to rely on this basis, the controller must perform a ‘ balancing test ’ in line with the principle of proportionality, and the processing is not permitted if the controller’s interests are overridden by the fundamental rights and freedoms of the data subjects. The WP29 has provided a set of criteria which can be used when performing the balancing test 125 . Of interest is part of Recital 47, which references ‘ further processing’ : ‘The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing.’ The wording implies that secondary use of data can be based on Article 6(1)(f) GDPR. However, Kotschy states that further processing is dealt with only under the provision of Article 6(4) GDPR (compatibility assessment) 126 . The question remains, therefore, whether the reasonable expectations of the data subject would only play a role in the case of compatible processing. As far as the secondary use of personal data for scientific research is deemed not incompatible, this could apply both when Article 6(4) is applied to assess compatible processing, and for research processing for which Article 6(4) should not be applied, as scientific research is always deemed not incompatible. Recital 113 GDPR also refers to legitimate interests in the context of international data transfers, and states that ‘for scientific or historical research purposes or statistical purposes, the legitimate expectations of society for an 23 increase of knowledge should be taken into consideration’ 127 . The use of the ground mentioned above should be viewed against the background of the Council of Europe recommendations 128 and binding Council of Europe conventions 129 , as well as other international documents adopted. In medical research, the core ethical principles require that the rights, safety, and well-being of the individual prevail above the interests of science and society 130 (see discussion of the role of ethics committees in the balancing test below). The EDPB has not provided further specific guidance on the application of Article 6(1)(f) GDPR in the field of research. However, a decisive criterion for the test could be found in the EDPB guidelines in the context of video-surveillance schemes 131 , namely the intensity of intervention that the processing poses for the rights and freedoms of the individual . In conclusion, the reasonable expectations of the data subjects will be important at least when relying on legitimate interests, but also for the assessment of the research ‘compatibility’ 132 . Article 6(1)(f) GDPR is a legal basis that could be invoked by private or commercial research institutions provided there remains a balance with the rights and freedoms of data subjects, which shall at all times be checked . 5.2.2 Legal justifications under Article 9(2) In Opinion 3/2019, the EDPB confirmed that when processing sensitive data, the legal bases under Article 6 GDPR must be applied in conjunction with the conditions under Article 9 GDPR 133 . It recommended two of the Article 9(2) GDPR conditions: (i) or (j) (see below). However, the EDPB examples are linked to a clinical trial context only. For genomic research, for instance, there are views that Article 9(2)(g) could also be a relevant condition 134 . The national input received for this study found several national academics who nevertheless perceive Articles 6 and