Study on the secondary use of personal data in the context of scientific research

2 This study has been prepared by Milieu under Contract No EDPS/2019/02 - 04 for the benefit of the EDPB. The study has been carried out by researchers from KU Leuven (CiTiP) and University of Namur (CRIDS), with the support of researchers from Milieu and Leiden University (eLaw). The authors of the study are Teodora Lalova, Els Kindt, Eleftherios Chelioudakis, Griet Verhenneman, Antoine Delforge andJean Herverg. National level input was provided by Carla Barbosa, Elisabetta Biasin, Gauthier Chassang, Eleftherios Chelioudakis, , Agnes Csonta, Antoine Delforge, Ivo Emanuilov, Danaja Fabcic, Nenad Georgiev, Dara Hallinan, Erik Kamenjasevic, , , Teodora Lalova, Zuzana Lukacova, Sjaak Nouwt, Domenico Orlando, Anastasia Siapka, Griet Verhenneman and Katerina Yordanova. The information and views set out in this study are those of the author(s) and do not reflect the official opinion of the EDPB. The EDPB does not guarantee the accuracy of the data included in this study. Neither the EDPB nor any person acting on the EDPB’s behalf may be held responsible for the use which may be made of the information contained therein. Milieu Consulting SRL , Chaussée de Charleroi 112, B-1060 Brussels, tel.: +32 2 506 1000; e- mail: EDPB.legalstudies@milieu.be ; web address: www.milieu.be . 3 Study on the secondary use of personal data in the context of scientific research TABLE OF CONTENT ABSTRACT ................................................................................................ ............................. 5 EXECUTIVE SUMMARY ................................................................................................ .......... 6

Scientific research................................................................................. 12

(Secondary) use of personal data for scientific research............... 13

World Medical Association (WMA) ................................................................... 14

LEGAL ANALYSIS OF THE NOTION ‘SCIENTIFIC RESEARCH’ IN THE GDPR................. 16 4.1 ‘Scientific research’ in the GDPR ...................................................................... 16 4.2 Overview and analysis of national legislation and guidance on the notion of ‘scientific research’ ........................................................................................ 17

IMPACT OF EU SECTORAL AND NATIONAL LEGISLATION ON THE PRINCIPLES OF PURPOSE LIMITATION AND LAWFULNESS IN SCIENTIFIC RESEARCH ................................. 18

Legal bases under Article 6(1) GDPR ................................................. 19

Legal justifications under Article 9(2) ................................................. 23

Broad consent (Recital 33 GDPR)....................................................... 26

Overview and analysis of national legislation and guidance on broad consent....................................................................................... 27

Article 11 GDPR And the obligation to inform data subjects of the reuse of data ...................................................................................................................... 32

Legal analysis of Article 11 GDPR at EU level .................................... 32

Overview and analysis of national legislation and guidance on Article 11 GDPR ..................................................................................... 33

Legal analysis of the application of the exemption to information duty for scientific research and appropriate measures under Article 14(5)(b) GDPR ............................................................................................................................... 34 4

Legal analysis of Article 14(5)(b) GDPR at EU level .......................... 34

Overview and analysis of national legislation and guidance on Article 14(5)(b) GDPR ........................................................................... 35

Article 89(1) GDPR (obligation to de-identify data collected) and data subjects’ rights under the GDPR........................................................................ 36

Legal analysis of Article 89(1) GDPR at EU level ............................... 36

Overview and analysis of national legislation and guidance on Article 89(1) GDPR ................................................................................ 37

CONCLUSIONS ........................................................................................................... 44 ANNEX 1 – FIGURES AND TABLES ...................................................................................... 45 ANNEX 2 – QUESTIONNAIRE ON RELEVANT NATIONAL LAWS AND PRACTICES .............. 53 ANNEX 3 – SOURCES OF INFORMATION ........................................................................... 63 ANNEX 4 - ACRONYMS AND ABBREVIATIONS ................................................................. 77 ANNEX 5 - ENDNOTES ........................................................................................................ 79 5 ABSTRACT The European Union (EU) has always promoted scientific research. It is increasingly a European Commission priority, particularly in the context of the current COVID-19 pandemic. Scientific research often requires the processing of personal data, including special categories of personal data (for example, in the field of medical research). To ensure that data protection law does not hinder the development of research, the General Data Protection Regulation (GDPR) provides for certain specific rules for scientific research. In particular, it facilitates the reuse of data for scientific purposes (secondary use of data). However, the term ‘scientific research’ is not defined in the GDPR and the rules concerning secondary use could be interpreted and/or implemented differently across EU Member States. The objective of this study was to investigate the secondary use of personal data in the context of scientific research (in particular in the medical domain) by providing an overview of international agreements, EU and Member States’ legislation and practices on the principles of purpose limitation and lawfulness, and the application of data subjects’ rights in light of exemptions from the transparency obligation provided in the GDPR. The methodology consisted of desk research (scientific literature, reports, position papers), supplemented by questionnaire responses on national laws from academic researchers with relevant expertise. In total, the study obtained input on 18 countries (out of the targeted 30 EU and European Economic Area (EEA) Member States). The results highlighted the lack of a uniform approach among Member States on key aspects of the secondary use of personal data for scientific research. The study recommends increased dialogue between Member States’ Supervisory Authorities (SAs), sharing of national practices and interpretations, and cooperation between SAs, European institutions and bodies and key stakeholders. In addition, the European Data Protection Board (EDPB) could adopt guidelines that specifically address the secondary use of data for scientific research. The study discusses the main issues that require guidance and proposes how they might be approached. 6 EXECUTIVE SUMMARY The objective of this study was to investigate the secondary use of personal data in the context of scientific research (in particular in the medical domain), by providing an overview of international agreements, European Union (EU) and Member State legislation and practices on the principles of purpose limitation and lawfulness, and the application of data subjects’ rights in light of exemptions from the transparency obligation provided in the General Data Protection Regulation (GDPR). The methodology consisted of desk research (review of scientific literature, reports, position papers), supplemented by questionnaire responses on national laws received from academic researchers with relevant expertise. In total, the study obtained input on 18 of the targeted 30 EU and European Economic Area (EEA) Member States. The legislation analysed was not limited to the GDPR but included international agreements or documents containing data protection rules (such as Council of Europe Convention 108+) and ethical standards (such as the World Medical Association (WMA)’s Declaration of Helsinki (DH) and EU sectoral legal frameworks (e.g. on clinical trials, biobanks). Analysis of these different legal texts and their application within the Member States examined found the following:  Two main international frameworks apply to secondary use of personal data for scientific research: data protection rules as they have evolved historically, and ethical standards. A data controller who conducts secondary use of personal data has to consider and apply both consistently. Overlaps, including in terminology (for instance, consent as an ethical requirement versus consent as one of the possible legal bases under the GDPR) make this a challenging task. Further research on the overlap between the two frameworks would be beneficial.  The notion of ‘scientific research’ is not explicitly defined in the GDPR, although some elements are provided in its Recitals. Few of the countries examined provide an overarching definition in their national legislation (with the exception of national lex specialis , e.g. for medical research). Based on the commonly accepted characteristics in EU and international legal texts, the concept of scientific research could be described or defined as: any research for a scientific purpose, financed by public authorities or the private sector, carried out in accordance with the established ethical standards and the methodology applicable in the sector concerned by the research. The scientific scope may include the development and demonstration of technologies, basic research, academic or applied research.  On the possibility to reuse personal data for scientific research, several uncertainties remain with regard to the l awfulness and purpose limitation data protection principles , and the impact of EU sectoral laws (such as the Clinical Trials Regulation (CTR) and biobank rules) on those principles. The choice of the possible legal basis (under Article 6 GDPR) and the most appropriate condition that could allow the processing of special categories of data (e.g. health data), pursuant to Article 9 of the GDPR for conducting scientific research, is a challenging task, particularly for transnational research. Members States often have divergent interpretations, with some still requiring consent, despite the European Data Protection Board (EDPB) and the European Commission’s position on clinical trials. The possibility to ground the secondary use of personal data in ‘broad consent’ (Recital 33 GDPR) is another point of divergence between Member States. ‘Secondary use’ is an established term in EU data protection legislation. It could pertain to either further compatible processing or non-compatible processing. There are different views at 7 institutional, national and scholarly level as to whether a new legal basis is required for the ‘secondary use’ of personal data. The study concluded that a legal basis is required for secondary use for scientific research purposes – this could either be the same as that for primary use or a new legal basis. Ten of the 18 countries examined had special advice available on the implementation of the presumption of compatibility of secondary use for scientific research. The views presented varied. Finland, for example, recently established a central licensing authority to facilitate secondary processing of health and social data, which is under the custody of several controllers. Such data are now centralised at national level, with a Data Permit Authority deciding on access requests.  The secondary use of personal data may impact the application of data subjects’ rights. A key issue here is how the rules on processing of personal data that do not require identification (Article 11 GDPR) fit with the transparency obligation and right to information of data subjects. Few Member States provide guidance on this topic, or on the related application of the exemption to information duty for scientific research in Article 14(5)(b) GDPR. In general, it is recommended that the transparency obligation be complied with via the assistance of the original data controller (through contractual agreements). France and Italy have both adopted a similar procedure, with authorisation required from the Data Protection Authority (DPA) prior to secondary use of personal data (including sensitive data), in cases where the controller (a third party) can rely on Article 14(5) GDPR. The analysis revealed no insights into Article 89(1) GDPR in the majority of the countries and there is no conclusive answer as to whether or not Member States alone can determine the appropriate safeguards, or whether the data controller can decide. The results showed no uniform approach/interpretation among Member States on key aspects related to the secondary use of personal data for scientific research. A distinction could be made between challenges caused by a lack of uniformity in the interpretation of key elements of the GDPR and challenges caused by divergences in Member States’ implementation of the GDPR. The study thus recommends encouraging increased dialogue between Member States’ Supervisory Authorities (SAs) and information sharing on national practices and interpretations, as well as improved cooperation between SAs, European institutions and bodies and key stakeholders. The EDPB and other European institutions and bodies could establish closer exchanges in order to align their advice on the interplay of the GDPR and other sectoral laws. The EDPB could promote the set-up of relevant codes of conduct (as per Article 40 GDPR) and stress the importance of involving all key stakeholders in the creation of such codes. It could also adopt specific guidelines on the secondary use of data for scientific research. The study discusses the main issues that require guidance and proposes how they might be approached. It also emphasises the importance of empirical research to gather the views and experiences of key stakeholders, and the need to investigate the role of ethics committees in data protection matters. 8 1 INTRODUCTION This chapter briefly outlines the background and objectives of the study (Section 1.1 ), the research questions (Section 1.2 ) and the methodology used (Section 1.3). The structure of this report is presented in Section 1.4 . 1.1 BACKGROUND AND OBJECTIVES OF THE STUDY This report addresses the specific questions raised by the European Data Protection Board (EDPB) on the topic of the secondary use of personal data in the context of scientific research. Varying legislation, practices and views exist in EU Member States with respect to the purpose limitation and lawfulness of the use of personal data for secondary research (secondary use of the data for a research purpose) 1 , especially in the medical domain. The report aims to (i) explain the issues in relation to the research questions, (ii) gather Member States relevant national provisions and interpretations, (iii) find converging approaches in Member States and (iv) propose policy recommendations for the EDPB to improve harmonisation. 1.2 RESEARCH QUESTIONS The subject of this report is the regime for the secondary use of personal data for scientific research. The study first tackles all specific concepts used in the General Data Protection Regulation (GDPR) 2 . The following questions were asked by the EDPB:  What is the meaning of ‘scientific research’ in the GDPR, in both a medical and non-medical context?  What shall be understood by ‘primary’ and ‘secondary use’ of personal data?  How is ‘scientific research’ understood in Member States? The main question in this legal study concerns the meaning of the purpose limitation and lawfulness principles in the context of the secondary use of personal data for research in a medical and non-medical context. It seeks to provide insights into the relationship between primary use and secondary (research) use of data from the point of the overarching purpose limitation principle, compatible use and the legal grounds for secondary use for research. The following sub-questions were raised by the EDPB:  How are these principles addressed in international agreements and documents?  What is the impact of EU sectoral legislation, such as the Clinical Trial Regulation and Biobank Regulation on these principles?  How are these principles addressed in legislation and guidance documentations in Member States (and EEA states)? The research focused on the secondary use of health data in the medical context. The third part of the study relates to limitations on data subjects’ rights and secondary use for research . The following areas were examined:  The relationship between Article 11 GDPR and the obligation to inform data subjects of the secondary use of personal data (Articles 13 and 14 GDPR);  The obligation of Article 89(1) GDPR to de-identify personal data for research and access by the controller/sponsor of clinical trials;  The information exception for research under Article 14(5)(b) GDPR. Finally, the research looked for converging elements in the national legislation of the 30 countries and formulated policy recommendations for the EDPB. 9 1.3 METHODOLOGY The issues (stocktaking) and questions were selected by the EDPB Secretariat and sub-groups. The results of the study are mainly based on desk research, in particular the collection, review and legal analysis of (i) national legislation , relevant scientific literature (academic and legal practice) and reports, and (ii) the questionnaire responses on Member States’ national laws received from the academic researchers in the research group and from a few selected external national experts . This questionnaire (see Annex 2) was developed for the purposes of this study, based on the stocktake of issues mentioned above. The literature selected and consulted includes not only articles in credible legal journals and recent commentaries on the GDPR, but reports and position papers published on internet platforms. The literature includes articles on the legal issues related to the use of personal data for research purposes in general and on the (re-)use of data concerning health (‘health data’ 3 ) for research. While literature on the former was rather limited, literature and reports on the use of health data for research was more widely available and pointed to many open issues and diverging national interpretations. Respondents to the questionnaires also tended to focus more on the secondary use of health data. The questionnaire was submitted to academic researchers from the research group and to several external (academic) contacts. This methodology was suitable, given the breadth and depth of international law researchers in the research team, each acquainted with the legal systems and languages of one of the 30 targeted 30 Member States and European Free Trade Association (EFTA) EEA states. This approach also avoided overburdening the national Supervisory Authorities (SAs) with requests for information. As the research team did not include internal legal researchers for all 30 European countries, the input was limited. National law input, SA guidance (e.g. if only available in a specific language, such as Swedish, Finnish, Maltese) and insights into certain countries required specific national language skills and legal system knowledge that was not available within the team . The intention was to remedy this with input from selected external experts in the remaining countries. Some excellent input was received, although the confidential nature of the study mean that not all experts could be readily contacted. A further difficulty was the lack of an incentive for these external experts to invest time in researching and completing the questionnaire, which likely reduced the replies further. The responses gave rise to other issues not covered in the research questions. Finally, the study was further limited in that the inputs gathered under national law have not been validated – this is recommended to be done with SAs through interview, for example. In total, input was gathered for 18 countries. These are not necessarily representative of the 30 EU/EEA States, however, and it is possible that some specific national positions are missing.The detailed input was structured in various tables and overviews in Excel sheets. The analysis shows general tendencies on many issues, suggesting that they could provide some insights and could usefully be examined in the remaining countries. Another approach worth further investigation (both for this and other data protection studies generally) is to review whether it is possible to cluster countries with similar traditions/views on data protection/specific data protection issues. This report aimed to formulate recommendations based on the legal issues and findings. These recommendations are mainly addressed to the EDPB, which can investigate further consistency measures. 1.4 STRUCTURE OF THE REPORT Chapter 2 discusses the scope of the analysis. Chapter 3 provides a brief overview of the key international agreements and documents that are useful in assessing the concepts of scientific research, the purpose limitation principle, and secondary use of data. Chapter 4 investigates the GDPR concept 10 of ‘scientific research’ and how it is understood in the 18 countries examined. Chapter 5 tackles the question of how to apply the purpose limitation (including compatible use) and lawfulness principles in the context of the secondary use of personal data for research. Sectoral EU legislation is briefly analysed, such as the Clinical Trial Regulation and Biobank Regulation, and the uptake and translation of these principles into national legislation and regulatory documents. The concepts of primary and secondary use are also discussed. Chapter 6 focuses on Article 11 GDPR and data subjects’ rights, including the right to information and transparency, and Article 89 GDPR. The analysis in each of the chapters comprises a short overview and analysis of relevant national legislation and guidance. Chapter 7 contains policy recommendations, with study conclusions presented in Chapter 8. 11 2 SCOPE OF ANALYSIS This chapter presents the scope of the study by presenting the legal issues analysed (Section 2.1 ) and the national jurisdictions covered (Section 2.2 ). 2.1 LEGAL ISSUES The issues analysed are described in the Terms of Reference. The most pressing questions relating to the secondary use of data for research are in the domain of ‘health data’. An important topic is the meaning and scope of the concept of ‘scientific research’ 4 , while questions are raised about the (conditions for) lawful grounds for the processing of health data for secondary use. This report discusses the purpose specification and limitation principle as a key principle that could or should play a role in further understanding the scope of scientific research intended by the legislator. This report does not address the use of personal data held in public databases for scientific research 5 . In addition, while both the report and the country inputs often mention or point to specific national regimes for genetic data and research, an in-depth analysis of specific characteristics, needs and harmonisation avenues of research based on or involving genetic data, while important, falls outside the scope of this study. Further dedicated and specific research on this topic is recommended. New technology and platforms play a role in the secondary use of data, chiefly by allowing more stakeholders to access and reuse data, depending on their roles of (joint) controllership. Again, this was not a focus of this study. 2.2 JURISDICTIONS National experts provided questionnaire responses for 18 countries, of which 17 were EU and EEA countries, i.e. Belgium, Bulgaria, Croatia, Cyprus, Denmark, France, Germany, Greece, Hungary, Italy, Latvia, Netherlands, Norway, Portugal, Romania, Slovakia and Slovenia, and one former EU Member State (United Kingdom). Of these 18 countries, 14 were covered by internal experts, i.e. researchers affiliated with the members of the consortium (KU Leuven, UNamur, Leiden University and Milieu). Three countries - France, Germany and the Netherlands - were covered by external experts known to consortium members. Denmark law was covered by internal experts, using open-access resources available in English. The study of Denmark’s legislation was thus necessarily more limited and mainly focused on the ‘Danish Data Protection Act’. Input for the UK was received from an external expert. References to the UK are considered useful, given its influence on many of the themes of data protection in recent decades. For some of the countries that were not covered via the input of national experts, desk research using scientific papers allowed an analysis of some of the relevant national legislation or interpretation of specific aspects 6 . 12 3 INTERNATIONAL AGREEMENTS AND DOCUMENTS This chapter provides a brief overview of key international agreements and documents that are useful in assessing the concepts of scientific research, the purpose limitation principle, and secondary use of data. The roots of the purpose limitation principle can be traced to various international agreements pertaining to data protection. In addition, when investigating how the principle applies in the context of scientific research, medical research provides a useful example. Therefore, this chapter presents and discusses international documents in both the field of data protection ethical standards in health research. The latter, in particular, may be seen as encoding prevailing assumptions and acceptance of (i) the scope of medical research, (ii) compatibility with initial collection(s) and (iii) expectations of society and individuals. Two general remarks are useful here. Firstly, consent as referred to in the majority of documents discussed below refers to consent as an ethical safeguard to participate in research, and should not be confused with consent as one of the possible lawful grounds based on Article 6(1)(a) GDPR (see Section 4.2) 7 . Secondly, it is commonly accepted that the purpose limitation principle consists of two building blocks: ‘purpose specification’ (personal data must be collected for specified, explicit and legitimate purposes) and ‘use limitation’ (personal data must not be further processed in a manner that is incompatible with those purposes) 8 . Both concepts are embedded in Council of Europe (binding) conventions and recommendations. Also related to ‘use limitation’ is the notion of presumed compatibility of secondary use of personal data for scientific research (Article 5(1)(b) GDPR), i.e. secondary use for the purposes of scientific research shall not be considered to be incompatible with the initial purposes. Section 3.1 discusses the conventions and recommendations adopted by the Council of Europe 9 . Sections 3.2 and 3.3 provide information about documents which have mainly an ethical character and value, i.e. those adopted by the World Medical Association (WMA) and the Organisation for Economic Development and Co-Operation (OECD). 3.1 COUNCIL OF EUROPE: (BINDING) CONVENTIONS AND RECOMMENDATIONS 3.1.1 Scientific research Council of Europe Convention 108 and 108+ Neither Convention 108 (Convention for the protection of individuals with regard to automatic processing of personal data) 10 nor 108+ (Protocol amending the Convention for the protection of individuals with regard to automatic processing of personal data) 11 defines the notion of scientific research. They do, however, provide special derogations to some duties incumbent on the data controller 12 . In the Explanatory Report, the Council of Europe mentions, just as the EU does in the GDPR, that the research must be compliant with ‘ the recognised ethical standards for scientific research’ 13 . However, Convention 108+ states that the purposes of processing the data for scientific research aims at ‘providing researchers with information contributing to an understanding of phenomena in varied scientific fields (epidemiology, psychology, economics, sociology, linguistics, political science, criminology, etc.) with a view to establishing permanent principles, laws of behaviour or patterns of causality which transcend all the individuals to whom they apply’ 14 . Council of Europe Recommendation (97)18 concerning the protection of personal data collected and processed for statistical purposes 15 Recommendation (97)18 provides a kind of definition of the concept of scientific knowledge, stating 13 that ‘ scientific knowledge consists in establishing permanent principles, laws of behaviour or patterns of causality which transcend all the individuals to whom they apply’ 16 . It also states that ‘in the biological and human sciences, much of the research process involves experimentation. In this area, personalised intervention is basic on research, even though statistical analysis may come into play at a later stage. This type of research calls for specific ethical and legal rules which have no place in the field of statistics as defined here’ 17 . 3.1.2 Purpose limitation Council of Europe Convention 108 and 108+ Both building blocks of the purpose limitation principle were introduced in Convention 108 and retained in Convention 108+. Article 5(b) of Convention 108 included the requirement that the purpose of the data processing should be specified (purpose specification) 18 . Article 9 provided for the possibility of derogations from this provision under specific conditions, thus generalising the principle that data can be processed for purposes other than the original ones only under specific circumstances (use limitation) However, Convention 108 did not provide information about the conditions under which the processing of personal data for scientific research could be allowed. 3.1.3 (Secondary) use of personal data for scientific research Council of Europe Recommendation (81)1 on medical databanks 19 In 1981, the Council of Europe adopted Recommendation (81)1, which contains principles for ’medical care, public health, management of medical care or public health services and medical research’ (Article 1(1)). As it contains specific provisions on ‘procedures for requests for use of data for purposes other than those for which they have been collected’ (Article 3(1)(k)), it complements Convention 108, which failed to specify conditions for secondary use of personal data for research. Article 5(4) seems to suggest – based on arguments a contrario - that it should be allowed to communicate and share information collected in medical databanks for the purposes of medical research 20 . Article 5(5) seems to confirm this conclusion, as it allows that data on the same individual from different databanks can be linked for the purposes of medical care, public health or medical research, in accordance with the relevant regulations. However, sharing and linking information is limited, i.e. it must be covered either by a shared obligation to ‘medical secrecy’ or the ‘expressed and informed consent’ of the individual 21 . Council of Europe Recommendations R(97)5 and CM/Rec(2019)2 on protection of health-related data 22 In 1997, Council of Europe Recommendation R(97)5, on the use of health data, mentioned secondary use for research purposes, thus providing more explicit requirements than Recommendation (81)1. It included a provision that explicitly allowed secondary use for research purposes. In additionn to informed consent for one or more purposes, authorised disclosure by a designated body for a ‘defined scientific research project concerning an important public interest’ or law providing for scientific research as ‘a necessary measure for public health reasons’ 23 , the healthcare professional (e.g. treating physician) has a unique position in that they are allowed to ‘further process’ medical data from their patients ‘ to carry out their own medical research ’, ‘subject to complementary provisions determined by domestic law’, on the condition that the data subject has been informed and was given the opportunity to opt-out (Article 12(3)) 24 . This addition of ‘own medical research’ of healthcare professionals based on laws on the use of medical data suggests that such ‘own medical research’ of the healthcare professional is not considered incompatible, whereby domestic law would presumably provide the legal ground and/or safeguards . In other words, this addition could be seen as codification of reasonable expectations of society and data subjects at that time, allowing this type of research, provided it is transparent and consenting. The distinction between medical research conducted by the treating physician and that conducted by others was initially made in 1997, raising the question of whether it remains relevant or the reasonable expectation of the patient has changed 25 . In other words, whether data subjects should be aware of or 14 expect that in order to facilitate scientific progress in the interest of society, health data need to be further processed by several people with different expertise. The issue of multidisciplinary research was reflected in the 2019 Recommendations by the Council of Europe, which replaced Recommendation (97)5 26 . It is now indicated that not only ’healthcare professionals who are entitled to carry out their ‘ own medical research’ , but also ‘ other scientists in other disciplines ’ should be able to use the health related data ‘which they hold’ for research purposes, as long as the data subject has been informed of the possibility beforehand and appropriate safeguards are in place (e.g. explicit consent or the assessment of a competent body)(Article 15(8)). The impact of this provision on the purpose specification and use limitation principle should be considered carefully. While it may broaden the number and type of people who may gain access to a certain dataset and, as such, affect the use limitation principle (the second building block of purpose limitation), it should not cause a shift in the requirement for purpose specification (the first building block). Council of Europe Recommendations of 2016(6) on research on biological materials of human origin 27 The Recommendation states that the interests and welfare of the human being shall prevail over the sole interest of society or science 28 . Obtaining and storage of biological materials for future research can be based on either consent or authorisation, prior to which the individual concerned should be provided with comprehensible information (Article 10). Biological materials can only be used in a research project if the latter is within the scope of the consent or authorisation given by the individual (Article 21(1)). For uses not in the scope of the original consent/authorisation, reasonable efforts should be made to contact the person concerned and obtain consent/authorisation (Article 22(2)(a)). If the attempt to contact the person is unsuccessful, an exception may be made where the research addresses an important scientific interest and is in accordance with the principle of accountability (Article 22(2)(b)(ii)). 3.2 WORLD MEDICAL ASSOCIATION (WMA) Declaration of Helsinki (1964-2013-…) 29 The principal international document on medical research - which is also a form of self-regulation by healthcare professionals - is the Declaration of Helsinki (DH). Initially proclaimed in 1964 by the WMA, and with regular updates (most recently in 2013), it aims to set moral and ethical medical research principles and standards 30 . Its principles have broad scope and are applicable in many domains, including clinical trials and the use of human material stored in biobanks 31 . It should be noted, however, that the Clinical Trials Regulation (CTR) 32 refers to an older version of the DH (2008), see Recital 80 CTR. The primary purpose of medical research involving human subjects is to generate new knowledge - more specifically, to understand, improve and evaluate 33 . However, the interest of the individual will always prevail, and participation shall be voluntary. This translates, in principle, to ‘ informed consent ’ (Article 25 et seq. DH). As for the use of identifiable human material or data, such as research on material or data in biobanks or similar repositories , consent shall be sought, unless if impossible or impracticable , in which case research ethics committees will have to consider or approve their use (Article 32 DH 2013). The notion of medical research has a well-developed meaning in documents such as the DH, imposing requirements on its purpose, methodology, and publicity of results (Articles 6, 35-36 DH). It is worth examining the extent to which the DH may influence other regulations. In particular, whether the conditions and understanding of the concept of medical research as presented in the DH may impact on the notion of scientific research under the GDPR. Another key question is whether the replacement of consent by ethics committees’ approval for identifiable human material has consequences, or is to have an effect under data protection 34 . 15 A third and most important question in relation to data protection is whether medical research, as understood in the DH, is (i) to be considered secondary use, and thus (ii) requiring a new legal basis, which could be different from explicit consent. Declaration of Tapei on ethical considerations regarding health databases and biobanks (2002- 2016- …) 35 The Declaration of Taipei (DT) is a complement to the DH 36 . The DT is unique in that it focuses on health databases and biobanks together and thus achieves a new level of standardisation in the field 37 . The DT provides a definition of biobanks 38 and supports broad consent by specifying the criteria for its validity 39 . Some authors have criticised the DT for being too committed to individual patient consent (as opposed to a public health ethics approach) 40 . Although the DT contains a waiver-of-consent provision, its scope is much more restricted than that of Article 32 of the DH. Namely, Paragraph 16 of the DT specifies that ‘in the event of a clearly identified, serious and immediate threat where anonymous data will not suffice, the requirements for consent may be waived to protect the health of the population. An independent ethics committee should confirm that each exceptional case is justifiable.’ Additionally, critics noted the uncertainty as to how the DT applies to secondary research 41 , with Ballantyne observing that ‘If the Declaration is intended to apply to this research, the ethical approach is remarkably restrictive. If the Declaration does not apply to this research, its scope of application is severely limited’ 42 . 3.3 ORGANISATION FOR ECONOMIC CO-OPERATION AND DEVELOPMENT (OECD) The 2009 OECD Guidelines for Human Biobanks and Genetic Research Databases (HBGRD Guidelines) 43 represent an important political commitment on the part of the member countries. Principle 4.B states that ‘ prior, free and informed consent’ should be obtained for each participant in a biobank/genetic research database. This consent for participation in a biobank is not the consent foreseen in the GDPR as a legal basis (Article 6(1)(a) GDPR). However , the biobank may also provide for ‘ obtaining consent/authorisation from an appropriate substitute decision-maker , or for obtaining waiver of consent from a research ethics committee or an appropriate authority, in accordance with applicable law and ethical principles pertaining to the protection of human subjects’ 44 . Upcoming national legislation is likely to address this, such as the Belgian Biobank Act 45 . In conclusion , there are two main frameworks that apply to secondary use of personal data for scientific (medical) research: (i) the data protection rules as they have evolved historically; and (ii) ethical standards, such as those defined by the DH (Sections 4.1.1-4.1.3). Even if the majority of the international documents are not binding, they could be considered to have important impacts on understandings of secondary use 46 . Consideration of both frameworks is important, given their intersecting nature. Firstly, ‘research’ has a well-developed meaning in ethical standards, such as the DH. This could be of use when seeking to define ‘scientific research’ under the GDPR, which lacks such definition. Secondly, in order to conduct secondary use, a data controller has to comply with the ethical requirements (e.g. consent as an ethical safeguard or authorisation from a competent body, such as an ethics committee) and the rules on purpose limitation as specified in GDPR (the roots of which can be traced to Convention 108 and 108+, and Council of Europe Recommendations 81(1) and 2019(2), for example). Overlaps, including in terminology (e.g. consent as an ethical requirement versus consent as one of the possible legal bases under GDPR) complicate this task and increase the need to consider and analyse both frameworks together. Further research on the overlaps of the two frameworks would be beneficial. 16 4 LEGAL ANALYSIS OF THE NOTION ‘SCIENTIFIC RESEARCH’ IN THE GDPR Section 4.1 presents legal analysis of the notion of ‘scientific research’ within the GDPR. Section 4.2 deals with the interpretation of the concept of ‘scientific research’ by European countries. The chapter closes with a proposed description of the concept of ‘scientific research’. 4.1 ‘SCIENTIFIC RESEARCH’ IN THE GDPR Although the EDPB asked that the negotiations occurring during the adoption of the GDPR be considered here, such documentation is not fully publicly accessible and is highly sensitive, complicating its review for this purpose 47 . Article 4 of the GDPR, on definitions, does not give any definition of the concept of scientific research. However, Recital 159 gives some elements: ‘ For the purposes of this Regulation, the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research.[…] Scientific research purposes should also include studies conducted in the public interest in the area of public health.[…] ’. This Recital also refers to Article 179(1) of the Treaty on the Functioning of the European Union (TFEU), which, unfortunately, does not give any further elements. Recital 33 also deals with scientific research, stating that ‘[…] Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research’, as does Recital 161, which states that ‘for the purpose of consenting to the participation in scientific research activities in clinical trials, the relevant provisions of Regulation (EU) No 536/2014 of the European Parliament and of the Council (1) should apply.’ It follows that scientific research is a concern, in particular in the medical domain, and should be seen as encompassing the various aspects of science, without, however, specifying the persons (physical or legal) who may carry out such research. Clearly, this is not limited to academic research organisations (universities, research centres, etc.) and research carried out by private entities with a commercial scope, such as pharmaceutical companies, could be qualified as scientific, providing ethical standards are followed (see below). The text also refers to other existing legislation, including the CTR (Recital 156 in fine GDPR) and national legislation and standards. In order to qualify as scientific, the research must be compliant with the ethical standards for scientific research. This may be a start of the definition of the concept. In 2018, the Article 29 Working Party (WP) considered that ‘ the notion may not be stretched beyond its common meaning and understands that “scientific research” in this context means a research project set up in accordance with relevant sector-related methodological and ethical standards, in conformity with good practice’ 48 . This is in line with the concept of compliance with ethical standards. At the same time, if the definition of scientific research makes no clear reference to objectives of (general) public interest (e.g. the European Data Protection Supervisor (EDPS) mentioned ‘the aim of growing society’s collective knowledge’ in its Preliminary Opinion on scientific research) 49 , the GDPR reintegrates a ‘public interest requirement’ in different recitals and indirectly in Article 6 (on compatiblity between primary and secondary use of personal data) 50 . 17 4.2 OVERVIEW AND ANALYSIS OF NATIONAL LEGISLATION AND GUIDANCE ON THE NOTION OF ‘SCIENTIFIC RESEARCH’ Based on the findings and analysis of 18 Member States in this study 51 , the vast majority of the countries examined do not provide a unique general and overarching definition of the term ‘scientific research’ in their national legislation. In fact, an umbrella definition of the term ‘scientific research’ is provided in the legal framework of only five countries: Bulgaria, France, Greece, Romania and Slovenia. The German courts have attempted to interpret the term ‘scientific research’ and define it in terms of the methodologies used and the goals pursued 52 . Nevertheless, definitions exist in 10 countries for specific types of scientific research in a ‘ lex specialis ’ context, such as legislation relating to the health sector or the medical sector: Belgium, Bulgaria, France, Greece, Italy, Latvia, the Netherlands, Portugal, Slovakia and Norway 53 . In Bulgaria and France, there is a common definition of scientific research, which can be found in sector-specific legislation. In Portugal, research is defined with reference to the Frascati Manual of the Organisation for Cooperation and Development. Additionally, the Netherlands has a commonly accepted definition for ‘scientific research’ explicitly in the health sector, as provided by soft law provisions (i.e. code of conduct) 54 . Germany, Italy and Portugal provide constitutional protection to scientific research, with no definition but a broad interpretation. In Finland, scientific research is distinguished from knowledge management and from development and innovation activities, for example 55 . Finally, Croatia and Cyprus appear to have neither general definitions nor sector-specific definitions for the term ‘scientific research’. In Denmark, scientific research may only be done on data mentioned in Article 9(1) GDPR if the study is ‘of significant importance to society’. Table 1 in Annex 1 presents an overview of the definition of scientific research in national legislation . The concept of scientific research could usefully be described or defined as follows: ‘ Scientific research is any research for a scientific purpose, financed by public authorities or the private sector, carried out in accordance with the established ethical standards and the methodology applicable in the sector concerned by the research. The scientific scope may include the development and demonstration of technologies, basic research, academic or applied research .’ It would have been useful to have a definition, or at least a description, of the characteristics of what the GDPR intends by the wording ‘scientific research’, as processing for scientific research entails specific rules on some data protection principles and data subjects’ rights, as provided by Article 89, that must be analysed with Recitals 156, 157 and 159 (see Section 5). 18 5 IMPACT OF EU SECTORAL AND NATIONAL LEGISLATION ON THE PRINCIPLES OF PURPOSE LIMITATION AND LAWFULNESS IN SCIENTIFIC RESEARCH Chapter 5 discusses purpose limitation, compatible use and lawfulness of personal data processing in the case of scientific research. It first addresses EU sectoral legislation, such as the frameworks applicable to clinical trials and biobanks (Section 5.1 ), and then examines the impact of specific frameworks (with a focus on clinical research) on the lawfulness principle, by presenting the difficulty in choosing a legal basis for (transnational) research and discussing a possible role for ethics committees in data protection matters (Section 5.2). Section 5.3 tackles purpose limitation and compatible use by delineating the concept of broad consent, followed by a discussion of the concepts of primary and secondary use of personal data and the need (or not) to use a new legal basis when processing data for secondary use. 5.1 CLINICAL TRIALS REGULATION AND THE HUMAN TISSUE AND CELLS DIRECTIVES The CTS and the Human Tissue and Cells Directives are discussed below. Clinical Trials Regulation (CTR) The CTR is set to replace the Clinical Trials Directive (EC) 2001/20/EC (CTD) 56 . The recitals, articles and Chapter V of the CTR contain multiple references to the need for consent. Most importantly, informed consent is needed from the subject for participation in a clinical trial 57 . Taking into account Recital 29, if data are collected for ‘future scientific research’, such as medical, natural or social science research, outside the clinical trial protocol by ‘universities and other research institutions’ , this shall be in accordance with data protection legislation (Article 28(2) al 2), and consent is required (see Recital 29) 58 . The European Commission’s ‘Questions and Answers on the interplay between the CTR and the GDPR’, and the EDPB in its Opinion 3/2019 of January 2019 on these Q&A 59 aimed to provide clarity on several key issues 60 , 61 . The EDPS added to the discussion with a Preliminary Opinion on data protection and scientific research 62 . The field of clinical research is under the close scrutiny of other bodies, in particular the national SAs (usually the Ministry of Health) and ethics committees. The authorisation and oversight of clinical trials is the responsibility of Member States and this will not change with the entry into force of the CTR. This lack of regulatory harmonisation reportedly creates challenges for pan-European research, in particular 63 . Biobank rules While the EU legal framework for conducting clinical trials is moving towards harmonisation 64 , this is not yet the case for biobanking 65 . Beier and Lenk classify the Member States into three groups for biobank regulation 66 : countries with a specific law (e.g. Belgium 67 ), countries with composite regulations, often accompanied by soft law (e.g. Denmark 68 ), and countries with no specific regulation (e.g. Bulgaria 69 ). A discussion about biobanks requires consideration of the so-called Human Tissue and Cells Directives 70 , which were adopted to reshape the regulatory landscape for storage and exchange of tissue 71 . The Directives put a key emphasis on informed consent for tissue donation but do not specify any substantive consent requirements. Scientific research is not within their scope, as they relate to human tissue and cells intended solely for application to humans and treatment purposes 72 . However, national laws put in place to implement the Human Tissue and Cells Directives are often applicable to research and biobanks 73 . Due to the considerable divergence in national approaches, biobank regulations will only be referenced 19 with respect to the concept of informed consent. 5.2 LAWFULNESS PRINCIPLE Data controllers can choose between six legal bases (Article 6 GDPR) on which to base the primary use of personal data. The bases are not ranked; however, in the context of clinical trials and in relation to primary use, the EDPB and the European Commission focused on a limited number of lawful grounds under Article 6 GDPR and discussed them in conjunction with the conditions for the processing of special categories of data (Article 9 GDPR). The EDPB distinguished between two main categories of processing activities - both of which fall under the concept of primary use in clinical trials - and recommended the use of different legal bases for every category. First, processing operations related to reliability and safety purposes, and second, processing operations purely related to research activities. Processing activities related to reliability and safety purposes The focus of this section will be on the legal bases recommended by the EDPB in relation to the second type of processing operations (for scientific research purposes). However, in the interest of completeness, it must be specified that the EDPB considered the processing operations related to reliability and safety purposes as falling under Article 6(1)(c) GDPR – ‘legal obligation(s) to which the controller is subject’, in conjunction with Article 9(2)(i) GDRPR – ‘processing is necessary for reasons of public interest in the area of public health’. As examples of such obligations, the EDPB has given safety reporting 74 and disclosure of clinical trial data to the national competent authorities in the course of an inspection 75 . To date, there appears to be no EU or national law that provides an obligation to conduct medical research, in particular clinical trials. However, if such a law does exist or is enacted in the future, it would be valuable to consider the use of Article 6(1)(c) GDPR. Processing purely related to research activities 1 Explicit consent of the data subject (Article 6(1)(a), in conjunction with Article 9(2)(a) GDPR); 2 A task carried out in the public interest (Article 6(1)(e), in conjunction with Article 9(2)(i) or (j) GDPR); or 3 The legitimate interests of the controller (Article 6(1)(f), in conjunction with Article 9(2)(i) or (j) GDPR) 76 . In its most recent guidelines issued in the context of the COVID-19 pandemic, the EDPB reaffirmed these same legal bases 77 . These grounds are discussed below 78 – firstly, the legal bases under Article 6(1) GDPR, and secondly, a short discussion of some of the possible justifications under Article 9(2) GDPR. 5.2.1 Legal bases under Article 6(1) GDPR 5.2.1.1 Explicit consent Consent for clinical trial participation and biological material donation: an ethical and legal requirement different from data protection requirements As the CTR rightfully points out, the Charter of Fundamental Rights of the European Union requires that any intervention in the field of biology and medicine cannot be performed without the free and informed consent of the individual concerned 79 . The consent required in Article 28(1)(c) of the CTR must be seen in this context of human participation in a clinical trial and not as the consent required or as providing a consent or other legal basis for the processing of personal data. The EDPB and the European Commission have agreed that the CTR requirement for informed consent for human participation must not be confused with consent as a legal basis for data processing under the GDPR 80 , 81 . Indeed, there are two different levels: one linked to the protection of the integrity and self-determination of the individual, and the other to the protection of their data. A parallel can be drawn with a patient 20 attending their doctor: in Belgium, for example, a doctor must obtain consent from their patient before carrying out any medical act, as provided by the Law of 22 August 2002 on patient rights 82 . The doctor will process data without requesting explicit consent, but using Article 9(2)(h) of the GDPR. The Human Tissue and Cells Directives and the consent required to donate biological material is to some extent similar, as the consent required is to be distinguished from any consent possibly required for data processing . Consent for the processing of personal data in the clinical trial context The EDPB emphasised that, depending on the circumstances, consent may not be the most adequate legal basis 83 . This appears to be the case in the context of primary use for clinical trials, as consent may not adequately satisfy the requirement to be ’ freely given’, due to the imbalance of power between the participants and the sponsor/investigator 84 . A similar difficulty arises with the possibility to withdraw consent versus the archiving obligations imposed by the CTR 85 . Under EU law, it is clear that personal data will be kept and processed even after the withdrawal of consent. Verhenneman has provided a compelling academic analysis of why the use of consent as a legal basis under GDPR should be carefully considered and may not always be the most suitable option for medical research in general 86 . Other international guidance and national laws, however, contradict this view .  The Council of Europe recently pointed to consent as the preferred legal basis for the processing of health data 87 . However, it went on to specify that ‘the law may provide for the processing of health-related data for scientific research without the data subject’s consent’ . While the recommendations of the Council are not legally binding, they create political pressure for the acceptance of specific standards. If the recommendation is implemented in the national laws of the Council’s member states (which include all EU Member States), this could conflict with the EU’s guidance on the matter. At the same time, it may be argued that this would not be in breach of EU law, given the Article 9(4) GDPR possibility for Member States to maintain or introduce further conditions, including limitations , with regard to the processing of data concerning health 88 .  The reasoning shall be carefully assessed . The report of July 2019 for the Panel for the Future of Science and Technology of the European Parliament (STOA) found the arguments of the EDPB ‘illogical’, in particular the idea that a study participant who consents to participate in a trial might not be able to consent to data processing due to a potential power imbalance 89 . Nevertheless, if a patient can freely consent to the participate in a clinical trial, they cannot choose to participate in the trial without their personal data being processed. Participation is only possible when they also consent to data processing. In addition, there is no valuable alternative, especially in last resort cases, which is a criterion that is generally used to assess the level of freedom in consent.  The argument against consent as a legal basis in the clinical trial field is not necessarily valid in other types of research . A clear distinction can be made between situations in which there is an appropriate power balance and those in which there is not. Van Veen notes that for some types of research with health data (e.g. observational studies that start with completing questionnaires), consent would, in fact, be the most appropriate legal basis 90 . Consent has also been reported as the preferred legal basis for the majority of patient preference studies , as the data collection occurs exclusively via qualitative techniques such as semi-structured interviews 91 . The same remains to be seen for biological material and research, for example.  Scholars are divided: while consent as a legal basis has long been considered the ‘default’ option for researchers 92 , arguments in favour of the use of other legal bases are steadily being put forward, taking into account recent technological developments and the realities of modern medical research, especially clinical research 93 . At the same time, one of the most prominent voices in support of consent is Hallinan, who stresses that consent under GDPR is the ‘ concrete mechanism giving voice’ to the underlying rationale of the legislation, i.e. providing the individual with informational self-determination 94 . Interestingly, representatives of the pharmaceutical industry have voiced the opposite opinion, that consent often provides ‘the illusion of self-determination and protection, while the individual may actually not always read the information provided, may not always understand this information, and may not be in a position to refuse anyway’ 95 . From a practical point of view , there is an argument that companies engaged in cross-border research 21 would struggle, in practice, to switch to a legal basis other than consent 96 . Finally, consent as (not the preferred) legal basis for research in the context of clinical trials, should be examined in the precise context of particular research, taking into account the nature of the data (e.g. genetic data). The power imbalance is less easily distinguished in genomic research and biobanking, except in a clinical trial (see below). According to expert in genomic research, Hallinan, consent should have primacy over other legal grounds , including the research exception (Article 9(2)(j) GDPR). This discussion – and indeed all related arguments – should be viewed against the background of the Council of Europe recommendations 97 and binding Council of Europe conventions 98 . Research is, within limits, seen as compatible with the primary use of health data in the doctor-patient relationship for therapeutic purposes, but also for own medical research, except where there is an objection (see above and Council of Europe Rec(97)5 and Rec(2019); see also Rec(81)1). The Council of Europe Convention 108+ also allows compatible use for research, provided there is a legal basis, which shall not necessarily be consent. These Council of Europe recommendations and conventions thus appear support legal bases other than consent. Consent for biological material, genomic research and biobanking As mentioned above, Hallinan argues that consent should have primacy over other legal grounds , including the research exception (Article 9(2)(j) GDPR). His position may have to be seen in the context of his research in the area, however. Overview and analysis of national legislation and guidance on explicit consent Based on the findings and analysis of the 18 countires by the researchers 99 , the majority of the countries examined do not impose the use of ‘explicit consent’ in the context of scientific research via case-law, codes of conduct, SA guidelines, other binding or non-binding instruments, and/or practices at national level. Only six countries - Belgium, France, Greece, Italy, the Netherlands and Romania - have related binding /non-binding instruments in place. Table 2 in Annex 1 presents explicit consent requirements for personal data processing in scientific research. The majority of countries distinguish consent for human participation in clinical trials from consent under the GDPR . The majority of countries do not impose consent as the legal basis for the processing of personal data 100 . However, there are cases where such a requirement is enshrined in law. In France 101 and Italy 102 , consent is imposed for genetic research. Germany 103 is the only country which imposes consent under the GDPR in the context of clinical trials. However, it was reported that in France it is common for sponsors of clinical trials to themselves decide to use consent, even though it is not mandated by law 104 . The researchers who provided input for Germany and Italy observed that the situation may change in light of EDPB Opinion 3/2019 105 . In Romania, participants must agree that their personal data will be examined during inspections by the National Medicines Agency 106 . A recommendation for further research would be to investigate the decision-making process of stakeholders involved in international research when choosing a legal basis, including they challenges they face. The consultation initiated by the European Medicines Agency (EMA) could potentially provide answers to these questions 107 . 5.2.1.2 A task carried out in the public interest (or official authority) Article 6(3) GDPR requires that the basis for the processing referred to in Article 6(1)(e) shall be laid down by Union or Member State law, which shall meet an objective of public interest and be proportionate to the legitimate aim pursued 108 .This implies that relying on Article 6(1)(e) has substantially different obligations, depending on the Member State concerned. The task carried out should be conveyed by legal provisions 109 . Broadly speaking, this is the general 22 legal basis for data processing for public sector purposes 110 . A specific law is not needed for each individual clinical trial 111 . However, Article 6(1)(e) is not limited to processing operations of public authorities but also extends to processing by private bodies who have been entrusted with a task in the public interest 112 . There is disagreement in the literature as to whether or not commercial entities may make use of this legal basis. According to Kramer, they may not, even if such bodies operate in the public interest 113 . Other authors make no such distinction 114 . It appears, however, that they may, provided that their processing fulfills a public interest and the law specifies the entities vested with such a task in the public interest. One potential challenge with using Article 6(1)(e) GDPR as a legal basis may become apparent in the context of transnational research, as the choice of legal basis influences the application of the one-stop- shop mechanism (Article 56 et seq GDPR) 115 . The one-stop-shop is crucial for controllers who conduct cross-border processing of data, allowing them to benefit from a single point of contact 116 . However, pursuant to Recital 128 of the GDPR, the rules on the lead supervisory authority and one-stop-shop mechanism should not apply where the processing is carried out by public authorities or private bodies in the public interest 117 . Although recitals are not legally binding, this proposition is reaffirmed in Article 55(2) GDPR, which states that Article 56 does not apply to processing carried out by public authorities or private bodies on the basis of point (c) or (e) of Article 6(1) GDPR. The use of the ground mentioned above should also be viewed against the background of the Council of Europe recommendations 118 and binding Council of Europe conventions 119 , as well as other international documents adopted. Reference to this legal basis of Article 6(1)(e) GDPR in combination with Article 9(2)(i) GDPR could be seen as being in line with Council of Europe Recommendation (2019)2 on the Protection of Medical Data (see Article 15). There remains some doubt for commercial sponsors to use this legal basis of ‘public interest’ allowing ‘compatible’ scientific research, at least in the clinical trial context. In addition, Article 6(1)(e) GDPR may not be the best fit for pan-European studies, depending on the specific circumstances with regard to (joint) controllership 120 . Article 6(1)(e) GDPR is a legal basis that best suits public research institutions operating at national level 121 . 5.2.1.3 Legitimate interests of the controller This legal basis is applicable only to private sector controllers 122 and where ‘legitimate interest’ refers to an interest which is ‘ visibly, although not explicitly, recognised ’ by Union or Member State law 123 . Processing for research purposes is not explicitly listed under Article 6(1)(f) GDPR, but WP29 included scientific research as a legitimate interest 124 . In order to rely on this basis, the controller must perform a ‘ balancing test ’ in line with the principle of proportionality, and the processing is not permitted if the controller’s interests are overridden by the fundamental rights and freedoms of the data subjects. The WP29 has provided a set of criteria which can be used when performing the balancing test 125 . Of interest is part of Recital 47, which references ‘ further processing’ : ‘The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing.’ The wording implies that secondary use of data can be based on Article 6(1)(f) GDPR. However, Kotschy states that further processing is dealt with only under the provision of Article 6(4) GDPR (compatibility assessment) 126 . The question remains, therefore, whether the reasonable expectations of the data subject would only play a role in the case of compatible processing. As far as the secondary use of personal data for scientific research is deemed not incompatible, this could apply both when Article 6(4) is applied to assess compatible processing, and for research processing for which Article 6(4) should not be applied, as scientific research is always deemed not incompatible. Recital 113 GDPR also refers to legitimate interests in the context of international data transfers, and states that ‘for scientific or historical research purposes or statistical purposes, the legitimate expectations of society for an 23 increase of knowledge should be taken into consideration’ 127 . The use of the ground mentioned above should be viewed against the background of the Council of Europe recommendations 128 and binding Council of Europe conventions 129 , as well as other international documents adopted. In medical research, the core ethical principles require that the rights, safety, and well-being of the individual prevail above the interests of science and society 130 (see discussion of the role of ethics committees in the balancing test below). The EDPB has not provided further specific guidance on the application of Article 6(1)(f) GDPR in the field of research. However, a decisive criterion for the test could be found in the EDPB guidelines in the context of video-surveillance schemes 131 , namely the intensity of intervention that the processing poses for the rights and freedoms of the individual . In conclusion, the reasonable expectations of the data subjects will be important at least when relying on legitimate interests, but also for the assessment of the research ‘compatibility’ 132 . Article 6(1)(f) GDPR is a legal basis that could be invoked by private or commercial research institutions provided there remains a balance with the rights and freedoms of data subjects, which shall at all times be checked . 5.2.2 Legal justifications under Article 9(2) In Opinion 3/2019, the EDPB confirmed that when processing sensitive data, the legal bases under Article 6 GDPR must be applied in conjunction with the conditions under Article 9 GDPR 133 . It recommended two of the Article 9(2) GDPR conditions: (i) or (j) (see below). However, the EDPB examples are linked to a clinical trial context only. For genomic research, for instance, there are views that Article 9(2)(g) could also be a relevant condition 134 . The national input received for this study found several national academics who nevertheless perceive Articles 6 and

GDPR as alternatives 135 . These are seen as cumulative requirements in some countries (including Belgium, France 136 , the Netherlands 137 , Slovakia 138 ). No information was available for the remaining countries, either in national legislation or in academic opinion 139 .  Article 9(2)(i) GDPR – ‘processing is necessary for reasons of public interest in the area of public health’. Similar to the legal basis under Article 6(1)(e) GDPR, this condition relies on EU or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject. As the condition is linked to public health, the considerations about the one-stop-shop mechanism described above apply. It can be concluded that the exception is narrow and best suited for national public health authorities and non-governmental organisations (NGOs) 140 .  Article 9(2)(g) GDPR – ’processing for reasons of substantial public interest’. Again, the condition relies on EU or Member State law but goes beyond the requirements of Articles 6(1)(e) and 9(2)(i) by imposing the condition that the public interest be ‘substantial’, creating a high threshold for satisfying this condition. However, there is no definition of ‘substantial public interest’ either in the GDPR nor in EU law more broadly 141 .  Article 9(2)(j) GDPR – ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes’ . Recital 52 of the GDPR clarifies that this justification requires implementation in EU or national law. Under this condition, the processing must be carried out in accordance with Article 89(1) GDPR, based on EU or Member State law, which shall be proportionate to the aim pursued, respect the essence of the right to data protection, and provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject. Based on the legal provision in the GDPR, Georgieva and Kuner outline several conditions for the application of this exception with respect to scientific research 142 . Hallinan 24 notes that there is no clear data protection jurisprudence establishing objective principles that clarify most of the conditions, meaning that whether or not a law fulfills the critera should be considered on a case-by-case basis 143 . Finally, Meszaros and Ho argue that a general level of public interest would be sufficient for scientific research. Significantly, they also specify that a higher level of public interest – such as ‘important’ or ‘substantial’ - could justify the secondary use of sensitive data 144 . In conclusion , the notion of ‘public interest’ appears to play a central role in all of the main justifications under Article 9(2) GDPR. Academics Meszaros and Ho attempted to summarise the different degrees of public interest and order them from the perceived lower to highest 145 . They acknowledged, however, that only ‘ the implementation, application and enforcement of the GDPR will clarify the meaning’ of the different levels of public interest. Clarification of the notion is urgently needed. Overview and analysis of national legislation and guidance on the appropriate legal basis for scientific research The study examined whether national laws provide for an appropriate legal ground for the processing of personal data in the context of scientific research, including for secondary use, as provided under Article 9(2)(j) GDPR. About half of the countries have implemented Article 9(2)(j) GDPR : Bulgaria 146 , Denmark 147 , France 148 , Germany 149 , Greece 150 , Hungary 151 , Latvia 152 , Portugal, 153 Romania 154 , Slovakia 155 , Italy 156 and the UK 157 . Denmark made no mention of Article 9(2)(j) GDPR but did refer more broadly to the data mentioned in Article 9(1) GDPR 158 . The implementing legislation in some countries (Bulgaria, Latvia) does not specify safeguards, or does so in a very general way (Germany), raising the question of whether or not the national provisions fulfil the requirements of Article 9(2)(j) GDPR and whether they can be actually be relied upon. In France, several provisions allow for the possibility to process data for scientific research, in particular Article 44(3) of the Loi Informatique et Libertés (LIL) - processing of personal health data justified by public interest. Estonia has recognised research (and official statistics) as an autonomous legal basis alternative to consent 159 . However, a role for ethics committees is foreseen in the application of this legal ground, namely in verifying that the controller complies with the requirements established by the law. In Norway, prior approval from an ethics committee is deemed to be a necessary and adequate legal basis to process personal health data in medical and health research 160 . In Belgium, it appear unclear if the national data protection law foresees an appropriate lawful ground for the processing of personal data in the context of scientific research and health data. In the Netherlands, processing of sensitive data is allowed for research, if necessary, provided it serves a general interest, explicit consent is impossible and sufficient guarantees are foreseen 161 . 5.2.3 Difficulties in choosing a legal basis Each of the legal bases outlined above has different implications for the rights of data subjects, the interests of the controller, and the feasibility of carrying out international research. Some Member States still require consent as the legal basis in all cases, without taking the specific case into consideration (see national input). Other legal bases previously encouraged by the EDPB (public interest in the area of public health and scientific research purposes) require the processing to be based on EU or Member State law, which sets the ground for further differences 162 . Each of the available legal bases creates a different set of consequences and rights 163 . Stakeholders question whether the legal basis for processing data in the scope of the same research can vary at country level 164 , pointing out that using different legal bases in the scope of the same research makes international studies more challenging and creates inequalities between patients from different countries. The literature proposes different solutions. Some scholars argue that a uniform standard should be adopted across the Member States regarding the appropriate legal basis for processing personal data for research purposes 165 . Others suggest that ethics committees should guide reliance on different lawful grounds 166 . Although an in-depth analysis of these solutions is outside the scope of this study, a critical discussion of the role of ethics committees in data protection is warranted. 25 5.2.4 Role of ethics committees Reports suggest that in many EU Member States compliance with data protection legislation in the scope of health research is under the scrutiny of ethics committees, which often lack appropriate GDPR training 167 . Examples include:  For primary use of data: stakeholders in the field of clinical trials report that ethics committees tend to decide which lawful ground should be used, in particular impose consent 168 ;  For secondary use of data: Cole and Towse report that the ‘variable judgments of ethics committees in considering the compatibility of research applications (to re-process data) with the original trial protocols constitute a huge barrier – the outcomes are “unpredictable”’ 169 . Other academics, however, advocate a stronger role for ethics committees in the field of data protection 170 . Although the GDPR itself does not address ethics committees 171 , the CTR links the ethical review required and the assessment of compliance with data protection legislation. Pursuant to Article 4 CTR, clinical trials are subject to ‘scientific and ethical review’ and shall be authorised in accordance with the Regulation. The same provision specifies that the ethical review may encompass aspects addressed in both Part I and Part II of the assessment report for the authorisation of a clinical trial. The specific aspects are to be determined at national level (‘as appropriate for each Member State concerned’). Part II includes assessment of compliance with Directive 95/46/EC (the Data Protection Directive, DPD), the predecessor of the GDPR (see Article 7(1)(d) CTR). This assessment can be conducted either by the competent authority or the competent ethics committee, depending on the national rules. At national level, Estonian law 172 assigns ethics committees a role in the national implementation of Article 9(2)(j) GDPR. In particular, Chapter 2, Paragraph 6(4) of the national Data Protection Act states that for scientific and historical research based on special categories of data, the ethics committee of the area concerned shall first verify compliance with the terms and conditions provided for in the law. For scientific areas with no mandated independent ethics review, responsibility to verify compliance with the requirements rests with the Estonian Data Protection Inspectorate. Italy provides another example, particularly where consent cannot be the appropriate legal ground for the processing of health data for scientific research purposes, as informing the data subjects proves impossible or entails a disproportionate effort on specific grounds, or it is likely to render impossible or seriously impair the achievement of the research purpose. In such cases, the research shall be the subject of a favourable opinion by an ethics committee 173 . It is worth exploring whether the role of ethics committees in data protection could be harmonised. Although an in-depth analysis is outside the scope of this study, several points are worth noting for consideration. Under the GDPR, ethics committees could usefully have a role in risk assessment . A risk-based approach is firmly embedded in clinical research 174 , just as it is in the GDPR 175 . The clinical trial sponsor must identify, evaluate and control (i.e. reduce and mitigate) the risks posed by the research, and the rights, safety and well-being of trial participants must always prevail over the interests of science and society 176 . The main responsibility of ethics committees is to protect potential participants in research, thus part of their independent review is identification and weighing of the risk/benefit ratio. Research risks are not limited to possible physical harm, but can also include psychological, social, legal and economic ramifications. If the risk/benefit ratio is not optimal, an ethics committee may provide a conditional decision, including suggestions for revision 177 . The risk assessment conducted by the sponsor and by the ethics committee is not a simple exercise, but includes both quantitative and qualitative evaluation and requires proper training. 26 Data protection - and the GDPR in particular - have a close relationship with ethics. The application of the legislation is not merely a technical exercise but always requires judgement. Hijmans and Raab highlight that this is at the core of processing based on the legitimate interests of the controller (Article 6(1)(f) GDPR) 178 . To rely on Article 6(1)(f) GDPR, the controller must perform a balancing test, and WP29 has provided a set of criteria. The EDPB’s view (albeit in a different context) is that the most decisive criterion should be the intensity of intervention that the processing of data poses for the rights and freedoms of the individual. With their role and experience in performing risk/benefit assessments for research, ethics committees may have the expertise to advise on achieving adequate balancing when relying on legitimate interests, assuming that the composition of these ethics commitees is sufficently balanced . Even more importantly, the new CTR states that laypersons, in particular patients and patient organisations, should be involved in the composition of ethics committees 179 . This provides further guarantees for the respect of data subjects' fundamental rights and interests. If this role in the risk/benefit assessment is accepted for ethics committees, a method must be found to safeguard against inequalities between studies subject to ethical review and those that are not. Ethical standards are not harmonised at EU level, and national and local ethics committees may show substantial differences when providing input on the application of Article 6(1)(f) GDPR. Harmonisation initiatives in the field of ethical standards, although nascent, are starting to appear. Most notably, this is the aim of the European Network of Research Ethics Committees, funded and supported by the European Commission 180 . At national level, there is a Nordic initiative addressing the development of a joint Nordic electronic information portal on ethics committees’ approval 181 . In addition to risk/benefit assessment, ethics committees could also be involved as an appropriate safeguard under Article 89 GDPR. The possibility requires further in-depth investigation, perhaps using existing national examples (Estonia, Italy). 5.3 PURPOSE LIMITATION AND COMPATIBLE USE FOR RESEARCH The purpose limitation principle is generally accepted as the cornerstone of data protection law 182 . However, the text of the GDPR is not sufficiently clear on application of the principle in the context of secondary use of personal data 183 . EU case-law is surprisingly limited in this respect 184 . For the purposes of this report, this section discusses broad consent and differentiates it from the purpose limitation principle. It then delineates the notions of primary and secondary use of data, which are important in understanding whether or not a new legal ground under GDPR is needed for secondary use. Finally, the national input on the purpose limitation principle is examined, including whether or not a new lawful ground is needed for secondary use, the application of the presumption of compatibility, and the potential influence of medical secrecy on purpose limitation. 5.3.1 Broad consent (Recital 33 GDPR) The GDPR moved towards the acceptance of broad consent (Recital 33 185 ), suggesting that the Regulation adheres to a different interpretation of the purpose specification principle in the context of informed consent, compared to situations where personal data are processed under other legal bases 186 . Recital 33 recognises that the purpose specification principle is challenging in research, particularly in the context of Big Data and AI techniques.Verhenneman advises against using Recital 33 to justify broadening the purpose specification principle, as this is not what the text indicated. Similarly, in its Q&A on the interplay of GDPR and CTR, the European Commission specified that the requirement of specific consent applies, even though the Recital provides some degree of flexibility 187 . WP29 had already limited the applicability of broad consent. Firstly, by stating that ‘ scientific research projects can only include personal data on the basis of consent if they have a well-described purpose’ 188 , and secondly, by endorsing the need for subsequent rolling granular consents over one ex ante broad 27 consent 189 . These two points were left unchanged in the recently issued EDPB Guidelines on consent 190 . According to Hallinan, however, interpretations of the WP29/EDPB guidance limiting the utility of broad consent could run contrary to the intent of the legislator and may even be undemocratic 191 . 5.3.2 Overview and analysis of national legislation and guidance on broad consent The study investigated how consent as a lawful ground is understood across the countries in light of Recital 33 GDPR. The findings are divergent and it is hard to establish a strong pattern . Around one- third of the countries investigated show support for broad consent, although the advice seems mixed 192 . Both Belgium 193 and Norway 194 specify that broad consent cannot be given to all types of research (blanket consent), but can in the case of cancer research, for example. In Germany, Recital 33 can be relied upon under certain conditions clarified by the German Datenschutzkonferenz – the group consisting of the independent German Federal and State SAs 195 . Significant concerns about upholding respect for the right to information were evident in all cases. Norwegian law stipulates that ‘Participants who have given broad consent are entitled to regular information about the project’ 196 . Similarly, in France, the Bill of bioethics law (last version amended by the Senate in February 2020 197 and still under parliamentary discussion) mentions the possibility to provide individuals with information about the research programme (to be understood as broadening the scope of consent for further use in research and opening the way to information about broader intelligible research fields) in order to allow reuse of biological samples for genetic research without requiring the data controller to implement individual re- contacting and reconsenting. In Portugal, broad consent can be used only if the ethical standards recognised by the scientific community are respected 198 . Romania seems to be the only Member State that opposes the use of broad consent, instead preferring dynamic consent. However, this conclusion is based on a single study 199 and more research is required to establish that position with certainty. On distinguishing between the use of consent as lawful ground for secondary use of data, the majority of the countries examined do not appear to have included related specifications in their national laws . More precisely, desk research found no such distinction in Belgium, Bulgaria, Croatia, Cyprus, France, Germany, Greece, Hungary, Italy, Latvia, Portugal, Romania, Slovakia, Slovenia and Norway. No country reported that its national law/guidance provides for a distinction between the use of consent as a lawful ground for primary use of data in light of Recital 33, and for secondary use of data. One of the researchers looking at France 200 observed that it could be envisaged that, where broad consent is used for basing primary processing for research, the individual be asked at the time of consent if they wish to be informed of any specific projects for which the personal data collected will be processed, in the context of the broadly specified research areas mentioned in the spirit of Recital 33, in respect of Article 14 GDPR and national laws. If the individual freely and knowingly chooses not to be informed, that consent could be considered the legal basis of further processing, which in return integrates primary processing purposes. Competent ethics committees, as well as data protection officers (DPOs) or other authorities assessing the project, will have the option to accept or reject such a practice. By way of preliminary conclusion , one of the key issues is whether or not broad consent could stretch compatible processing for research from ‘primary use’ to ‘secondary use’, including in the clinical trial context. However, concrete binding advice is needed as to the utility of broad consent. 5.3.3 Primary versus secondary use of data Primary use is not a common term in data protection. The DPD 201 used the wording ‘further processing’ in Article 6(1)(b) in the context of the purpose specification principle, stating that further processing ‘in a way incompatible’ with the defined purposes is not permitted, while also stating that ‘[f]urther processing of data for historical, statistical or scientific purposes shall not be considered as 28 incompatible’ on the condition that national law provides safeguards (for the data subjects). The GDPR took over the same purpose (specification and) limitation principle with a special regime for ‘research’ 202 . Use of personal data for research was added to this first category of ‘further processing’, and understood as processing for compatible purposes, or not considered incompatible. Other than this compatibility assumption, neither this article nor any other provisions in the GDPR indicate additional exceptions from the application of any other principles and obligations under the GDPR, such as the transparency and information obligation and need for legal grounds 203 . The compatible secondary/further processing must still comply with all other rules in the GDPR. In 2013, the Article 29 WP launched a specific view on further processing in its ‘Opinion on purpose limitation’ (not endorsed by the EDPB). The WP viewed the very first processing activity as separate from all subsequent processing operations 204 . As such, only the collection of data was qualified as the initial (primary) processing, with all subsequent processing activities (including the very first activities following collection, such as data storage and use) considered ‘further processing’. It is plausible that the Article 29 WP in fact merely intended to say that any further processing activity shall be for the same purpose(s) as initially specified and defined before, or at the latest at, the initial collection 205 . The Article 29 WP also stated that further compatible processing may need a separate lawful ground 206 . In its recent Guidelines on the on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak, the EDPB seems to clarify this possible misunderstanding by explaining that health data collected for conducting a clinical trial (primary use) may be reused (secondary use) for other scientific research and this usage should be classified as ‘further processing […] (secondary use)’ 207 . Two remarks are important here. Firstly, the intention of the legislator to consider processing for ‘research’ as not incompatible 208 is likely inspired by the necessity or mandated ‘ important objectives of general public interest (of Member States or the EU) ’ 209 . In other words, it is in the interest of society and the public that ‘research’ can be conducted, provided there are safeguards for the data subjects 210 . This general public interest will vary over time, as will the expectations of data subjects 211 , as to the extent to which data (health, localisation data, etc.) would also be used for research purposes. Regulation could help to determine the further processing that should be regarded as compatible 212 . Secondly, the safeguards initially envisaged, such as anonymisation, pose serious issues in some contexts. Location data, if used as single data patterns (a particular location pattern that can be used to identify the data subject) are difficult to anonymise 213 . Human tissue or body material for further research cannot, by default, be (fully) anonymised , and information relating to data subjects necessarily remains. Under data protection legislation, there is additional uncertainty about the precise status of human tissue or body material, more precisely (i) as a source of personal information rather than (ii) personal data itself 214 . Biobanks containing body material, tissues or cells also have an unclear status. This type of information – which is now very valuable to both private and public funded research - also contains genetic information 215 on which a lot of research is based. Advances in knowledge could potentially be in the interest of the data subject or even those to whom they are genetically linked. The transfer of health data (blood samples, other body material) to biobanks, which cannot be fully anonymised or only with difficulty, but which contain genetic information must be taken into account in the context of analysis of compatible use, purpose and lawful grounds for research in the health sector. This is, however, not at the core of this study. The need for a separate lawful ground for ‘further processing’, in particular for research, is strongly debated and questioned. Policy documents and academic papers frequently diverge on this point, even within the same country 216 . Several EU institutions appear to be in favour of a new legal basis. In its Preliminary opinion on scientific research of January 2020, the EDPS stated that a new legal basis is needed 217 . The European Commission also found that the new ground ‘ may or may not differ from the legal basis of primary use’ 218 , meaning that a new legal basis is required for secondary use. The EDPB found that the logic of the 29 Commission excludes the applicability of the presumption of compatibility and stated that ‘ the controller could be able [...] to further process the data without the need for a new legal basis’ 219 . However, other EU bodies do not seem to share the same view. A recent EMA discussion paper noted that ‘ no legal basis separate from which allowed the collection of the personal data is required’ 220 . Stakeholders in the field hold a particular middle ground; for instance, the European Organisation for Research and Treatment of Cancer (EORTC) understands Recital 50 as a ‘ possibility to continue with the same legal basis, not an obligation’ and believes that secondary use may rely on a different legal basis 221 . As for authoritative GDPR commentaries, some state that ‘ only compatible further use does not require an additional legal basis’ 222 , while others conclude that the part of Recital 50 stating that no new legal basis is needed is an ‘ editorial mistake’ and that a new legal basis is always required 223 . There are arguments against the need for a (separate) legal basis, even if they are not entirely convincing. One argument is text-based: the fact that the compatibility test of the WP of 2013 (which has now become part of the GDPR in Article 6(4) GDPR) is mentioned in Article 6 stating the grounds for lawful processing, deducing that such a test, if positive, would mean that the further processing would not require a separate legal ground. However, this cannot be deduced merely from the position of Article 6(4) – which is based on the earlier Opinion of the WP – and as this Article only discusses purpose compatibility 224 . Others refer to the (non-binding) Recital 50 GDPR, but understand this in different ways. These diverging views are presented in Table 3 in Annex 1 . In addition to the arguments above, the study concludes that (presumed compatible) further processing for scientific research needs a legal basis 225 because:  the history of data protection legislation - the requirement of lawful processing and the need for a legal basis or ground has always been a central requirement and cornerstone, whereby data protection requirements for scientific research have not and should not be treated fundamentally differently, other than for the compatibility assumption;  other longstanding principles should not be overturned without a clear legislative text confirming such intention (text argument);  he meaning and wording of Article 8 of the EU Charter on Fundamental Rights 226 . Notwithstanding several diverging views, a legal basis remains required 227 , including where data are further processed for research purposes. For presumed compatible research purposes, this could be the same or a new legal basis. If the data controller further processes (reuse) personal data, it can typically reuse the same legal basis as for the primary processing if this secondary processing is compatible. If it is not, they should – generally - obtain new consent from the data subject. Secondary processing by a different controller is more complicated when it comes to reusing the same legal basis. The concept of further processing or further use has been used to mean different things over the years, creating confusion. It seems clear that the term ‘secondary use’ is not an established term used in the EU general data protection legislation. The term is rather recent and increasingly used, in particular in national legislation 228 . Secondary use could coincide with further use referring compatible processing 229 or further use in the sense of use other than the initial processing, and non-compatible, in which case this is a ‘new’ or ‘second’ use, or also ‘second(ary) use’ in the strict sense 230 . Secondary use in the strict sense will always require a new legal ground. An understanding of the need for a legal ground in relation to further processing/secondary use is presented in Figure 1 in Annex 1. 30 5.3.4 Overview and analysis of national legislation and guidance on the purpose limitation principle Is a new legal basis required for secondary use of data? In the majority of countries (12 out of 18), this is not discussed in any way 231 . Recently, however, Germany has suggested an innovative possibility, that the original legal basis is still valid as the basis for secondary processing 232 . Three countries require no legal basis 233 but each of the national legal frameworks comes with a caveat. For instance, in Greece, the data protection law creates ‘a national legal basis for secondary use’ 234 . In Belgium, academics believe that a new legal basis is not required when using data further for the purposes of academic medical research. The assessment of lawfulness is thus generally limited to an assessment of the lawfulness of the primary data collection and the appropriateness of the security measures implemented 235 . In Italy, secondary use of sensitive data for scientific research is subject to particularly strict requirements 236 . Although no new legal basis is required, third parties processing sensitive data for secondary use are obliged to obtain prior authorisation from the Italian SA 237 . Such authorisation may be either via an ad hoc decision, or through a general provision specifying the conditions and necessary measures that the controller has to implement (such a general provisions has not yet been implemented 238 ). Where it is the same controller that processes the data further (i.e. originally collected for clinical activity), there is no need for authorisation. However, the Italian law imposes further conditions on the controller, such as implementing additional safeguards, obtaining ethics committee approval, and consulting the SA prior to the processing 239 . The only country in which a new legal basis appears to be required is the UK . However, the advice of the Information Commissioner’s Office (ICO)is quite unclear 240 . Some medical research documents seem to suggest the need for a new lawful basis, but there is no definitive advice 241 . Implementation of the presumption of compatibility Special advice is available in the majority of the countries (10 out of 18) 242 . With respect to specific legislation, the Hungarian example is interesting, where a government committee was established (by law) to oversee the presumption of compatibility 243 . In France, the presumption of compatibility is seen as a ‘philosophical’ approach to scientific research and is used for establishing simplified procedures for research that serves the public interest and is bound by research ethics and deontology of health professions 244 . The Romanian Law on healthcare reform imposes a unique restriction on the processing of pseudonymised data from electronic health records for scientific research purposes, as it allows it only after the death of the person 245 . An interesting similarity can be observed between the Belgian and Bulgarian academic views; in both countries, academics emphasise the appropriate safeguards when the presumption of compatibility for scientific research applies. In Belgium, Verhenneman has observed that the compatibility test must be conducted but is limited to an assessment of the appropriate safeguards 246 , whereas in Bulgaria, the view is that the test should not be conducted at all in cases when the presumption of compatibility applies, on the condition that the controller provides appropriate safeguards 247 . The result appears to be the same, but the phrasing is fundamentally different. In five of the countries studied, the existing advice does not go beyond the GDPR 248 . However, Italian scholars, in particular, are puzzled by the lack of conceptual clarity 249 . Recent legislation in Finland is noteworthy . A central licensing authority for secondary data use 250 has been established 251 to facilitate more efficient data use, in particular secondary processing of health data and social data under the custody of several controllers and usually requiring several authorisations from controllers for further use for research purposes. Such data are now pooled and centralised at national level at FinData 252 . A central one-stop-shop, the Data Permit Authority, will decide on requests for access to (i) data from different controllers, (ii) national information system services (‘client data in healthcare and social welfare’) and (iii) registers of one or more private organisers of healthcare 31 services (Section 11 of the Act on the secondary use of health and social data) within specific timeframes. Secondary use of the data will be allowed for permitted purposes as defined in the law, with a revocable licence issued for a fixed term. The agency will collect, combine and, if necessary, pseudonymise or anonymise the data or generate the aggregated statistics requested (Section 14) 253 . The Act on the secondary use of health and social data provides for a clarified legal basis for data collection by the Finnish National Institute for Health and Welfare and national monitoring, and knowledge management 254 by social and healthcare service providers but also for businesses to support decisions, by combining technical and commercial data with social and healthcare data. A licence may also be required for education, information management and development and innovation activities (Section 37) 255 , provided that the explicit consent of data subjects for secondary use is sought for the latter, as no category under Article 9(2) GDPR fit. Such consent is granular for each use (for processing by FinData, and by each secondary user) and is controllable for the data subject by a digital ecosystem, facilitating communication with the Data Permit Authority, including consent modification and withdrawal. None of the 18 countries 256 examined appear to have defined national rules on the application of the presumption of compatibility at national level in conjunction with the principle of lawfulness established under Articles 6 and 9 of the GDPR, in light of Recital 50 and Article 6(4) GDPR,. Does medical confidentiality influence the purpose limitation principle? At international level, the WMA’s Code of Medical Ethics states that a physician shall ‘respect a patient’s right to confidentiality. It is ethical to disclose confidential information when the patient consents to it or when there is a real and imminent threat of harm to the patient or to others and this threat can be only removed by a breach of confidentiality’ 257 . Council of Europe Recommendation (81)1 on medical databanks states that medical records may not be shared ‘ outside of the fields of medical care, public health or medical research ’ without express and informed consent, unless , however, permitted by rules of medical professional secrecy 258 . In other words, medical research can be broadened where medical professional secrecy rules allow such communication because the receiving party is also bound by such medical secrecy. At national level, various regulations are usually applicable to medical confidentiality, including criminal codes, patients’ rights laws, laws on the exercise of the medical profession, and national codes of ethics. As all health professionals understand the need for confidentiality, it can be seen as an additional safeguard when it comes to data protection. In the majority of countries (11 out of 18) investigated for this study, no discussion on the influence of medical confidentiality on the purpose limitation principle was evident. Experts from seven countries (Belgium, Bulgaria, France, Germany, Italy, the Netherlands, and Portugal) shared their observations (see Table 4 in Annex 1), which together suggested that medical secrecy has a practical impact on the purpose limitation principle as applied in the context of scientific research (particularly in Bulgaria, France, and Italy). It is important to note that in the context of the COVID-19 pandemic, the UK permitted general practitioners (GPs) and organisations providing health services to disseminate confidential patient data to other persons or organisations, as long as this was required for a COVID-19 purpose, e.g., preventing the spread of the virus or research 259 . Interim conclusion: On the ground of legitimate interest, the study concludes that specific legal grounds other than consent could be invoked, insofar as specific conditions are met for the compatible research. As it is likely that not all research outside earlier defined projects (e.g. clinical trial) may meet these conditions, including the expectations of individuals and society, it would be useful to haave a debate on the preferred ground (if such preference is to be established). Agreement by the data subject (consent) would be suitable in some cases, but not feasible in others. 32 6 LEGAL ANALYSIS OF SELECTED GDPR PROVISIONS This chapter first addresses Article 11 of the GDPR (Section 6.1 ), followed by Article 14(5)(b) of the GDPR, concerning the exemption from the information obligation for scientific research (Section 6.2). It also addresses the application of Article 89(1) of the GDPR, in particular the obligation to de-identify personal data, and the data subject’s rights under the GDPR which may give the data controller the possibility to identify study participants (Section 6.3). 6.1 ARTICLE 11 GDPR AND THE OBLIGATION TO INFORM DATA SUBJECTS OF THE REUSE OF DATA 6.1.1 Legal analysis of Article 11 GDPR at EU level As Article 11 GDPR has no equivalent in the DPD 260 , there is no relevant case-law as yet. Surprisingly, Article 11 has not been subject to much academic discussion 261 , although it has sparked debate within research community from time to time. Prior to the GDPR, researchers argued that identifying information was sometimes maintained in order to meet data subjects’ requests, e.g. for correction or removal 262 . Some issues persist with the new Article 11 GDPR. In literature, it remains unclear whether Article 11 is about anonymous or pseudonymous data. As anonymous data is out of the scope of the GDPR, the study has taken it to relate solely to pseudonymous data 263 , the understanding of which appears to be generally accepted in literature, particularly in authoritative GDPR commentaries 264 . Another issue is Article 11’s classification and legal impact 265 . In the context of clinical research, ‘reasonable measures to verify the identity of a data subject’ (Article 11(2) GDPR and also Recital 64) may be difficult to define. As established by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) Guideline for Good Clinical Practice (GCP), the sponsor receives only coded (i.e. pseudonymised) data concerning the trial subjects (Principles 1.58 and 5.5.5), while the key for identification is held by the investigator. Patients receive all relevant information (about the trial and data protection notices) via the investigator and are not contacted directly by the sponsor. In that respect, if a patient provides their name, or even their ID, directly to the sponsor, the information may not be sufficient to identify the data subject (as the sponsor does not have the key code, nor the right to obtain it from the investigator, pursuant to GCP) 266 . Finally, there is a question as to whether accepting such additional information is a separate processing activity. The GDPR commentary 267 attempts to answer this question. In particular, Georgieva is of the opinion that the additional information required under Article 11(2) cannot be interpreted as a legal basis for data processing pursuant to Article 6(1), and the controller is still required to undertake the purpose compatibility test pursuant to Article 6(4) GDPR 268 . The controller must clarify which ‘additional information’ is needed. Another interpretation could be that such processing is necessary to comply with the controller’s legal obligation set forth in Article 11(2) GDPR, thus the legal basis for the processing would be Article 6(1)(c) GDPR – ‘legal obligation to which the controller is subject’. The major issue, however, is how Article 11 GDPR fits with the transparency obligation and right to information of data subjects, particularly Article 14(5)(b) GDPR. Compatibility with the fundamental right to data protection as set out in Article 8 of the EU Charter on Fundamental Rights must also be assessed 269 . It is useful here to draw a distinction between different scenarios common in research, and different kinds of research:  Where a data controller itself reuses data and (anonymises or) pseudonymises that data itself, Article 11 GDPR does not prevent that data controller from informing the data subject prior to the reuse of data. On the contrary, if a data controller reuses data but obtained such (anonymised or) pseudonymised data from another party, Article 11 could prevent information being given to 34 first stage of processing, the data controller collects data of identifiable natural persons. However, in the course of the processing it is discovered that identifying the data subjects is no longer needed. The authors provide the following examples: ‘it may be that the primary purposes for which the data were collected, have changed’ ; ‘it is possible that the storage periods have expired and that, in order to comply with the storage limitation principle, the data controller would not be able to store the data any longer in a form that would allow the identification of the data subjects’ . With respect to the second example, Toshkova-Nikolva and Feti explain that storing data for longer periods (than originally planned) is possible only as long as they will be processed solely for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes, and when applying technical and organisational measures to safeguard the rights and freedoms of the data subjects , in accordance with Article 89(1) of the GDPR. By contrast, in France , Article 11 GDPR was assumed to refer to anonymised data. According to Chassang, the challenge is to ensure that the data are well anonymised. Individuals should be informed about the anonymisation and consequences regarding the exercising of their rights under the GDPR 278 . Finally, in Belgium , two scenarios were considered:  Where the data controller reusing data anonymises or pseudonymises the data itself, Article 11 does not prohibit informing the data subject prior to that reuse;  Where the data controller who reuses data obtains anonymised or pseudonymised data from another party, Article 11 GDPR prohibits informing the data subject prior to that reuse. In this case, the transparency obligation can be transferred to the original data controller through contractual agreements 279 . 6.2 Legal analysis of the application of the exemption to information duty for scientific research and appropriate measures under Article 14(5)(b) GDPR 6.2.1 Legal analysis of Article 14(5)(b) GDPR at EU level The lawfulness of the processing operations is seriously endangered by the lack of a sufficient level of transparency on the use and further use of health-related data in the context of scientific research. Transparency allows data subjects to – a priori 280 – learn about the planned data processing operations and – a posteriori 281 – enforce their rights. Additionally, where patients are able to find transparent information on the processing of their health-related personal data at the moment of their choice, they will find themselves (re-)assured and gain trust 282 . Prior to the implementation of the GDPR, participants in prospective (interventional) studies were generally informed about their privacy and the processing of their data through informed consent procedures. The CTD has harmonised the requirement for informed consent for participation in clinical trials using medicinal products. Since the GDPR, it remains possible to inform data subjects about data protection through the informed consent form (ICF) for participation in the clinical trial, on the condition that the structure of the ICF clearly distinguishes between (the risks caused by) participation and (risks caused by) data processing. Doing so is not advised where informed consent is not indicated as the legal basis for the data processing (see above), as it may cause confusion in data subjects and could potentially induce requalification of the legal basis. Prior to the GDPR it was not uncommon to apply an exemption to transparency obligations for disproportionate effort. The size of the research project, the age of the data and the mortality rate in the research population were generally considered valuable arguments to allow researchers to provide information through a public announcement (website, leaflet, brochure, poster) rather than informing research participants individually. While such a public announcement has little added value for data subjects , the GDPR similarly allows for researchers to invoke disproportionate effort. Currently , the exemption is restricted to situations where the data are not collected from the data subject 283 . It is necessary to clarify the distinction between Article 13 (data obtained from a data subject) 35 and Article 14 (data not directly obtained from a data subject). In case of the further use of patient data (for scientfic purposes), which article applies when the data have been collected directly from the patient by physician A, but are for the purpose of research reused by physician B, who is working in the same hospital but does not have a therapeutic relationship with the patient? When Article 14 is applicable, physician B could argue for an exception under Article 14(5)(b). When Article 13 is applicable, that physician would not be able to argue for an exception. The importance of transparency might encourage restricting the scope of Article 14(5)(b). A two-step approach could be useful, especially in a context where data are further used for more than one specific purpose (e.g. more than one clinical trial, more than one research and development project, more than one project).  In a first step, data controllers have to provide general information to all of the participants. In a hospital setting, this would mean that all ambulant and admitted patients are informed that research is conducted at the hospital. Transparency can be created by using patient information brochures, leaflets, websites, digital information screens;  In a second step, the general information should be supplemented with an individualised overview of the projects and studies for which the data of that individual will be used. Such an overview should encompass prospective studies, retrospective studies and feasibility screenings (see definition of scientific research above). In a hospital setting, this would mean that on the patient portal of the hospital where the patient is treated, the patient is able to find an overview of the studies and clinical trials for which their data are used 284 . A complementary solution could be an EU portal providing a repository 285 . 6.2.2 Overview and analysis of national legislation and guidance on Article 14(5)(b) GDPR The majority of countries investigated make no specific advice available. However, France and Italy have adopted a similar procedure - authorisation is required from the DPA prior to secondary use of personal data (including sensitive data) in cases where the controller (a third party) can rely on Article 14(5) GDPR. In the UK, it appears that the lack of specific guidance likely results from the range of possible research circumstances to which the principle might apply and the need to consider the relevant processes and interests involved on a case-by-case basis 286 . In Belgium , the personal view of the researcher who contributed, has been reported above 287 . Specific guidance (either in law or national guidelines) was reported in Germany, Hungary, Italy and France. In Germany, the Association for Data Protection and Data Security (GDD) made certain general observations on the concept of disproportionate effort. For example, the case-law findings that such an effort should not result from obstructions unnecessarily created by the controller, and cannot solely consider financial or organisational costs. The GDD eventually recognises that whether efforts are disproportionate or not can only be considered on a case-by-case basis 288 , given the range of possible research circumstances to which the principle might apply. In France , according to the CNIL 289 , all of the reasons mentioned in Article 14(5) GDPR can be invoked by the data controller to justify an exception to individual right to information in the context of scientific research. Nevertheless, this must be justified in detail by the controller. The controller will not have access to simplified procedures in these circumstances. CNIL authorisation is needed prior to the start of the processing. In each case, the CNIL assesses the reasons and circumstances of the exception invoked, as well as the guarantees presented by the controller (and processors) before providing any authorisation (assessment of the material difficulty in re-identifying the persons concerned, the human workload, the financial cost, the age of the data, the number of people, etc.). These assessments are performed with due consideration for the means available to the data controller to respect data subject’s right to information. Where the 36 research project is submitted by law to a prior research ethics committee approval (for Research Involving Human Persons (RIHP) projects), the CNIL verifies that this has been obtained. In Italy , the Italian Data Protection Act (PDPC) contains a direct reference to the exemption to Article 14(5) GDPR. Pursuant to Section 110-a PDPC, secondary use of personal data for scientific research purposes by third parties is subject to authorisation by the SA, if informing the data subjects proves impossible or entails a disproportionate effort on specific grounds, or if it is likely to render impossible or seriously impair the achievement of the research purposes 290 . 6.3 ARTICLE 89(1) GDPR (OBLIGATION TO DE-IDENTIFY DATA COLLECTED) AND DATA SUBJECTS’ RIGHTS UNDER THE GDPR 6.3.1 Legal analysis of Article 89(1) GDPR at EU level Article 89(1) GDPR provides that processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall be subject to ‘appropriate safeguards’ of the rights and freedoms of data subjects. The nature of these appropriate safeguards is not clearly specified nor is it clear if national legislation may impose some specific measures or if the data controller alone can decide the appropriate safeguards. It could be argued that the principle of accountability and the lack of reference to margin of manoeuvre for the Member Statess in Paragraph 1 (although included in Paragraph 2) seems to indicate that the data controller is free to choose the more appropriate safeguards 291 . Article 89(1) GDPR only contains specific obligations for data minimisation. These specific obligations should be understood as a cascade obligation with three levels 292 :  When, for the purpose of research, the use of personal data (that allow for the identification of the data subject) is not required, data should be anonymised 293 ;  When, for the purpose of research, the use of personal data (that allow for the re-identification of the data subject) is required, but the use of easily identifiable information including direct identifiers is not required, personal data should be pseudonymised 294 ;  When, for the purpose of research, the use of non-pseudonymised data, including direct identifiers, is required, an appropriate level of security should be achieved using different measures 295 . When data are anonymised, the further use of data is out-of-scope of the GDPR. The sole question that arises in this case is whether the data subject must be informed about the anonymisation itself, since anonymisation is also a processing operation 296 . When data are transferred from one controller to another, it is the first controller that anonymises the data 297 . When data are pseudonymised, the burden of the transparency principle is, in practice, often transferred to the party that collects the data – this is not necessarily the party that decides on the purposes and the means. For instance, in clinical research, the sponsor of the trial will determine the protocol (purpose and means of the research) and would be qualified as the data controller 298 . The participating site will collect the personal data, but as the data processor, because it does not determine the purpose and means. While the sponsor (controller) will provide the content of the information that needs to be provided to the data subject, the participating site (processor) will often be requested to provide the information to the data subject through the investigator. While the participating site should be free to claim compensation for their efforts, it seems correct that they are requested to provide the information to the data subject. This obligation should be included in the data processing agreement and in the study protocol. To implement procedures to enhance transparency, ideas can be adopted from ICH GCP, especially the informed consent procedure (principle 4.8) 299 . It could be argued that compliance with the transparency obligations under the GDPR can be achieved through a staged approach. Where it is necessary for the purpose of the research not to provide 37 information on the techniques and methodologies, a more general description should be allowed. Nevertheless, given that the GDPR does not provide for exceptions to the transparency obligation and the key role of this principle in the functioning of the GDPR, data controllers must ensure that data subjects are provided with additional information as soon as possible. Lessons can be learned from ICH GCP principles, for example, which apply to the use of single and double-blind studies. The study sought to investigate how the transparency obligations under the GDPR apply in the context of projects using covert techniques. The GDPR contains no specific provision in this respect and few Member States have specific provisions or national guidance on the subject (see Section 5.3.2 ). 6.3.2 Overview and analysis of national legislation and guidance on Article 89(1) GDPR In the majority of the countries examined, there were no insights into Article 89(1) GDPR 300 . National advice (in the form of law or guidelines) was found in five Member States 301 . In Germany , the law provides certain legal clarification of the obligation to de-identify under Article 89(1) GDPR 302 . There seems to be little further specific clarification of how these measures are to be implemented within specific research projects or organisations. This makes sense given the significant differences in types of research conducted, organisation of research approaches and resources available 303 . In Slovakia , similar to Article 89(1) GDPR, Section 78(8) DPA provides for general safeguards in cases of processing of personal data for scientific purposes. There is no direct reference to the possibility for third parties to access the de-identified data in the DPA or other legislation. In the case of the processing of data for scientific purposes, several data subjects’ rights may be restricted (e.g. the right to access personal data, the right to rectification of personal data, the right to rectification of the processing of personal data and the right to object to the processing of personal data), as specified in Section 78(9) DPA 304 . In Slovenia , the proposal for a new data protection law includes a provision pursuant to which academic researchers registered with the relevant agency may under certain circumstances access previously processed data. This is permitted if they disclose certain information to the controller 305 . However, there is no certainty if or when the proposal will be adopted. Finally, in the UK , the Data Protection Act reiterates that the obligations outlined in Article 89(1) GDPR must be adhered to for the processing of personal data for research purposes. There is certain limited guidance available on the obligation to maintain principles of data minimisation in scientific research. The Health Research Authority, for example, states: ‘Organisations must also have technical and organisational measures in place to ensure respect for the principle of data minimisation. These should include that only the absolute minimum amount or type of personal data required for a purpose is processed. Personal data should be pseudonymised where compatible with the research purpose, and identifiable data should not be used where the research purpose can be fulfilled by further processing with anonymised data’ 306 . The Authority notes, however, that this guidance will need to be implemented at organisational level 307 . In Bulgaria, pursuant to Article 28(1) of the Health Act, health information may be ‘disclosed to third parties in any of the following cases: […] 6. it is necessary for the needs of medical statistics or medical research , having deleted the data identifying the patient’ . The law does not specify whether ‘deleting the data identifying the patient’ is understood to mean pseudonymised or anonymised data. According to Opinion 05/2014 of the Article 29 WP, ‘when a data controller does not delete the original (identifiable) data at event-level, and the data controller hands over part of this dataset ( for example after removal or masking of identifiable data ), the resulting data is still personal data’ 308 . There appears to be no specific guidance in Bulgarian case-law/codes of conduct on the technical measures required to comply with Article 28(1) of the Health Act. It can likely be assumed that in most cases the data disclosed would be pseudonymised data, i.e. personal data. This issue touches on the complex discussion about absolute/relative anonymisation, which is not yet solved at EU level 309 . Currently, there is no consistency at national level or in international standards as to what constitutes anonymisation 310 . 38 6.3.3 Overview and analysis of national legislation and guidance on projects using covert techniques There was no specific law or national guidance available in the majority of the countries investigated (13 out of 18) 311 . In France , a specific article for ensuring ethical deception practice in research limits the use of deception to the sole research in psychology (explicit purpose limitation; and explicit mention of the type of information exceptionally allowed to be hidden from the participant, see Article L. 1122-1 PHC). The practice of deception method, even if scientifically justified, in no way entirely deprives research participants of their right to be informed. The information process will nevertheless be adapted before the first data collection and completed as soon as possible afterwards. Complete information on the research is provided at the end. The use of deception and its justification from a scientific or methodological point of view shall be detailed in the dossier submitted to the competent REC ( Comité de Protection des Personnes , mentioned in Article L. 1123-6) and explicitly mention the nature of the preliminary information sent to potential research participants. The REC will assess and approve or reject such a possibility, on a case-by-case basis. Correct implementation of the approved procedure should be documented by the data controller during the research as part of its accountability obligation. In Belgium , the national input for this study echoes the rationale of the French law, i.e. that the use of covert techniques should not prevent researchers from being completely transparent at the end. Once the study is complete, data subjects should be further informed 312 . 39 7 POLICY RECOMMENDATIONS Chapter 7 presents some approaches and policy recommendations to better harmonise the legal regime relating to scientific or historical research or statistical purposes. Section 7.1 presents general recommendations and Section 7.2 more specific recommendations. 7.1 GENERAL RECOMMENDATION: INCREASED DIALOGUE AND COOPERATION There is no uniformity in Member States’ approaches to key aspects of the secondary use of personal data for scientific research. Following the detailed analysis presented, the general recommendation is for the EDPB to encourage increased dialogue between Member State SAs, sharing of information on national practices and interpretations in view of Article 60 and following the GDPR, and cooperation between Member State SAs, European institutions and bodies, and key stakeholders. In addition:  The EDPB and other European institutions and bodies (European Commission, EDPS, regulatory bodies in the research field, such as the EMA) could establish closer exchanges, with a view to aligning their advice on the interplay of the GDPR and other sectoral laws (CTR, national biobank legislation, etc.). Discrepancies are evident in the views of European institutions and an alignment of positions would greatly aid practitioners (such as commercial and academic research institutions) in applying the GDPR.  The EDPB could promote the establishment of relevant sectoral codes of conduct (as per Article 40 GDPR), such as that currently drafted by the Biobanking and BioMolecular Resources Research Infrastructure – European Research Infrastructure Consortium (BBMRI-ERIC) in the sphere of health research. This can be done via official communication.  The EDPB could stress the importance of involving all key stakeholders (commercial and academic research centres, patients, consumers, governments and citizens) in the creation of sectoral codes of conduct and binding and non-binding guidelines. Empirical research on a pan-European scale could be useful in mapping stakeholders’ experience, challenges and solutions.  The EDPB could adopt guidelines to address the secondary use of personal data for scientific research (see Section 6.2 for specific areas needing guidance). A disctinction could be made between: (i) problems caused by a lack of uniformity in the interpretation of the key elements of GDPR and (ii) divergences in Member States’ implementation of the margins of discretion in the GDPR in national laws. 7.2 SPECIFIC RECOMMENDATIONS Table 6 presents some suggested approaches to topics that should be addressed in future EDPB guidelines on the topic of secondary use of personal data for scientific research purposes. These recommendations reflect the findings of the study, particularly with respect to health data. The table notes whether the problems are caused by a lack of uniformity in interpretation (‘interpretation issue’) or divergences in the implementation of the GDPR in national laws (‘implementation issue’). In certain cases, both types of issue are evident. 44 8 CONCLUSIONS This study investigated pertinent questions about the secondary use of personal data for scientific research. Based on the information gathered on 18 countries, there appears to be a lack of a uniform approach among Member States. This might lead to a lack of protection of data subjects involved in research, or ‘forum shopping’ for commercial actors undertaking scientific research. The diversity of positions reflects the margin of manoeuvre left to Member States by the GDPR, with respect to the processing of personal data in the framework of research. Equally, the GDPR itself is not explicit on some points. This study shows that the situation and laws in the Member States are different because some have specific national provisions clarifying the European legislation. The first concern is the meaning of ‘scientific research’ - there is no clear definition in the GPDR and most Member States do not specify it futher, except in some sectoral laws. Without a clear definition, homogenous application of the presumption of compatibility and the Article 89 GPDR specific framework is not possible. The terms ‘secondary use’ and ‘further processing of data’, and the links between them, need attention and guidance to prevent misunderstandings. In the case of reuse of personal data, the question of the need for a (new) legal basis should be clarified, given that some Member States require a new legal basis while others do not. Similarly, Member States lack a clear position on legal bases for sensitive data, with little clarity on the articulation between Articles 6 and 9 GDPR (cumulative requirements or separate requirements). Few Member States clearly see Article 9 GDPR as a cumulative requirement. The choice of legal basis can also pose a problem for pan-European studies. The effectiveness of data subjects’ rights was an important aspect of the study, especially in relation to consent and the right to information. Some clarifications seem necessary, for instance in relation to application of the transparency obligation in cases of reusing personal data, or how precisely data subjects may choose the areas of scientific research where their data could be used (interpretation of Recital 33 of the GDPR). Questions remain about the concept of ‘appropriate safeguards’ in the context of Article 89 GDPR. Most Member States lack clear practical guidance on the kinds of measures that should be implemented by the data controller. Another concern is the possibility for Member States to impose some specific measures in this context. It seems clear that the EDPB could usefully promote cooperation and dialogue between SAs and between different European institutional bodies involved in scientific research regulation with a view to providing these clarifications. The promotion of sectoral codes of conduct (binding on adherents) or guidelines is another possible solution. These kinds of instruments should be developed with input from a large panel of stakeholders (commercial and academic research centres, patients, consumers, governments and citizens). Even if clarifications are provided by EDPB guidelines, or codes of conduct, national differences may persist due to national law rather than interpretations of GDPR provisions. In such cases, the EDPB would have limited ability to harmonise these rules and the only way forward would be to modify EU or Member State legislation. Finally, the GDPR overlaps and interacts with other specific European legislation (CTR, Biobanks Directives). Further guidance on the interplay between these different pieces of legislation could be beneficial. 53 ANNEX 2 – QUESTIONNAIRE ON RELEVANT NATIONAL LAWS AND PRACTICES 1 1 This questionnaire was intended for external use. Questionnaire used by internal researchers was slightly more elaborate. 55 Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research BACKGROUND INFORMATION The European Data Protection Supervisor (EDPS) and the European Data Protection Board (EDPB) recently awarded a framework contract for ‘Studies on the implication of several GDPR provisions, case laws and other laws having an impact on data protection’. This questionnaire on secondary use of personal data for scientific research is provided within this framework contract and shall be kept strictly confidential . This questionnaire is aimed at compiling relevant legal information about national regulation and on secondary use of personal data for scientific research the implementation of specific provisions of the GDPR by EU Member States and EFTA EEA countries (Iceland, Lichtenstein and Norway). We would like to obtain an overview of the applicable national legislation, guidelines, decisions and conditions for the secondary use of personal data for scientific purposes, with a specific focus on how the principles of purpose limitation and lawfulness, which are closely related when it comes to the secondary use of personal data, are applied in the context of scientific research. This Questionnaire has been designed as a methodological tool to gather national information from experts on the national specificities. Please provide answers to all questions which are relevant in the context of your national legal order. When we ask for explanation on the national rules, please consider also case law, legal interpretation by legal scholars and any national guidelines from the SAs and other relevant authorities, (legal) scholar views and national practices that are relevant. Please provide with your answer any relevant specific source, including links or attachments to the relevant sections or legislation pieces. We would be grateful to receive your input by June 8 If you would need more time, please let us know in advance so that we can take this into account. Once completed, please send it back to and eleftherios.chelioudakis@kuleuven.be . If you have any questions regarding this study or the questionnaire, please contact the same e-mail addresses. Data Protection Notice Please be informed that all personal data that you provide by collaborating and answering to this questionnaire and gathered for this study - in particular your contact details and your input to the questions - will be treated in conformity with Regulation (EU) 2018/1725 and all other applicable legal requirements. The controller for execution purposes of the procurement framework contract, including the conduct of the legal studies, is the EDPS (including the EDPB Secretariat) and the EDPB. Your personal data will be processed by the consortium of partners, including their subcontractors/affiliates, namely Milieu Consulting SPRL, the Center for Law and Digital Technologies (eLaw) from Leiden University, KU Leuven, represented by the KU Leuven Centre for IT & IP law (CiTiP), the Research Centre in Information Law and Society (CRIDS) from the University of Namur and CLI - Vrije Universiteit Amsterdam, acting as processors on behalf of the EDPB and the EDPS and under their sole instructions. The content of your replies you provide will be used by those processors to gather information and knowledge for the provision of the report. Your answers will remain confidential, and will not be transferred to any other third parties, except where legally required (e.g. audits by EU bodies or access to documents requests, on the basis of available exceptions and in accordance with applicable law). Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research No responses to the questionnaire will be published with any of your contact details. Please note, however, that, at your request, a general reference to your full name and/or professional affiliation as a participating expert may be included in the study. Should that be the case, please make such request, in writing, to the consortium as an expression of your consent. Such reference will become public in the event that the study is published or made accessible following an access to document request. You may withdraw your consent at any time, but please note that all activities carried out before your withdrawal remain lawful. For information on how your personal data will be processed in the context of these activities, including on the applicable legal basis and retention periods applicable to the processing of your personal data, on the exercise of your data subject rights and the necessary contacts concerning complaints, please read the applicable EDPB / EDPS data protection notice on the execution of the contract. For information on how your personal data will be processed in the context of the management of the contract, please check the EDPS data protection notice: https://edps.europa.eu/data-protection/our- work/publications/other-documents/12-edps-data-protection-notice-procurement_en . Confidentiality clause Please treat in the strictest confidence and do not make use of and do not divulge to third parties any information or documents, disclosed in writing or orally, which are linked to the performance of this study, including the questionnaire and the name of the study, unless:  The use is required to answer this questionnaire;  The EDPB gives you our prior written consent to the disclosure;  You are required by law or by any regulatory authority to make the disclosure; o  The document or information has entered the public domain other than by wrongful disclosure by you. Please note that you shall continue to be bound by this obligation after completion of this questionnaire without limit in time. Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research QUESTIONNAIRE Contact details Contact persons and contacts Please, provide your name and your position within your organisation: Please, provide your contact information (e.g. email and/or telephone number): I. General questions 1 Is “scientific research” defined in your national legislation ( lex generalis or lex specialis , e.g. health legislation) and/or does the national legislation or case law in your country list principles that define scientific research? Please, bear in mind that specific arrangements can exist for a specific type of research (e.g. medical research), hence information should be looked for not only in general law, but also in sectorial legislation. (Please also provide reference to the applicable legal act and article, if any; feel free to use more space if needed) 2 If there is no legal definition, are you aware of case law, sectorial guidance, case law or any other source that provides a commonly accepted definition or is there a specific understanding of scientific research in your country ? II. Implementation of the principle of lawfulness of processing of special categories of personal data for scientific research in your country under 9(2)(a) 2 and Article 9(2)(j) 3 of GDPR. 1 Are there national legal provisions which require “explicit consent” as under Article 9(2)(a) GDPR for scientific research in your country, and in which contexts ? (Please also provide reference to the applicable legal act and article, if any; feel free to use more space if needed) 2 Are you aware of case law, codes of conduct, SA guidelines, other binding or non-binding instruments and/or practices in your country that impose the use of “explicit consent” in the context of scientific research? (Please also provide reference to the applicable legal act and article, if any; feel free to use more space if needed) 2 Article 9(2)(a) GDPR: “The data subject has given explicit consent to the processing of those personal data for one or more specified purposes…”. 3 Article 9(2)(j) GDPR : “Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”. Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research ANNEX 3 – SOURCES OF INFORMATION Legal documents  Charter of Fundamental Rights of the European Union (OJ C 326, 26.10.2012), p. 391–407, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:12012P/TXT .  Commission Directive 2006/17/EC of 8 February 2006 implementing Directive 2004/23/EC of the European Parliament and of the Council as regards certain technical requirements for the donation, procurement and testing of human tissues and cells (OJ L 330M , 28.11.2006, p. 162–174 (MT), OJ L 38, 9.2.2006, p. 40–52), https://eur-lex.europa.eu/legal- content/EN/TXT/?uri=CELEX%3A32006L0017 .  Commission Directive (EU) 2015/566 of 8 April 2015 implementing Directive 2004/23/EC as regards the procedures for verifying the equivalent standards of quality and safety of imported tissues and cells (OJ L 93, 9.4.2015, p. 56–68), https://eur-lex.europa.eu/eli/dir/2015/566/oj .  Council of Europe, Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine: Convention on Human Rights and Biomedicine (Oviedo Convention), ETS No 164, https://www.coe.int/en/web/bioethics/oviedo- convention .  Council of Europe, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ETS No 108, https://www.coe.int/en/web/conventions/full-list/- /conventions/rms/0900001680078b37 .  Council of Europe, Modernised Convention for the Protection of Individuals with Regard to the Processing of Personal Data, ETS No. 108 +, https://search.coe.int/cm/Pages/result_details.aspx?ObjectId=09000016807c65bf .  Council of Europe, Committee of Ministers Recommendation No. R (81) 1 on Regulations for automated medical data banks, ‘Rec(81)1’, https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016804 eee77 .  Council of Europe, Recommendation CM/Rec (2019) 2 of the Committee of Ministers to member States on the protection of health-related data, https://www.apda.ad/sites/default/files/2019- 03/CM_Rec%282019%292E_EN.pdf .  Council of Europe, Recommendation No. R (97) 5 of the Committee of Ministers to member States on the protection of medical data, https://search.coe.int/cm/Pages/result_details.aspx?ObjectID=09000016804f0ed0 .  Council of Europe, Recommendation No. R (97) 18 of the Committee of Ministers to member States, concerning the protection of personal data collected and processed for statistical purposes, https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016805 08d7e .  Council of Europe, Recommendation Rec(2006) 4 on research on biological materials of human origin, https://www.coe.int/t/dg3/healthbioethic/Activities/10 Biobanks/Rec%282006%294%20EM%20E.pdf .  Council of Europe, Recommendation CM/Rec (2016) 6 of the Committee of Ministers to member States on research on biological materials of human origin, https://search.coe.int/cm/Pages/result details.aspx?ObjectId=090000168064e900 .  Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31-50), https://eur-lex.europa.eu/legal- content/EN/TXT/?uri=celex%3A31995L0046 .  Directive 2001/20/EC of the European Parliament and of the Council of 4 April 2001 on the approximation of the laws, regulations and administrative provisions of the Member States relating to the implementation of good clinical practice in the conduct of clinical trials on medicinal products for human use (OJ L 121, 1.5.2001, p. 34–44), https://eur-lex.europa.eu/legal- content/EN/TXT/?uri=CELEX%3A32001L0020 .  Directive 2004/23/EC of the European Parliament and of the Council of 31 March 2004 on setting Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research standards of quality and safety for the donation, procurement, testing, processing, preservation, storage and distribution of human tissues and cells (OJ L 102, 7.4.2004, p. 48–58), https://eur- lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32004L0023 .  Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use, and repealing Directive 2001/20/EC (OJ L 158, 27.5.2014, p. 1–76), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32014R0536 .  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, (OJ L 119, 4.5.2016, p. 1-88), https://eur- lex.europa.eu/eli/reg/2016/679/oj . Literature  Andersen, M.R., Storm, H.H. (on behalf of the Eurocourse Work Package 2 Group), ‘Cancer registration, public health and the reform of the European data protection framework: Abandoning or improving European public health research?’, European Journal of Cancer , Vol. 51, No. 9, 2015, p. 1028-1038.  Aurucci, P., ‘Legal issues in regulating observational studies: The impact of the GDPR on Italian biomedical research’, European Data Protection Law Review , Vol. 5, No 2, Lexxion, 2019, pp. 197–208.  Aymé, S., ‘Enforcement of a new data protection law in Europe: A threat and an opportunity for registries and cohorts in the field of rare diseases’, La Revue de Médecine Interne , Vol. 39, No. 10, p. 769-771.  Ballantyne, A., ‘Adjusting the focus: A public health ethics approach to data research’, Bioethics , Vol. 33, No. 3, 2019, pp. 357-366.  Beier, K., Lenk, C., ‘Biobanking strategies and regulative approaches in the EU: recent perspectives’, Journal of Biorepository Science for Applied Medicine , Vol. 3, 2015, p. 69-81.  Bygrave, L.A., ‘The Body as Data? Biobank Regulation via the ‘Back Foor’ of Data Protection Law’, Law, Innovation and Technology , Vol. 2, No. 1, 2010, p. 1-25.  Chassang, G., Rial-Sebbag, E., ‘ Research Biobanks and Health Databases: The WMA Declaration of Taipei, Added Value to European Legislation (Soft and Hard Law)’, European Journal of Health Law , Vol. 25, No. 5, Brill and Nijhoff , 2018, pp. 501-516.  Cole, A. and Towse, A., ‘Legal Barriers to the Better Use of Health Data to Deliver Pharmaceutical Innovation’, OHE Consulting Report , 23 (2018), Office of Health Economic, London, 2018, https://www.ohe.org/publications/legal-barriers-better-use-health-data-deliver-pharmaceutical-innovation .  Comande, G., ‘Ricerca in Sanità e Data Protection un Puzzle...Risolvibile’, rivista italiana di medicina legale e del diritto in campo sanitario, Vol. 1., 2019, p. 187-207.  De Hert, P., Papakonstatinou, V., ‘The new general data protection regulation: Still a sound system for the protection of individuals’, Computer Law and Security Review , Vol. 32, No. 2, 2016, p. 179- 194.  Demotes-Mainard, J, Cornu, C., Guérin , A., ‘How the new European data protection regulation affects clinical research and recommendations’, Therapies , Vol. 74, No. 1, 2019.  Djurisic, S., Rath, A., Gaber, S., Garattini, S., Bertele, V., Ngwabyt, S., Hivert, V., Neugebauer, E., Laville, M., Hiesmayr, M., Demotes-Mainard, J., Kubiak, C., Jakobsen, J., Gluud, C., ‘Barriers to the conduct of randomised clinical trials within all disease areas’, Trials , Vol. 18, 2017.  Dove, E., ‘The EU General Data Protection Regulation: Implications for International Scientific Research in the Digital Era’, The Journal of Law Medicine and Ethics , Vol. 46, No. 4, 2018, p. 1013-1030, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3240459 .  Ducato. R., ‘Data protection, scientific research, and the role of information’ (CRIDES Working Paper Series no. 1/2020), Computar Law and Security Review , 2020, https://www.researchgate.net/publication/339213343_Data_protection_scientific_research_and_the_role_of information .  Duguet, A., and Herveg, J., ‘Safeguards and derogations relating to processing for scientific purposes: Article 89 analysis for biobank research’, in Slokenberga, S., Tzortzatou, O., Reichel Jane Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research (eds), GDPR and Biobanking , Springer, 2021.  Frunză, A., Sandu, A., ‘Ethical Acceptability of Using Generic Consent for Secondary Use of Data and Biological Samples in Medical Research’, Acta Bioethica, Vol. 23, No. 2, 2017, p. 289-299, https://actabioethica.uchile.cl/index.php/AB/article/view/47480/57703 .  Georgieva, L., and Kuner, C., ‘Article 9 Processing of special categories of personal data’, in Kuner, C., A. Bygrave, L., Docksey C., (eds.), The EU General Data Protection Regulation (GDPR). A commentary , Oxford University Press 2020.  Georgieva, L., Kuner, C., 2020  Georgieva, L., ‘Article 11 Processing which does not require identification’, in Kuner, C., A. Bygrave, L., Docksey C., (eds.), The EU General Data Protection Regulation (GDPR). A commentary, Oxford University Press 2020.  Georgieva, L., 2020.  Gola, P., 'Article 11', Datenschutz-Grundverordnung: DS-GVO, VO (EU) 2016/679 , 2nd Edition, C.H. BECK, 2017.  Hallinan, D., ‘Broad consent under the GDPR: an optimistic perspective on a bright future’, Life Sciences, Society and Policy , Vol. 16, Springer, 2020.  Hallinan, D., Feeding biobanks with genetic data. What role can the general data protection regulation play in the protection of genetic privacy in research biobanking in the EU? , VUB Doctoral Thesis, Brussels, 2018.  Hallinan 2018  Hartlev, M., ‘Genomic Databases and Biobanks in Denmark’, The Journal of Law, Medicine and Ethics , Vol. 43, No. 4, 2015, p. 743-753.  Herbst, T., ‘Art. 5 Grundsätze für die Verarbeitung personenbezogener Daten’, in Kühling, J., Buchner B. (eds.), Datenschutz-Grundverordnung, Bundesdatenschutzgesetz: DS-GVO / BDSG , 228, Beck, 2018.  Hijmans, H., Raab, C.D, ‘Ethical Dimensions of the GDPR’, in Cole, M., Boehm, F., (eds.), Commentary on the General Data Protection Regulation , Edward Elgar, Cheltenham, 2018 (forthcoming), https://ssrn.com/abstract=3222677 .  Hintze, M., ‘Viewing the GDPR through a De-Identification Lens: A Tool for Compliance, Clarification, and Consistency’, International Data Protection Law , Vol. 8, No. 1, Oxford University Press, 2018, p. 86-101, https://fpf.org/wp-content/uploads/2016/11/M-Hintze-GDPR-Through- the-De-Identification-Lens-31-Oct-2016-002.pdf .  Ienca, M., Scheibner, J., Ferreti, A., Gille, F., Amann, J., Sleigh. J., Blasimme, A., Vayena, E., ‘ How the General Data Protection Regulation changes the rules for scientific research’ , Study for the European Parliament Panel for the Future of Science and Technology, Brussels, 2019, http://www.europarl.europa.eu/thinktank/en/document.html?reference=EPRS STU(2019)634447 .  Ienca, M., et al., 2019.  Kamenjasevic, E., ‘ Health data for scientific research under the CoE Recommendation and the GDPR – Part II’ , Blog of KU Leuven’s Centre for IT&IP Law, 2019, https://www.law.kuleuven.be/citip/blog/health-data-for-scientific-research-under-the-coe-recommendation- and-the-gdpr-part-ii/ .  Kerr, D.J., ‘Policy: EU data protection regulation - harming cancer research’, Nature Reviews Clinical Oncology , Vol. 11, 2014, p. 563-564.  Kindt, E., Privacy and Data Protection Issues of Biometric Applications , Springer, 2013.  Kostadinova, Z., ‘ Purpose limitation under the GDPR: can Article 6(4) be automated? ’, Tilburg University Master Thesis, http://arno.uvt.nl/show.cgi?fid=146471 .  Kotschy, W., ‘Article 6 Lawfulness of processing’, in Kuner, C., A. Bygrave, L., Docksey, C., (eds.), The EU General Data Protection Regulation (GDPR). A commentary , Oxford University Press 2020.  Kramer, P., 'Article 6, Rechtmäßigkeit der Verarbeitung‘, in Auernhammer, H., Eßer, M., Kramer, P., von Lewinski, K., (eds.), Auernhammer DSGVO/BDSG , 5th ed., Carl Heymanns Verlag, Cologne, 2017.  Kuner, C., Svantesson, D.J., Cate, F.H., Lynskey, O., Millard, C., ‘The language of data privacy law (and how it differs from reality)’, International Data Privacy Law , Vol. 6, No. 4, 2016, p. 259-260. Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research  Lalova, T., et al., ‘An overview of Belgian legislation applicable to biobank research and tis interplay with data protection rules’, in Slokenberga, S., Tzortzatou, O., Reichel Jane (eds), GDPR and Biobanking , Springer, 2021.  Lalova, T., Negrouk, A., Deleersnijder, A., Valcke, P., Huys, I., ‘Conducting Non-COVID-19 Clinical trials during the Pandemic: Can Today’s learning Impact Framework Efficiency?’, European Journal of Health Law , Vol. 27, No. 5, forthcoming.  Mészáros, J., Ho, C., ‘Big Data and Scientific Research: The Secondary Use of Personal Data under the Research Exemption in the GDPR’, Hungarian Journal of Legal Studies , Vol. 59, No. 4, 2018, p. 403-419.  Minssen, T., Rajam, N., Bogers, M., ‘Clinical Trial Data Transparency and GDPR Compliance: Implications for Data Sharing and Open Innovation’, Science and Public Policy , 2020, p.1-11.  Negrouk, A., Lacombe, D., ‘Does GDPR harm or benefit research participants? An EORTC point of view’, The Lancet Oncology , Vol. 19 No. 10, 2018, p.1278-1280.  Negrouk, A., Lacombe, D., Meunier, F., ‘Diverging EU health regulations: The urgent need for co ordination and convergence’, Journal of Cancer Policy , Vol. 17, 2018, p. 34-39.  Peloquin, D., Di Maio, M., Bierer, B., ‘Disruptive and avoidable: GDPR challenges to secondary research uses of data’, European Journal of Human Genetics , Vol. 28, 2020, p.697-705.  Quinn, P., ‘The Anonymisation of Research Data — A Pyric Victory for Privacy that Should Not Be Pushed Too Hard by the eu Data Protection Framework?’, European Journal of Health Law , Vol. 24, No. 4, 2017, p. 347-367.  Quinn, P., Quinn, L., ‘Big genetic data and its big data protection challenges’, Computer Law & Security Review , Vol. 34, No. 5, 2018, p. 1000-1018, https://www.sciencedirect.com/science/article/abs/pii/S0267364918300827?via%3Dihub .  Reimer, P., ‘Artikel 5: Grundsätze für die Verarbeitung personenbezogener Daten’ in Sydow, G., (ed.), Europäische Datenschutzgrundverordnung: Handkommentar , Nomos, 2018, 326.  Rial-Sebbag, E., Cambon-Thomsen, A., ‘The Emergence of Biobanks in the Legal Landscape: Towards a New Model of Governance’, Journal of Law and Society , Vol. 39 No. 1, 2012, p. 113- 130.  Shabani, M., Borry, P., ‘Rules for processing genetic data for research purposes in view of the new EU General Dat Protection Regulation’, European Journal of Human Genetics , Vol. 26, No. 2, 2018. p. 149-156.  Spindler, G., Schmechel, P., ‘Personal Data and Encryption in the European General Data Protection Regulation’, Journal of Intellectual Property, Information Technology and E-Commerce Law , Vol. 7, No. 2, 2016, p. 163-177.  de Terwangne, C., ‘Article 5 Principle relating to processing of personal data’, in Kuner, C., A. Bygrave, L., Docksey, C., (eds.), The EU General Data Protection Regulation (GDPR). A commentary , Oxford University Press 2020.  De Terwangne C., Degrave É., Delforge A., & Gerard L., La protection des données à caractère personnel en Belgique: manuel de base , Politeia, Brussels, 2019.  Toshkova-Nikolova, D., Feti, N., Защита на личните данни [Protection of personal data], ИК Труд и Право [Publishing House Trud i Pravo], 2019.  Van Veen, E., ‘Observational health research in Europe: understanding the General Data Protection Regulation and underlying debate’, European Journal of Cancer , vol. 104, 2018, p. 70-80.  Vanden Heede, E., ‘ GDPR Application in Patient Preference Studies ’, Master thesis for Intellectual Property and ICT Law under supervision of Prof. Huys, I..  Verhenneman, G., ‘ The patient's right to privacy and autonomy against a changing healthcare model: assessing informed consent, anonymisation and purpose limitation in light of e-health and personalised healthcare’ , PhD dissertation, KU Leuven Faculty of Law, 2020.  Verhennenman, G., 2020  Verhenneman, G., Claes, K., Derèze, J.J., Herijgers, P., Mathieu, C., Rezda, R., Vanautgarden, M., ‘ How GDPR Enhances Transparency and Fosters Pseudonymisation in Academic Medical Research’, European Journal of Health Law , Vol. 27(1), Brill and `Nijhoff, 2019, p. 40.  Wierda, E., Eindhoven, D.C., Schalij, M.J., Borleffs, C.J.W., van Veghel, D., Michell, C.R., de Mol, B.A.J.M., Hirsch, A., Ploem., M.C., ‘Privacy of patient data in quality-of-care registries in Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research cardiology and cardiothoracic surgery: the impact of the new general data protection regulation EU- law’, European Heart Journal – Quality of Care and Clinical Outcomes , Vol. 4, No. 4, 2018, p. 239-245.  Zuiderveen Borgesius, F., Hallinan, D., ‘Article 5’, in Boehm, F., Cole, M., (eds), GDPR Commentary , Elgar, 2021 (forthcoming).  Zuiderveen Borgesius, F., Hallinan, D., 2021  Zuiderveen Borgesius, F., ‘Singling Out People without Knowing Their Names - Behavioural targeting, pseudonymous data, and the new Data Protection Regulation’, Computer Law & Security Review , Vol. 32, No. 2, 2016, p. 256-271. Case law  ECtHR, Bărbulescu v. Romania [GC], Application No. 61496/08, 5 September 2017, CE:ECHR:2017:0905JUD006149608.  ECtHR, I. v. Finland, Application No. 20511/03, 17 July 2008, CE:ECHR:2008:0717JUD002051103.  ECtHR, S. and Marper v. U.K. [GC], Applications No. 30562/04 and 30566/04, 4 December 2008,  CE:ECHR:2008:1204JUD003056204.  CJEU, Judgement of 19 October 2016, Patrick Breyer v. Bundesrepublik Deutschland, C-582/14, EU:C:2016:779.  CJEU, Judgement of 16 July 2020, Facebook Ireland and Schrems, C-311/18, EU:C:2020:559. Other sources of information  Article 29 Data Protection Working Party, Guidelines on consent under Regulation 2016/679, 17/EN, WP 259 rev.01, 28 November 2017, as revised on

April 2018, https://ec.europa.eu/newsroom/article29/item-detail.cfm?item id=623051 .  Article 29 Data Protection, Working Party, Opinion 04/2007 on the concept of personal data, 01248/07/EN, WP 136, 20 June 2007.  Article 29 Data Protection, Working Party, Opinion 03/2013 on purpose limitation, 00569/13/EN, WP 203, 2 April 2013.  Article 29 Data Protection Working Party, Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, 844/14/EN, WP 217, 9 April 2014.  Article 29 Data Protection Working Party, Opinion 05/2014 on Anonymisation Techniques, 0829/14/EN, WP 216, 10 April 2014.  Article 29 Data Protection Working Party, Opinion 03/2017 on Processing personal data in the context of Cooperative Intelligent Systems (C-ITS), 17/EN, WP 252, 4 October 2017.  Article 29 Data Protection Working Party, Working document on a common interpretation of Article 26(1) of Directive 5/46/EC of 24 October 1995, 2093/05/EN, WP 114, 25 November 2005.  Council of Europe, Explanatory Report to Modernised Convention for the Protection of Individuals with Regard to the Processing of Personal Data, ETS No. 108 +, https://edoc.coe.int/en/international- law/7729-convention-108-convention-for-the-protection-of-individuals-with-regard-to-the-processing-of- personal-data.html .  Council of Europe, Explanatory Memorandum to Recommendation No. R (97) 18 of the Committee of Ministers to member States, concerning the protection of personal data collected and processed for statistical purposes, para. 11 and 14.  Encyclopedia of Research Design, Neil J. Salkind, N.J. (ed.), SAGE Publications, Inc., 2010, https://sk.sagepub.com/reference/researchdesign .  European Commission, COM(2020) 264 final, Communication from the Commission to the European Parliament and the Council on Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition - two years of application of the General Data Protection Regulation.  European Commission, DG for Health and Food Safety, Question and Answers on the interplay Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research between the Clinical Trials Regulation and the General Data Protection Regulation , 2019, https://ec.europa.eu/health/sites/health/files/files/documents/qa clinicaltrials gdpr en.pdf .  European Data Protection Board, Guidelines 3/2019 on processing of personal data through video devices, 10 July 2019, https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32019- processing-personal-data-through-video_en .  European Data Protection Board, Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak, 21 April 2020, https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032020-processing-data- concerning-health-purpose_en .  European Data Protection Board, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 2 September 2020, https://edpb.europa.eu/our-work-tools/public-consultations-art- 704/2020/guidelines-072020-concepts-controller-and-processor_en .  European Data Protection Board, Guidelines 4/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak, 21 April 2020, https://edpb.europa.eu/our-work- tools/our-documents/guidelines/guidelines-042020-use-location-data-and-contact-tracing_en .  European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, Version 1.1, 4 May 2020, https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines- 052020-consent-under-regulation-2016679 en .  European Data Protection Board, Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR), 23 January 2019, https://edpb.europa.eu/our-work-tools/our-documents/dictamen-art-70/opinion- 32019-concerning-questions-and-answers en .  European Data Protection Supervisor, A Preliminary Opinion on data protection and scientific research, 6 January 2020, https://edps.europa.eu/data-protection/our- work/publications/opinions/preliminary-opinion-data-protection-and-scientific_en .  European Data Protection Supervisor, Guidelines concerning the processing of health data in the workplace by Community institutions and bodies, 28 September 2009, https://edps.europa.eu/data- protection/our-work/publications/guidelines/health-data-work en .  European Data Protection Supervisor, Opinion 7/2015, ‘Meeting the challenges of big data, A call for transparency, user control, data protection by design and accountability’, 19 November 2015, https://edps.europa.eu/data-protection/our-work/publications/opinions/meeting-challenges-big-data en .  European Medicines Agency, Clinical Trial Regulation - Clinical Trials Information System development , https://www.ema.europa.eu/en/human-regulatory/research-development/clinical- trials/clinical-trial-regulation#clinical-trials-information-system-development-section .  European Medicines Agency, Guideline for good clinical practice E6(R2), 1 December 2016, https://www.ema.europa.eu/en/documents/scientific-guideline/ich-e-6-r2-guideline-good-clinical-practice- step-5_en.pdf .  European Organisation for Research and Treatment of Cancer, EORTC Contribution to the EMA Discussion Paper for c-Performing and Research-Supporting Infrastructures entitled “The General Data Protection Regulation: Secondary Use of Data for Medicines and Public Health Purposes Discussion Paper for Medicines Developers, Data Providers, Research-Performing and Research- Supporting Infrastructures” , 10 July 2020, http://www.eortc.org/app/uploads/2020/09/EMA- Secondary-use-of-health-data Discussion-Paper Stakeholders-consultation.pdf .  Foundation Federation of Dutch Medical Scientific Societies (Federa),’Self-regulatory code of conduct for Observational Research with personal data (Gedragscode Gezondheidsonderzoek, 2004)’, https://www.federa.org/sites/default/files/bijlagen/coreon/code_of_conduct_for_medical_research_1.pdf .  Gellman, R., ‘Privacy: Finding a Balanced Approach to Consumer Options’, Robert Gellman webpage , 2002, https://www.bobgellman.com/rg-docs/rg-opt-in-out-02.pdf .  Gene, A., Long, W., Webinar ‘Clinical Trials and GDPR – State of play’ , Drug Information Association (DIA), 10 July 2019.  Germany, Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, Public Consultation on the theme: Anonymisierung unter der DSGVO unter besonderer Berücksichtigung der TK- Branche , 2020, p. 6-7, https://www.bfdi.bund.de/SharedDocs/Konsultationsverfahren/2020/01 Anonymisierung- Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research TK.pdf?__blob=publicationFile&v=6 .  Germany, Conference on Data Protection ( Datenschutzkonferenz) , ‘Beschluss der 97 Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder zu Auslegung des Begriffs „bestimmte Bereiche wissenschaftlicher Forschung“ im Erwägungsgrund 33 der DS- GVO‘, 2019, https://www.datenschutzkonferenz- online.de/media/dskb/20190405 auslegung bestimmte bereiche wiss forschung.pdf .  German Association for Medical Informatics, Biometry and Epidemiology (GMDS) and German Association for Data Protection and Data Security (GDD), 'Datenschutzrechtliche Anforderungen an die medizinische Forschung unter Berucksichtigung der EU Datenschutz-Grundverordnung (DS- GVO)‘, 30, 2018, https://www.gdd.de/arbeitskreise/datenschutz-und-datensicherheit-im-gesundheits-und- sozialwesen/materialien-und-links/datenschutzrechtliche-anforderungen-an-die-medizinische-forschung- unter-beru-cksichtigung-der-eu-datenschutz-grundverordnung/datenschutzrechtliche-anforderungen-an-die- medizinische-forschung-unter-beru-cksichtigung-der-eu-datenschutz-grundverordnung/ .  Huys, I, ‘ Integrating patient preferences in the drug life cycle ’, Presentation for the Patient Preferences in Benefit-Risk Assessments during the Drug Life Cycle (PREFER), https://www.afmps.be/sites/default/files/content/11. prefer-fagg.pdf .  Interview with Alexandre Entraygues, Head Data Privacy Europe at Novartis, European Data Protection Law Review , Vol. 5, No. 5, Lexxion, 2019.  ISC Intelligence, ‘The Application of GDPR to Biomedical Research: Stakeholder Advisory Opinion to Assist Regulators, Prepared for the ISC Seminar on Challenges for Health Research Arising from the GDPR’, 19 November 2019, http://www.iscintelligence.com/event.php?id=334 .  Medical Dictionary, Definition of “Lost to follow-up”, Medical Dictionary , Farlex and Partners, 2009, https://medical-dictionary.thefreedictionary.com/lost+to+follow-up .  Organisation for Economic Co-operation and Development, Guidelines on Human Biobanks and Genetic Research Databases, 2009, http://www.oecd.org/sti/emerging-tech/44054609.pdf .  Netherlands, Ministry of Justice and Security, ‘ Handleiding Algemene verordening gegevensbescherming en Uitvoeringswet, Algemene verordening gegevensbescherming ’ [Instruction manual General Data Protection Regulation and Implementating Act of the General Data Protection Regulation], 2018, https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/handleidingalgemeneverordeninggegeven sbescherming.pdf .  Nordic Council, ‘ Nordic research collaboration for better health ’, https://www.norden.org/en/information/nordic-health-co-operation .  Slovakia, Office for Personal Data Protection, Guidelines 2/2018, https://dataprotection.gov.sk/uoou/sites/default/files/zakonnost aktualizovana verzia 22.01.2019.pdf .  Southerington, T., ‘GA4GH GDPR Brief: The Finnish Secondary Use Act 2019 (May 2020 Bonus Brief)’ [blog post], 21 May 2020, https://www.ga4gh.org/news/ga4gh-gdpr-brief-the-finnish-secondary- use-act-2019-may-2020-bonus-brief/ .  UK Information Commissioner’s Office, Overview ‘ Lawful Basis for Processing ’, https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation- gdpr/lawful-basis-for-processing/ .  UK Medical Research Council, ‘GDPR: Answers to some frequently asked questions (FAQs) - Can I share data with colleagues now that GDPR is in force?’, http://www.highlights.rsc.mrc.ac.uk/GDPR/share.html .  UK Medical Research Council, ‘ Guidance Note 3, General Data Protection Regulation (GDPR): Consent in Research and Confidentiality ’, March 2018, as updated in March 2019, https://mrc.ukri.org/research/facilities-and-resources-for-researchers/regulatory-support-centre/gdpr- resources/ .  UK Health Research Authority, ‘Safeguards’ [webpage], last updated in 2018, https://www.hra.nhs.uk/planning-and-improving-research/policies-standards-legislation/data-protection-and- information-governance/gdpr-detailed-guidance/safeguards/ .  UK Health Research Authority, ‘Transparency’ [webpage], last updated in 2018, https://www.hra.nhs.uk/planning-and-improving-research/policies-standards-legislation/data-protection-and- information-governance/gdpr-detailed-guidance/transparency/ .  UK Secretary of State for Health and Social Care, Decision ‘ Coronavirus (COVID-19): notice under Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research ANNEX 5 - ENDNOTES 1 For the purposes of this report, we use uniformly ‘secondary use’ understood as ‘re-use of personal data for a new purpose’, but we acknowledge that the GDPR employs the term ‘further processing’. See also the discussion in Section 4.2.2.2 on primary versus secondary use of personal data. 2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, (OJ L 119, 4.5.2016, p. 1-88). 3 I n this report, the term ‘health data’ is used to mean ‘data concerning health’ rather than ‘medical data’ the latter having a more narrow scope. On these concepts, see EDPS, Guidelines concerning the processing of health data in the workplace by Community institutions and bodies, 28 September 2009. 4 This question raises precisely because the GDPR contains specific principles, provisions, and possibilities of derogations for scientific research. 5 This priority was mentioned in European Commission, COM(2020) 264 final, Communication from the Commission to the European Parliament and the Council on Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition - two years of application of the General Data Protection Regulation, p. 2. This does not mean however that this topic is not discussed herein: e.g., see the new Finnish Act on the Secondary Use of Health and Social Data (552/2019), which entered into force on May 1, 2019, available at the Finnish Ministry of Social Affairs and Health, Secondary use of health and social data, available at: https://stm.fi/en/secondary-use-of-health-and-social-data, which regulates re-use of personal data in public databases for described purposes, such as knowledge management. 6 See e.g. examples from Estonia (Section 5.2.2) and Finland (Section 5.3.4). 7 This distinction was affirmed by the EDPB in European Data Protection Board, Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR), 23 January 2019. 8 See Verhenneman, G., ‘ The patient's right to privacy and autonomy against a changing healthcare model: assessing informed consent, anonymisation and purpose limitation in light of e-health and personalised healthcare’ , PhD dissertation, KU Leuven Faculty of Law, 2020, p. 206 and 224. 9 We focused on several key documents, however other conventions and recommendations of special importance must also be mentioned, in particular Council of Europe, Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine: Convention on Human Rights and Biomedicine (Oviedo Convention), ETS No 164, and its Additional protocol on Biomedical Research (2005) and Council of Europe, Recommendation No R (97) 18 of the Committee of Ministers to member States, concerning the protection of personal data collected and processed for statistical purposes. 10 Council of Europe, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ETS No 108.

Council of Europe, Modernised Convention for the Protection of Individuals with Regard to the Processing of Personal Data, ETS No. 108 +.

Council of Europe, Explanatory Report to Modernised Convention for the Protection of Individuals with Regard to the Processing of Personal Data, ETS No. 108 +, p. 20, n°43.

Id . See also Council of Europe, Explanatory Memorandum to Recommendation No. R (97) 18 of the Committee of Ministers to member States, concerning the protection of personal data collected and processed for statistical purposes, para. 11 and 14.

Convention 108+ slightly changed the wording of Article 5.

Council of Europe, Committee of Ministers Recommendation No. R (81) 1 on Regulations for automated medical data banks, (‘Rec(81)1’ or ‘CoE, Rec(81)1’).

Article 5(4) of CoE Recommendation (81) 1 states: “ Without the data subject's express and informed consent, the existence and content of his medical record may not be communicated to persons or bodies outside the fields of medical care, public health or medical research, unless such a communication is permitted by the rules on medical professional secrecy. ”

Article 5(4) of CoE Recommendation (81) 1.

Council of Europe, Recommendation No. R (97) 5 of the Committee of Ministers to member States on the protection of medical data.

See Section 12(2), which points to these legal bases for use of medical data for scientific research, if not anonymous, as secondary purpose.

Clearly, a need was felt to distinguish scientific research by the treating physician from scientific research by others. A possible explanation may be that this is an indication for what, at that time, were considered reasonable expectations from the data subjects as compatible use and purposes. By allowing the further use of data by the treating physician on the condition that the data subject was informed and had the possibility to opt-out, it was encoded in law that this was considered standard practice and not interfering in the relationship of trust between the treating physician and the patient, and provided as such a Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research legal basis. Apparently, one felt that the same assumption could not be made when the data were shared with others since for this scenario additional safeguards were included.

Both the profession of healthcare practitioner and of researcher has changed since in both professions multidisciplinary teamwork has become increasingly important.

World Medical Association, Declaration of Helsinki – Ethical Principles for Medical Research Involving Human Subjects, June 1964.

The interests of and respect for the individual are the cornerstones, as well as the right to self-determination and right of the individual to make informed decisions in relation to research. (Articles 8, 9 and 26 Declaration of Helsinki ). Medical research is also required to meet certain standards of quality and publicity (Articles 21-22 Declaration of Helsinki).

Article 6 of the Declaration of Helsinki: “ [...] to understand the causes, development and effects of diseases and improve preventive, diagnostic and therapeutic interventions (methods, procedures and treatments). Even the best proven interventions must be evaluated continually through research for their safety, effectiveness, efficiency, accessibility and quality”.

One could also ask whether the GDPR rules on consent will have an influence on the interpretation of consent under e.g., the Declaration of Helsinki.

World Medical Association, Declaration of Taipei - Research on Health Databases, Big Data and Biobanks, October 2002.

See also Duguet, A., and Herveg, J., ‘Safeguards and derogations relating to processing for scientific purposes: Article 89 analysis for biobank research’, in Slokenberga, S., Tzortzatou, O., Reichel Jane (eds), GDPR and Biobanking , Springer, 2021. According to Duguet and Herveg, the OECD “ gives priority to facilitating research with biobanks, while the rights of the subjects involved are secondary and in accordance with national legislation ”.

Act of 19 December 2008 regarding the procurement and use of human bodily material destined for human medical applications or for scientific research.

Article 29 Data Protection Working Party, Guidelines on consent under Regulation 2016/679, 17/EN, WP 259 rev.01, 28 November 2017, as revised on 10 April 2018. This reference has been mentioned in European Data Protection Board, Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak, 21 April 2020.

European Data Protection Supervisor, A Preliminary Opinion on data protection and scientific research, 6 January 2020 , p. 12.

Foundation Federation of Dutch Medical Scientific Societies (Federa),’Self-regulatory code of conduct for Observational Research with personal data (Gedragscode Gezondheidsonderzoek, 2004)’.

See sec. 2 of the Finnish Act on the Secondary Use of Health and Social Data. See also below. Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research

Regulation (EU) No 536/2014 (Clinical Trials Regulation) is expected to come into application in 2022. The timing depends on confirmation of full functionality of the Clinical Trials Information System (CTIS) through an independent audit (scheduled to commence in December 2020), and Clinical Trials Regulation will become applicable six months after the European Commission publishes notice of this confirmation. For more information, see European Medicines Agency, Clinical Trial Regulation - Clinical Trials Information System development . The term of investigator is used to designate the responsible individual for the conduct of a CT at a clinical trial site (Article 2(15)), while sponsor is the individual, company, institution or organisation which takes responsibility for the initiation, for the management and for setting up the financing of the clinical trials (Article 2(14)). Recital 81 also refers to ‘non-commercial sponsors’, relying on funding ‘which comes partly or entirely from public funds or charities’ and the need to stimulate their research.

See Article 28(1)(c) and Articles 28-32 Clinical Trials Regulation .

Recital 29 and Article 28(2) al. 2 Clinical Trials Regulation .

These are in particular regarding the choice of legal basis, the distinction between consent for participation in research and consent as one of the lawful grounds for processing of data, and the differentiation between primary and secondary use of clinical trial data. This occupies a prominent part of the scholarly debate. See e.g. Van Veen, E., ‘Observational health research in Europe: understanding the General Data Protection Regulation and underlying debate’, European Journal of Cancer , vol. 104, 2018, p. 70-80; Negrouk, A., Lacombe, D., ‘Does GDPR harm or benefit research participants? An EORTC point of view’, The Lancet Oncology , Vol. 19 No. 10, 2018, p.1278-1280; Demotes-Mainard, J, Cornu, C., Guérin , A., ‘How the new European data protection regulation affects clinical research and recommendations’, Therapies , Vol. 74, No. 1, 2019; Ienca, M., Scheibner, J., Ferreti, A., Gille, F., Amann, J., Sleigh. J., Blasimme, A., Vayena, E., ‘ How the General Data Protection Regulation changes the rules for scientific research’ , Study for the European Parliament Panel for the Future of Science and Technology, Brussels, 2019; Minssen, T., Rajam, N., Bogers, M., ‘Clinical Trial Data Transparency and GDPR Compliance: Implications for Data Sharing and Open Innovation’, Science and Public Policy , 2020, p.1-11.

In the research community, however, there is still uncertainty as to how to comply with these two pieces of legislation, especially when it comes to secondary use of personal data. See e.g. Peloquin, D., Di Maio, M., Bierer, B., ‘Disruptive and avoidable: GDPR challenges to secondary research uses of data’, European Journal of Human Genetics , Vol. 28, 2020, p.697- 705; Aymé, S., ‘Enforcement of a new data protection law in Europe: A threat and an opportunity for registries and cohorts in the field of rare diseases’, La Revue de Médecine Interne , Vol. 39, No. 10, 2018, p. 769-771; Wierda, E., Eindhoven, D.C., Schalij, M.J., Borleffs, C.J.W., van Veghel, D., Michell, C.R., de Mol, B.A.J.M., Hirsch, A., Ploem., M.C., ‘Privacy of patient data in quality-of-care registries in cardiology and cardiothoracic surgery: the impact of the new general data protection regulation EU-law’, European Heart Journal – Quality of Care and Clinical Outcomes , Vol. 4, No. 4, 2018, p. 239-245; Kerr, D.J., ‘Policy: EU data protection regulation - harming cancer research’, Nature Reviews Clinical Oncology , Vol. 11, 2014, p. 563-564; Andersen, M.R., Storm, H.H. (on behalf of the Eurocourse Work Package 2 Group), ‘Cancer registration, public health and the reform of the European data protection framework: Abandoning or improving European public health research?’, European Journal of Cancer , Vol. 51, No. 9, 2015, p. 1028-1038.

EDPS, A Preliminary Opinion on data protection and scientific research , p. 35.

Until recently, biobanks in Denmark were governed by a complex and rather unique system construed by data protection legislation, ethics review, and legal rules pertaining to patients’ rights, see Hartlev, M., ‘Genomic Databases and Biobanks in Denmark’, The Journal of Law, Medicine and Ethics , Vol. 43, No. 4, 2015, p. 743-753 .

In Bulgaria, a patchwork of provisions applies to biobanking in Bulgaria: Art. 141-144 (concerning genetic laboratories) of the Health Act (2004), the Protection against Discrimination Act (2003), the Law on Transplantation of Organs, Tissues and Cells (2004), from which scope the use of organs for research purposes is excluded (Article 1), a number of Ordinances that Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research further implement the Law on Transplantation, general administrative and civil law provisions (concerning biobank custodianship) and finally, the ethical framework (soft-law).

Article 1 of Directive 2004/23/EC.

See e.g. the Belgian Act on Human Body Material (19 December 2008) which is intended, inter alia, to implement the Directives, but which also includes scientific research purposes in its scope.

We should regret that some guidelines has put forward that, when processing special categories of data, the data controller must combine Articles 6 and 9 This does not look compliant with the economy of the GDPR that makes a clear distinction between the ‘normal’ data and the ones from special categories. Requesting that the controller must find a lawful base in Article 6 and then in Article 9 is a not adequate. GDPR sets two categories of data with lawful grounds each. This is obvious when we compare the various grounds which are crossing each other's. This shows they do not need to be overlaid. It is one article or the other. The only reason to overlay the two articles may lie in the fact that Article 2(i) provides for the right to affix the stamp only for processing operations carried out on the basis of Article 6(1)(e) or (f). But can we legally twist the principles of the GDPR to correct a legislative error. Instead, it would be preferable to alert the legislature to fix this error as it has done since 2016.

EDPB Opinion 3/2019, p. 5, European Commission, DG for Health and Food Safety, Question and Answers on the interplay between the Clinical Trials Regulation and the General Data Protection Regulation, Question 4 The EDPS also asserted the logic shared by EDPB and the Commission but further acknowledged that the conditions under which IC for participation in research might be deemed an appropriate safeguard are still unclear: EDPS, A Preliminary Opinion on data protection and scientific research, p. 19. Moreover, the EDPS concluded that the notion of consent in the two areas requires further discussion between the research community and data protection experts.

Article 8, 22 Aout 2002, Loi relative aux droits du patient .

Defined in EDPB Opinion 3/2019, as processing operations relating to a specific CT, from the ‘starting of the trial to deletion at the end of the archiving period’ (Article 7). Note, that at the same time, consent is not excluded.

See Article 58 Clinical Trials Regulation concerning obligations to archive the clinical trial master file for 25 years.

In particular, Verhenneman argues that informed consent may not be the preferred legal basis when (i) there is lack of freedom (e.g. when signing informed consent for the processing of personal data is a by-product of a service, such as the ability to receive the newest treatment available through the participation in a clinical trial); (ii) there is a lack of information or understanding (e.g. through the use of complicated and very long informed consent documents); (iii) there is lack of specificity (e.g. by considering informed consent as a general waiver to use and secondary use of personal data). See Verhennenman, G., 2020, p. 169, and also p. 110-173.

See e.g., Kamenjasevic, E., ‘ Health data for scientific research under the CoE Recommendation and the GDPR – Part II’ , Blog of KU Leuven’s Centre for IT&IP Law, 2019 .

Ienca, M., et al., 2019. Authors of a stakeholder advisory opinion prepared for an ISC seminar expressed a similar view: ISC Intelligence, ‘The Application of GDPR to Biomedical Research: Stakeholder Advisory Opinion to Assist Regulators, Prepared for the ISC Seminar on Challenges for Health Research Arising from the GDPR’, 19 November 2019, p. 8: “Moreover, the EDPB’s guidance that consent for data processing is not “freely given” in the context of a clinical trial is at odds with standard practice in research ethics, including the Declaration of Helsinki, and the EU’s own Clinical Trials Regulation, both of which typically require obtaining the voluntary consent of research subjects before enrolling them in a clinical trial. The EDPB has never explained why it believes that a research subject’s consent to the processing of personal data in connection with a clinical trial cannot be freely given, whereas consent to participate in the clinical trial itself can be freely given. It is curious for the EDPB to conclude, apparently, that a research subject can consent to receive an investigational medicinal product of unknown safety and efficacy but that another basis for data processing is recommended because of concerns that consent may not be freely given.” ISC is an advisory firm specializing in science, technology and R&D research and policy. They provide intelligence on science and innovation policy and programmes. See more at: http://iscintelligence.com/aboutisc.php . Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research

See Vanden Heede, E., ‘ GDPR Application in Patient Preference Studies ’, Master thesis for Intellectual Property and ICT Law under supervision of Prof. Huys, I., p. 23-27. Patient preferences “reflect why patients choose a particular health intervention over other available options. This health treatment can be a drug or a medical device. A preference can be stated for a health intervention as a whole or for the advantages and disadvantages of one intervention. In order to make a choice or state a preference, patients need to weigh up the advantages and disadvantages and compare them to those of other health interventions.”, see Huys, I, ‘ Integrating patient preferences in the drug life cycle ’, Presentation for the Patient Preferences in Benefit-Risk Assessments during the Drug Life Cycle (PREFER).

Quinn, P., Quinn, L., ‘Big genetic data and its big data protection challenges’, Computer Law & Security Review , Vol. 34, No. 5, 2018, p. 1000-1018 (‘Quin & Quin Big Genetic Data 2018’).

See e.g. Dove, E., ‘The EU General Data Protection Regulation: Implications for International Scientific Research in the Digital Era’, The Journal of Law Medicine and Ethics , Vol. 46, No. 4, 2018, p. 1013-1030; Verhenneman, G., Claes, K., Derèze, J.J., Herijgers, P., Mathieu, C., Rezda, R., Vanautgarden, M., ‘ How GDPR Enhances Transparency and Fosters Pseudonymisation in Academic Medical Research’, European Journal of Health Law , Vol. 27(1), Brill and Nijhoff, 2019, p. 40; Quinn, P., ‘The Anonymisation of Research Data — A Pyric Victory for Privacy that Should Not Be Pushed Too Hard by the eu Data Protection Framework?’, European Journal of Health Law , Vol. 24, No. 4, 2017, p. 347-367; van Veen, E., 2018. S ee also Quinn and Quinn arguing that Consent is not the most reliable option for researchers, especially ones working with Big Data: Quinn, P. & Quinn L., 2018, p. 1013.

D Hallinan, D., ‘Broad consent under the GDPR: an optimistic perspective on a bright future’, Life Sciences, Society and Policy , Vol. 16, Springer, 2020, p. 11.

This is because of 1) the lack of harmonized approach nationally (e.g., if a trial is open in Germany, it would be easier to use consent as a basis everywhere) (see also below), and 2) because they have been using consent for more than 70 years as the standard. On the other hand, and at the same time, it was also shared that there are companies (referred to as “early adopters”), who have started trying to follow the line of the EDPB, but with difficulties. Moreover, in practice, and especially for patients, it is very hard to distinguish between the two types of consent in practice, which leads to a lot of confusion. See the Webinar, Gene, A., Long, W., Webinar ‘Clinical Trials and GDPR – State of play’ , Drug Information Association (DIA), 10 July 2019. Cole and Towse also argue and assume that pharmaceutical companies would look to their process of obtaining consent as a way to explicitly set out and gain “permission” for all data processing activities. However, they rightfully argue that this may put companies in a more risky position, as achieving the high standards set in the data protection legislation would be difficult in a research context (whether commercial or public), and it implies that no other legitimate basis for using the data is available. See Cole, A. and Towse, A., ‘Legal Barriers to the Better Use of Health Data to Deliver Pharmaceutical Innovation’, OHE Consulting Report , 23 (2018), Office of Health Economic, London, 2018, p. 21.

In particular, the Council of Europe recommendations which were discussed in Section 3.1 of this report, and specifically CoE Recommendation (81)1 on medical databanks, CoE CM/Rec (2019)2 on protection of health-related data, and CoE Recommendation 2016(6) on research on biological materials of human origin.

For primary genetic testing for scientific purposes (Article 16-10 of the Civil Code and Article 76 Loi Informatique et Libertés – LIL , French data protection act). Consent provided in these situations covers the necessary processing of personal health data related to the purpose of the research at the exclusion of processing made mandatory by law such as for obtaining drug marketing authorisation with competent authorities relying on the legal obligation of data controller and/or on the pursuit of a public interest purpose. Article 76 LIL requiring consent prior to genetic examination for research purposes does not apply to researches performed on the basis of already obtained biological samples in the respect of Article L.1131-1-1 PHC.

The Italian data protection act (PDPC) sets two key provisions concerning the legal basis for processing special categories of personal data for scientific research. According to the PDPC, consent as a legal basis for scientific research, is required mainly in two cases: (i) When data concerning health are processed for research purposes in the medical, biomedical and epidemiological field (Article 110 PDPC). In such cases, consent is the legal basis that applies, unless laws or regulations pursuant to Article 9(2)(i) GDPR apply, or when the data processing is carried out within the framework of a national research programme pursuing to Leg. Decr. 502/1990; (ii) When genetic data are processed for research purposes. Section 2(f)(6) PDPC (Safeguards applying to the processing of genetic data, biometric data, and data relating to health) does not require consent as such, i.e. as a default rule for processing genetic data, however the article foresees that the Italian SA may set additional measures, including consent. Following this article, and other relevant rules, the Italian SA, has foreseen additional measures including consent, via decisions and guidelines.

Norms related to the implementation of the rules of good practice in conducting clinical trials performed with drugs for human use, Approved by Decree of the Ministry of Health No. 904/25.07.2006, available at http://www.scumc.ro/LegisDir/42.%20Ordin%20904%20din%202006.pdf. Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research

For instance, one stakeholder in clinical research (EORTC) recently stated that their preferred legal basis is Article 6(1)(f) in conjunction with Article 9(2)(j) GDPR. European Organisation for Research and Treatment of Cancer , EORTC Contribution to the EMA Discussion Paper for Medicines Developers, Data Providers, Research-Performing and Research-Supporting Infrastructures entitled “The General Data Protection Regulation: Secondary Use of Data for Medicines and Public Health Purposes Discussion Paper for Medicines Developers, Data Providers, Research-Performing and Research-Supporting Infrastructures” , 10 July 2020.

Moreover, the same provides that the legal basis may contain specific provisions related to different elements (lawfulness conditions, types of data to be processed, concerned data subjects, purpose limitation, storage periods). See e.g., Finland, where scientific research is recognised under Article 6(1)(e) GDPR: Section 4, Finnish Data Protection Act, available at: https://www.finlex.fi/en/laki/kaannokset/2018/en20181050.pdf.

Kotschy, W., ‘Article 6 Lawfulness of processing’, in Kuner, C., A. Bygrave, L., Docksey, C., (eds.), The EU General Data Protection Regulation (GDPR). A commentary , Oxford University Press 2020, p. 335.

Kramer, P., 'Article 6, Rechtmäßigkeit der Verarbeitung‘, in Auernhammer, H., Eßer, M., Kramer, P., von Lewinski, K., (eds.), Auernhammer DSGVO/BDSG , 5th ed., Carl Heymanns Verlag, Cologne, 2017, as cited in Kotschy, W., 2020.

Article 4(23) GDPR.

The same would apply to relying on Article 9(2)(i) GDPR, necessity for reasons of public interest in the area of public health. This exception is a narrow one, and best suited for public health authorities, NGOs, entities working in areas such as disaster relief and humanitarian aid. See also Georgieva, L., and Kuner, C., ‘Article 9 Processing of special categories of personal data” in Kuner, C., A. Bygrave, L., Docksey C., (eds.), The EU General Data Protection Regulation (GDPR). A commentary , Oxford University Press 2020, p. 380.

In particular, the Council of Europe recommendations which were discussed in Section 3.1 of this report, and specifically CoE Recommendation (81)1 on medical databanks, CoE CM/Rec (2019)2 on protection of health-related data, and CoE Recommendation 2016(6) on research on biological materials of human origin.

In support of this conclusion, see the UK Medical Research Council which previously identified this legal basis as the one that UK public bodies (universities, NHS, research councils) are most likely to rely on: see UK Medical Research Council, ‘ Guidance Note 3, General Data Protection Regulation (GDPR): Consent in Research and Confidentiality ’, March 2018, as updated in March 2019.

See last sentence of Article 6(1) and Recital 47 of the GDPR.

Kotschy, W., 2020, p. 337. H ence only a commercial interest would not suffice. Potential sources of legitimate interests are the fundamental rights and freedoms recognized in the Charter of Fundamental Rights of the EU, and examples are also provided in the GDPR recitals.

Article 29 Data Protection Working Party, Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, 844/14/EN, WP 217, 9 April 2014. According to Shabani and Borry, Recitals 47 and 113 provide grounds in support of this understanding, see Shabani, M., Borry, P., ‘Rules for processing genetic data for research purposes in view of the new EU General Dat Protection Regulation’, European Journal of Human Genetics , Vol. 26, No. 2, 2018. p. 149-156 .

See Article 29 WP Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, p. 33. These criteria are a) assessing the controller’s legitimate interests, b) impact on the data subjects, c) provisional balance, and d) additional safeguards applied by the controller to prevent any undue impact on the data subjects.

About this recital and the balancing test, see also Ducato. R., ‘Data protection, scientific research, and the role of information’ (CRIDES Working Paper Series no. 1/2020), Computar Law and Security Review , 2020 .

In particular, the Council of Europe recommendations which were discussed in Section 3.1 of this report, and specifically CoE Recommendation (81)1 on medical databanks, CoE CM/Rec (2019)2 on protection of health-related data, and CoE Recommendation 2016(6) on research on biological materials of human origin.

Principle 2(3) of the International Council on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use (ICH) Guideline forGood Clinical Practice E6 (R2), available at: https://www.ema.europa.eu/en/ich-e6-r2- good-clinical-practice . See also e.g. Article 3 of the Additional Protocol to the CoE Convention 164 (Oviedo Convention, 1997) , concerning Biomedical research.

See European Data Protection Board, Guidelines 3/2019 on processing of personal data through video devices, 10 July 2019, p. 10-11. This intensity can, inter alia, be defined by: the type of information that is gathered (information content), the scope (information density), the number of the data subjects concerned, the situation in question, the actual interests of the group of data subjects, alternative means and the nature and the scope of the data assessment.

Concerning the compatibility assessment in Article 6(4) GDPR, Recital 50 specifically mentions ‘ the reasonable expectations of data subjects based on their relationship with the controller as to their further use’ , thus establishing a direct link. Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research

EDPB Opinion 3/2019, p. 5. The WP29 also previously clarified that Article 6 and Article 9 should be applied cumulatively, see Article 29 Data Protection Working Party advice on Agreement between National Authorities or National Organisations responsible for National Contact Points for eHealth on the Criteria required for the participation in Cross-Border eHealth Information Services, Brussels, 11 th April 2018, p. 2-3.

Scholars in Bulgaria and Italy view Article 9 GDPR as the sole legal basis required. See Toshkova-Nikolova, D., Feti, N., Защита на личните данни [Protection of personal data], ИК Труд и Право [Publishing House Trud i Pravo], 2019 ; see the national input for Italy for this study.

Slovakia, Office for Personal Data Protection, Guidelines 2/2018 .

According to Hallinan, the concept is comparable to ‘important’ public interest for which jurisprudence is available (Hallinan, D., 2020, p. 6, fn. 8). WP29 has previously observed that the latter notion should be given a ‘restrictive interpretation’ and should refer to processing which is necessary and identified ad an important public interest by national legislation (Article 29 Data Protection Working Party, Working document on a common interpretation of Article 26(1) of Directive 5/46/EC of 24 October 1995, 2093/05/EN, WP 114, 25 November 2005, p. 14-15). According to the Meszaros & Ho order of the levels of public interest, the ‘substantial’ under 9(2)(g) GDPR is the highest level of public interest referred to under GDPR (Mészáros, J., Ho, C., ‘Big Data and Scientific Research: The Secondary Use of Personal Data under the Research Exemption in the GDPR’, Hungarian Journal of Legal Studies , Vol. 59, No. 4, 2018, p. 408). To our knowledge, the provision is implemented in France, see Article 44(6) Loi Informatique et Libertés (LIL) regarding necessary processing performed for public research purposes (as defined under Article L. 112-1 of the Code of Research) and answering to important reasons of public interest on the basis of Art.9(2)(g) GDPR.

The processing must: concern scientific research purposes; be based on and in compliance with Union or Member State law; be proportionate, i.e. the data must be processed only so far as strictly necessary; respect the essence of the right to data protection; provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject. The law does not specify what those safeguards must be. In the lack of specifity, Georgieva and Kuner find that controllers and processors have to design safeguards based on the data protection principles (e.g. proportionality, data minimization). Examples include encryption, minimizing the amount of sensitive data processed, training staff who handle personal data and placing them under a duty of confidentiality. (See Georgieva, L. and Kuner, C., 2020, p. 380).

Hallinan, D., Feeding biobanks with genetic data. What role can the general data protection regulation play in the protection of genetic privacy in research biobanking in the EU? , VUB Doctoral Thesis, Brussels, 2018, p. 323.

Article 25(m) of the Personal Data Protection Act (PDPA). The PDPA is available in English at: https://www.cpdp.bg/en/index.php?p=element&aid=1194 .

Article 10 of Act No. 502 of 23 May 2018 on supplementary provisions to the regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Article 9(2)(j) GDPR is provided with national legislative support in the new national data protection act implementing the GDPR - BDSG. Conditions legitimating the use of Article 9(2)(j) GDPR are generally outlined in Article 27. Article 27 then points to Article 22(2)(2) which provides a – non-exhaustive – list of safeguards a data controller should implement to protect the rights and freedoms of data subjects. The provisions outlined in Articles 27 and 22, however, are not particularly specific in relation to research or indeed in relation to any types of data processing activity. In this regard, there remain questions as to the degree to which these Articles, alone, fulfil the requirements of Article 9(2)(j) GDPR – in particular as this requires: “ Union or Member State law…[to] provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”.

Law 4624/2019, Article 30: Processing of special categories of personal data is allowed without data subject’s consent when it is necessary for, inter alia, scientific research purposes and the data controller’s interest overrides the data subject’s interest in not having their personal data processed. The article demands that suitable, specific safeguards should be set in place to protect data subjects’ legitimate interests and provides indicative examples.

Amendment of the 2011 CXII. Law on the Right to Self-Determination of Information and Freedom of Information was accepted on 16th of July 2018 by the Hungarian Parliament (2011. évi CXII. Törvény az információs önrendelkezési jogról és az információszabadságról), available at: https://www.parlament.hu/irom41/00623/00623-0008.pdf . Article 3(7) contains a reference to explicit consent and Article 5 provides a lawful ground for (i) personal data and (ii) sensitive data processing (including) in the context of scientific research.

Article 25 (2) and (3) of the Latvian Data Protection Law (PDPL), available at: https://likumi.lv/ta/id/300099#p32 . This PDPL provision requires consent for data processing in all cases, also for the purposes of scientific research. Secondary use of data is allowed if there are legal grounds for that as per the GDPR (inter alia, consent), or it must be compatible with the original processing purpose. Article 10(7) on the law of patients data, available at: https://likumi.lv/ta/en/en/id/203008-law-on-the- rights-of-patients . The Law on Patients’ Rights allows the secondary use of patient data for research purposes where: (i) the patient cannot be directly or indirectly identified according to the information to be analysed; or (ii) the patient has consented in writing that the information regarding him or her may be used in a specific research, or (iii) permission to process patient Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research data is granted in a special procedure by a competent authority. It is important to note that although Article 25(2) states that processing of special categories of data is possible if at least one of the grounds referred to in Article 9(2) GDPR exists, including Article 9(2)(j) GDPR, Latvian law does not provide safeguards relating to processing of personal data for scientific purposes as required under Article 89(1) of the GDPR.

Article 31(4) of Law 58/2019 ensuring execution, in the national legal order, of Regulation (EU) 2016/679.

Article 8, Paragraphs 1, 3 and 4 of the Law No. 190/2018 on implementing measures of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, available at: https://lege5.ro/Gratuit/gi4dsnjugi2q/legea-nr-190- 2018-privind-masuri-de-punere-in-aplicare-a-regulamentului-ue-2016-679-al-parlamentului-european-si-al-consiliului-din- 27-aprilie-2016-privind-protectia-persoanelor-fizice-in-ceea-ce-priv . Article 346, Paragraphs 1 and 4 of the Law No. 95/2006 on health care reform ( Legea nr. 95/2006 privind reforma în domeniul sănătății ), 1 May 2006, available at: https://lege5.ro/App/Document/g42tmnjsgi/legea-nr-95-2006-privind-reforma-in-domeniul- sanatatii?d=22.04.2020&forma=zi .

Article 16, a and k Data Protection Act, available at: https://www.zakonypreludi.sk/zz/2018-18 .The article stipules the situation when the prohibition of the processing of special categories of personal data shall not apply if: (a) the data subject has given explicit consent to the processing of those personal data; (k) processing is necessary for archiving purposes, for scientific purposes, for historical research purposes or for statistical purposes pursuant to this Act.

Article 110 of the Italian PDPC can be considered an implementation of Article 9(2)(j) GDPR.

Article 9(2)(j) GDPR has been implemented via the UK Data Protection Act 2018. Paragraph 4 of Schedule 1 clarifies that the general prohibition on the use of sensitive data is lifted for the processing of sensitive data for scientific research purposes provided the conditions in Schedule 4, Part 1(4) of the Act are fulfilled. The conditions laid out in this Part, however are limited and, for the most part, simply mirror those in Article 89(1) GDPR. The Part does however, specifically require that research be: ‘in the public interest’. Part 2, Chapter 2, Section 19 also includes clarifications of circumstances which will not fulfil the requirements of Article 89(1) – including if processing “ is likely to cause substantial damage or substantial distress to a data subject ” or if it “ is carried out for the purposes of measures or decisions with respect to a particular data subject ”. The Act raises the same issues as (Germany) BDSG(neu). It is far from clear that the Act alone constitutes a law, according to Article 9(2)(j) GDPR, which provides “ suitable and specific measures to safeguard the fundamental rights and the interests of the data subject ”.

Article 10 of Act No. 502 of 23 May 2018 on supplementary provisions to the regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Section 6(3)-(6), Estonian Personal Data Protection Act Implementation Act, available at: https://www.riigiteataja.ee/en/eli/523012019001/consolide .

Health Research Act (Lov om medisinsk og helsefaglig forskning), available at: https://lovdata.no/dokument/NL/lov/2008- 06-20-44 . Chapter 7, Sections 32 and 33: prior approval from the ethics committeeis deemed to be a necessary and adequate legal basis to process personal health data in medical and health research.

Autoriteit Persoonsgegevens, Handleiding Algemene verordening gegevensbescherming en Uitvoeringswet Algemene verordening gegevensbescherming , 2018, 43, available at: https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/handleidingalgemeneverordeninggegevensbescherming.pd f . “Bijzondere categorieën van persoonsgegevens mogen worden verwerkt als dit noodzakelijk is voor wetenschappelijk of historisch onderzoek of statistische doeleinden. Dit mag echter alleen als het onderzoek een algemeen belang dient, het vragen van uitdrukkelijke toestemming onmogelijk blijkt en voldoende waarborgen zijn getroffen om zo min mogelijk risico’s voor de persoonlijke levenssfeer van de betrokkene te creëren”.

For instance, the authors of a report prepared for the European Parliament’s STOA panel strongly recommended that ethics committees should help guiding the development of organizational strategies for when to rely on different grounds of lawful processing (see Ienca, M., et al., 2019, p. 33). Verhenemman et al. also stressed the importance of ethics committee reviews as a good organizational measure to protect data subjects in research. The UZ Leuven GDPR compliance policy implemented independent ethics review as a general measure applicable to all research projects (see Verhenneman et al., 2019). Moreover, Verhenneman et al. opine that an ethics review can assess claims about the use of anonymization techniques . This stance comes at odds with the opinions of other researchers.

Chapter 2, Paragraph 6(2) of the Personal Data Protection Act, available in English at: https://www.riigiteataja.ee/en/eli/523012019001/consolide .

Section 110 of the Italian Personal Data Protection Code.

Article 24 GDPR. Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research

Principle 2.3 of the International Council on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use (ICH) Guideline forGood Clinical Practice E6 (R2), available at: https://www.ema.europa.eu/en/ich-e6-r2- good-clinical-practice ., also e.g. Article 3 of the Additional Protocol to the Convention on Human Rights and Biomedicine (Oviedo Convention), concerning Biomedical research.

Crucial exception in the view of Borgesius and Hallinan is the case Österreichischer Rundfunk, in which the court found that national law derogating from the purpose limitation principle is permissible only if the derogation and the secondary processing are proportionate to the aims it intends to achieve. See C-465/00, C-138/01 and C-139/01 Rechnungshof (C-465/00) and Österreichischer Rundfunk, Wirtschaftskammer Steiermark, Marktgemeinde Kaltenleutgeben, L and Niederösterreich, Österreichische Nationalbank, Stadt Wiener Neustadt, Austrian Airlines, Österreichische Luftverkehrs-AG , and between Christa Neukomm (C-138/01), Joseph Lauermann (C-139/01) and Österreichischer Rundfunk , [2003], para. 59 See also Kostadinova, Z., ‘Purpose limitation under the GDPR: can Article 6(4) be automated?’, Tilburg University Master Thesis, p. 51-59. The author concluded that the CJEU has not assessed (so far) further processing directly, but it has acknowledged that processing of personal data has to comply with the purpose limitation principle. Furthermore, the CJEU has not yet provided additional knowledge on how to interpret Article 6(4) GDPR. See also Kostadinova, p. 60 for a summary of knowledged obtained from case law on processing of personal data.

Recital 33 has several areas of uncertainty, as outlined by Hallinan. First, the concept ‘certain areas of research’ could be interpreted both narrowly (e.g. only specific types of genomic research, cancer research etc), or broadly (e.g. all types of biological research). Second, it is unclear to which ‘ethical standards’ the recital refers: national instruments governing research, international standards, or standards imposed by ethics committees. Finally, ‘to the extent allowed by the intended purposes’ may be interpreted narrowly (consent can be given only to the narrowest possible use of data), or broadly (data subjects may be given a range of choices of consent options: from narrowest possible use to broader formulations). Hallinan, D., 2018, p. 387-388.

Article 29 Working Party, Guidelines on consent under Regulation 2016/679, 2017, p. 28.

European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, Version 1.1, 4 May 2020, p. 30-31.

In the explanatory memorandum to the Belgian Law on the processing of personal data of 30 July 2018 (“ Wet betreffende de bescherming van natuurlijke personen met betrekking tot de verwerking van persoonsgegevens ”) it is noted that data controllers may use Recital 33 in the context of scientific research to for example request consent for “cancer research”, but not “research” or “medical research” (cf. input from Verhenneman, G.).

Department Guidelines on medical and health research ( Veileder til lov 20. juni 2008 nr. 44 om medisinsk og helsefaglig forskning ) clarify that broad consent cannot be given to “all medical research” or to “genetic research”. Rather, it should be possible to give a broad consent to, for example, cancer research or diabetes research, without the individual details required.

The Datenschutzkonferenz , in line with the Article 29 Working Party’s clarification on Recital 33, clarify that broad consent is only possible under certain conditions: (i) when the purpose of research really cannot be defined in advance; (ii) when specific measures to mitigate the lack of transparency which comes with broad consent are put in place; (iii) when measures to increase trust – such as ethics committee approval are in place and a consideration of whether granular consent approaches, such as dynamic consent, has been undertaken; and (iv) increased data security measures have been enacted. How far this recommendation will influence practice remains to be seen. Germany, Conference on Data Protection (Datenschutzkonferenz), ‘Beschluss der 97 Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder zu Auslegung des Begriffs „bestimmte Bereiche wissenschaftlicher Forschung“ im Erwägungsgrund 33 der DS-GVO‘, 2019.

Health Research Act ( Lov om medisinsk og helsefaglig forskning ), Chapter 4, Section 14: “ Research participants may consent to the use of their human biological material and health information for specific, broadly defined research purposes. The regional committee for medical and health research ethics may set conditions for the use of broad consent and may require the project manager to obtain new consent if the committee deems it necessary. Participants who have given broad consent are entitled to regular information about the project ”.

Article 31(4) of Law No. 58/2019 ensures execution, in the national legal order, of Regulation (EU) 2016/679.

Frunză, A., Sandu, A., ‘Ethical Acceptability of Using Generic Consent for Secondary Use of Data and Biological Samples in Medical Research’, Acta Bioethica,Vol. 23, No. 2, 2017, p. 289-299.

See the national input for France for this study. Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31-50).

Albeit with more precision by now referring to ‘archiving purposes in the public interest, scientific or historical research purposes or statistical purposes’: Art. 5(1)(b) GDPR. About the purpose limitation principle, see also: Zuiderveen Borgesius, F., Hallinan, D., ‘Article 5’, in Boehm, F., Cole, M., (eds), GDPR Commentary, Elgar, 2021 (forthcoming), (‘Zuiderveen and Hallinan, Article 5 (2021)’).

See also Recital 50 GDPR: “ [...] In any case, the application of the principles set out in this Regulation […] should be ensured […] ”. As to the information obligation, this is confirmed for ‘further processing’ in Article 13(3) GDPR.

Article 29 Data Protection, Working Party, Opinion 03/2013 on purpose limitation, 00569/13/EN, WP 203, 2 April 2013, (‘Article 29 WP, WP203’).

Article 29 WP, WP203, p. 21 and p. 28.

See the original formulation in the Directive 95/46/EC, Article 6(1)(b).

See also Recital 50. See also Article 6(4) GDPR, referring to Article 23(1) GDPR, but also allowing, however, national or Union law’s exceptions to the rights of data subjects, including in case of data breach, and Article 5 GDPR (including the purpose limitation principle).

Hence, the need for safeguards to be determined by national law, including e.g. anonymisation and pseudonimisation. See also Article 29 WP, WP203, p. 28 et seq..

Expectations of the data subjects remain crucial. See also Recital 47: “ The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing.” Note that both consent and Union or Member State law are exceptions to the requirement for compatibility: Recital 50, second paragraph and Article 6(4) GDPR. Interestingly, t he original Commission Proposal for the GDPR opened up the possibility for further processing for incompatible purposes much more widely, by proposing that further processing should be allowed if done by the same controller and provided that the controller’s or a third party’s legitimate interests prevailed over the data subject’s interests. This idea was heavily criticized (see and as discussed in de Terwangne, C., ‘Article 5 Principle relating to processing of personal data’, in Kuner, C., A. Bygrave, L., Docksey, C., (eds.), The EU General Data Protection Regulation (GDPR). A commentary, Oxford University Press 2020, p. 316). Recital 47 (see also below) could be a remnant.

See EDPB, Guidelines 4/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak, 21.4.2020, European Data Protection Board, Guidelines 4/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak, 21 April 2020, Article 21.

See also Recital 34 GDPR in this regard. In the case ECtHR, S. and Marper v. U.K. [GC], Applications No. 30562/04 and 30566/04, 4 December 2008 , the court clearly stated that ‘all three categories of the personal information retained by the authorities (… ) and cellular samples, constitute personal data within the meaning of the Data Protection Convention as they relate to identified or identifiable individuals.’ (emphasis added). The opponent, the U.K. government also clearly accepted that all three categories are ‘personal data’ within the meaning of the UK Data Protection Act in the hands of those who are able to identify the individual (§ 68). On this subject, see also Bygrave, L.A., ‘The Body as Data? Biobank Regulation via the ‘Back Foor’ of Data Protection Law’, Law, Innovation and Technology , Vol. 2, No. 1, 2010, p. 1-25, p. 3. The author states that it is not impossible to apply data protection legislation to biological material. He mentions the New South Wales Privacy and Personal Information Protection Act 1998, which defines ‘personal information’ as encompassing, inter alia, ‘body samples’ (section 4). He also refers to the discussion in Norway and to the report ALRC, Essentially Yours, 2003; see Bygrave, L.A., 2010, p. 1-25 and Kindt, E., Privacy and Data Protection Issues of Biometric Applications , Springer, 2013 , pp. 179-189.

Recital 34 GDPR defines genetic data as “ personal data relating to the inherited or acquired genetic characteristics of a natural person which result from the analysis of a biological sample from the natural person in question, in particular chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis, or from the analysis of another element enabling equivalent information to be obtained“.

In Germany: See, for example: Herbst, T., ‘Art. 5 Grundsätze für die Verarbeitung personenbezogener Daten’, in Kühling, J., Buchner B. (eds.), Datenschutz-Grundverordnung, Bundesdatenschutzgesetz: DS-GVO / BDSG , 228, Beck, 2018: a new legal basis is necessary; Reimer, P., ‘Artikel 5: Grundsätze für die Verarbeitung personenbezogener Daten’ in Sydow, G., (ed.), Europäische Datenschutzgrundverordnung: Handkommentar , Nomos, 2018, 326: no new legal basis is necessary; Germany, Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, Public Consultation on the theme: Anonymisierung unter der DSGVO unter besonderer Berücksichtigung der TK-Branche , 2020, p. 6-7: the original legal basis could serve as the basis for the secondary processing.

EDPS, A Preliminary Opinion on data protection and scientific research, p. 22-23.

European Medicines Agency (EMA), The General Data Protection Regulation: Secondary Use of Data for Medicines and Public Health Responses. Discussion Paper for Medicines Developers, Data Providers, Research-Performing and Research- Supporting Infrastructures , 2020, p. 9. The paper is part of a project conducted by EMA, in collaboration with the European Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research Commission. The project aims to develop “Questions and Answers (Q&As) on the GDPR and the Secondary Use of Data for Medicines and Public Health Purposes.” The discussion paper was sent to interested stakeholders who were invited to share their experience and questions on 9 key topic areas, namely secondary use of health data, legal basis, presumption of compatibility, pseudonymisation, data retention, transparency, data subjects' rights, registries, and international transfers.

Zuiderveen Borgesius, F., Hallinan, D., 2021. See further also Verhenneman, who stated that the “GDPR creates a favorable position for scientific research, not by excluding the requirement for a compatibility test, but by limiting the compatibility assessment to an assessment of the appropriate safeguards”: Verhennenman, G., et al., 2019, p. 40

See also, in the same sense, in particular for ‘medical research’, EDPB Guidelines 03/2020, p. 5.

E.g., in Finland (see also below). In Finland, for example, secondary purpose is therein defined as ‘the processing of personal data for a purpose other than the primary purpose’. Primary purpose is defined as referring to ‘the purpose for which the personal data was originally saved’: Sec.3(2) and (3) Finnish Act on Secondary Use of Health and Social Data (non-official English translation).

Law 4624/2019, Official Government Gazette A’ 137/29.08.2019, http://www.et.gr/idocs- nph/search/pdfViewerForm.html?args=5C7QrtC22wFqnM3eAbJzrXdtvSoClrL8WkQtR1OJjJd5MXD0LzQTLWPU9yLzB8 V68knBzLCmTXKaO6fpVZ6Lx9hLslJUqeiQFO1o1b-ZCxkj8oDGZfpPVRON0QvoraqawUQAslqKetE . See also EXPLANATORY MEMORANDUM to the Draft Law “Hellenic Data Protection Authority, Implementation Measures of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and Transposition into National Legislation of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016”. Note that the relevant provisions have been criticised by the Greek SA. Hellenic Data Protection Authority, ‘Opinion No. 1/2020.’

According to Article 22(4) of Legislative decree no 101 of 10 August 2018, the general authorisations referred to in Article 40 of the old PDPC are to be maintained for a transitional period.

UK Information Commissioner’s Office, Overview ‘ Lawful Basis for Processing ’.

UK Medical Research Council, ‘GDPR: Answers to some frequently asked questions (FAQs) - Can I share data with colleagues now that GDPR is in force?’.

Belgium, Bulgaria, Croatia, France, Hungary, Romania, Germany, Slovenia, Norway, Portugal. 243 2019 CXXIII. Act amending the LXXVI of 2014 Act and certain related legal provisions on Scientific Research, Development and Innovation – 2019 , évi CXXIII. törvé ny a tudományos kutatásról, fejlesztésről és innovációról szóló 2014. évi LXXVI. törvény és egyes kapcsolódó törvényi rendelkezések módosításáról , available at: https://mkogy.jogtar.hu/jogszabaly?docid=A1900123.TV .

See Act on the Secondary Use of Health and Social Data (552/2019), which entered into force on May 1, 2019, available at the Finnish Ministry of Social Affairs and Health, Secondary use of health and social data, https://stm.fi/en/secondary-use-of- health-and-social-data with short summary and link to the Act. The main objectives of the Act include the easier, secure and more efficient access and use of health and social care data for various secondary use purposes in the field of scientific research and statistics, besides other purposes such as ‘development and innovation activities’ and supervision and reporting, while guaranteeing the data subject’s legitimate expectations and rights and freedoms (Section1).

The data will only be provided via a secure information processing environment approved or provided by FinData (see Section 20 et seq. ), enabling remote access to the raw data, without downloading or export possibilities. Outside this Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research environment, only irreversibly aggregated data (done by FinData) may be processed. This approach has been criticized as possibly impeding (international) research initiatives: see Southerington, T., ‘GA4GH GDPR Brief: The Finnish Secondary Use Act 2019 (May 2020 Bonus Brief)’ [blog post], 21 May 2020. 254 “ Knowledge management refers to the processing of data carried out by a service provider in their customer, service and production processes for the purpose of supporting operations, production, financial control, management and decision- making” (Section 3(5)). See also Section 41.

World Medical Association, International Code of Medical Ethics , 1949, last amended in 2006: The Internaitonal Code of Medical Ethids of the World Medical Association was adopted by the 3d WMA General Assembly in October 1949, and last amended by the 57 th WMA General Assembly in October 2006 .

CoE Recommendation (81) 1, Article 5(4): “ Without the data subject's express and informed consent, the existence and content of his medical record may not be communicated to persons or bodies outside the fields of medical care, public health or medical research, unless such a communication is permitted by the rules on medical professional secrecy ”.

It has also no equivalent in other key pieces of EU legislation (Electronic Privacy Directive 2002/58/EC, Law Enforcement Directive (EU) 2016/60). It has an equivalent only in the Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies (Article 12) and the two provisions should be interpreted homogeneously, pursuant to its Recital 5 .

See also Recital 64 GDPR: “The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests”.

This is a conclusion reached by a joint reading of the text of Articles 4, 5 and 11 GDPR, Recital 26 GDPR (concerning personal data) and Article 29 Data Protection Working Party, Opinion 03/2017 on Processing personal data in the context of Cooperative Intelligent Systems (C-ITS), 17/EN, WP 252, 4 October 2017.

See e.g. Georgieva, L., Kuner, C., 2020, p. 394-396. She states inter alia : “Article 11 applies when the controller holds personal data but some informational elements are missing and the controller cannot (any longer) identify the data subject.” (p. 396).See also Toshkova-Nikolova, D., Feti, N., 2019, p. 144 et seq. See also Hintze, M., ‘Viewing the GDPR through a De- Identification Lens: A Tool for Compliance, Clarification, and Consistency’, International Data Protection Law , Vol. 8, No. 1, Oxford University Press, 2018, p. 86-101 . There are, however, other views (see also national input, especially for France and Belgium).

According to Georgieva, Article 11 GDPR could be seen as concerning a principle, because it is in the same chapter as Articles 4-6. If this is accepted, it would mean that the article has de jure potential impact on each GDPR provision which requires identification, but de facto it impacts only on Articles 15-20, pursuant to its Paragraph 2. See: Georgieva, L., 2020 , p. 394. There are other opinions, however. For instance, that Article 11(1) GDPR applies to the obligations pursuant to Articles 13 and 14, stating that these obligations do not have to be fulfilled when Article 11 applies. See: Gola, P., 'Article 11', Datenschutz-Grundverordnung: DS-GVO, VO (EU) 2016/679 , 2nd Edition, C.H. BECK, 2017 , para 8 as cited in Georgieva, L., and Kuner, C., ‘Article 11 Processing which does not require identification’, in Kuner, C., A. Bygrave, L., Docksey C., (eds.), The EU General Data Protection Regulation (GDPR). A commentary , Oxford University Press 2020, p. 395.

However, WP29 rejected any interpretation aimed at reducing the responsibility of controllers for compliance with data protection obligations. It advised that Article 11 GDPR should be interpreted as ‘ a way to enforce “genuine” data minimisation, without… hindering the exercise of data subjects’ rights’. See: Article 29 WP Opinion 03/2017, p. 6. This, however, has raised concerns about the risks of re-identification, especially when processing health data. See: Goergieva, L., Kuner, C., 2020, p. 39.

Article 8(2) Charter of Fundamental Rights states that ‘data must be processed fairly’ and that everyone ‘has the right of access to data’ and ‘the right to have it rectified’.

Here, the Belgian Data protection law is a very relevant example. See 30 Juillet 2018 Loi relative à la protection des personnes physiques à l’égard des traitements de données à caractère personnel , Article 194 which stipulates that where ‘ the personal data have not been collected from the data subject, the data controller (Controller 2) concludes an agreement with the initial controller (Controller 1). In case the data are publicly available or there is no other legal requirement to conclude such an agreement, Controller 2 has a duty to notify Controller 1 In any case, Controller 2 is obliged to inform the initial Controller 1 about eventual restrictions on data subjects’ rights’. According to Ducato, the underlying assumption of the law is that the initial controller acts as a “contact point” for the data subjects and will fulfil their requests if they want to exercise their rights. See: Ducato, R., 2020. For a similar reading, see also EORTC Contribution to the EMA Discussion Paper: “when (…) receiving controller can easily justify that conditions of Articles 11(1) and 14(5)(b) are met, which releases them from many GDPR obligations, EORTC puts in place additional clauses aiming to further protect data subject rights. Namely, through this agreement, EORTC requires assistance from the recipient controller in case of relevant data subject requests and prompt feedback in case of any high-risk data breach or in case of incidental findings”. Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research

Possible definition of ‘retrospective research’: “ In a retrospective study, in contrast to a prospective study, the outcome of interest has already occurred at the time the study is initiated .” See Encyclopedia of Research Design, Neil J. Salkind, N.J. (ed.), SAGE Publications, Inc., 2010. 272 ‘Lost to follow-up’ means a person who has not returned for continued care or evaluation (e.g. because of death, disability, relocation, or drop-out). See: Medical Dictionary, Definition of “Lost to follow-up”, Medical Dictionary, Farlex and Partners, 2009.

UK Research Authority, ‘Transparency’ [webpage], last updated in 2018. See also contribution for this study by Dara Hallinan.

In the illustrative case of Bărbulescu v. Romania , the European Court of Human Rights (ECtHR) concluded that transparency on the purpose and extent of the processing is a prerequisite for any lawful limitation to the right to privacy. See: ECtHR, Bărbulescu v. Romania [GC], Application No. 61496/08, 5 September 2017, CE:ECHR:2017:0905JUD006149608 .

In the case of I . v. Finland , the European Court of Human Rights explained that data subjects may not be deprived from their ability to enforce their right to privacy, by not providing transparent information on the processing of their data. The court considered that a lack of transparency with regard to the extent of the data processing deprives individuals from their ability to even prove that their right to privacy was infringed on. The Court found that transparent control mechanisms, such as a log, which would have allowed to perform a retrospective check compliance with Article 8 European Convention on Human Rights (ECHR), should have been available. See ECtHR, I . v. Finland , Application No. 20511/03, 17 July 2008, CE:ECHR:2008:0717JUD002051103.

European Data Protection Supervisor, Opinion 7/2015, ‘Meeting the challenges of big data, A call for transparency, user control, data protection by design and accountability’, 19 November 2015, p. 8; Gellman, R., ‘Privacy: Finding a Balanced Approach to Consumer Options’, Robert Gellman webpage , 2002.

Article 14(5)(b) GDPR.

Generally, these platforms are extremely safe and are using advanced access rights management policies which ensure a low risk for information ending up with the wrong data subject – something which is an actual risk when sending information notices through mail or e-mail, especially in research populations with a high mortality rate. Enhancing transparency through patient portals can end discussions on (i) whether or not providing transparency involves a disproportionate effort; and (ii) the non-sense of replacing the right to information of the data subject with publishing general information on a publicly available website.

German Association for Medical Informatics, Biometry and Epidemiology (GMDS) and German Association for Data Protection and Data Security (GDD), 'Datenschutzrechtliche Anforderungen an die medizinische Forschung unter Berucksichtigung der EU Datenschutz-Grundverordnung (DS-GVO)‘, 30, 2018.

The cascade is based on measures found in the strategy for GDPR compliance developed by the University Hospitals Leuven and in the old Belgian data protection framework. See Verhenneman, G., et al., 2019. Old Belgian Royal Decree of 13 February 2001, “Koninklijk besluit ter uitvoering van de wet van 8 december 1992 tot bescherming van de persoonlijke levenssfeer ten opzichte van de verwerking van persoonsgegevens, BS 13 Maart 2001. See also the elaboration on the cascade by Verhenneman, G., 2020, p. 258.

A relevant question remains when one can speak of ‘anonymised medical data’ . Currently (with the Breyer case) the CJEU has adopted a “relative” approach towards anonymization, i.e. considers the necessary effort that would be required by the data controller to identify the data subject and only realistic chances of combining data to identify an individual would be taken into account. Similar view could be found in the old Article 29 Data Protection Working Party, Opinion 04/2007 on the concept of personal data, 01248/07/EN, WP 136, 20 June 2007, (under DPD), where the WP29 used a clinical trials example and it seemed that key-coded data is anonymous in the hands of a third party that does not have access to the key: “The identification of patients is thus embedded in the purposes and the means of the processing. In this case, one can conclude that such key-coded data constitutes information relating to identifiable natural persons for all parties that might be involved in the possible identification and should be subject to the rules of data protection legislation. This does not mean, though, that any other data controller processing the same set of coded data would be processing personal data, if within the specific scheme in which those other controllers are operating re- identification is explicitly excluded and appropriate technical measures have been taken in this respect.” Note that the Privacy Shield (now invalidated, CJEU, Judgement of 16 July 2020, Facebook Ireland Milieu Consulting SPR Brussels Study on the secondary use of personal data in the context of scientific research and Schrems , C-311/18, EU:C:2020:559) treated key-coded data as anonymised if the recipient does not possess the key to re- identify the data (Annex II, Article 2(14)(g)). However, Recital 26 GDPR veers towards an absolute approach . See also Zuiderveen Borgesius, F., ‘Singling Out People without Knowing Their Names - Behavioural targeting, pseudonymous data, and the new Data Protection Regulation’, Computer Law & Security Review , Vol. 32, No. 2, 2016, p. 267.

An example thereof is a longitudinal research. Because at regular intervals data need to be collected from the same individuals, it is required to re-establish the link between the individual and the corresponding pseudonym.

The use of identifiers is for example required in a cohort study, which is a type of medical research used to investigate the causes of disease and to establish links between risk factors and health outcomes.

If that is the case, the transparency obligations should be with the party who anonymises the information. In practice, data subjects will be informed of the further use of their data only when the data are anonymised during the research project. E.g. they are first collected with identifiers, but before the data are analysed, they are anonymised.

It rarely happens that this first controller will inform data subjects on the fact that it anonymised the data before transferring them to another controller. While it would be useful for data controllers to keep track of transfers of anonymised data in a register, informing the data subjects individually and for each new purpose on the mere fact of the anonymisation, may not be necessary.

See also European Data Protection Board, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 2 September 2020, p. 20.

Article 27(3) BDSG(neu). The Article requires controllers to: (i) anonymise data, as soon as this is possible according to the research purposes – unless research subject interests stand in the way; (ii) until anonymisation, data should be pseudonymised, and only processed in unpseudonymised form when this is required by the purposes of research.

Article 100(2) of the proposal for the new Personal Data Protection Act ( ZVOP-2 ). The list includes: 1 The title of the project, 2 Detailed contact data of the researchers involved, 3 The field of study, 4 The goals and objectives, 5 Data management plan, 6 Categories and types of personal data required, 7 Whether data should be transmitted raw, pseudonymised, de-identified or anonymised, 8 Necessity of using already collected personal data, and disproportionate effort if new data would have to be collected (necessity and appropriateness), 9 Benefits resulting from the research outweigh any potential drawbacks to data subjects (proportionality), 10 Results publication strategy, 11 Comply with field-specific research ethics, if applicable, and 12 Who has access to data.

Article 29 Data Protection Working Party, Opinion 05/2014 on Anonymisation Techniques, 0829/14/EN, WP 216, 10 April 2014 , p. 9.

See e.g. Article 29 WP Opinion 05/2014 (absolute approach) vs CJEU, C-582-14, Patrick Breyer v. Bundesrepublik Deutschland , which seems to go into the relative approach direction. See also e.g., Spindler, G., Schmechel, P., ‘Personal Data and Encryption in the European General Data Protection Regulation’, Journal of Intellectual Property, Information Technology and E-Commerce Law , Vol. 7, No. 2, 2016, p. 163-177.