Personal Data & Scientific Research

Personal Data & Scientific Research

European Citizens have a fundamental right to privacy and GDPR applies to any research that uses personal data. Therefore, it is important for universities that undertake research and process personal data for research purposes to be cognisant of these rights.

GDPR requires that the organisations that have control over the ‘why’ and ‘how’ of personal data processing (data controllers) inform individuals about the purpose(s) of such processing. Generally, any further processing, beyond the original purpose is not permitted.

At the same time, GDPR recognises that in the context of research it will not always be possible to be so specific about the details from the outset. GDPR also recognises that frequently in a research context secondary processing of personal data collected will be required to achieve the research goals.

Consequently, the GDPR creates an exemption to the principle of purpose limitation for scientific research. Article 5(1)(b) states, “further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes.” 

Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes are referred to in Article 89(1):“Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.”

Note: For scientific research using health related data see Research Using Health Related Personal Data.

For additional information and resources on data protection see: Guidance & Resources