GDPR as alternatives 135 . These are seen as cumulative requirements in some countries (including Belgium, France 136 , the Netherlands 137 , Slovakia 138 ). No information was available for the remaining countries, either in national legislation or in academic opinion 139 .  Article 9(2)(i) GDPR – ‘processing is necessary for reasons of public interest in the area of public health’. Similar to the legal basis under Article 6(1)(e) GDPR, this condition relies on EU or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject. As the condition is linked to public health, the considerations about the one-stop-shop mechanism described above apply. It can be concluded that the exception is narrow and best suited for national public health authorities and non-governmental organisations (NGOs) 140 .  Article 9(2)(g) GDPR – ’processing for reasons of substantial public interest’. Again, the condition relies on EU or Member State law but goes beyond the requirements of Articles 6(1)(e) and 9(2)(i) by imposing the condition that the public interest be ‘substantial’, creating a high threshold for satisfying this condition. However, there is no definition of ‘substantial public interest’ either in the GDPR nor in EU law more broadly 141 .  Article 9(2)(j) GDPR – ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes’ . Recital 52 of the GDPR clarifies that this justification requires implementation in EU or national law. Under this condition, the processing must be carried out in accordance with Article 89(1) GDPR, based on EU or Member State law, which shall be proportionate to the aim pursued, respect the essence of the right to data protection, and provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject. Based on the legal provision in the GDPR, Georgieva and Kuner outline several conditions for the application of this exception with respect to scientific research 142 . Hallinan 24 notes that there is no clear data protection jurisprudence establishing objective principles that clarify most of the conditions, meaning that whether or not a law fulfills the critera should be considered on a case-by-case basis 143 . Finally, Meszaros and Ho argue that a general level of public interest would be sufficient for scientific research. Significantly, they also specify that a higher level of public interest – such as ‘important’ or ‘substantial’ - could justify the secondary use of sensitive data 144 . In conclusion , the notion of ‘public interest’ appears to play a central role in all of the main justifications under Article 9(2) GDPR. Academics Meszaros and Ho attempted to summarise the different degrees of public interest and order them from the perceived lower to highest 145 . They acknowledged, however, that only ‘ the implementation, application and enforcement of the GDPR will clarify the meaning’ of the different levels of public interest. Clarification of the notion is urgently needed. Overview and analysis of national legislation and guidance on the appropriate legal basis for scientific research The study examined whether national laws provide for an appropriate legal ground for the processing of personal data in the context of scientific research, including for secondary use, as provided under Article 9(2)(j) GDPR. About half of the countries have implemented Article 9(2)(j) GDPR : Bulgaria 146 , Denmark 147 , France 148 , Germany 149 , Greece 150 , Hungary 151 , Latvia 152 , Portugal, 153 Romania 154 , Slovakia 155 , Italy 156 and the UK 157 . Denmark made no mention of Article 9(2)(j) GDPR but did refer more broadly to the data mentioned in Article 9(1) GDPR 158 . The implementing legislation in some countries (Bulgaria, Latvia) does not specify safeguards, or does so in a very general way (Germany), raising the question of whether or not the national provisions fulfil the requirements of Article 9(2)(j) GDPR and whether they can be actually be relied upon. In France, several provisions allow for the possibility to process data for scientific research, in particular Article 44(3) of the Loi Informatique et Libertés (LIL) - processing of personal health data justified by public interest. Estonia has recognised research (and official statistics) as an autonomous legal basis alternative to consent 159 . However, a role for ethics committees is foreseen in the application of this legal ground, namely in verifying that the controller complies with the requirements established by the law. In Norway, prior approval from an ethics committee is deemed to be a necessary and adequate legal basis to process personal health data in medical and health research 160 . In Belgium, it appear unclear if the national data protection law foresees an appropriate lawful ground for the processing of personal data in the context of scientific research and health data. In the Netherlands, processing of sensitive data is allowed for research, if necessary, provided it serves a general interest, explicit consent is impossible and sufficient guarantees are foreseen 161 . 5.2.3 Difficulties in choosing a legal basis Each of the legal bases outlined above has different implications for the rights of data subjects, the interests of the controller, and the feasibility of carrying out international research. Some Member States still require consent as the legal basis in all cases, without taking the specific case into consideration (see national input). Other legal bases previously encouraged by the EDPB (public interest in the area of public health and scientific research purposes) require the processing to be based on EU or Member State law, which sets the ground for further differences 162 . Each of the available legal bases creates a different set of consequences and rights 163 . Stakeholders question whether the legal basis for processing data in the scope of the same research can vary at country level 164 , pointing out that using different legal bases in the scope of the same research makes international studies more challenging and creates inequalities between patients from different countries. The literature proposes different solutions. Some scholars argue that a uniform standard should be adopted across the Member States regarding the appropriate legal basis for processing personal data for research purposes 165 . Others suggest that ethics committees should guide reliance on different lawful grounds 166 . Although an in-depth analysis of these solutions is outside the scope of this study, a critical discussion of the role of ethics committees in data protection is warranted. 25 5.2.4 Role of ethics committees Reports suggest that in many EU Member States compliance with data protection legislation in the scope of health research is under the scrutiny of ethics committees, which often lack appropriate GDPR training 167 . Examples include:  For primary use of data: stakeholders in the field of clinical trials report that ethics committees tend to decide which lawful ground should be used, in particular impose consent 168 ;  For secondary use of data: Cole and Towse report that the ‘variable judgments of ethics committees in considering the compatibility of research applications (to re-process data) with the original trial protocols constitute a huge barrier – the outcomes are “unpredictable”’ 169 . Other academics, however, advocate a stronger role for ethics committees in the field of data protection 170 . Although the GDPR itself does not address ethics committees 171 , the CTR links the ethical review required and the assessment of compliance with data protection legislation. Pursuant to Article 4 CTR, clinical trials are subject to ‘scientific and ethical review’ and shall be authorised in accordance with the Regulation. The same provision specifies that the ethical review may encompass aspects addressed in both Part I and Part II of the assessment report for the authorisation of a clinical trial. The specific aspects are to be determined at national level (‘as appropriate for each Member State concerned’). Part II includes assessment of compliance with Directive 95/46/EC (the Data Protection Directive, DPD), the predecessor of the GDPR (see Article 7(1)(d) CTR). This assessment can be conducted either by the competent authority or the competent ethics committee, depending on the national rules. At national level, Estonian law 172 assigns ethics committees a role in the national implementation of Article 9(2)(j) GDPR. In particular, Chapter 2, Paragraph 6(4) of the national Data Protection Act states that for scientific and historical research based on special categories of data, the ethics committee of the area concerned shall first verify compliance with the terms and conditions provided for in the law. For scientific areas with no mandated independent ethics review, responsibility to verify compliance with the requirements rests with the Estonian Data Protection Inspectorate. Italy provides another example, particularly where consent cannot be the appropriate legal ground for the processing of health data for scientific research purposes, as informing the data subjects proves impossible or entails a disproportionate effort on specific grounds, or it is likely to render impossible or seriously impair the achievement of the research purpose. In such cases, the research shall be the subject of a favourable opinion by an ethics committee 173 . It is worth exploring whether the role of ethics committees in data protection could be harmonised. Although an in-depth analysis is outside the scope of this study, several points are worth noting for consideration. Under the GDPR, ethics committees could usefully have a role in risk assessment . A risk-based approach is firmly embedded in clinical research 174 , just as it is in the GDPR 175 . The clinical trial sponsor must identify, evaluate and control (i.e. reduce and mitigate) the risks posed by the research, and the rights, safety and well-being of trial participants must always prevail over the interests of science and society 176 . The main responsibility of ethics committees is to protect potential participants in research, thus part of their independent review is identification and weighing of the risk/benefit ratio. Research risks are not limited to possible physical harm, but can also include psychological, social, legal and economic ramifications. If the risk/benefit ratio is not optimal, an ethics committee may provide a conditional decision, including suggestions for revision 177 . The risk assessment conducted by the sponsor and by the ethics committee is not a simple exercise, but includes both quantitative and qualitative evaluation and requires proper training. 26 Data protection - and the GDPR in particular - have a close relationship with ethics. The application of the legislation is not merely a technical exercise but always requires judgement. Hijmans and Raab highlight that this is at the core of processing based on the legitimate interests of the controller (Article 6(1)(f) GDPR) 178 . To rely on Article 6(1)(f) GDPR, the controller must perform a balancing test, and WP29 has provided a set of criteria. The EDPB’s view (albeit in a different context) is that the most decisive criterion should be the intensity of intervention that the processing of data poses for the rights and freedoms of the individual. With their role and experience in performing risk/benefit assessments for research, ethics committees may have the expertise to advise on achieving adequate balancing when relying on legitimate interests, assuming that the composition of these ethics commitees is sufficently balanced . Even more importantly, the new CTR states that laypersons, in particular patients and patient organisations, should be involved in the composition of ethics committees 179 . This provides further guarantees for the respect of data subjects' fundamental rights and interests. If this role in the risk/benefit assessment is accepted for ethics committees, a method must be found to safeguard against inequalities between studies subject to ethical review and those that are not. Ethical standards are not harmonised at EU level, and national and local ethics committees may show substantial differences when providing input on the application of Article 6(1)(f) GDPR. Harmonisation initiatives in the field of ethical standards, although nascent, are starting to appear. Most notably, this is the aim of the European Network of Research Ethics Committees, funded and supported by the European Commission 180 . At national level, there is a Nordic initiative addressing the development of a joint Nordic electronic information portal on ethics committees’ approval 181 . In addition to risk/benefit assessment, ethics committees could also be involved as an appropriate safeguard under Article 89 GDPR. The possibility requires further in-depth investigation, perhaps using existing national examples (Estonia, Italy). 5.3 PURPOSE LIMITATION AND COMPATIBLE USE FOR RESEARCH The purpose limitation principle is generally accepted as the cornerstone of data protection law 182 . However, the text of the GDPR is not sufficiently clear on application of the principle in the context of secondary use of personal data 183 . EU case-law is surprisingly limited in this respect 184 . For the purposes of this report, this section discusses broad consent and differentiates it from the purpose limitation principle. It then delineates the notions of primary and secondary use of data, which are important in understanding whether or not a new legal ground under GDPR is needed for secondary use. Finally, the national input on the purpose limitation principle is examined, including whether or not a new lawful ground is needed for secondary use, the application of the presumption of compatibility, and the potential influence of medical secrecy on purpose limitation. 5.3.1 Broad consent (Recital 33 GDPR) The GDPR moved towards the acceptance of broad consent (Recital 33 185 ), suggesting that the Regulation adheres to a different interpretation of the purpose specification principle in the context of informed consent, compared to situations where personal data are processed under other legal bases 186 . Recital 33 recognises that the purpose specification principle is challenging in research, particularly in the context of Big Data and AI techniques.Verhenneman advises against using Recital 33 to justify broadening the purpose specification principle, as this is not what the text indicated. Similarly, in its Q&A on the interplay of GDPR and CTR, the European Commission specified that the requirement of specific consent applies, even though the Recital provides some degree of flexibility 187 . WP29 had already limited the applicability of broad consent. Firstly, by stating that ‘ scientific research projects can only include personal data on the basis of consent if they have a well-described purpose’ 188 , and secondly, by endorsing the need for subsequent rolling granular consents over one ex ante broad 27 consent 189 . These two points were left unchanged in the recently issued EDPB Guidelines on consent 190 . According to Hallinan, however, interpretations of the WP29/EDPB guidance limiting the utility of broad consent could run contrary to the intent of the legislator and may even be undemocratic 191 . 5.3.2 Overview and analysis of national legislation and guidance on broad consent The study investigated how consent as a lawful ground is understood across the countries in light of Recital 33 GDPR. The findings are divergent and it is hard to establish a strong pattern . Around one- third of the countries investigated show support for broad consent, although the advice seems mixed 192 . Both Belgium 193 and Norway 194 specify that broad consent cannot be given to all types of research (blanket consent), but can in the case of cancer research, for example. In Germany, Recital 33 can be relied upon under certain conditions clarified by the German Datenschutzkonferenz – the group consisting of the independent German Federal and State SAs 195 . Significant concerns about upholding respect for the right to information were evident in all cases. Norwegian law stipulates that ‘Participants who have given broad consent are entitled to regular information about the project’ 196 . Similarly, in France, the Bill of bioethics law (last version amended by the Senate in February 2020 197 and still under parliamentary discussion) mentions the possibility to provide individuals with information about the research programme (to be understood as broadening the scope of consent for further use in research and opening the way to information about broader intelligible research fields) in order to allow reuse of biological samples for genetic research without requiring the data controller to implement individual re- contacting and reconsenting. In Portugal, broad consent can be used only if the ethical standards recognised by the scientific community are respected 198 . Romania seems to be the only Member State that opposes the use of broad consent, instead preferring dynamic consent. However, this conclusion is based on a single study 199 and more research is required to establish that position with certainty. On distinguishing between the use of consent as lawful ground for secondary use of data, the majority of the countries examined do not appear to have included related specifications in their national laws . More precisely, desk research found no such distinction in Belgium, Bulgaria, Croatia, Cyprus, France, Germany, Greece, Hungary, Italy, Latvia, Portugal, Romania, Slovakia, Slovenia and Norway. No country reported that its national law/guidance provides for a distinction between the use of consent as a lawful ground for primary use of data in light of Recital 33, and for secondary use of data. One of the researchers looking at France 200 observed that it could be envisaged that, where broad consent is used for basing primary processing for research, the individual be asked at the time of consent if they wish to be informed of any specific projects for which the personal data collected will be processed, in the context of the broadly specified research areas mentioned in the spirit of Recital 33, in respect of Article 14 GDPR and national laws. If the individual freely and knowingly chooses not to be informed, that consent could be considered the legal basis of further processing, which in return integrates primary processing purposes. Competent ethics committees, as well as data protection officers (DPOs) or other authorities assessing the project, will have the option to accept or reject such a practice. By way of preliminary conclusion , one of the key issues is whether or not broad consent could stretch compatible processing for research from ‘primary use’ to ‘secondary use’, including in the clinical trial context. However, concrete binding advice is needed as to the utility of broad consent. 5.3.3 Primary versus secondary use of data Primary use is not a common term in data protection. The DPD 201 used the wording ‘further processing’ in Article 6(1)(b) in the context of the purpose specification principle, stating that further processing ‘in a way incompatible’ with the defined purposes is not permitted, while also stating that ‘[f]urther processing of data for historical, statistical or scientific purposes shall not be considered as 28 incompatible’ on the condition that national law provides safeguards (for the data subjects). The GDPR took over the same purpose (specification and) limitation principle with a special regime for ‘research’ 202 . Use of personal data for research was added to this first category of ‘further processing’, and understood as processing for compatible purposes, or not considered incompatible. Other than this compatibility assumption, neither this article nor any other provisions in the GDPR indicate additional exceptions from the application of any other principles and obligations under the GDPR, such as the transparency and information obligation and need for legal grounds 203 . The compatible secondary/further processing must still comply with all other rules in the GDPR. In 2013, the Article 29 WP launched a specific view on further processing in its ‘Opinion on purpose limitation’ (not endorsed by the EDPB). The WP viewed the very first processing activity as separate from all subsequent processing operations 204 . As such, only the collection of data was qualified as the initial (primary) processing, with all subsequent processing activities (including the very first activities following collection, such as data storage and use) considered ‘further processing’. It is plausible that the Article 29 WP in fact merely intended to say that any further processing activity shall be for the same purpose(s) as initially specified and defined before, or at the latest at, the initial collection 205 . The Article 29 WP also stated that further compatible processing may need a separate lawful ground 206 . In its recent Guidelines on the on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak, the EDPB seems to clarify this possible misunderstanding by explaining that health data collected for conducting a clinical trial (primary use) may be reused (secondary use) for other scientific research and this usage should be classified as ‘further processing […] (secondary use)’ 207 . Two remarks are important here. Firstly, the intention of the legislator to consider processing for ‘research’ as not incompatible 208 is likely inspired by the necessity or mandated ‘ important objectives of general public interest (of Member States or the EU) ’ 209 . In other words, it is in the interest of society and the public that ‘research’ can be conducted, provided there are safeguards for the data subjects 210 . This general public interest will vary over time, as will the expectations of data subjects 211 , as to the extent to which data (health, localisation data, etc.) would also be used for research purposes. Regulation could help to determine the further processing that should be regarded as compatible 212 . Secondly, the safeguards initially envisaged, such as anonymisation, pose serious issues in some contexts. Location data, if used as single data patterns (a particular location pattern that can be used to identify the data subject) are difficult to anonymise 213 . Human tissue or body material for further research cannot, by default, be (fully) anonymised , and information relating to data subjects necessarily remains. Under data protection legislation, there is additional uncertainty about the precise status of human tissue or body material, more precisely (i) as a source of personal information rather than (ii) personal data itself 214 . Biobanks containing body material, tissues or cells also have an unclear status. This type of information – which is now very valuable to both private and public funded research - also contains genetic information 215 on which a lot of research is based. Advances in knowledge could potentially be in the interest of the data subject or even those to whom they are genetically linked. The transfer of health data (blood samples, other body material) to biobanks, which cannot be fully anonymised or only with difficulty, but which contain genetic information must be taken into account in the context of analysis of compatible use, purpose and lawful grounds for research in the health sector. This is, however, not at the core of this study. The need for a separate lawful ground for ‘further processing’, in particular for research, is strongly debated and questioned. Policy documents and academic papers frequently diverge on this point, even within the same country 216 . Several EU institutions appear to be in favour of a new legal basis. In its Preliminary opinion on scientific research of January 2020, the EDPS stated that a new legal basis is needed 217 . The European Commission also found that the new ground ‘ may or may not differ from the legal basis of primary use’ 218 , meaning that a new legal basis is required for secondary use. The EDPB found that the logic of the 29 Commission excludes the applicability of the presumption of compatibility and stated that ‘ the controller could be able [...] to further process the data without the need for a new legal basis’ 219 . However, other EU bodies do not seem to share the same view. A recent EMA discussion paper noted that ‘ no legal basis separate from which allowed the collection of the personal data is required’ 220 . Stakeholders in the field hold a particular middle ground; for instance, the European Organisation for Research and Treatment of Cancer (EORTC) understands Recital 50 as a ‘ possibility to continue with the same legal basis, not an obligation’ and believes that secondary use may rely on a different legal basis 221 . As for authoritative GDPR commentaries, some state that ‘ only compatible further use does not require an additional legal basis’ 222 , while others conclude that the part of Recital 50 stating that no new legal basis is needed is an ‘ editorial mistake’ and that a new legal basis is always required 223 . There are arguments against the need for a (separate) legal basis, even if they are not entirely convincing. One argument is text-based: the fact that the compatibility test of the WP of 2013 (which has now become part of the GDPR in Article 6(4) GDPR) is mentioned in Article 6 stating the grounds for lawful processing, deducing that such a test, if positive, would mean that the further processing would not require a separate legal ground. However, this cannot be deduced merely from the position of Article 6(4) – which is based on the earlier Opinion of the WP – and as this Article only discusses purpose compatibility 224 . Others refer to the (non-binding) Recital 50 GDPR, but understand this in different ways. These diverging views are presented in Table 3 in Annex 1 . In addition to the arguments above, the study concludes that (presumed compatible) further processing for scientific research needs a legal basis 225 because:  the history of data protection legislation - the requirement of lawful processing and the need for a legal basis or ground has always been a central requirement and cornerstone, whereby data protection requirements for scientific research have not and should not be treated fundamentally differently, other than for the compatibility assumption;  other longstanding principles should not be overturned without a clear legislative text confirming such intention (text argument);  he meaning and wording of Article 8 of the EU Charter on Fundamental Rights 226 . Notwithstanding several diverging views, a legal basis remains required 227 , including where data are further processed for research purposes. For presumed compatible research purposes, this could be the same or a new legal basis. If the data controller further processes (reuse) personal data, it can typically reuse the same legal basis as for the primary processing if this secondary processing is compatible. If it is not, they should – generally - obtain new consent from the data subject. Secondary processing by a different controller is more complicated when it comes to reusing the same legal basis. The concept of further processing or further use has been used to mean different things over the years, creating confusion. It seems clear that the term ‘secondary use’ is not an established term used in the EU general data protection legislation. The term is rather recent and increasingly used, in particular in national legislation 228 . Secondary use could coincide with further use referring compatible processing 229 or further use in the sense of use other than the initial processing, and non-compatible, in which case this is a ‘new’ or ‘second’ use, or also ‘second(ary) use’ in the strict sense 230 . Secondary use in the strict sense will always require a new legal ground. An understanding of the need for a legal ground in relation to further processing/secondary use is presented in Figure 1 in Annex 1. 30 5.3.4 Overview and analysis of national legislation and guidance on the purpose limitation principle Is a new legal basis required for secondary use of data? In the majority of countries (12 out of 18), this is not discussed in any way 231 . Recently, however, Germany has suggested an innovative possibility, that the original legal basis is still valid as the basis for secondary processing 232 . Three countries require no legal basis 233 but each of the national legal frameworks comes with a caveat. For instance, in Greece, the data protection law creates ‘a national legal basis for secondary use’ 234 . In Belgium, academics believe that a new legal basis is not required when using data further for the purposes of academic medical research. The assessment of lawfulness is thus generally limited to an assessment of the lawfulness of the primary data collection and the appropriateness of the security measures implemented 235 . In Italy, secondary use of sensitive data for scientific research is subject to particularly strict requirements 236 . Although no new legal basis is required, third parties processing sensitive data for secondary use are obliged to obtain prior authorisation from the Italian SA 237 . Such authorisation may be either via an ad hoc decision, or through a general provision specifying the conditions and necessary measures that the controller has to implement (such a general provisions has not yet been implemented 238 ). Where it is the same controller that processes the data further (i.e. originally collected for clinical activity), there is no need for authorisation. However, the Italian law imposes further conditions on the controller, such as implementing additional safeguards, obtaining ethics committee approval, and consulting the SA prior to the processing 239 . The only country in which a new legal basis appears to be required is the UK . However, the advice of the Information Commissioner’s Office (ICO)is quite unclear 240 . Some medical research documents seem to suggest the need for a new lawful basis, but there is no definitive advice 241 . Implementation of the presumption of compatibility Special advice is available in the majority of the countries (10 out of 18) 242 . With respect to specific legislation, the Hungarian example is interesting, where a government committee was established (by law) to oversee the presumption of compatibility 243 . In France, the presumption of compatibility is seen as a ‘philosophical’ approach to scientific research and is used for establishing simplified procedures for research that serves the public interest and is bound by research ethics and deontology of health professions 244 . The Romanian Law on healthcare reform imposes a unique restriction on the processing of pseudonymised data from electronic health records for scientific research purposes, as it allows it only after the death of the person 245 . An interesting similarity can be observed between the Belgian and Bulgarian academic views; in both countries, academics emphasise the appropriate safeguards when the presumption of compatibility for scientific research applies. In Belgium, Verhenneman has observed that the compatibility test must be conducted but is limited to an assessment of the appropriate safeguards 246 , whereas in Bulgaria, the view is that the test should not be conducted at all in cases when the presumption of compatibility applies, on the condition that the controller provides appropriate safeguards 247 . The result appears to be the same, but the phrasing is fundamentally different. In five of the countries studied, the existing advice does not go beyond the GDPR 248 . However, Italian scholars, in particular, are puzzled by the lack of conceptual clarity 249 . Recent legislation in Finland is noteworthy . A central licensing authority for secondary data use 250 has been established 251 to facilitate more efficient data use, in particular secondary processing of health data and social data under the custody of several controllers and usually requiring several authorisations from controllers for further use for research purposes. Such data are now pooled and centralised at national level at FinData 252 . A central one-stop-shop, the Data Permit Authority, will decide on requests for access to (i) data from different controllers, (ii) national information system services (‘client data in healthcare and social welfare’) and (iii) registers of one or more private organisers of healthcare 31 services (Section 11 of the Act on the secondary use of health and social data) within specific timeframes. Secondary use of the data will be allowed for permitted purposes as defined in the law, with a revocable licence issued for a fixed term. The agency will collect, combine and, if necessary, pseudonymise or anonymise the data or generate the aggregated statistics requested (Section 14) 253 . The Act on the secondary use of health and social data provides for a clarified legal basis for data collection by the Finnish National Institute for Health and Welfare and national monitoring, and knowledge management 254 by social and healthcare service providers but also for businesses to support decisions, by combining technical and commercial data with social and healthcare data. A licence may also be required for education, information management and development and innovation activities (Section 37) 255 , provided that the explicit consent of data subjects for secondary use is sought for the latter, as no category under Article 9(2) GDPR fit. Such consent is granular for each use (for processing by FinData, and by each secondary user) and is controllable for the data subject by a digital ecosystem, facilitating communication with the Data Permit Authority, including consent modification and withdrawal. None of the 18 countries 256 examined appear to have defined national rules on the application of the presumption of compatibility at national level in conjunction with the principle of lawfulness established under Articles 6 and 9 of the GDPR, in light of Recital 50 and Article 6(4) GDPR,. Does medical confidentiality influence the purpose limitation principle? At international level, the WMA’s Code of Medical Ethics states that a physician shall ‘respect a patient’s right to confidentiality. It is ethical to disclose confidential information when the patient consents to it or when there is a real and imminent threat of harm to the patient or to others and this threat can be only removed by a breach of confidentiality’ 257 . Council of Europe Recommendation (81)1 on medical databanks states that medical records may not be shared ‘ outside of the fields of medical care, public health or medical research ’ without express and informed consent, unless , however, permitted by rules of medical professional secrecy 258 . In other words, medical research can be broadened where medical professional secrecy rules allow such communication because the receiving party is also bound by such medical secrecy. At national level, various regulations are usually applicable to medical confidentiality, including criminal codes, patients’ rights laws, laws on the exercise of the medical profession, and national codes of ethics. As all health professionals understand the need for confidentiality, it can be seen as an additional safeguard when it comes to data protection. In the majority of countries (11 out of 18) investigated for this study, no discussion on the influence of medical confidentiality on the purpose limitation principle was evident. Experts from seven countries (Belgium, Bulgaria, France, Germany, Italy, the Netherlands, and Portugal) shared their observations (see Table 4 in Annex 1), which together suggested that medical secrecy has a practical impact on the purpose limitation principle as applied in the context of scientific research (particularly in Bulgaria, France, and Italy). It is important to note that in the context of the COVID-19 pandemic, the UK permitted general practitioners (GPs) and organisations providing health services to disseminate confidential patient data to other persons or organisations, as long as this was required for a COVID-19 purpose, e.g., preventing the spread of the virus or research 259 . Interim conclusion: On the ground of legitimate interest, the study concludes that specific legal grounds other than consent could be invoked, insofar as specific conditions are met for the compatible research. As it is likely that not all research outside earlier defined projects (e.g. clinical trial) may meet these conditions, including the expectations of individuals and society, it would be useful to haave a debate on the preferred ground (if such preference is to be established). Agreement by the data subject (consent) would be suitable in some cases, but not feasible in others. 32 6 LEGAL ANALYSIS OF SELECTED GDPR PROVISIONS This chapter first addresses Article 11 of the GDPR (Section 6.1 ), followed by Article 14(5)(b) of the GDPR, concerning the exemption from the information obligation for scientific research (Section 6.2). It also addresses the application of Article 89(1) of the GDPR, in particular the obligation to de-identify personal data, and the data subject’s rights under the GDPR which may give the data controller the possibility to identify study participants (Section 6.3). 6.1 ARTICLE 11 GDPR AND THE OBLIGATION TO INFORM DATA SUBJECTS OF THE REUSE OF DATA 6.1.1 Legal analysis of Article 11 GDPR at EU level As Article 11 GDPR has no equivalent in the DPD 260 , there is no relevant case-law as yet. Surprisingly, Article 11 has not been subject to much academic discussion 261 , although it has sparked debate within research community from time to time. Prior to the GDPR, researchers argued that identifying information was sometimes maintained in order to meet data subjects’ requests, e.g. for correction or removal 262 . Some issues persist with the new Article 11 GDPR. In literature, it remains unclear whether Article 11 is about anonymous or pseudonymous data. As anonymous data is out of the scope of the GDPR, the study has taken it to relate solely to pseudonymous data 263 , the understanding of which appears to be generally accepted in literature, particularly in authoritative GDPR commentaries 264 . Another issue is Article 11’s classification and legal impact 265 . In the context of clinical research, ‘reasonable measures to verify the identity of a data subject’ (Article 11(2) GDPR and also Recital 64) may be difficult to define. As established by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) Guideline for Good Clinical Practice (GCP), the sponsor receives only coded (i.e. pseudonymised) data concerning the trial subjects (Principles 1.58 and 5.5.5), while the key for identification is held by the investigator. Patients receive all relevant information (about the trial and data protection notices) via the investigator and are not contacted directly by the sponsor. In that respect, if a patient provides their name, or even their ID, directly to the sponsor, the information may not be sufficient to identify the data subject (as the sponsor does not have the key code, nor the right to obtain it from the investigator, pursuant to GCP) 266 . Finally, there is a question as to whether accepting such additional information is a separate processing activity. The GDPR commentary 267 attempts to answer this question. In particular, Georgieva is of the opinion that the additional information required under Article 11(2) cannot be interpreted as a legal basis for data processing pursuant to Article 6(1), and the controller is still required to undertake the purpose compatibility test pursuant to Article 6(4) GDPR 268 . The controller must clarify which ‘additional information’ is needed. Another interpretation could be that such processing is necessary to comply with the controller’s legal obligation set forth in Article 11(2) GDPR, thus the legal basis for the processing would be Article 6(1)(c) GDPR – ‘legal obligation to which the controller is subject’. The major issue, however, is how Article 11 GDPR fits with the transparency obligation and right to information of data subjects, particularly Article 14(5)(b) GDPR. Compatibility with the fundamental right to data protection as set out in Article 8 of the EU Charter on Fundamental Rights must also be assessed 269 . It is useful here to draw a distinction between different scenarios common in research, and different kinds of research:  Where a data controller itself reuses data and (anonymises or) pseudonymises that data itself, Article 11 GDPR does not prevent that data controller from informing the data subject prior to the reuse of data. On the contrary, if a data controller reuses data but obtained such (anonymised or) pseudonymised data from another party, Article 11 could prevent information being given to 34 first stage of processing, the data controller collects data of identifiable natural persons. However, in the course of the processing it is discovered that identifying the data subjects is no longer needed. The authors provide the following examples: ‘it may be that the primary purposes for which the data were collected, have changed’ ; ‘it is possible that the storage periods have expired and that, in order to comply with the storage limitation principle, the data controller would not be able to store the data any longer in a form that would allow the identification of the data subjects’ . With respect to the second example, Toshkova-Nikolva and Feti explain that storing data for longer periods (than originally planned) is possible only as long as they will be processed solely for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes, and when applying technical and organisational measures to safeguard the rights and freedoms of the data subjects , in accordance with Article 89(1) of the GDPR. By contrast, in France , Article 11 GDPR was assumed to refer to anonymised data. According to Chassang, the challenge is to ensure that the data are well anonymised. Individuals should be informed about the anonymisation and consequences regarding the exercising of their rights under the GDPR 278 . Finally, in Belgium , two scenarios were considered:  Where the data controller reusing data anonymises or pseudonymises the data itself, Article 11 does not prohibit informing the data subject prior to that reuse;  Where the data controller who reuses data obtains anonymised or pseudonymised data from another party, Article 11 GDPR prohibits informing the data subject prior to that reuse. In this case, the transparency obligation can be transferred to the original data controller through contractual agreements 279 . 6.2 Legal analysis of the application of the exemption to information duty for scientific research and appropriate measures under Article 14(5)(b) GDPR 6.2.1 Legal analysis of Article 14(5)(b) GDPR at EU level The lawfulness of the processing operations is seriously endangered by the lack of a sufficient level of transparency on the use and further use of health-related data in the context of scientific research. Transparency allows data subjects to – a priori 280 – learn about the planned data processing operations and – a posteriori 281 – enforce their rights. Additionally, where patients are able to find transparent information on the processing of their health-related personal data at the moment of their choice, they will find themselves (re-)assured and gain trust 282 . Prior to the implementation of the GDPR, participants in prospective (interventional) studies were generally informed about their privacy and the processing of their data through informed consent procedures. The CTD has harmonised the requirement for informed consent for participation in clinical trials using medicinal products. Since the GDPR, it remains possible to inform data subjects about data protection through the informed consent form (ICF) for participation in the clinical trial, on the condition that the structure of the ICF clearly distinguishes between (the risks caused by) participation and (risks caused by) data processing. Doing so is not advised where informed consent is not indicated as the legal basis for the data processing (see above), as it may cause confusion in data subjects and could potentially induce requalification of the legal basis. Prior to the GDPR it was not uncommon to apply an exemption to transparency obligations for disproportionate effort. The size of the research project, the age of the data and the mortality rate in the research population were generally considered valuable arguments to allow researchers to provide information through a public announcement (website, leaflet, brochure, poster) rather than informing research participants individually. While such a public announcement has little added value for data subjects , the GDPR similarly allows for researchers to invoke disproportionate effort. Currently , the exemption is restricted to situations where the data are not collected from the data subject 283 . It is necessary to clarify the distinction between Article 13 (data obtained from a data subject) 35 and Article 14 (data not directly obtained from a data subject). In case of the further use of patient data (for scientfic purposes), which article applies when the data have been collected directly from the patient by physician A, but are for the purpose of research reused by physician B, who is working in the same hospital but does not have a therapeutic relationship with the patient? When Article 14 is applicable, physician B could argue for an exception under Article 14(5)(b). When Article 13 is applicable, that physician would not be able to argue for an exception. The importance of transparency might encourage restricting the scope of Article 14(5)(b). A two-step approach could be useful, especially in a context where data are further used for more than one specific purpose (e.g. more than one clinical trial, more than one research and development project, more than one project).  In a first step, data controllers have to provide general information to all of the participants. In a hospital setting, this would mean that all ambulant and admitted patients are informed that research is conducted at the hospital. Transparency can be created by using patient information brochures, leaflets, websites, digital information screens;  In a second step, the general information should be supplemented with an individualised overview of the projects and studies for which the data of that individual will be used. Such an overview should encompass prospective studies, retrospective studies and feasibility screenings (see definition of scientific research above). In a hospital setting, this would mean that on the patient portal of the hospital where the patient is treated, the patient is able to find an overview of the studies and clinical trials for which their data are used 284 . A complementary solution could be an EU portal providing a repository 285 . 6.2.2 Overview and analysis of national legislation and guidance on Article 14(5)(b) GDPR The majority of countries investigated make no specific advice available. However, France and Italy have adopted a similar procedure - authorisation is required from the DPA prior to secondary use of personal data (including sensitive data) in cases where the controller (a third party) can rely on Article 14(5) GDPR. In the UK, it appears that the lack of specific guidance likely results from the range of possible research circumstances to which the principle might apply and the need to consider the relevant processes and interests involved on a case-by-case basis 286 . In Belgium , the personal view of the researcher who contributed, has been reported above 287 . Specific guidance (either in law or national guidelines) was reported in Germany, Hungary, Italy and France. In Germany, the Association for Data Protection and Data Security (GDD) made certain general observations on the concept of disproportionate effort. For example, the case-law findings that such an effort should not result from obstructions unnecessarily created by the controller, and cannot solely consider financial or organisational costs. The GDD eventually recognises that whether efforts are disproportionate or not can only be considered on a case-by-case basis 288 , given the range of possible research circumstances to which the principle might apply. In France , according to the CNIL 289 , all of the reasons mentioned in Article 14(5) GDPR can be invoked by the data controller to justify an exception to individual right to information in the context of scientific research. Nevertheless, this must be justified in detail by the controller. The controller will not have access to simplified procedures in these circumstances. CNIL authorisation is needed prior to the start of the processing. In each case, the CNIL assesses the reasons and circumstances of the exception invoked, as well as the guarantees presented by the controller (and processors) before providing any authorisation (assessment of the material difficulty in re-identifying the persons concerned, the human workload, the financial cost, the age of the data, the number of people, etc.). These assessments are performed with due consideration for the means available to the data controller to respect data subject’s right to information. Where the 36 research project is submitted by law to a prior research ethics committee approval (for Research Involving Human Persons (RIHP) projects), the CNIL verifies that this has been obtained. In Italy , the Italian Data Protection Act (PDPC) contains a direct reference to the exemption to Article 14(5) GDPR. Pursuant to Section 110-a PDPC, secondary use of personal data for scientific research purposes by third parties is subject to authorisation by the SA, if informing the data subjects proves impossible or entails a disproportionate effort on specific grounds, or if it is likely to render impossible or seriously impair the achievement of the research purposes 290 . 6.3 ARTICLE 89(1) GDPR (OBLIGATION TO DE-IDENTIFY DATA COLLECTED) AND DATA SUBJECTS’ RIGHTS UNDER THE GDPR 6.3.1 Legal analysis of Article 89(1) GDPR at EU level Article 89(1) GDPR provides that processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall be subject to ‘appropriate safeguards’ of the rights and freedoms of data subjects. The nature of these appropriate safeguards is not clearly specified nor is it clear if national legislation may impose some specific measures or if the data controller alone can decide the appropriate safeguards. It could be argued that the principle of accountability and the lack of reference to margin of manoeuvre for the Member Statess in Paragraph 1 (although included in Paragraph 2) seems to indicate that the data controller is free to choose the more appropriate safeguards 291 . Article 89(1) GDPR only contains specific obligations for data minimisation. These specific obligations should be understood as a cascade obligation with three levels 292 :  When, for the purpose of research, the use of personal data (that allow for the identification of the data subject) is not required, data should be anonymised 293 ;  When, for the purpose of research, the use of personal data (that allow for the re-identification of the data subject) is required, but the use of easily identifiable information including direct identifiers is not required, personal data should be pseudonymised 294 ;  When, for the purpose of research, the use of non-pseudonymised data, including direct identifiers, is required, an appropriate level of security should be achieved using different measures 295 . When data are anonymised, the further use of data is out-of-scope of the GDPR. The sole question that arises in this case is whether the data subject must be informed about the anonymisation itself, since anonymisation is also a processing operation 296 . When data are transferred from one controller to another, it is the first controller that anonymises the data 297 . When data are pseudonymised, the burden of the transparency principle is, in practice, often transferred to the party that collects the data – this is not necessarily the party that decides on the purposes and the means. For instance, in clinical research, the sponsor of the trial will determine the protocol (purpose and means of the research) and would be qualified as the data controller 298 . The participating site will collect the personal data, but as the data processor, because it does not determine the purpose and means. While the sponsor (controller) will provide the content of the information that needs to be provided to the data subject, the participating site (processor) will often be requested to provide the information to the data subject through the investigator. While the participating site should be free to claim compensation for their efforts, it seems correct that they are requested to provide the information to the data subject. This obligation should be included in the data processing agreement and in the study protocol. To implement procedures to enhance transparency, ideas can be adopted from ICH GCP, especially the informed consent procedure (principle 4.8) 299 . It could be argued that compliance with the transparency obligations under the GDPR can be achieved through a staged approach. Where it is necessary for the purpose of the research not to provide 37 information on the techniques and methodologies, a more general description should be allowed. Nevertheless, given that the GDPR does not provide for exceptions to the transparency obligation and the key role of this principle in the functioning of the GDPR, data controllers must ensure that data subjects are provided with additional information as soon as possible. Lessons can be learned from ICH GCP principles, for example, which apply to the use of single and double-blind studies. The study sought to investigate how the transparency obligations under the GDPR apply in the context of projects using covert techniques. The GDPR contains no specific provision in this respect and few Member States have specific provisions or national guidance on the subject (see Section 5.3.2 ). 6.3.2 Overview and analysis of national legislation and guidance on Article 89(1) GDPR In the majority of the countries examined, there were no insights into Article 89(1) GDPR 300 . National advice (in the form of law or guidelines) was found in five Member States 301 . In Germany , the law provides certain legal clarification of the obligation to de-identify under Article 89(1) GDPR 302 . There seems to be little further specific clarification of how these measures are to be implemented within specific research projects or organisations. This makes sense given the significant differences in types of research conducted, organisation of research approaches and resources available 303 . In Slovakia , similar to Article 89(1) GDPR, Section 78(8) DPA provides for general safeguards in cases of processing of personal data for scientific purposes. There is no direct reference to the possibility for third parties to access the de-identified data in the DPA or other legislation. In the case of the processing of data for scientific purposes, several data subjects’ rights may be restricted (e.g. the right to access personal data, the right to rectification of personal data, the right to rectification of the processing of personal data and the right to object to the processing of personal data), as specified in Section 78(9) DPA 304 . In Slovenia , the proposal for a new data protection law includes a provision pursuant to which academic researchers registered with the relevant agency may under certain circumstances access previously processed data. This is permitted if they disclose certain information to the controller 305 . However, there is no certainty if or when the proposal will be adopted. Finally, in the UK , the Data Protection Act reiterates that the obligations outlined in Article 89(1) GDPR must be adhered to for the processing of personal data for research purposes. There is certain limited guidance available on the obligation to maintain principles of data minimisation in scientific research. The Health Research Authority, for example, states: ‘Organisations must also have technical and organisational measures in place to ensure respect for the principle of data minimisation. These should include that only the absolute minimum amount or type of personal data required for a purpose is processed. Personal data should be pseudonymised where compatible with the research purpose, and identifiable data should not be used where the research purpose can be fulfilled by further processing with anonymised data’ 306 . The Authority notes, however, that this guidance will need to be implemented at organisational level 307 . In Bulgaria, pursuant to Article 28(1) of the Health Act, health information may be ‘disclosed to third parties in any of the following cases: […] 6. it is necessary for the needs of medical statistics or medical research , having deleted the data identifying the patient’ . The law does not specify whether ‘deleting the data identifying the patient’ is understood to mean pseudonymised or anonymised data. According to Opinion 05/2014 of the Article 29 WP, ‘when a data controller does not delete the original (identifiable) data at event-level, and the data controller hands over part of this dataset ( for example after removal or masking of identifiable data ), the resulting data is still personal data’ 308 . There appears to be no specific guidance in Bulgarian case-law/codes of conduct on the technical measures required to comply with Article 28(1) of the Health Act. It can likely be assumed that in most cases the data disclosed would be pseudonymised data, i.e. personal data. This issue touches on the complex discussion about absolute/relative anonymisation, which is not yet solved at EU level 309 . Currently, there is no consistency at national level or in international standards as to what constitutes anonymisation 310 . 38 6.3.3 Overview and analysis of national legislation and guidance on projects using covert techniques There was no specific law or national guidance available in the majority of the countries investigated (13 out of 18) 311 . In France , a specific article for ensuring ethical deception practice in research limits the use of deception to the sole research in psychology (explicit purpose limitation; and explicit mention of the type of information exceptionally allowed to be hidden from the participant, see Article L. 1122-1 PHC). The practice of deception method, even if scientifically justified, in no way entirely deprives research participants of their right to be informed. The information process will nevertheless be adapted before the first data collection and completed as soon as possible afterwards. Complete information on the research is provided at the end. The use of deception and its justification from a scientific or methodological point of view shall be detailed in the dossier submitted to the competent REC ( Comité de Protection des Personnes , mentioned in Article L. 1123-6) and explicitly mention the nature of the preliminary information sent to potential research participants. The REC will assess and approve or reject such a possibility, on a case-by-case basis. Correct implementation of the approved procedure should be documented by the data controller during the research as part of its accountability obligation. In Belgium , the national input for this study echoes the rationale of the French law, i.e. that the use of covert techniques should not prevent researchers from being completely transparent at the end. Once the study is complete, data subjects should be further informed 312 . 39 7 POLICY RECOMMENDATIONS Chapter 7 presents some approaches and policy recommendations to better harmonise the legal regime relating to scientific or historical research or statistical purposes. Section 7.1 presents general recommendations and Section 7.2 more specific recommendations. 7.1 GENERAL RECOMMENDATION: INCREASED DIALOGUE AND COOPERATION There is no uniformity in Member States’ approaches to key aspects of the secondary use of personal data for scientific research. Following the detailed analysis presented, the general recommendation is for the EDPB to encourage increased dialogue between Member State SAs, sharing of information on national practices and interpretations in view of Article 60 and following the GDPR, and cooperation between Member State SAs, European institutions and bodies, and key stakeholders. In addition:  The EDPB and other European institutions and bodies (European Commission, EDPS, regulatory bodies in the research field, such as the EMA) could establish closer exchanges, with a view to aligning their advice on the interplay of the GDPR and other sectoral laws (CTR, national biobank legislation, etc.). Discrepancies are evident in the views of European institutions and an alignment of positions would greatly aid practitioners (such as commercial and academic research institutions) in applying the GDPR.  The EDPB could promote the establishment of relevant sectoral codes of conduct (as per Article 40 GDPR), such as that currently drafted by the Biobanking and BioMolecular Resources Research Infrastructure – European Research Infrastructure Consortium (BBMRI-ERIC) in the sphere of health research. This can be done via official communication.  The EDPB could stress the importance of involving all key stakeholders (commercial and academic research centres, patients, consumers, governments and citizens) in the creation of sectoral codes of conduct and binding and non-binding guidelines. Empirical research on a pan-European scale could be useful in mapping stakeholders’ experience, challenges and solutions.  The EDPB could adopt guidelines to address the secondary use of personal data for scientific research (see Section 6.2 for specific areas needing guidance). A disctinction could be made between: (i) problems caused by a lack of uniformity in the interpretation of the key elements of GDPR and (ii) divergences in Member States’ implementation of the margins of discretion in the GDPR in national laws. 7.2 SPECIFIC RECOMMENDATIONS Table 6 presents some suggested approaches to topics that should be addressed in future EDPB guidelines on the topic of secondary use of personal data for scientific research purposes. These recommendations reflect the findings of the study, particularly with respect to health data. The table notes whether the problems are caused by a lack of uniformity in interpretation (‘interpretation issue’) or divergences in the implementation of the GDPR in national laws (‘implementation issue’). In certain cases, both types of issue are evident. 44 8 CONCLUSIONS This study investigated pertinent questions about the secondary use of personal data for scientific research. Based on the information gathered on 18 countries, there appears to be a lack of a uniform approach among Member States. This might lead to a lack of protection of data subjects involved in research, or ‘forum shopping’ for commercial actors undertaking scientific research. The diversity of positions reflects the margin of manoeuvre left to Member States by the GDPR, with respect to the processing of personal data in the framework of research. Equally, the GDPR itself is not explicit on some points. This study shows that the situation and laws in the Member States are different because some have specific national provisions clarifying the European legislation. The first concern is the meaning of ‘scientific research’ - there is no clear definition in the GPDR and most Member States do not specify it futher, except in some sectoral laws. Without a clear definition, homogenous application of the presumption of compatibility and the Article 89 GPDR specific framework is not possible. The terms ‘secondary use’ and ‘further processing of data’, and the links between them, need attention and guidance to prevent misunderstandings. In the case of reuse of personal data, the question of the need for a (new) legal basis should be clarified, given that some Member States require a new legal basis while others do not. Similarly, Member States lack a clear position on legal bases for sensitive data, with little clarity on the articulation between Articles 6 and 9 GDPR (cumulative requirements or separate requirements). Few Member States clearly see Article 9 GDPR as a cumulative requirement. The choice of legal basis can also pose a problem for pan-European studies. The effectiveness of data subjects’ rights was an important aspect of the study, especially in relation to consent and the right to information. Some clarifications seem necessary, for instance in relation to application of the transparency obligation in cases of reusing personal data, or how precisely data subjects may choose the areas of scientific research where their data could be used (interpretation of Recital 33 of the GDPR). Questions remain about the concept of ‘appropriate safeguards’ in the context of Article 89 GDPR. Most Member States lack clear practical guidance on the kinds of measures that should be implemented by the data controller. Another concern is the possibility for Member States to impose some specific measures in this context. It seems clear that the EDPB could usefully promote cooperation and dialogue between SAs and between different European institutional bodies involved in scientific research regulation with a view to providing these clarifications. The promotion of sectoral codes of conduct (binding on adherents) or guidelines is another possible solution. These kinds of instruments should be developed with input from a large panel of stakeholders (commercial and academic research centres, patients, consumers, governments and citizens). Even if clarifications are provided by EDPB guidelines, or codes of conduct, national differences may persist due to national law rather than interpretations of GDPR provisions. In such cases, the EDPB would have limited ability to harmonise these rules and the only way forward would be to modify EU or Member State legislation. Finally, the GDPR overlaps and interacts with other specific European legislation (CTR, Biobanks Directives). Further guidance on the interplay between these different pieces of legislation could be beneficial. 53 ANNEX 2 – QUESTIONNAIRE ON RELEVANT NATIONAL LAWS AND PRACTICES 1 1 This questionnaire was intended for external use. Questionnaire used by internal researchers was slightly more elaborate. 55 Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research BACKGROUND INFORMATION The European Data Protection Supervisor (EDPS) and the European Data Protection Board (EDPB) recently awarded a framework contract for ‘Studies on the implication of several GDPR provisions, case laws and other laws having an impact on data protection’. This questionnaire on secondary use of personal data for scientific research is provided within this framework contract and shall be kept strictly confidential . This questionnaire is aimed at compiling relevant legal information about national regulation and on secondary use of personal data for scientific research the implementation of specific provisions of the GDPR by EU Member States and EFTA EEA countries (Iceland, Lichtenstein and Norway). We would like to obtain an overview of the applicable national legislation, guidelines, decisions and conditions for the secondary use of personal data for scientific purposes, with a specific focus on how the principles of purpose limitation and lawfulness, which are closely related when it comes to the secondary use of personal data, are applied in the context of scientific research. This Questionnaire has been designed as a methodological tool to gather national information from experts on the national specificities. Please provide answers to all questions which are relevant in the context of your national legal order. When we ask for explanation on the national rules, please consider also case law, legal interpretation by legal scholars and any national guidelines from the SAs and other relevant authorities, (legal) scholar views and national practices that are relevant. Please provide with your answer any relevant specific source, including links or attachments to the relevant sections or legislation pieces. We would be grateful to receive your input by June 8 If you would need more time, please let us know in advance so that we can take this into account. Once completed, please send it back to and eleftherios.chelioudakis@kuleuven.be . If you have any questions regarding this study or the questionnaire, please contact the same e-mail addresses. Data Protection Notice Please be informed that all personal data that you provide by collaborating and answering to this questionnaire and gathered for this study - in particular your contact details and your input to the questions - will be treated in conformity with Regulation (EU) 2018/1725 and all other applicable legal requirements. The controller for execution purposes of the procurement framework contract, including the conduct of the legal studies, is the EDPS (including the EDPB Secretariat) and the EDPB. Your personal data will be processed by the consortium of partners, including their subcontractors/affiliates, namely Milieu Consulting SPRL, the Center for Law and Digital Technologies (eLaw) from Leiden University, KU Leuven, represented by the KU Leuven Centre for IT & IP law (CiTiP), the Research Centre in Information Law and Society (CRIDS) from the University of Namur and CLI - Vrije Universiteit Amsterdam, acting as processors on behalf of the EDPB and the EDPS and under their sole instructions. The content of your replies you provide will be used by those processors to gather information and knowledge for the provision of the report. Your answers will remain confidential, and will not be transferred to any other third parties, except where legally required (e.g. audits by EU bodies or access to documents requests, on the basis of available exceptions and in accordance with applicable law). Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research No responses to the questionnaire will be published with any of your contact details. Please note, however, that, at your request, a general reference to your full name and/or professional affiliation as a participating expert may be included in the study. Should that be the case, please make such request, in writing, to the consortium as an expression of your consent. Such reference will become public in the event that the study is published or made accessible following an access to document request. You may withdraw your consent at any time, but please note that all activities carried out before your withdrawal remain lawful. For information on how your personal data will be processed in the context of these activities, including on the applicable legal basis and retention periods applicable to the processing of your personal data, on the exercise of your data subject rights and the necessary contacts concerning complaints, please read the applicable EDPB / EDPS data protection notice on the execution of the contract. For information on how your personal data will be processed in the context of the management of the contract, please check the EDPS data protection notice: https://edps.europa.eu/data-protection/our- work/publications/other-documents/12-edps-data-protection-notice-procurement_en . Confidentiality clause Please treat in the strictest confidence and do not make use of and do not divulge to third parties any information or documents, disclosed in writing or orally, which are linked to the performance of this study, including the questionnaire and the name of the study, unless:  The use is required to answer this questionnaire;  The EDPB gives you our prior written consent to the disclosure;  You are required by law or by any regulatory authority to make the disclosure; o  The document or information has entered the public domain other than by wrongful disclosure by you. Please note that you shall continue to be bound by this obligation after completion of this questionnaire without limit in time. Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research QUESTIONNAIRE Contact details Contact persons and contacts Please, provide your name and your position within your organisation: Please, provide your contact information (e.g. email and/or telephone number): I. General questions 1 Is “scientific research” defined in your national legislation ( lex generalis or lex specialis , e.g. health legislation) and/or does the national legislation or case law in your country list principles that define scientific research? Please, bear in mind that specific arrangements can exist for a specific type of research (e.g. medical research), hence information should be looked for not only in general law, but also in sectorial legislation. (Please also provide reference to the applicable legal act and article, if any; feel free to use more space if needed) 2 If there is no legal definition, are you aware of case law, sectorial guidance, case law or any other source that provides a commonly accepted definition or is there a specific understanding of scientific research in your country ? II. Implementation of the principle of lawfulness of processing of special categories of personal data for scientific research in your country under 9(2)(a) 2 and Article 9(2)(j) 3 of GDPR. 1 Are there national legal provisions which require “explicit consent” as under Article 9(2)(a) GDPR for scientific research in your country, and in which contexts ? (Please also provide reference to the applicable legal act and article, if any; feel free to use more space if needed) 2 Are you aware of case law, codes of conduct, SA guidelines, other binding or non-binding instruments and/or practices in your country that impose the use of “explicit consent” in the context of scientific research? (Please also provide reference to the applicable legal act and article, if any; feel free to use more space if needed) 2 Article 9(2)(a) GDPR: “The data subject has given explicit consent to the processing of those personal data for one or more specified purposes…”. 3 Article 9(2)(j) GDPR : “Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”. Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research ANNEX 3 – SOURCES OF INFORMATION Legal documents  Charter of Fundamental Rights of the European Union (OJ C 326, 26.10.2012), p. 391–407, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:12012P/TXT .  Commission Directive 2006/17/EC of 8 February 2006 implementing Directive 2004/23/EC of the European Parliament and of the Council as regards certain technical requirements for the donation, procurement and testing of human tissues and cells (OJ L 330M , 28.11.2006, p. 162–174 (MT), OJ L 38, 9.2.2006, p. 40–52), https://eur-lex.europa.eu/legal- content/EN/TXT/?uri=CELEX%3A32006L0017 .  Commission Directive (EU) 2015/566 of 8 April 2015 implementing Directive 2004/23/EC as regards the procedures for verifying the equivalent standards of quality and safety of imported tissues and cells (OJ L 93, 9.4.2015, p. 56–68), https://eur-lex.europa.eu/eli/dir/2015/566/oj .  Council of Europe, Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine: Convention on Human Rights and Biomedicine (Oviedo Convention), ETS No 164, https://www.coe.int/en/web/bioethics/oviedo- convention .  Council of Europe, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ETS No 108, https://www.coe.int/en/web/conventions/full-list/- /conventions/rms/0900001680078b37 .  Council of Europe, Modernised Convention for the Protection of Individuals with Regard to the Processing of Personal Data, ETS No. 108 +, https://search.coe.int/cm/Pages/result_details.aspx?ObjectId=09000016807c65bf .  Council of Europe, Committee of Ministers Recommendation No. R (81) 1 on Regulations for automated medical data banks, ‘Rec(81)1’, https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016804 eee77 .  Council of Europe, Recommendation CM/Rec (2019) 2 of the Committee of Ministers to member States on the protection of health-related data, https://www.apda.ad/sites/default/files/2019- 03/CM_Rec%282019%292E_EN.pdf .  Council of Europe, Recommendation No. R (97) 5 of the Committee of Ministers to member States on the protection of medical data, https://search.coe.int/cm/Pages/result_details.aspx?ObjectID=09000016804f0ed0 .  Council of Europe, Recommendation No. R (97) 18 of the Committee of Ministers to member States, concerning the protection of personal data collected and processed for statistical purposes, https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016805 08d7e .  Council of Europe, Recommendation Rec(2006) 4 on research on biological materials of human origin, https://www.coe.int/t/dg3/healthbioethic/Activities/10 Biobanks/Rec%282006%294%20EM%20E.pdf .  Council of Europe, Recommendation CM/Rec (2016) 6 of the Committee of Ministers to member States on research on biological materials of human origin, https://search.coe.int/cm/Pages/result details.aspx?ObjectId=090000168064e900 .  Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31-50), https://eur-lex.europa.eu/legal- content/EN/TXT/?uri=celex%3A31995L0046 .  Directive 2001/20/EC of the European Parliament and of the Council of 4 April 2001 on the approximation of the laws, regulations and administrative provisions of the Member States relating to the implementation of good clinical practice in the conduct of clinical trials on medicinal products for human use (OJ L 121, 1.5.2001, p. 34–44), https://eur-lex.europa.eu/legal- content/EN/TXT/?uri=CELEX%3A32001L0020 .  Directive 2004/23/EC of the European Parliament and of the Council of 31 March 2004 on setting Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research standards of quality and safety for the donation, procurement, testing, processing, preservation, storage and distribution of human tissues and cells (OJ L 102, 7.4.2004, p. 48–58), https://eur- lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32004L0023 .  Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use, and repealing Directive 2001/20/EC (OJ L 158, 27.5.2014, p. 1–76), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32014R0536 .  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, (OJ L 119, 4.5.2016, p. 1-88), https://eur- lex.europa.eu/eli/reg/2016/679/oj . Literature  Andersen, M.R., Storm, H.H. (on behalf of the Eurocourse Work Package 2 Group), ‘Cancer registration, public health and the reform of the European data protection framework: Abandoning or improving European public health research?’, European Journal of Cancer , Vol. 51, No. 9, 2015, p. 1028-1038.  Aurucci, P., ‘Legal issues in regulating observational studies: The impact of the GDPR on Italian biomedical research’, European Data Protection Law Review , Vol. 5, No 2, Lexxion, 2019, pp. 197–208.  Aymé, S., ‘Enforcement of a new data protection law in Europe: A threat and an opportunity for registries and cohorts in the field of rare diseases’, La Revue de Médecine Interne , Vol. 39, No. 10, p. 769-771.  Ballantyne, A., ‘Adjusting the focus: A public health ethics approach to data research’, Bioethics , Vol. 33, No. 3, 2019, pp. 357-366.  Beier, K., Lenk, C., ‘Biobanking strategies and regulative approaches in the EU: recent perspectives’, Journal of Biorepository Science for Applied Medicine , Vol. 3, 2015, p. 69-81.  Bygrave, L.A., ‘The Body as Data? Biobank Regulation via the ‘Back Foor’ of Data Protection Law’, Law, Innovation and Technology , Vol. 2, No. 1, 2010, p. 1-25.  Chassang, G., Rial-Sebbag, E., ‘ Research Biobanks and Health Databases: The WMA Declaration of Taipei, Added Value to European Legislation (Soft and Hard Law)’, European Journal of Health Law , Vol. 25, No. 5, Brill and Nijhoff , 2018, pp. 501-516.  Cole, A. and Towse, A., ‘Legal Barriers to the Better Use of Health Data to Deliver Pharmaceutical Innovation’, OHE Consulting Report , 23 (2018), Office of Health Economic, London, 2018, https://www.ohe.org/publications/legal-barriers-better-use-health-data-deliver-pharmaceutical-innovation .  Comande, G., ‘Ricerca in Sanità e Data Protection un Puzzle...Risolvibile’, rivista italiana di medicina legale e del diritto in campo sanitario, Vol. 1., 2019, p. 187-207.  De Hert, P., Papakonstatinou, V., ‘The new general data protection regulation: Still a sound system for the protection of individuals’, Computer Law and Security Review , Vol. 32, No. 2, 2016, p. 179- 194.  Demotes-Mainard, J, Cornu, C., Guérin , A., ‘How the new European data protection regulation affects clinical research and recommendations’, Therapies , Vol. 74, No. 1, 2019.  Djurisic, S., Rath, A., Gaber, S., Garattini, S., Bertele, V., Ngwabyt, S., Hivert, V., Neugebauer, E., Laville, M., Hiesmayr, M., Demotes-Mainard, J., Kubiak, C., Jakobsen, J., Gluud, C., ‘Barriers to the conduct of randomised clinical trials within all disease areas’, Trials , Vol. 18, 2017.  Dove, E., ‘The EU General Data Protection Regulation: Implications for International Scientific Research in the Digital Era’, The Journal of Law Medicine and Ethics , Vol. 46, No. 4, 2018, p. 1013-1030, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3240459 .  Ducato. R., ‘Data protection, scientific research, and the role of information’ (CRIDES Working Paper Series no. 1/2020), Computar Law and Security Review , 2020, https://www.researchgate.net/publication/339213343_Data_protection_scientific_research_and_the_role_of information .  Duguet, A., and Herveg, J., ‘Safeguards and derogations relating to processing for scientific purposes: Article 89 analysis for biobank research’, in Slokenberga, S., Tzortzatou, O., Reichel Jane Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research (eds), GDPR and Biobanking , Springer, 2021.  Frunză, A., Sandu, A., ‘Ethical Acceptability of Using Generic Consent for Secondary Use of Data and Biological Samples in Medical Research’, Acta Bioethica, Vol. 23, No. 2, 2017, p. 289-299, https://actabioethica.uchile.cl/index.php/AB/article/view/47480/57703 .  Georgieva, L., and Kuner, C., ‘Article 9 Processing of special categories of personal data’, in Kuner, C., A. Bygrave, L., Docksey C., (eds.), The EU General Data Protection Regulation (GDPR). A commentary , Oxford University Press 2020.  Georgieva, L., Kuner, C., 2020  Georgieva, L., ‘Article 11 Processing which does not require identification’, in Kuner, C., A. Bygrave, L., Docksey C., (eds.), The EU General Data Protection Regulation (GDPR). A commentary, Oxford University Press 2020.  Georgieva, L., 2020.  Gola, P., 'Article 11', Datenschutz-Grundverordnung: DS-GVO, VO (EU) 2016/679 , 2nd Edition, C.H. BECK, 2017.  Hallinan, D., ‘Broad consent under the GDPR: an optimistic perspective on a bright future’, Life Sciences, Society and Policy , Vol. 16, Springer, 2020.  Hallinan, D., Feeding biobanks with genetic data. What role can the general data protection regulation play in the protection of genetic privacy in research biobanking in the EU? , VUB Doctoral Thesis, Brussels, 2018.  Hallinan 2018  Hartlev, M., ‘Genomic Databases and Biobanks in Denmark’, The Journal of Law, Medicine and Ethics , Vol. 43, No. 4, 2015, p. 743-753.  Herbst, T., ‘Art. 5 Grundsätze für die Verarbeitung personenbezogener Daten’, in Kühling, J., Buchner B. (eds.), Datenschutz-Grundverordnung, Bundesdatenschutzgesetz: DS-GVO / BDSG , 228, Beck, 2018.  Hijmans, H., Raab, C.D, ‘Ethical Dimensions of the GDPR’, in Cole, M., Boehm, F., (eds.), Commentary on the General Data Protection Regulation , Edward Elgar, Cheltenham, 2018 (forthcoming), https://ssrn.com/abstract=3222677 .  Hintze, M., ‘Viewing the GDPR through a De-Identification Lens: A Tool for Compliance, Clarification, and Consistency’, International Data Protection Law , Vol. 8, No. 1, Oxford University Press, 2018, p. 86-101, https://fpf.org/wp-content/uploads/2016/11/M-Hintze-GDPR-Through- the-De-Identification-Lens-31-Oct-2016-002.pdf .  Ienca, M., Scheibner, J., Ferreti, A., Gille, F., Amann, J., Sleigh. J., Blasimme, A., Vayena, E., ‘ How the General Data Protection Regulation changes the rules for scientific research’ , Study for the European Parliament Panel for the Future of Science and Technology, Brussels, 2019, http://www.europarl.europa.eu/thinktank/en/document.html?reference=EPRS STU(2019)634447 .  Ienca, M., et al., 2019.  Kamenjasevic, E., ‘ Health data for scientific research under the CoE Recommendation and the GDPR – Part II’ , Blog of KU Leuven’s Centre for IT&IP Law, 2019, https://www.law.kuleuven.be/citip/blog/health-data-for-scientific-research-under-the-coe-recommendation- and-the-gdpr-part-ii/ .  Kerr, D.J., ‘Policy: EU data protection regulation - harming cancer research’, Nature Reviews Clinical Oncology , Vol. 11, 2014, p. 563-564.  Kindt, E., Privacy and Data Protection Issues of Biometric Applications , Springer, 2013.  Kostadinova, Z., ‘ Purpose limitation under the GDPR: can Article 6(4) be automated? ’, Tilburg University Master Thesis, http://arno.uvt.nl/show.cgi?fid=146471 .  Kotschy, W., ‘Article 6 Lawfulness of processing’, in Kuner, C., A. Bygrave, L., Docksey, C., (eds.), The EU General Data Protection Regulation (GDPR). A commentary , Oxford University Press 2020.  Kramer, P., 'Article 6, Rechtmäßigkeit der Verarbeitung‘, in Auernhammer, H., Eßer, M., Kramer, P., von Lewinski, K., (eds.), Auernhammer DSGVO/BDSG , 5th ed., Carl Heymanns Verlag, Cologne, 2017.  Kuner, C., Svantesson, D.J., Cate, F.H., Lynskey, O., Millard, C., ‘The language of data privacy law (and how it differs from reality)’, International Data Privacy Law , Vol. 6, No. 4, 2016, p. 259-260. Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research  Lalova, T., et al., ‘An overview of Belgian legislation applicable to biobank research and tis interplay with data protection rules’, in Slokenberga, S., Tzortzatou, O., Reichel Jane (eds), GDPR and Biobanking , Springer, 2021.  Lalova, T., Negrouk, A., Deleersnijder, A., Valcke, P., Huys, I., ‘Conducting Non-COVID-19 Clinical trials during the Pandemic: Can Today’s learning Impact Framework Efficiency?’, European Journal of Health Law , Vol. 27, No. 5, forthcoming.  Mészáros, J., Ho, C., ‘Big Data and Scientific Research: The Secondary Use of Personal Data under the Research Exemption in the GDPR’, Hungarian Journal of Legal Studies , Vol. 59, No. 4, 2018, p. 403-419.  Minssen, T., Rajam, N., Bogers, M., ‘Clinical Trial Data Transparency and GDPR Compliance: Implications for Data Sharing and Open Innovation’, Science and Public Policy , 2020, p.1-11.  Negrouk, A., Lacombe, D., ‘Does GDPR harm or benefit research participants? An EORTC point of view’, The Lancet Oncology , Vol. 19 No. 10, 2018, p.1278-1280.  Negrouk, A., Lacombe, D., Meunier, F., ‘Diverging EU health regulations: The urgent need for co ordination and convergence’, Journal of Cancer Policy , Vol. 17, 2018, p. 34-39.  Peloquin, D., Di Maio, M., Bierer, B., ‘Disruptive and avoidable: GDPR challenges to secondary research uses of data’, European Journal of Human Genetics , Vol. 28, 2020, p.697-705.  Quinn, P., ‘The Anonymisation of Research Data — A Pyric Victory for Privacy that Should Not Be Pushed Too Hard by the eu Data Protection Framework?’, European Journal of Health Law , Vol. 24, No. 4, 2017, p. 347-367.  Quinn, P., Quinn, L., ‘Big genetic data and its big data protection challenges’, Computer Law & Security Review , Vol. 34, No. 5, 2018, p. 1000-1018, https://www.sciencedirect.com/science/article/abs/pii/S0267364918300827?via%3Dihub .  Reimer, P., ‘Artikel 5: Grundsätze für die Verarbeitung personenbezogener Daten’ in Sydow, G., (ed.), Europäische Datenschutzgrundverordnung: Handkommentar , Nomos, 2018, 326.  Rial-Sebbag, E., Cambon-Thomsen, A., ‘The Emergence of Biobanks in the Legal Landscape: Towards a New Model of Governance’, Journal of Law and Society , Vol. 39 No. 1, 2012, p. 113- 130.  Shabani, M., Borry, P., ‘Rules for processing genetic data for research purposes in view of the new EU General Dat Protection Regulation’, European Journal of Human Genetics , Vol. 26, No. 2, 2018. p. 149-156.  Spindler, G., Schmechel, P., ‘Personal Data and Encryption in the European General Data Protection Regulation’, Journal of Intellectual Property, Information Technology and E-Commerce Law , Vol. 7, No. 2, 2016, p. 163-177.  de Terwangne, C., ‘Article 5 Principle relating to processing of personal data’, in Kuner, C., A. Bygrave, L., Docksey, C., (eds.), The EU General Data Protection Regulation (GDPR). A commentary , Oxford University Press 2020.  De Terwangne C., Degrave É., Delforge A., & Gerard L., La protection des données à caractère personnel en Belgique: manuel de base , Politeia, Brussels, 2019.  Toshkova-Nikolova, D., Feti, N., Защита на личните данни [Protection of personal data], ИК Труд и Право [Publishing House Trud i Pravo], 2019.  Van Veen, E., ‘Observational health research in Europe: understanding the General Data Protection Regulation and underlying debate’, European Journal of Cancer , vol. 104, 2018, p. 70-80.  Vanden Heede, E., ‘ GDPR Application in Patient Preference Studies ’, Master thesis for Intellectual Property and ICT Law under supervision of Prof. Huys, I..  Verhenneman, G., ‘ The patient's right to privacy and autonomy against a changing healthcare model: assessing informed consent, anonymisation and purpose limitation in light of e-health and personalised healthcare’ , PhD dissertation, KU Leuven Faculty of Law, 2020.  Verhennenman, G., 2020  Verhenneman, G., Claes, K., Derèze, J.J., Herijgers, P., Mathieu, C., Rezda, R., Vanautgarden, M., ‘ How GDPR Enhances Transparency and Fosters Pseudonymisation in Academic Medical Research’, European Journal of Health Law , Vol. 27(1), Brill and `Nijhoff, 2019, p. 40.  Wierda, E., Eindhoven, D.C., Schalij, M.J., Borleffs, C.J.W., van Veghel, D., Michell, C.R., de Mol, B.A.J.M., Hirsch, A., Ploem., M.C., ‘Privacy of patient data in quality-of-care registries in Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research cardiology and cardiothoracic surgery: the impact of the new general data protection regulation EU- law’, European Heart Journal – Quality of Care and Clinical Outcomes , Vol. 4, No. 4, 2018, p. 239-245.  Zuiderveen Borgesius, F., Hallinan, D., ‘Article 5’, in Boehm, F., Cole, M., (eds), GDPR Commentary , Elgar, 2021 (forthcoming).  Zuiderveen Borgesius, F., Hallinan, D., 2021  Zuiderveen Borgesius, F., ‘Singling Out People without Knowing Their Names - Behavioural targeting, pseudonymous data, and the new Data Protection Regulation’, Computer Law & Security Review , Vol. 32, No. 2, 2016, p. 256-271. Case law  ECtHR, Bărbulescu v. Romania [GC], Application No. 61496/08, 5 September 2017, CE:ECHR:2017:0905JUD006149608.  ECtHR, I. v. Finland, Application No. 20511/03, 17 July 2008, CE:ECHR:2008:0717JUD002051103.  ECtHR, S. and Marper v. U.K. [GC], Applications No. 30562/04 and 30566/04, 4 December 2008,  CE:ECHR:2008:1204JUD003056204.  CJEU, Judgement of 19 October 2016, Patrick Breyer v. Bundesrepublik Deutschland, C-582/14, EU:C:2016:779.  CJEU, Judgement of 16 July 2020, Facebook Ireland and Schrems, C-311/18, EU:C:2020:559. Other sources of information  Article 29 Data Protection Working Party, Guidelines on consent under Regulation 2016/679, 17/EN, WP 259 rev.01, 28 November 2017, as revised on