April 2018, https://ec.europa.eu/newsroom/article29/item-detail.cfm?item id=623051 .  Article 29 Data Protection, Working Party, Opinion 04/2007 on the concept of personal data, 01248/07/EN, WP 136, 20 June 2007.  Article 29 Data Protection, Working Party, Opinion 03/2013 on purpose limitation, 00569/13/EN, WP 203, 2 April 2013.  Article 29 Data Protection Working Party, Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, 844/14/EN, WP 217, 9 April 2014.  Article 29 Data Protection Working Party, Opinion 05/2014 on Anonymisation Techniques, 0829/14/EN, WP 216, 10 April 2014.  Article 29 Data Protection Working Party, Opinion 03/2017 on Processing personal data in the context of Cooperative Intelligent Systems (C-ITS), 17/EN, WP 252, 4 October 2017.  Article 29 Data Protection Working Party, Working document on a common interpretation of Article 26(1) of Directive 5/46/EC of 24 October 1995, 2093/05/EN, WP 114, 25 November 2005.  Council of Europe, Explanatory Report to Modernised Convention for the Protection of Individuals with Regard to the Processing of Personal Data, ETS No. 108 +, https://edoc.coe.int/en/international- law/7729-convention-108-convention-for-the-protection-of-individuals-with-regard-to-the-processing-of- personal-data.html .  Council of Europe, Explanatory Memorandum to Recommendation No. R (97) 18 of the Committee of Ministers to member States, concerning the protection of personal data collected and processed for statistical purposes, para. 11 and 14.  Encyclopedia of Research Design, Neil J. Salkind, N.J. (ed.), SAGE Publications, Inc., 2010, https://sk.sagepub.com/reference/researchdesign .  European Commission, COM(2020) 264 final, Communication from the Commission to the European Parliament and the Council on Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition - two years of application of the General Data Protection Regulation.  European Commission, DG for Health and Food Safety, Question and Answers on the interplay Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research between the Clinical Trials Regulation and the General Data Protection Regulation , 2019, https://ec.europa.eu/health/sites/health/files/files/documents/qa clinicaltrials gdpr en.pdf .  European Data Protection Board, Guidelines 3/2019 on processing of personal data through video devices, 10 July 2019, https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32019- processing-personal-data-through-video_en .  European Data Protection Board, Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak, 21 April 2020, https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032020-processing-data- concerning-health-purpose_en .  European Data Protection Board, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 2 September 2020, https://edpb.europa.eu/our-work-tools/public-consultations-art- 704/2020/guidelines-072020-concepts-controller-and-processor_en .  European Data Protection Board, Guidelines 4/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak, 21 April 2020, https://edpb.europa.eu/our-work- tools/our-documents/guidelines/guidelines-042020-use-location-data-and-contact-tracing_en .  European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, Version 1.1, 4 May 2020, https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines- 052020-consent-under-regulation-2016679 en .  European Data Protection Board, Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR), 23 January 2019, https://edpb.europa.eu/our-work-tools/our-documents/dictamen-art-70/opinion- 32019-concerning-questions-and-answers en .  European Data Protection Supervisor, A Preliminary Opinion on data protection and scientific research, 6 January 2020, https://edps.europa.eu/data-protection/our- work/publications/opinions/preliminary-opinion-data-protection-and-scientific_en .  European Data Protection Supervisor, Guidelines concerning the processing of health data in the workplace by Community institutions and bodies, 28 September 2009, https://edps.europa.eu/data- protection/our-work/publications/guidelines/health-data-work en .  European Data Protection Supervisor, Opinion 7/2015, ‘Meeting the challenges of big data, A call for transparency, user control, data protection by design and accountability’, 19 November 2015, https://edps.europa.eu/data-protection/our-work/publications/opinions/meeting-challenges-big-data en .  European Medicines Agency, Clinical Trial Regulation - Clinical Trials Information System development , https://www.ema.europa.eu/en/human-regulatory/research-development/clinical- trials/clinical-trial-regulation#clinical-trials-information-system-development-section .  European Medicines Agency, Guideline for good clinical practice E6(R2), 1 December 2016, https://www.ema.europa.eu/en/documents/scientific-guideline/ich-e-6-r2-guideline-good-clinical-practice- step-5_en.pdf .  European Organisation for Research and Treatment of Cancer, EORTC Contribution to the EMA Discussion Paper for c-Performing and Research-Supporting Infrastructures entitled “The General Data Protection Regulation: Secondary Use of Data for Medicines and Public Health Purposes Discussion Paper for Medicines Developers, Data Providers, Research-Performing and Research- Supporting Infrastructures” , 10 July 2020, http://www.eortc.org/app/uploads/2020/09/EMA- Secondary-use-of-health-data Discussion-Paper Stakeholders-consultation.pdf .  Foundation Federation of Dutch Medical Scientific Societies (Federa),’Self-regulatory code of conduct for Observational Research with personal data (Gedragscode Gezondheidsonderzoek, 2004)’, https://www.federa.org/sites/default/files/bijlagen/coreon/code_of_conduct_for_medical_research_1.pdf .  Gellman, R., ‘Privacy: Finding a Balanced Approach to Consumer Options’, Robert Gellman webpage , 2002, https://www.bobgellman.com/rg-docs/rg-opt-in-out-02.pdf .  Gene, A., Long, W., Webinar ‘Clinical Trials and GDPR – State of play’ , Drug Information Association (DIA), 10 July 2019.  Germany, Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, Public Consultation on the theme: Anonymisierung unter der DSGVO unter besonderer Berücksichtigung der TK- Branche , 2020, p. 6-7, https://www.bfdi.bund.de/SharedDocs/Konsultationsverfahren/2020/01 Anonymisierung- Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research TK.pdf?__blob=publicationFile&v=6 .  Germany, Conference on Data Protection ( Datenschutzkonferenz) , ‘Beschluss der 97 Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder zu Auslegung des Begriffs „bestimmte Bereiche wissenschaftlicher Forschung“ im Erwägungsgrund 33 der DS- GVO‘, 2019, https://www.datenschutzkonferenz- online.de/media/dskb/20190405 auslegung bestimmte bereiche wiss forschung.pdf .  German Association for Medical Informatics, Biometry and Epidemiology (GMDS) and German Association for Data Protection and Data Security (GDD), 'Datenschutzrechtliche Anforderungen an die medizinische Forschung unter Berucksichtigung der EU Datenschutz-Grundverordnung (DS- GVO)‘, 30, 2018, https://www.gdd.de/arbeitskreise/datenschutz-und-datensicherheit-im-gesundheits-und- sozialwesen/materialien-und-links/datenschutzrechtliche-anforderungen-an-die-medizinische-forschung- unter-beru-cksichtigung-der-eu-datenschutz-grundverordnung/datenschutzrechtliche-anforderungen-an-die- medizinische-forschung-unter-beru-cksichtigung-der-eu-datenschutz-grundverordnung/ .  Huys, I, ‘ Integrating patient preferences in the drug life cycle ’, Presentation for the Patient Preferences in Benefit-Risk Assessments during the Drug Life Cycle (PREFER), https://www.afmps.be/sites/default/files/content/11. prefer-fagg.pdf .  Interview with Alexandre Entraygues, Head Data Privacy Europe at Novartis, European Data Protection Law Review , Vol. 5, No. 5, Lexxion, 2019.  ISC Intelligence, ‘The Application of GDPR to Biomedical Research: Stakeholder Advisory Opinion to Assist Regulators, Prepared for the ISC Seminar on Challenges for Health Research Arising from the GDPR’, 19 November 2019, http://www.iscintelligence.com/event.php?id=334 .  Medical Dictionary, Definition of “Lost to follow-up”, Medical Dictionary , Farlex and Partners, 2009, https://medical-dictionary.thefreedictionary.com/lost+to+follow-up .  Organisation for Economic Co-operation and Development, Guidelines on Human Biobanks and Genetic Research Databases, 2009, http://www.oecd.org/sti/emerging-tech/44054609.pdf .  Netherlands, Ministry of Justice and Security, ‘ Handleiding Algemene verordening gegevensbescherming en Uitvoeringswet, Algemene verordening gegevensbescherming ’ [Instruction manual General Data Protection Regulation and Implementating Act of the General Data Protection Regulation], 2018, https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/handleidingalgemeneverordeninggegeven sbescherming.pdf .  Nordic Council, ‘ Nordic research collaboration for better health ’, https://www.norden.org/en/information/nordic-health-co-operation .  Slovakia, Office for Personal Data Protection, Guidelines 2/2018, https://dataprotection.gov.sk/uoou/sites/default/files/zakonnost aktualizovana verzia 22.01.2019.pdf .  Southerington, T., ‘GA4GH GDPR Brief: The Finnish Secondary Use Act 2019 (May 2020 Bonus Brief)’ [blog post], 21 May 2020, https://www.ga4gh.org/news/ga4gh-gdpr-brief-the-finnish-secondary- use-act-2019-may-2020-bonus-brief/ .  UK Information Commissioner’s Office, Overview ‘ Lawful Basis for Processing ’, https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation- gdpr/lawful-basis-for-processing/ .  UK Medical Research Council, ‘GDPR: Answers to some frequently asked questions (FAQs) - Can I share data with colleagues now that GDPR is in force?’, http://www.highlights.rsc.mrc.ac.uk/GDPR/share.html .  UK Medical Research Council, ‘ Guidance Note 3, General Data Protection Regulation (GDPR): Consent in Research and Confidentiality ’, March 2018, as updated in March 2019, https://mrc.ukri.org/research/facilities-and-resources-for-researchers/regulatory-support-centre/gdpr- resources/ .  UK Health Research Authority, ‘Safeguards’ [webpage], last updated in 2018, https://www.hra.nhs.uk/planning-and-improving-research/policies-standards-legislation/data-protection-and- information-governance/gdpr-detailed-guidance/safeguards/ .  UK Health Research Authority, ‘Transparency’ [webpage], last updated in 2018, https://www.hra.nhs.uk/planning-and-improving-research/policies-standards-legislation/data-protection-and- information-governance/gdpr-detailed-guidance/transparency/ .  UK Secretary of State for Health and Social Care, Decision ‘ Coronavirus (COVID-19): notice under Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research ANNEX 5 - ENDNOTES 1 For the purposes of this report, we use uniformly ‘secondary use’ understood as ‘re-use of personal data for a new purpose’, but we acknowledge that the GDPR employs the term ‘further processing’. See also the discussion in Section 4.2.2.2 on primary versus secondary use of personal data. 2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, (OJ L 119, 4.5.2016, p. 1-88). 3 I n this report, the term ‘health data’ is used to mean ‘data concerning health’ rather than ‘medical data’ the latter having a more narrow scope. On these concepts, see EDPS, Guidelines concerning the processing of health data in the workplace by Community institutions and bodies, 28 September 2009. 4 This question raises precisely because the GDPR contains specific principles, provisions, and possibilities of derogations for scientific research. 5 This priority was mentioned in European Commission, COM(2020) 264 final, Communication from the Commission to the European Parliament and the Council on Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition - two years of application of the General Data Protection Regulation, p. 2. This does not mean however that this topic is not discussed herein: e.g., see the new Finnish Act on the Secondary Use of Health and Social Data (552/2019), which entered into force on May 1, 2019, available at the Finnish Ministry of Social Affairs and Health, Secondary use of health and social data, available at: https://stm.fi/en/secondary-use-of-health-and-social-data, which regulates re-use of personal data in public databases for described purposes, such as knowledge management. 6 See e.g. examples from Estonia (Section 5.2.2) and Finland (Section 5.3.4). 7 This distinction was affirmed by the EDPB in European Data Protection Board, Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR), 23 January 2019. 8 See Verhenneman, G., ‘ The patient's right to privacy and autonomy against a changing healthcare model: assessing informed consent, anonymisation and purpose limitation in light of e-health and personalised healthcare’ , PhD dissertation, KU Leuven Faculty of Law, 2020, p. 206 and 224. 9 We focused on several key documents, however other conventions and recommendations of special importance must also be mentioned, in particular Council of Europe, Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine: Convention on Human Rights and Biomedicine (Oviedo Convention), ETS No 164, and its Additional protocol on Biomedical Research (2005) and Council of Europe, Recommendation No R (97) 18 of the Committee of Ministers to member States, concerning the protection of personal data collected and processed for statistical purposes. 10 Council of Europe, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ETS No 108.