--- visibility: public Id.: G-2026-01 Version no: 1 Publication Date: '2026-04-15' Latest Revision: '2026-04-15' Ext. Link: >- https://www.edpb.europa.eu/public-consultations/guidelines-12026-on-processing-of-personal-data-for-scientific-research_en Publication Status: Adopted - For Public Consultation Language: English NoteType: Guidelines aliases: - Guidelines 01/2026 - Guidelines 1/2026 - >- EDPB Guidelines 01-2026 on processing of personal data for scientific research purposes tags: - Privacy - EDPB-Guidelines - scientific-research icon: "\U0001F1EA\U0001F1FA" date: '2026-04-15' Finalized: true title: >- EDPB Guidelines 2026-01 on processing of personal data for scientific research purposes created: '2026-04-15' modified: '2026-04-15' published: '2026-04-15' --- # Guidelines 01/2026 on processing of personal data for scientific research purposes Adopted on 15 April 2026 # Executive Summary Scientific research is an important objective in the EU treaties, which state that the Union has the objective of strengthening its scientific and technological bases by achieving a European research area in which researchers, scientific knowledge and technology circulate freely, and encouraging it to become more competitive. Many fields of scientific research involve the [[processing]] of [[personal data]] and such [[processing]] has led to important scientific breakthroughs to the benefit of society, not least in the field of medical sciences. Several scientific breakthroughs have been made possible by the advent of new technologies, such as recent advances in artificial intelligence. These technological developments enable researchers to use and analyse [[data]] in ways that were not possible only a couple of years ago. While the recent technological developments present many benefits and opportunities for scientific research, they have also revealed [[risk|risks]] to fundamental rights and freedoms when [[processing]] [[personal data]] for scientific research purposes. These [[risk|risks]] need to be managed properly to make sure that [[personal data]] are processed responsibly and with respect for personal integrity as well as the private life of individual [[data subject|data subjects]]. The EU's commitment to scientific research is reflected in the General Data Protection Regulation (the [[SiteMap/Official Texts/GDPR|GDPR]]). By laying down specific rules and considerations for the [[processing]] of [[personal data]] for scientific research purposes, the GDPR provides for a framework that enables and facilitates the [[processing]] of [[personal data]] for scientific research, while safeguarding the fundamental rights and freedoms of [[data subject|data subjects]]. The [[processing]] of [[personal data]] for scientific research purposes has given rise to a number of important and sometimes difficult questions from [[controller|controllers]], [[processor|processors]] and [[supervisory authority|supervisory authorities]] on how the GDPR should be interpreted and applied. To bring more clarity and guidance for researchers, the European [[data|Data]] Protection Board (the **[EDPB](https://www.edpb.europa.eu/)**) decided that it was necessary to issue the present guidelines. This is also in line with the EDPB's commitment in the Helsinki statement, where the EDPB set out to facilitate easier GDPR compliance. The most important questions addressed in the present guidelines are listed below: **Concept of scientific research**: Only research that is genuinely scientific benefits from the specific rules applying to [[processing]] of [[personal data]] for scientific research purposes in the GDPR. To help determine if the πŸ“’processing of πŸ“’personal data is carried out for scientific research within the meaning of the GDPR, the guidelines present six key-indicative factors that should be considered, in addition to the nature, scope, context and purposes of πŸ“’processing. If the research activities meet these six factors, they can be presumed to constitute scientific research. If the research activities do not meet all factors, the πŸ“’controller needs to justify and be able to demonstrate why the activities should be considered scientific research, within the meaning of the GDPR (section 2). **Presumption of compatibility**: Further [[processing]] for scientific research purposes is presumed to be compatible with the initial purpose for collecting the [[personal data]]. Therefore, a [[controller]] that further processes [[personal data]] for scientific research purposes does not have to do the purpose compatibility test under the GDPR. However, the [[controller]] must still check if the [[processing]] is lawful. When doing this check, it is often possible to rely on the same legal basis that applied for the initial [[processing]] (section 3.1). **Storage limitation**: [[controller|controllers]] can store [[personal data]] for scientific research purposes for longer periods of time, even if the original purposes for [[processing]] the [[data]] have been fulfilled. For example, if the initial research results give rise to future research projects that require additional [[processing]] of [[personal data]], it may be permitted to store the [[personal data]] for such projects (section 3.2). **[[consent]]**: Where the purposes of research are not fully known at the time of collecting the [[personal data]], it is possible for [[controller|controllers]] to rely on the [[consent]] of a [[data subject]] to collect and process [[personal data]] in a certain area of scientific research (so-called **broad [[consent]]**). To rely on broad [[consent]], the [[controller]] should process [[personal data]] in accordance with ethical standards for scientific research and put additional safeguards in place to compensate for the lack of purpose specification. [[controller|controllers]] can also ask [[data subject|data subjects]] to [[consent]] to different individual research projects, or parts thereof, separately, as soon as the purposes of those projects become known (so-called **dynamic [[consent]]**). A combination of both approaches to [[consent]] is also possible (section 4.1.2). **Public interest or exercise of official authority**: Relying on [[performance of an AI system|performance]] of a task carried out in the public interest, or exercise of official authority, as a legal basis is not limited to public entities conducting scientific research. Private entities may also rely on that legal basis, if the legal act in question covers their activities (section 4.2). **Legitimate interest**: Scientific research can be a legitimate interest under the GDPR, regardless of whether the research is undertaken on a non-profit or commercial basis. A [[controller]] that intends to process [[personal data]] for scientific research purposes on the basis of legitimate interest can often attribute significant weight to the [[processing]] of [[personal data]] for scientific research purposes when applying the balancing test. This is because genuine scientific research is considered to be an important activity that is beneficial for the whole of society (section 4.3). **[[special categories of personal data]]**: Union or Member State law can authorise the [[processing]] of special categories of [[personal data]]. The legal act must provide for suitable and specific measures to safeguard the fundamental rights and interests of the [[data subject]]. Member State law may also impose further conditions or limitations for the [[processing]] of genetic, biometric, or [[data concerning health|health data]]. Such laws may be relevant for [[controller|controllers]] when [[processing]] [[personal data]] for scientific research purposes (section 4.4.3). If no Union or MS law permits the [[processing]] of special categories of [[personal data]] for a given scientific research purpose, then [[controller|controllers]] can instead ask for the explicit [[consent]] of [[data subject|data subjects]]. [[consent]] to [[processing]] of special categories of [[personal data]] can be broad or dynamic (section 4.4.1). It can also be possible to process special categories of [[personal data]] that were manifestly made public by the [[data subject]], for example on social media (section 4.4.2). **Transparency**: If [[controller|controllers]] process [[personal data]] for long periods of time for scientific research purposes, then they should adopt appropriate measures to ensure transparency during the entire [[processing]] period. [[controller|controllers]] should also provide updates to [[data subject|data subjects]] if there are changes to the [[processing]]. The obligation to provide transparency also applies if the [[controller]] does not have access to any [[personal data]] or any contact with the [[data subject]], for example if the [[processing]] is done by a [[processor]]. In such cases, the [[processor]] may be the one that gives information to the [[data subject|data subjects]] or replies to information requests on the [[controller]]'s behalf, if requested to do so by the [[controller]] (section 5). **Right to erasure**: [[data subject|data subjects]] have a right to have their [[personal data]] erased, but the GDPR provides for exceptions from this right. There is a specific exception for situations where the [[processing]] is necessary for scientific research purposes. This exception only applies if the right to erasure is likely to render impossible or seriously impair the objective of conducting scientific research and if the [[controller]] has adopted appropriate safeguards (section 6.2.2). **Right to object**: [[data subject|data subjects]] have the right to object to the [[processing]] of their [[personal data]], but there are limitations to this right when [[personal data]] are processed for scientific research purposes. [[controller|controllers]] may reject an objection, if the [[processing]] is necessary for the [[performance of an AI system|performance]] of a task carried out for reasons of public interest under Union or Member State law. This includes cases where a legitimate interest pursued by the [[controller]] or a [[third party]] coincides with a public interest (section 6.3). **Attribution of responsibility**: Where several entities are involved in the [[processing]] of [[personal data]] for scientific research purposes, it is necessary to assess and document how responsibility is allocated among the entities. This is particularly relevant when multiple actors are involved in the drafting of a scientific research protocol or in the case of a public-private partnership. The determination of roles is important to ensure accountability and compliance of the entities involved in the [[processing]] of [[personal data]] and to determine towards which entity [[data subject|data subjects]] can exercise their [[data]] protection rights (section 7). **Appropriate safeguards**: [[controller|controllers]] must adopt appropriate safeguards for the rights and freedoms of [[data subject|data subjects]] when they process [[personal data]] for scientific research purposes. In line with the principle of [[data]] minimisation, anonymised β€” or alternatively pseudonymised [[data]] β€” should be used for scientific research, as long as the purposes of [[processing]] can be fulfilled using such [[data]]. The [[processing]] of [[personal data]] that can be used to directly identify a person is only allowed where it is *strictly necessary* and *proportionate* to achieve the purposes of the scientific research. Depending on the nature, scope, context and purposes of [[processing]], it may be necessary to also apply other safeguards than anonymisation or [[pseudonymisation]] of [[personal data]]. Such safeguards can be independent or ethical oversight, secure [[processing]] environments, privacy enhancing technologies, protective measures for publication of research results, confidentiality arrangements, conditions for further use, etc. (section 8.3–8.5). --- # 1. Introduction 1. Scientific advancement, promotion of scientific research and the establishment of a European research area are objectives laid down in the EU's founding treaties[^1]. Furthermore, Article 13 of the Charter of Fundamental Rights of the European Union (the CFREU)[^2] provides that scientific research shall be free of constraint and academic freedom shall be respected. The EU's commitment to scientific research is also reflected in both the provisions and recitals of the General [[data|Data]] Protection Regulation (the GDPR), that apply when [[processing]] [[personal data]] for scientific research purposes[^3]. 2. The [[processing]] of [[personal data]] for scientific research purposes and the application of the GDPR's provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of [[data subject|data subjects]], pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of [[personal data]], pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU[^4]. 3. The EDPB recognises that the [[processing]] of [[personal data]] in the area of scientific research is diverse and complex, not least as there are many different actors, fields of research, types of [[data]] and categories of [[data subject|data subjects]] involved, as well as different technologies and methods used to collect and process [[data]]. Accordingly, the EDPB decided to issue these guidelines on the interpretation and application of the provisions in the GDPR that are specific to or of particular relevance when [[processing]] [[personal data]] for scientific research purposes. 4. The GDPR does not exhaustively harmonise the requirements for the [[processing]] of [[personal data]] for scientific research purposes. Accordingly, the EDPB underlines that there is ample room left to, and consequently a need for, complementary Union and Member State (MS) law. The application of such laws is not addressed in the current guidelines[^5]. --- # 2. The scope of the concept 'processing of personal data for scientific research purposes' 5. As stated in the previous section, conducting scientific research is a fundamental freedom under EU law and the GDPR includes several provisions that apply specifically to the [[processing]] of [[personal data]] for scientific research purposes. If a [[controller]] intends to apply those provisions, then it must substantiate and be able to demonstrate that the **purpose** for [[processing]] [[personal data]] is to carry out **scientific research**[^6]. 6. While the EDPB is aware that no universally agreed definition of scientific research exists, it is nonetheless necessary to clarify the concept of [[processing]] of [[personal data]] for scientific research purposes, in the meaning of the GDPR[^7]. 7. Recital 159 GDPR provides that: "[for] the purposes of this Regulation, the [[processing]] of [[personal data]] for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research. In addition, it should take into account the Union's objective under Article 179(1) TFEU of achieving a European Research Area. Scientific research purposes should also include studies conducted in the public interest in the area of *public health*." 8. Furthermore, the GDPR recognises that research using [[personal data]] in registries can provide knowledge and results that can "*improve the quality of life for a number of people and improve the* efficiency *of social services*"[^8]. 9. While the concept of scientific research should be interpreted in a broad manner, it "*may not be stretched beyond its common meaning*". Therefore, the EDPB has previously stated that: *"'scientific research' [...] means a research project set up in accordance with relevant sector-related methodological and ethical standards, in conformity with good practice*"[^9]. In other words, the concept of scientific research purposes in the GDPR covers [[processing]] of [[personal data]] in research activities that are **genuinely scientific**. 10. Other sources describing scientific research activities emphasise different elements, such as the aim to acquire new knowledge, systematic and methodical research, the role of the entities and the qualifications of persons involved in research, adherence to scientific methodology and ethical standards and dissemination of research results[^10]. Like the GDPR, other sources underline that scientific research can be conducted by both public and private entities and that it may be conducted for profit[^11]. ## 2.1 Key-indicative factors for determining whether processing of personal data is motivated by scientific research purposes 11. While neither the GDPR nor the sources referred to above reveal a unitary or finite definition of **scientific research**, they present some common elements which can serve as **key-indicative factors**. [[controller|controllers]] should give particular importance to these key-indicative factors, as listed below, when determining whether [[processing]] of [[personal data]] is motivated by scientific purposes or not, taking into account the nature, scope and context of [[processing]]: ### i. Methodical and systematic approach The research activities, including formulation and testing of a hypothesis[^12], are conducted following a methodical and systematic approach of the relevant research field, for example in accordance with a comprehensive research plan. If the research is exploratory or in a preliminary stage, the research may have a stated objective as opposed to a hypothesis. ### ii. Adherence to ethical standards The research activities are conducted in adherence to ethical standards in the relevant research field[^13]. Ethical standards are intended to prevent individuals from being subjected to harm or other adverse effects due to participating in scientific research and include β€” among other things β€” the respect for human autonomy and the concept of [[consent]] to participate in research[^14], transparency, accountability and oversight[^15]. ### iii. Verifiability and transparency The research activities aim to achieve verifiable results and the conduct of research allows the hypotheses, methods, [[data]] and conclusions to be open to criticism, normally following peer review.[^16] The results of the research are shared with other parties, for example by publication, or will be shared in the future, with due regard to legitimate limitations to access such as protection of intellectual property and [[trade secret|trade secrets]]. ### iv. Autonomy and independence The research activities are conducted autonomously and independently in relation to the prejudices of the scientific community and other external parties, as well as the researcher's own prejudices, in an environment free from undue pressures[^17]. This means that the research team has the freedom to define research questions, identify methods by which problems are solved, choose and develop scientific theories, as well as the freedom to disseminate and publish the results of their research[^18]. The researchers [[processing]] the [[personal data]] have academic (e.g. a PhD title) or scientific qualifications (e.g. proven experience or recognition) in the relevant field of research[^19]. This applies regardless of whether the research activities are carried out by an academic institution, non-profit organisation, public institution or a for-profit organisation (such as a commercial company or a start-up). The research can also be conducted under the supervision of qualified researchers. The research team is transparent about any assumptions or values that may influence their research and the robustness of scientific evidence, including any remaining uncertainties and knowledge gaps. ### v. Objectives of the research The research activities are carried out with the aim of contributing to the growth of society's general knowledge and wellbeing[^20]. This does not exclude that the research may also aim to further commercial interests. ### vi. Potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways The research activities are merited, as they have the potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways[^21]. The scientific merits of the research can be [[subject]] to assessment, review or approval by independent experts or committees[^22], for example when applying for a research grant or when applying for authorisation to market certain products that involve elements of scientific evaluation[^23]. 12. If the research activities under assessment meet all of the factors in para. 11, they can be presumed to constitute scientific research. If the research activities do not meet all factors, the [[controller]] needs to justify and be able to demonstrate why the activities should nonetheless be considered scientific research, within the meaning of the GDPR. When doing such an assessment, the more key-indicative factors are present, the more likely it is that the activities constitute scientific research within the meaning of the GDPR. > [!important]+ **Example 1: [[processing|Processing]] of [[personal data]] for scientific research purposes** > > > A pharmaceutical company is developing a new pharmaceutical intended to combat a rare disease. To explore the potential side effects, the pharmaceutical company initiates a clinical trial. While the pharmaceutical is developed by a commercial company, the purpose of the clinical trial is also to further the scientific knowledge of the rare disease in question and improve the quality of life of patient suffering from the disease. To this end, the research activities carried out within the scope of the clinical trial correspond to factor v (objectives of the research). > > The pharmaceutical company hires a team of academically qualified and vetted researchers to carry out the scientific research activities necessary to conduct the trial. This corresponds to factor iv (independence and autonomy). > > The research team selects a number of patients suffering from the disease in question to participate in the trial as research [[subject|participants]]. These patients' [[personal data]] will be processed during the course of the trial. To conduct the trial, the researchers draw up a research plan, following the rules of good clinical practice (GCP) that will be reviewed by an ethical committee. In so far as the clinical trial will be conducted in accordance with the research plan, this indicates that researchers are following a methodical and systematic approach in adherence to ethical standards, corresponding to factors i and ii. > > The research activities are expected to generate new scientific knowledge, and the results of the trial will be published in a scientific journal. Accordingly, the research activities correspond to factors iii (verifiability and transparency) and vi (potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways). > > For these reasons, the clinical trial and the associated [[processing]] of the research [[subject|participants]]' [[personal data]] can be deemed to be conducted for scientific research purposes under the GDPR. > [!important]+ **Example 2: [[processing|Processing]] of [[personal data]] for scientific research purposes** > > > GSPM AI GmbH is a start-up company that conducts research and development in the field of generative AI and is looking to conduct research on the topic of bias in generative AI models. To do so, GSPM AI intends to apply for funding for its research from a foundation which provides funding in various fields of technological research. The conditions for funding include that research projects must use established scientific methods, be [[subject]] to ethical review and the results of the research must be made publicly available. The choice of scientific method, formulation of hypotheses etc. is to be determined by the researchers applying for sponsorship. In so far as the intended research fulfils the conditions for funding, the research activities will correspond to factor i (methodical and systematic approach) as well as factor iv (autonomy and independence). > > GSPM AI partners with a university faculty that conducts research in the field of robotics and AI and that is looking to get involved in research concerning bias in generative AI models. By doing so, the research project will include qualified researchers, in line with factor iv (autonomy and transparency). > > The company and the university set up a joint research group that starts to plan for the research project, applies for sponsorship and submits to review by the university's ethical board, which is composed of independent experts. Subjecting the research project to ethical review corresponds to factor ii (adherence to ethical standards). > > The joint research group is granted sponsorship. Having successfully completed the project, GSPM AI and the university faculty publish a peer-reviewed paper, in line with factor iii (verifiability and transparency). By sharing the research results through publication, the research projects benefit the larger research community, while not excluding commercial use of the results by GSPM AI. Therefore, the research activities correspond to factor v (objectives of the research). > > In sum, the [[processing]] of [[personal data]] within the scope of the research project takes place for scientific research purposes, in the meaning of the GDPR. > **[!important]+ Example 3: [[processing|Processing]] of [[personal data]] not considered as motivated for scientific research purposes** > > A retail company analyses their sales [[data]] of online [[customer|customers]], to get insight in the different categories of [[customer|customers]] (target groups), what purchases they make, their frequency of website visits and how many [[customer|customers]] are returning to their webpage on more than one occasion. The company intends to use the analysis to inform their marketing strategy. > > The research does not aim to achieve verifiable results and the results are not shared with any other parties. The results of the analysis do not have any apparent potential to contribute to existing scientific knowledge or apply such knowledge in novel ways. It is also not carried out by independent and autonomous researchers, but by marketing experts within the company. The aim of the research is solely concerned with furthering the commercial interests of the company and is not carried out with the aim of contributing to the growth of society's collective knowledge and wellbeing. Nor is the research [[subject]] to independent review. > > Considering that the research does not trigger the key-indicative factors, it does not qualify as scientific research in the meaning of the GDPR and the associated [[processing]] of [[personal data]] cannot be considered to be conducted for scientific research purposes. ## 2.2 Research data infrastructures 13. [[personal data]] may be processed in a research [[data]] infrastructure[^24] (also referred to as a research repository or database) for the purposes of making the [[data]] available for future research projects within a specific area of research[^25]. The [[processing]] of [[personal data]] within the scope of a research infrastructure may be motivated by scientific research purposes, within the meaning of the GDPR. To determine whether this is the case, a [[controller]] should assess the relevant [[processing]] operations that are necessary for operating the research infrastructure in light of the factors listed at para. 11. For example, the entity that decides on the operation of the infrastructure, or a legislator, may establish criteria that determine which research [[data]] should be collected and for which types of research projects access to the [[data]] should be granted. Access to research [[data]] will typically be limited to projects in certain fields of research. Moreover, conditions on access to [[data]] could require that researchers have fulfilled certain academic or scientific qualifications, or that researchers that request access to special categories of [[data]] should adhere to ethical standards, relevant to the concerned field of research. > [!important]+ **Example 4: [[processing|Processing]] of [[personal data]] for scientific research purposes in a research infrastructure** > > > A public agency responsible for monitoring the quality of education has a statutory task to make [[personal data]] on pupils available for scientific research projects. [[data|Data]] can be disclosed to support the agency's tasks, but also for research projects being undertaken by external researchers. > > The law determines which types of [[personal data]] can be disclosed, namely [[personal data]] such as grades and gender. The public agency also has access to and can disclose individual diaries on the behaviour and well-being of pupils, noted down by teachers and other staff (such as school nurses) for the stated purposes. Public and private schools submit [[data]] in a pseudonymised format to the agency and the [[data]] is also stored in this format in a secure environment with access controls. > > The law also provides the conditions for access of the pseudonymised [[data]] in a secure [[processing]] environment. Accordingly, a researcher can apply with an individual research project for approval to get access to the [[personal data]] stored in the database kept by the public agency. To be approved, the research project must have a sufficiently detailed research plan outlining which [[data]] is to be used and for what purposes. This fulfils factors i (methodical and systematic approach) and v (objectives of the research). Moreover, the research must be conducted by qualified researchers, in line with factor iv (autonomy and independence). In addition, the results of the research must be made available to the general public, fulfilling factor iii (verifiability and transparency). > > To protect [[data subject|data subjects]], the staff working for approved research projects must commit to confidentiality agreements and can only access the [[data]] remotely, through a secure [[processing]] environment without the possibility to download [[personal data]] from that environment. It is, however, possible to download aggregated [[data]] that does not contain any [[personal data]]. If a researcher wants to access special categories of [[personal data]] for a research project, such as [[data]] on the health or mental well-being of pupils β€” pursuant to [[SiteMap/Official Texts/GDPR#article-9--processing-of-special-categories-of-personal-data|Article 9(2) of the GDPR]] β€” then it also needs ethical approval, in line with factor ii (adherence to ethical standards). > > Considering that the conditions for accessing the database trigger several of the factors listed above, the [[processing]] of [[personal data]] related to the management and provision of research [[data]] can be deemed to be conducted for scientific research purposes, in the meaning of the GDPR. ## 2.3 Ancillary processing operations 14. Not only [[processing]] operations undertaken within the scope of research projects or research infrastructures may be motivated by scientific research purposes, but also other [[processing]] operations that are ancillary to scientific research projects. Ancillary [[processing]] operations can be [[processing]] operations in the preparatory step of research, for example [[processing]] contact details of individuals in order to identify potential research [[subject|subjects]] (e.g. patients, pupils, persons receiving social welfare etc.). Other potential ancillary [[processing]] operations relate to the management of the research [[data]] as such and include (but are not limited to) identification of relevant [[data]], [[data]] extraction, filtering, grouping, curation and categorisation of [[personal data]][^26]. Anonymisation or [[pseudonymisation]] of [[personal data]] prior to the [[processing]] of [[personal data]] in individual research projects may also be motivated by scientific research purposes[^27]. 15. Ancillary [[processing]] operations should have a clear scientific research objective, which must be assessed on a case-to-case basis in light of the factors listed at para. 11, in order for those [[processing]] operations to be considered motivated by scientific research purposes. > [!important]+ **Example 5: Ancillary [[processing]] operation for scientific research purposes** > > > A research institute intends to create a panel of respondents whose answers will reflect the opinions on current events of the general population. The purpose of creating the panel is to enable scientific research projects, that would be considered motivated by scientific research purposes under the GDPR, in a number of academic fields of social sciences, where the opinions of [[data subject|data subjects]] is a necessary [[data]] point. > > The institute has access to certain geographical and population [[data]] via a registry maintained by a public body tasked by national law with statistical research and provision of aggregated as well as non-aggregated statistical [[data]] for, inter alia, scientific research. Via this registry, the research institute can enter queries to get a random [[representative]] selection of potential respondents in different geographical areas, on the basis of certain pre-established criteria (e.g. number of residents per household, income levels in the different geographical areas, types of buildings). > > The research institute sends out invitation letters to the potential members of the panel, using the addresses to the households it has received from the public body. [[data subject|data subjects]] can decide to participate in the panel by answering the letter or by filling out a form on the webpage of the research institute. [[personal data]] of [[data subject|data subjects]] who do not respond will be deleted after a predetermined period of time. > > To protect the [[personal data]] of panellists, the research institute provides a platform through which individual researchers can construct surveys and pose questions to the panellists, provided that their research projects fulfil certain conditions. While the identities of the panellists are known to the research institute, their [[personal data]] β€” in the form of answers to surveys β€” is pseudonymised when provided to the researchers, who also do not get any contact details to the panellists. Moreover, [[data subject|data subjects]] can at any time stop their participation in the panel, and request to have their [[data]] erased. > > When access to [[personal data]] from the panellists is provided or when researchers utilise the panel and process [[personal data]] for the conduct of scientific research projects, the [[processing]] operations associated with the use of the panel can be considered to be for scientific research purposes, within the meaning of the GDPR. --- # 3. Data protection principles (Article 5 GDPR) 16. Section 3 firstly addresses the distinction between the [[processing]] of [[personal data]] for scientific research purposes as the **primary purpose** of [[processing]], and the **further [[processing]]** of [[personal data]] that was initially collected for another purpose than scientific research (or for another scientific research purpose). Secondly, section 3 addresses the **presumption of purpose compatibility** contained in Article 5(1)(b) of the GDPR, when further [[processing]] of [[personal data]] is carried out for scientific research purposes. Thirdly, section 3 addresses the **principle of storage limitation**, and how it applies when [[personal data]] is processed for scientific research purposes. ## 3.1 Purpose limitation (Article 5(1) GDPR) 17. If a [[controller]] collects [[personal data]] to process it for a specific scientific research purpose, then the research purpose is considered to be the **primary** purpose of [[processing]]. If a [[controller]] subsequently wants to process that [[personal data]] for **another** scientific research purpose that is *not* covered by the primary purpose, such [[processing]] is considered to be **further [[processing]] for another purpose**. If a [[controller]] initially collects and processes [[personal data]] for **non-scientific purposes**, but later on decides to process the [[personal data]] for scientific research purposes, this is considered **further [[processing]] for scientific research purposes**. 18. [[personal data]] can also be collected for several purposes, amongst which one of the purposes can be scientific research. In such situations, the scientific research purpose is also considered to be a primary purpose of [[processing]]. ### 3.1.1 Presumption of purpose compatibility 19. Under ([[SiteMap/Official Texts/GDPR#^article5|Article 5(1)(b) GDPR]], further [[processing]] for scientific research purposes is presumed to be compatible with the initial purpose(s) of the [[processing]][^28]. Therefore, when further [[processing]] [[personal data]] for scientific research purposes it is not necessary to undertake the compatibility test, pursuant to [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(4) GDPR]][^29]. However, the compatibility test should be undertaken if the primary purpose of [[processing]] is scientific research, but the further [[processing]] of [[personal data]] is done in pursuit of another purpose than scientific research[^30]. 20. While ([[SiteMap/Official Texts/GDPR#^article5|Article 5(1)(b) GDPR]] only refers to the purposes of [[processing]], recital 50 also addresses the lawfulness of [[processing]] and states that: "[...] the [[processing]] of [[personal data]] for purposes other than those for which the [[personal data]] were initially collected should be allowed only where the [[processing]] is compatible with the purposes for which the [[personal data]] were initially collected. In such a case, no separate legal basis from that which allowed the collection of the [[personal data]] is required [...] Further [[processing]] for [...] scientific research purposes [...] should be considered to be lawful [[processing]] operations." 21. In this regard, the EDPB has previously stated that under certain conditions, and provided that appropriate safeguards have been adopted pursuant to Article 89(1) GDPR, a [[controller]] may be able to rely on the legal basis for the initial [[processing]] operations when further [[processing]] [[personal data]] for scientific research purposes[^31]. However, the EDPB and the EDPS have also stated that the question of compatibility of purposes should not be confused with principle of lawfulness[^32]. Therefore, the possibility to rely on the legal basis that the initial [[processing]] was based on requires an assessment of lawfulness to determine that this legal basis is also suitable to rely on for the further [[processing]] of [[personal data]] for scientific research purposes. 22. In many cases [[controller|controllers]] will be able to rely on the same legal basis, for example where a [[controller]] initially processed [[personal data]] on the basis of public or legitimate interest[^33]. It is, however, not always possible to rely on the same legal basis when further [[processing]] [[personal data]] for scientific research purposes. This applies in particular if the initial legal basis for the primary [[processing]] is [[consent]] or a legal obligation[^34]. 23. If a [[controller]] considers that further [[processing]] for scientific research purposes could be based on [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]], the significant societal interest of conducting scientific research, as also reflected by the presumed compatibility of [[processing]] for scientific research purposes, carries significant weight in the balancing test in relation to the [[data subject|data subjects]]' interests or fundamental rights or freedoms[^35]. > [!important]+ **Example 6: Further [[processing]] of [[personal data]] for scientific research purposes**[^36] > > > A private research institute collects publicly accessible [[personal data]] from social media and uses this [[data]] in a scientific research project to analyse the use of a particular dialect in written language. Following a [[risk]] analysis and having implemented appropriate safeguards, the research institute determines that it can rely on a legitimate interest, pursuant to [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]], to collect the [[data]]. > > Having concluded the research project, the research institute wishes to further use the collected [[data]] to develop an app for use in another research project. The purpose of the app is to support individuals speaking the dialect with improving their spelling when writing in dialect, and then for the research institute to use that [[data]] to conduct research on the improvement of writing skills over time. > > The research institute does not have to undertake the compatibility test, pursuant to [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(4) GDPR]], as the further [[processing]] of the [[personal data]] gathered in the first research project is presumed to be compatible with the original purposes of [[processing]], in line with Article 5(1)(b). > > The research institute assesses the lawfulness, pursuant to [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]], for the further [[processing]] of the collected [[personal data]]. When doing so, the institute considers the societal interest of the research and the presumed compatibility of the further [[processing]] in the balancing test and concludes that it can use the [[data]] to develop the app in question. 24. If a [[controller]] further processes special categories of [[personal data]], pursuant to [[SiteMap/Official Texts/GDPR#article-9--processing-of-special-categories-of-personal-data|Article 9(1) GDPR]], for scientific research purposes, it may also rely on the presumption of compatibility of purposes, pursuant to Article 5(1)(b). Nevertheless, the [[controller]] must still assess which derogation to the prohibition to process special categories of [[personal data]], pursuant to [[SiteMap/Official Texts/GDPR#article-9--processing-of-special-categories-of-personal-data|Article 9(2) GDPR]], that applies when further [[processing]] such [[data]] for scientific research purposes[^37]. Accordingly, if the [[controller]] intends to rely on the same derogation, pursuant to [[SiteMap/Official Texts/GDPR#article-9--processing-of-special-categories-of-personal-data|Article 9(2) GDPR]], that it relied on for the initial [[processing]] operation, then the [[controller]] must assess whether that derogation is also suitable for the further [[processing]] of [[personal data]] for scientific research purposes[^38]. 25. When the [[controller]] further processes [[personal data]] concerning health, genetic or [[biometric data]], it should also consider that there may be additional conditions or limitations imposed by MS law on the [[processing]], pursuant to Article 9(4) of GDPR, also in cases of further [[processing]] for scientific research purposes. ### 3.1.2 Further processing when providing personal data to another controller for scientific research purposes 26. If a [[controller]] ([[controller]] A) wishes to, or is obliged by Union or MS law, to provide [[personal data]] to another [[controller]] ([[controller]] B), and [[controller]] B intends to process the [[data]] for its own scientific research purposes, the provision of [[personal data]] by [[controller]] A will be considered further [[processing]] if it was not one of the primary [[processing]] purposes when the [[personal data]] was collected. When providing [[personal data]] to another [[controller]] for scientific research purposes, neither the providing ([[controller]] A) nor receiving [[controller]] ([[controller]] B) needs to undertake a compatibility assessment, pursuant to [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(4) GDPR]][^39]. ## 3.2 Storage limitation (Article 5(1)(e) GDPR) 27. Under the principle of storage limitation[^40], a [[controller]] collecting [[personal data]] for scientific research purposes must determine for how long the [[personal data]] will be processed or, if that is not possible, the criteria used to determine that period. The [[controller]] must also inform the [[data subject|data subjects]] on this matter[^41]. Storage of [[personal data]] following the conclusion of a research project will typically be justified as long as it is necessary to retain the [[data]] in order to verify or scrutinise research results, for example within the scope of a peer review process or in accordance with scientific standards for retention. The storage period must be determined by the [[controller]] before the [[personal data]] are processed[^42]. In this regard, [[controller|controllers]] should consider and inform [[data subject|data subjects]] about possible uncertainties regarding the exact duration of the scientific research activities, for example when [[undertaking]] longitudinal research projects. 28. Article 5(1)(e) lit 2 GDPR permits [[controller|controllers]] to store [[personal data]] if the [[data]] is intended to be further processed for specific scientific research purposes, even if the original purposes for [[processing]] the [[data]] have been fulfilled and regardless of whether the original purposes were scientific research or not. For example, if research results give rise to future research projects that require additional [[processing]] of [[personal data]] in future research projects, it may be permissible to store the [[personal data]] for such projects. 29. If it is not possible to specify the purposes of a future research project at the time of storage, specifying potential research in a certain area of research can suffice[^43]. However, in line with the principle of purpose limitation that requires the purpose of [[processing]] to be specific, storage for generic scientific research purposes without any specification of purpose cannot be justified with reference to Article 5(1)(e) GDPR. Moreover, the future scientific research activities should be reasonably foreseeable in relation to the relevant scientific field of research, taking the nature, scope, context and purposes of the envisaged [[processing]] operations into account. This means that the [[controller]] should substantiate how it intends to use the [[personal data]] in future scientific research projects, although it should not be required to draft a complete research plan. 30. Furthermore, [[controller|controllers]] storing [[personal data]] for scientific research purposes must evaluate which categories of [[personal data]] are necessary to retain for presumptive future research projects, in line with the principles of purpose limitation and [[data]] minimisation, pursuant to ([[SiteMap/Official Texts/GDPR#^article5|Article 5(1)(b) and (c) GDPR]][^44]. When doing the necessity assessment as part of this evaluation, [[controller|controllers]] should take due regard to elements that may give rise to [[risk|risks]] to [[data subject|data subjects]], such as [[processing]] of special categories of [[personal data]], pursuant to [[SiteMap/Official Texts/GDPR#article-9--processing-of-special-categories-of-personal-data|Article 9(2) GDPR]][^45]. 31. [[controller|controllers]] storing [[data]] in accordance with Article 5(1)(e) lit 2 GDPR must also adopt appropriate safeguards, pursuant to Article 89(1) GDPR[^46]. In particular, when [[controller|controllers]] store [[personal data]] for prolonged periods of time, they must regularly review the necessity of storing [[personal data]] β€” including in which format the [[data]] should be retained (i.e. whether the [[personal data]] should be anonymised or pseudonymised) β€” in light of the envisaged further [[processing]] for scientific research purposes. --- # 4. Lawfulness (Articles 5(1)(a), 6(1) and 9 of the GDPR) 32. Before a [[controller]] starts [[processing]] [[personal data]], it must determine which is the appropriate lawful basis for the envisaged [[processing]][^47]. The main legal bases that are relevant for the [[processing]] of [[personal data]] for scientific research purposes are [[consent]] (Article 6(1)(a)[^48]), legal obligation (Article 6(1)(c)), public interest (Article 6(1)(e)) and legitimate interest ([[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]])[^49]. 33. If a [[controller]] intends to process special categories of [[personal data]] for scientific research purposes, then it needs to determine which derogation under [[SiteMap/Official Texts/GDPR#article-9--processing-of-special-categories-of-personal-data|Article 9(2) GDPR]] applies[^50]. Similarly, if a [[controller]] processes [[personal data]] relating to criminal convictions and offences for scientific research purposes, it has to ensure that it can do so under the control of official authority or authorisation by Union or MS Law[^51]. 34. In the following section, the considerations relating to lawfulness that are of particular interest when [[processing]] [[personal data]] for scientific research purposes are elaborated upon. ## 4.1 Consent (Article 6(1)(a) of the GDPR) 35. The EDPB's [[EDPB Guidelines 2020-05 on consent under GDPR|Guidelines 5/2020 on consent under Regulation 2016/679]] (hereafter "**Guidelines on [[consent]]**) provide general guidance on the legal basis [[consent]], pursuant to Article 6(1)(a) GDPR. The following sub-section provides additional guidance relevant to the [[processing]] of [[personal data]] for scientific research purposes when relying on Article 6(1)(a) GDPR. ### 4.1.1 Freely given consent 36. [[controller|Controllers]] must consider the condition that [[consent]] must be freely given, in particular if they intend to process [[personal data]] of [[data subject|data subjects]] that are in a vulnerable or disadvantaged position, i.e. if there is a situation of imbalance in power in the relationship between the [[data subject]] and the [[controller]][^52]. In the field of scientific research this could, for example, be the case when a research project involves [[processing]] of [[personal data]] of convicted persons, pupils, unemployed or disenfranchised persons. If there are any doubts in this respect, [[controller|controllers]] should refrain from relying on [[consent]] as a legal basis. 37. If [[personal data]] is processed in the field of medical research involving patients, such as clinical trials, then the [[controller]] should consider the mental or physical condition of the patient. If a patient's capacity to provide [[consent]] is severely affected by his or her mental or physical medical condition, then the [[controller]] should refrain from relying on [[consent]] for the [[processing]] of [[personal data]][^53]. Conversely, the fact that a [[data subject]] is a patient receiving health [[care]] does not in itself affect the [[data subject]]'s capacity to freely provide [[consent]], in so far as the [[data subject]] is not severely affected by a mental or physical medical condition[^54]. 38. A [[controller]] can obtain a single [[consent]] for clinical research that involves the [[processing]] of [[personal data]] which are necessary both for the purposes of providing healthcare and conducting scientific research, since those purposes are interrelated. However, a [[controller]] cannot ask a [[data subject]] to [[consent]] to the [[processing]] of [[personal data]] for scientific research purposes as a condition for providing healthcare or other services, if those purposes for [[processing]] are not necessary for and interrelated with the conduct of scientific research[^55]. In such a case, the [[controller]] should ask [[data subject|data subjects]] to [[consent]] to the [[processing]] of [[personal data]] for scientific research purposes separately, as it may otherwise not be considered to have been freely given. > [!important]+ **Example 7: Freely given [[consent]]** > > > A private research institute is [[undertaking]] a study on how persons with a particular neurological disease are treated in their contact with public authorities and entities. There is no legal provision in Union or MS law that the institute can base the [[processing]] of [[personal data]] for its research on and it therefore explores whether it would be possible to rely on the explicit [[consent]] of the [[data subject|data subjects]] involved in the study, pursuant to Article 9(2)(a) GDPR. In order to ensure that [[data subject|data subjects]] with the particular neurological disease are in a position to give their [[consent]], the institute consults with a non-profit organisation that represents patients and their relatives. The non-profit organisation gives the advice that most of the potential research [[subject]] should be in a position to give their [[consent]] but that some, given the severity of their disease, will not be able to do so. On the basis of this advice, the institute conducting the study decides to proceed on the basis of [[consent]], but will exclude [[data subject|data subjects]] that it determines are not in a position to give free [[consent]]. 39. If [[data subject|data subjects]] receive any kind of reimbursement or other benefit for participating in a research project, which may be regulated by Union or MS law, then [[controller|controllers]] must determine whether the reimbursement or other forms of incentives affect the choice made by the [[data subject|data subjects]] as to whether or not they agree to the [[processing]] of their [[personal data]]. In this regard, remuneration intended to cover the income that [[data subject|data subjects]] might lose for participating in a research project, for example because they may miss out from work, would normally not affect whether [[consent]] is freely given. Conversely, if the remuneration would constitute a significant part of the [[data subject]]'s regular income, it is more likely that it would affect whether [[consent]] was freely given or not. ### 4.1.2 Specificity 40. In the field of scientific research, it is possible for [[controller|controllers]] to rely on the [[consent]] of a [[data subject]] to collect and process [[personal data]] in a certain area of scientific research when the purposes of research are not fully known at the time of collection of the [[data]]. This requires that certain conditions are met, most notably that additional safeguards should be adopted[^56], in line with recognised ethical standards relevant to the particular field of scientific research[^57]. In the scientific research community, this way of obtaining [[consent]] is commonly referred to as broad [[consent]], which is the term that will be used henceforth in the current guidelines. 41. Another way to obtain [[consent]] is for [[controller|controllers]] to ask [[data subject|data subjects]] to [[consent]] to each different individual research project β€” or part thereof β€” separately, as soon as the purposes for [[processing]] [[personal data]] in those projects become known. This way of obtaining [[consent]] is commonly referred to as dynamic [[consent]]. 42. The determination of how to obtain [[consent]] must be made before [[personal data]] is processed. [[controller|controllers]] should opt for a mechanism of obtaining [[consent]] that provides [[data subject|data subjects]] with sufficient specificity of the purposes of [[processing]] and a high level of [[data]] protection over time, as described in this section. The choice for the type of [[consent]] should, in line with the accountability principle[^58], be appropriately documented, e.g. in a [[risk]] analysis or β€” where required β€” the [[data protection impact assessment]] ([[data protection impact assessment|DPIA]])[^59]. The following sub-sections describe important considerations for [[controller|controllers]] when they determine which way of obtaining [[consent]] is appropriate when [[processing]] [[personal data]] for scientific research purposes. #### 4.1.2.1 Broad consent 43. A [[controller]] can obtain broad [[consent]] from [[data subject|data subjects]] when collecting and storing [[personal data]] for [[processing]] in future research projects within certain areas of scientific research. In certain cases, several [[controller|controllers]] can rely on the same broad [[consent]][^60]. This is possible when it has not yet been decided how to use the [[data]] in individual research projects at the time of collection and when the precise [[processing]] purposes are clearly determined at a later stage, for example when a research plan that details the [[processing]] of [[personal data]] is drafted or finalised. 44. With regard to broad [[consent]], the EDPB has stated that the GDPR cannot be interpreted in a way that allows [[controller|controllers]] to navigate around the key principle of specifying the purposes for which [[consent]] of the [[data subject|data subjects]] is asked[^61]. Accordingly, [[controller|controllers]] cannot ask [[data subject|data subjects]] to [[consent]] to the [[processing]] of their [[personal data]] without any specification of the purposes for which the [[data]] will or may be processed and it is not sufficient to only state that [[personal data]] will be used for scientific research purposes[^62]. Therefore, [[controller|controllers]] intending to process [[personal data]] for scientific research purposes on the basis of broad [[consent]] should define the purposes of future research as clearly as possible[^63]. 45. The delimitation of the purpose should enable [[controller|controllers]] to determine what [[personal data]] are necessary to process[^64] and make it possible for [[data subject|data subjects]] to understand what purposes of [[processing]] they are [[consent]]ing to[^65]. The purpose for [[processing]] can be delimited to a certain field of research, for example medical research in the field of oncology, or sociological research in the field of criminology. However, the purpose can also be delimited in view of expected outcomes of the research, for example conducting genetic research to find better medical treatment methods. 46. When [[controller|controllers]] obtain broad [[consent]], they should ensure that [[data subject|data subjects]] understand the consequence of their choice that their [[personal data]] will be processed in research projects within the area of scientific research that was communicated to them. Thereafter, when the purposes of [[processing]] for individual research projects (or stages thereof) become known and before the [[processing]] is initiated, the [[controller]] should consider if the [[processing]] of [[personal data]] in those projects will be undertaken inside the boundaries of the broad [[consent]]. When doing so, [[controller|controllers]] should evaluate if the [[processing]] of [[personal data]] correlates with the reasonable expectations of the [[data subject|data subjects]], in line with the principle of fairness and the autonomy of [[data subject|data subjects]][^66]. If possible, [[controller|controllers]] should consult with groups representing the [[data subject|data subjects]] to get a better understanding of the [[data subject|data subjects]]' wishes and expectations. If a [[controller]] determines that the [[processing]] of [[personal data]] in an individual research project (or part thereof) would fall outside the scope of a broad [[consent]], then it should ask the [[data subject|data subjects]] to [[consent]] to that individual research project (or stage thereof) β€” i.e. rely on dynamic [[consent]][^67]. 47. Broad [[consent]] can be relied on for the [[processing]] operations of β€” inter alia β€” collection, curation, storage and provision of [[data]] (e.g. by way of transmission or giving access through a secure [[processing]] environment), as well as subsequent [[processing]] operations in individual research projects or parts thereof, as long as the [[processing]] of [[personal data]] remains within the relevant research area and the reasonable expectations of the [[data subject|data subjects]]. For example, patients that have had their genome sequenced as part of personalised medical treatment can [[consent]] to making their [[personal data]] available for the purposes of scientific research in the field of medical genetics for multiple research projects. Broad [[consent]] can also be relied on if a research project progresses towards a direction that was not anticipated or expected at the time when the [[personal data]] was collected, as long as it remains within the relevant research area. 48. If a [[controller]] asks for broad [[consent]], then it should adopt specific safeguards that give [[data subject|data subjects]] sufficient control over the use of their [[personal data]] to offset for the lack of purpose specification[^68]. In particular, [[controller|controllers]] should make detailed information available to [[data subject|data subjects]] (for example on a webpage) on how their [[personal data]] are being processed, as the research progresses in individual research projects. This allows [[data subject|data subjects]] to consider whether or not they want to exercise their rights, e.g. the right to withdraw [[consent]][^69]. In addition, [[controller|controllers]] should adopt measures that enable [[data subject|data subjects]] to receive information about the [[processing]] of their [[personal data]], for example by subscribing to a newsletter. The modality for receiving information and its regularity should be determined in line with the wishes of the [[data subject]], as well as legal requirements or ethical considerations for communication with [[subject|participants]] in research projects. 49. [[controller|controllers]] should also assess whether they should implement safeguards to compensate for the lack of purpose specification. Safeguards may include, among others, measures for use and access controls (such as an independent [[data]] trustee)[^70], time-limited validity of [[consent]] or an independent oversight body[^71]. An oversight body may include a [[representative]] of the research [[subject|participants]], experts in the respective scientific research field, experts in [[data]] protection, as well as the [[data]] protection officer (DPO) (when a DPO has been designated[^72]). The oversight body may in particular be tasked to review proposed new research projects and to give an opinion on the [[processing]] of [[personal data]] for those projects. If the research activities are already covered by an existing oversight mechanism, such as an ethical review board, the [[controller]] can review whether that mechanism provides sufficient oversight of the [[processing]] of [[personal data]] as a safeguard. 50. Finally, [[controller|controllers]] should assess if it may be useful to provide an effective technical tool, or other measure, that empowers [[data subject|data subjects]] in the exercise of their choice regarding [[consent]] to the [[processing]] of their [[personal data]] for individual research projects[^73]. Such a tool should not cause a digital divide, over- or underrepresentation of certain groups of individuals. >[!important]+ **Example 8: [[processing|Processing]] of [[personal data]] for scientific research purposes on the basis of broad [[consent]]** > > > Various university hospitals work together in a research network in order to make [[personal data]] from the treatment of patients available for scientific research through a federated database. The envisaged storage and further [[processing]] of pseudonymised [[personal data]] will be based on broad [[consent]] from each patient, as the specific research projects and the relevant purposes are not foreseeable at the time of medical treatment when [[consent]] is obtained. > > In order to meet the requirements of a comprehensive medical research infrastructure, and to include inter-disciplinary issues as well as questions of multimorbidity, the purposes covered by the given [[consent]] are not limited to any specific disease. Instead, the given [[consent]] covers a broad range of specified medical disciplines. When additional medical disciplines that are not covered by the original [[consent]] are added, [[data subject|data subjects]] are informed about this. The [[data subject|data subjects]] are also asked whether they want to [[consent]] to the [[processing]] of their [[personal data]] in research projects covered by the additional purposes. > > The research network requires the adoption of mandatory safeguards for each participating hospital, including independent review of individual research projects and strict terms of use for researchers. The use of patient [[data]] for a specific research project also requires prior review and approval by an independent ethics committee. General information about the research network and the use of [[personal data]] is provided in flyers and brochures that are available in each hospital, as well as in the media and online. Furthermore, information about every future research project is published on a website and provided individually to [[data subject|data subjects]] who have subscribed to a newsletter. > > The [[personal data]] are collected by the university hospitals when treating [[data]] for a period of five years. During this time period, the [[personal data]] are collected and made available for scientific research purposes, as long as the [[data subject]] does not withdraw their [[consent]]. The collected [[personal data]] can be processed for scientific research purposes for a specified period of time, that spans beyond the time period for [[consent]]. However, no new [[personal data]] collected from the treatment of the [[data subject|data subjects]] are made available for scientific research after the five-year period has expired. If a [[data subject]] visits a university hospital after the five-year period has expired, they are asked again if they want to [[consent]] to making their [[personal data]] available for scientific research purposes for five more years. #### 4.1.2.2 Dynamic consent 51. Relying on dynamic [[consent]] means that [[controller|controllers]] initially obtain [[data subject|data subjects]]' [[consent]] to the [[processing]] of their [[personal data]] for a research project in a certain area of research, or for specific stages of a research project that are already known at the time of collection of their [[personal data]]. For [[processing]] of [[personal data]] for purposes related to subsequent research projects that were not known at the time of collection of [[consent]], or stages within a project that were introduced after the initial [[consent]] had been obtained, a separate [[consent]] is obtained. If a [[controller]] relied on broad [[consent]] when it collected the [[personal data]], there are circumstances where it should rely on dynamic [[consent]] when further [[processing]] the [[personal data]] for scientific research purposes. This includes situations where the further [[processing]] of [[personal data]] for individual scientific research projects (or parts thereof) would fall outside the reasonable expectations of [[data subject|data subjects]], or if those projects would not fall within the specific research area that a [[data subject]] has [[consent]]ed to. 52. Dynamic [[consent]] enables the [[controller]] to address changes in both the researchers' scientific needs and the [[data subject|data subjects]]' interests, when [[processing]] [[personal data]] for scientific research purposes over extended periods of time. To that end, dynamic [[consent]] can facilitate the conduct of long-term scientific research activities, as it allows [[controller|controllers]] to continuously communicate with research [[subject|participants]], as well as manage the research. For example, if the researchers are in a close and prolonged relationship with the [[data subject|data subjects]], as may be the case in fields of research where researchers interact with research [[subject|participants]] on a regular basis in long-term research projects, dynamic [[consent]] is often the appropriate way of obtaining [[consent]]. ### 4.1.3 Consent to participate in scientific research pursuant to ethical or legal requirements not stemming from the GDPR 53. There can be ethical or legal requirements to obtain the [[consent]] of [[data subject|data subjects]][^74], expressing their willingness to participate in scientific research as research [[subject|participants]], as a prerequisite for carrying out certain types of research[^75]. An individual's [[consent]] to participate in research pursuant to ethical or legal requirements is typically intended to ensure the protection of the right to human dignity and the right to integrity of [[data subject|data subjects]] as individuals, under Article 1 and 3 of the CFREU[^76]. Such [[consent]] is not required by the GDPR, but may be considered as an additional safeguard according to Article 89 GDPR[^77]. 54. It is important to underline that [[consent]] to participate in scientific research, which stems from ethical or legal requirements, should be distinguished from [[consent]] to the [[processing]] of [[personal data]] as a legal basis pursuant to the GDPR[^78]. This is because requirements of [[consent]] that fulfil an ethical standard or legal obligation typically goes beyond the [[processing]] of [[personal data]] and do not always fulfil the requirements of a valid [[consent]] pursuant to the GDPR, in particular explicit [[consent]] that is necessary for the [[processing]] of special categories of [[data]], pursuant to Article 9(2)(a) of the GDPR. Therefore, if a [[controller]] that asks for [[consent]] to participate in scientific research, following ethical or legal requirements, **also** intends to rely on [[consent]] as legal basis for [[processing]] of [[personal data]] β€” pursuant to Article 6(1)(a) (and Article 9(2)(a), if applicable) of the GDPR β€” then the [[controller]] needs to determine and be able to demonstrate[^79] whether the [[consent]] given fulfils the conditions of the GDPR to provide a valid legal basis for the [[processing]] of [[personal data]]. 55. A [[controller]] that asks [[data subject|data subjects]] to [[consent]] to the participation in a research project and to the [[processing]] of [[personal data]] at the same point in time must ensure that the request for [[consent]], pursuant to the GDPR, is clearly distinguishable[^80]. For many research projects, it will be possible to request [[data subject|data subjects]] to [[consent]] to both the participation in the research project as such and the [[processing]] of personal in the same interface or [[consent]] form. As long as the different requests for [[consent]] are sufficiently distinguishable, it may even be preferrable to provide a common interface or [[consent]] form, as information on the [[processing]] of [[personal data]] provided to [[data subject|data subjects]] under the GDPR should be as concise as possible[^81]. However, for research projects that involve particularly complex or sensitive [[processing]] of [[personal data]], it may be necessary for the [[controller]] to provide a separate interface or form that only addresses [[consent]] pursuant to the GDPR[^82]. ## 4.2 Public interest or exercise of official authority (Article 6(1)(e) GDPR) 56. Where scientific research is recognised as a societal good that contributes to the general knowledge and the wellbeing of society, there is significant public interest in conducting scientific research activities. Accordingly, [[processing]] of [[personal data]] in the public interest, pursuant to Article 6(1)(e) GDPR, is a legal basis of particular importance for scientific research[^83]. 57. Pursuant to Article 6(3) GDPR, [[processing]] of [[personal data]] in the public interest or in the exercise of official authority[^84] must be based on a legal basis laid down by Union or MS law to which a [[controller]] is subjected[^85]. In contrast to Article 6(1)(c) GDPR, Union and MS law in the scope of Article 6(1)(e) does not always determine precise obligations for a [[controller]], but rather authorises [[controller|controllers]] to process [[personal data]] when necessary to fulfil a task of public interest or in the exercise of official authority vested in the [[controller]]. For example, Union and MS law may authorise a [[controller]] to conduct scientific research in a certain field in the public interest, without necessarily specifying how the research is to be undertaken. 58. Relying on [[performance of an AI system|performance]] of a task carried out in the public interest, or exercise of official authority, as a legal basis is not limited to public entities conducting scientific research. Private entities may also rely on that legal basis, if the legal act covers their activities[^86]. [[controller|controllers]] that are not authorised to process [[personal data]] on the basis of Article 6(1)(e) GDPR can instead assess whether they can rely on [[consent]] (Article 6(1)(a)[^87]) or legitimate interest ([[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]][^88]). 59. Finally, Union or MS law providing for [[processing]] of [[personal data]] pursuant to Article 6(1)(e) GDPR, and any [[processing]] of [[personal data]] reliant upon such laws, must comply with the principles of necessity and proportionality[^89]. ## 4.3 Legitimate interest (Article 6(1)(f) GDPR) 60. The EDPB's Guidelines 1/2024 on legitimate interest based on [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]] (hereafter Guidelines on legitimate interests[^90]) provide general guidance on the legal basis legitimate interest. The following sub-section provides additional guidance relevant to the [[processing]] of [[personal data]] for scientific research purposes when relying on [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]]. 61. Scientific research and the accompanying [[processing]] of [[personal data]] can be a legitimate interest under [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]][^91], regardless of whether it is undertaken on a non-profit or commercial basis[^92]. Moreover, scientific research is generally attributed with special importance as an activity that is beneficial for society[^93]. Accordingly, a [[controller]] that intends to process [[personal data]] for scientific research purposes on the basis of legitimate interest can, when applying the balancing test pursuant to [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]], often attribute significant weight to the [[processing]] of [[personal data]] for scientific research purposes, in relation to the [[data subject|data subjects]]' interests or fundamental rights or freedoms. 62. The [[controller]] must consider the reasonable expectations of the [[data subject]][^94]. In certain areas of activities, there may be a more apparent expectation of the [[data subject|data subjects]] that their [[personal data]] will be processed for scientific research purposes. The expectations of [[data subject|data subjects]] may, for example, be determined following a consultation with organisations that represent categories of [[data subject|data subjects]][^95]. 63. Finally, when assessing if the legitimate interest for a scientific research purpose overrides the [[data subject|data subjects]]' interests or fundamental rights or freedoms, the [[controller]] should also take the requirement to provide appropriate safeguards, pursuant to Article 89(1) of the GDPR, into account. In this regard, the [[controller]] must assess the appropriateness of such safeguards in order to avoid, reduce or mitigate the impact on the rights and freedoms of [[data subject|data subjects]] as much as possible[^96]. Any remaining [[risk|risks]] of a negative impact on the rights and freedom of [[data subject|data subjects]] should then be weighed in the balancing test, in order to determine whether the [[risk|risks]] are of such a nature or extent as to outweigh the legitimate interests of the [[controller]] or a [[third party]][^97]. If a [[controller]] determines that the adopted safeguards are not sufficient to address the identified [[risk|risks]], then additional mitigating safeguards should be adopted and the [[controller]] should undertake the balancing test anew[^98]. If the [[controller]] considers that no sufficient mitigating measures can be taken, then the [[processing]] cannot be based on [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]] and the [[controller]] should consider whether another legal basis is applicable[^99]. ## 4.4 Processing special categories of personal data for scientific research purposes (Article 9 GDPR) 64. If special categories of [[personal data]], pursuant to [[SiteMap/Official Texts/GDPR#article-9--processing-of-special-categories-of-personal-data|Article 9(1) GDPR]], are processed for scientific research purposes, then a [[controller]] must assess which of the derogations under [[SiteMap/Official Texts/GDPR#article-9--processing-of-special-categories-of-personal-data|Article 9(2) GDPR]] it can rely upon to process such [[data]][^100]. The notion of special categories of [[personal data]] covers not only [[data]] that directly reveal sensitive information about a [[data subject]], but also [[personal data]] that can be used to collate or deduce such information, and sensitive information inferred from the [[data]] processed[^101]. 65. The [[risk|risks]] associated with [[processing]] of special categories of [[personal data]] must be mitigated by implementing appropriate and effective safeguards, in line with Article 89(1) GDPR[^102]. If [[controller|controllers]] process special categories of [[personal data]] on a large scale, they must assess and mitigate the [[risk|risks]] associated with such [[processing]] through a [[data protection impact assessment|DPIA]][^103]. 66. MS law regulating the [[processing]] of genetic, biometric, or [[data concerning health|health data]] may impose further conditions, including limitations on [[controller|controllers]][^104]. While such Union or MS law is outside the scope of the present guidelines, those exceptions may be of particular importance for [[controller|controllers]] when [[processing]] those categories of [[personal data]] for scientific research purposes. ### 4.4.1 Explicit consent (Article 9(2)(a) GDPR) 67. [[controller|Controllers]] may also assess if they can rely on the explicit [[consent]] of [[data subject|data subjects]], including broad[^105] or dynamic [[consent]][^106], pursuant to Article 9(2)(a) GDPR, to process special categories of [[personal data]] for scientific research purposes. The considerations outlined in section 4.1 are also relevant when a [[controller]] considers relying on Article 9(2)(a) GDPR, as a derogation from the prohibition of [[processing]] to special categories of [[personal data]]. ### 4.4.2 Personal data manifestly made public by the data subject (Article 9(2)(e) GDPR) 68. If a [[data subject]] has manifestly made special categories of [[personal data]] public, a [[controller]] may assess whether it can rely on Article 9(2)(e) GDPR to process that [[data]] for scientific research purposes. In this regard, the word *manifestly* implies that there is a high threshold for relying on the exemption, pursuant to Article 9(2)(e) GDPR[^107]. 69. In order to assess whether [[personal data]] has been made manifestly public, the [[controller]] needs to "ascertain whether the [[data subject]] had intended, explicitly and by a clear affirmative action, to make the [[personal data]] in question accessible to the general public"[^108]. A clear affirmative action may, for example, consist of participating in a public event that is broadcasted online[^109]. 70. A [[controller]] that wants to process special categories of [[personal data]] in individual posts on social media for scientific research purposes should make sure that the [[data]] was posted following an active choice by the [[data subject]]. The [[controller]] should check the settings available to [[user|users]] on the social media platform. The [[controller]] should also verify that [[user|users]] who post public content can only do so after having adjusted the necessary settings, with knowledge that their [[data]] will be made public[^110]. 71. [[controller|controllers]] should also consider the context in which the special categories of [[data]] are made public and by whom[^111]. In that respect, special categories of [[personal data]] that are actively posted by [[data subject|data subjects]] themselves (for example by an influencer or a video blogger) can indicate that the [[data]] has been manifestly made public, which would not be the case if the [[data]] was posted by a [[third party]] (e.g. a photo published by a friend or relative which reveals special categories of [[data]])[^112]. 72. Finally, the EDPB reiterates that the fact that a [[data subject]] has made special categories of [[personal data]] public at a certain point in time and in a certain context, does not mean that the [[data subject]] has also made other [[personal data]] β€” within the same category of [[data]] β€” public[^113]. >[!important]+ **Example 9: [[personal data]] which are manifestly made public by the [[data subject]]** > > > A private research institute for psychology is conducting a study on the impact of frequent use of social media platforms on the psychological well-being of young adults. The research team investigates the possibility of collecting [[personal data]] concerning health from [[data subject|data subjects]]' profiles that are public on a social media platform, on the basis of legitimate interest, pursuant to [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]], and the derogation for special categories of [[data]] manifestly made public, pursuant to Article 9(2)(e). To inform itself of the possibility to use the [[data]], the research team reviews the privacy policy and the individual settings available to [[user|users]] on the social media platform. Following this review, the research team can determine that [[user|users]]' [[personal data]] is not made public by default, but only following an active choice in the platform settings by the individual [[user]]. Therefore, the researchers determine that it is possible to process the [[personal data]] on the basis of [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]], and the derogation pursuant to Article 9(2)(e). In order to enhance the privacy of [[data subject|data subjects]] whose [[personal data]] will be processed in the research project, all [[data]] collected from the social media platform is pseudonymised before it is entered into the [[data]] set. Furthermore, [[data subject|data subjects]] are informed by the research institute through the social media platform, in accordance with Article 14(1) GDPR, and given the opportunity to object to the [[processing]] of [[personal data]]. > **Example 10: [[personal data]] which are manifestly made public by the [[data subject]]** > > Researchers at a public university undertake research in the field of political science where they are [[processing]] [[personal data]] on political opinions that have been made public on social media or other media outlets by politicians. As the political orientations are manifestly made public by the [[data subject]] on publicly accessible social media profiles and through media outlets, the derogation β€” pursuant to Article 9(2)(e) of the GDPR β€” applies to the [[processing]] of this special category of [[personal data]]. ### 4.4.3 Derogations laid down in Union or MS law (Article 9(2)(g), (i) and (j) GDPR) 73. [[controller|controllers]] may rely on derogations to the prohibition of [[processing]] of special categories of [[data]] provided for by Union or MS law, pursuant to Article 9(2)(g), (i) and (j) of the GDPR, when [[processing]] [[personal data]] for scientific research purposes.[^114] Such laws must "respect the essence of the fundamental rights and observe the principle of proportionality"[^115]. To fulfil the principle of proportionality, the laws must β€” inter alia β€” provide for suitable and specific measures, to safeguard the fundamental rights and interests of the [[data subject]], to be adopted by the [[controller]][^116]. 74. A [[controller]] that intends to rely on a derogation pursuant to Article 9(2)(g), (i) or (j) GDPR should consider and be able to demonstrate that the law in question applies to the intended [[processing]] for scientific research purposes. Moreover, the [[controller]] should assess and be able to demonstrate that it has implemented suitable and specific measures required by the concerned Union or MS law. In this regard, [[controller|controllers]] might have to adopt appropriate safeguards, pursuant to Article 89(1) GDPR[^117], in addition to measures mandated by law. This will be relevant when the [[processing]] operation in question gives rise to [[data]] protection [[risk|risks]] that were not anticipated by the law providing an exemption under [[SiteMap/Official Texts/GDPR#article-9--processing-of-special-categories-of-personal-data|Article 9(2) GDPR]]. The need to adopt such safeguards will depend on the nature, scope, context and purposes of [[processing]] as well as the [[risk|risks]] of varying likelihood and severity for the rights and freedoms of natural persons. 75. Finally, the EDPB notes that reliance on [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]] in the context of medical research (such as clinical trials) also requires the application of a derogation, pursuant to [[SiteMap/Official Texts/GDPR#article-9--processing-of-special-categories-of-personal-data|Article 9(2) GDPR]]. One example of a provision in Union law that provides for a derogation pursuant to [[SiteMap/Official Texts/GDPR#article-9--processing-of-special-categories-of-personal-data|Article 9(2) GDPR]] is Article 53(1)(e) in the European [[data concerning health|Health Data]] Space Regulation (EHDS). This provision can be relied upon for [[controller|controllers]] intending to process [[data concerning health|health data]] for the purposes of conducting scientific research on the basis of [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]][^118]. # 5. Obligations to inform (Articles 12-14 GDPR) 76. The EDPB's Guidelines on transparency under Regulation 2016/679 (hereafter Guidelines on transparency[^119]) provide general guidance on the obligations to inform, pursuant to Article 12-14 GDPR. The following section provides additional guidance relevant to the [[processing]] of [[personal data]] for scientific research purposes. ## 5.1 General 77. When a [[controller]] intends to or anticipates that it will process [[personal data]] for scientific research purposes over longer periods of time, then it should give [[data subject|data subjects]] an opportunity to voluntarily provide contact details. This will make it possible for [[data subject|data subjects]] to get necessary updates on the [[processing]] of their [[personal data]]. [[data subject|data subjects]] should get this opportunity, even if the purposes for [[processing]] [[personal data]] do not require the [[processing]] of contact details. 78. Examples of when it might be relevant to gather contact details are generational studies or when the research is based on [[data]] contained in a research infrastructure (such as a biobank or a [[data]] repository). In such cases, the [[data subject|data subjects]] should be given a choice of how to be contacted, for example by e-mail. To overcome the digital divide, [[data subject|data subjects]] should also be given an opportunity to be contacted by mail or telephone[^120]. 79. [[controller|controllers]] should consider setting up a webpage or providing an application through which [[data subject|data subjects]] can stay informed on the [[processing]] of their [[personal data]], if relevant using a layered approach, as detailed in the Guidelines on transparency[^121]. If several [[controller|controllers]] participate in the [[processing]] of [[personal data]] in scientific research activities, the setting up of webpages or applications should be co-ordinated. In this regard, it should be noted that for certain types of research, or if the research project only concerns a limited number of [[subject|participants]], it might not be necessary to provide a webpage or application, as the [[controller]] may have more direct ways of informing the [[data subject|data subjects]], for example via calls, text messages, e-mail or regular mail. 80. [[controller|controllers]] should also consider providing a privacy dashboard, as described in the Guidelines on transparency[^122], and in case [[consent]] is relied on as a legal basis, provide the [[data subject]] with [[consent]] receipts, i.e. a digital record on the [[consent]] statement[^123]. A privacy dashboard can also enable [[data subject|data subjects]] to exercise their rights[^124], give or withdraw their [[consent]] (where applicable) in an easy and accessible manner[^125], or be used to ask questions about the [[processing]] of their [[personal data]] to the [[controller]]. 81. Moreover, [[controller|controllers]] should consider setting up a contact point, either digital or analogue β€” but preferably both β€” through which [[data subject|data subjects]] can pose questions, get information or exercise their [[data]] protection rights. This will allow [[data subject|data subjects]] to adequately and consciously make decisions regarding the use of their [[personal data]]. In this regard, the EDPB underlines that it follows from the general obligations of the GDPR that [[data subject|data subjects]] must have efficient ways of contacting [[controller|controllers]][^126]. ## 5.2 Provision of information when personal data are collected directly from the data subject (Article 13(1) GDPR) 82. When [[personal data]] are collected directly from the [[data subject]], then the [[controller]] must provide information on [[processing]] of [[personal data]] at the time of collection. The following sub-section provide examples on how information should best be provided to [[data subject|data subjects]] in some situations where [[personal data]] is collected for scientific research purposes. > [!important]+ **Example 11: Information to [[data subject|data subjects]] whose [[personal data]] is directly collected from the [[data subject]] through a clinical trial** > > > A pharmaceutical company is conducting a clinical trial for a new pharmaceutical product in co-operation with a healthcare facility. In accordance with Article 28(1)(c) of the Clinical trials regulation (CTR), the informed [[consent]] of the research [[subject|participants]] to participate in the clinical trial is required. When the research [[subject|participants]] sign up for the trial, they are informed during an interview and given a folder that includes a form for informed [[consent]] and information about the trial, possible side effects of the pharmaceutical product, how the research [[data]] will be processed and the objectives of the trial. The folder also contains a separate section which informs about the central elements of [[processing]] of [[personal data]], which is clearly indicated in a table of contents in the folder. In addition, [[data subject|data subjects]] are informed about the possibility of getting more detailed information through a dedicated webpage and a contact point (with an email address and a phone number) through which [[data subject|data subjects]] can pose questions, receive information or exercise their [[data]] protection rights. >[!important]+ **Example 12: Information to [[data subject|data subjects]] whose [[personal data]] is directly collected from the [[data subject]] through interviews** > > > A university faculty of labour studies is conducting a study on participation when making decisions in the work place. The researchers are gathering [[data]] by phone calls or in-person interviews with [[data subject|data subjects]] who are recruited by phone from a statistically randomised cohort of research [[subject|participants]]. The faculty adopts a layered approach when providing information. Therefore, the researchers inform the [[data subject|data subjects]] orally about the central elements of [[processing]] of [[personal data]] before the interview starts[^127]. The researchers also inform that more detailed information can be found on the webpage of the university, or be obtained by calling the university's central number. >[!important]+ **Example 13: Information to [[data subject|data subjects]] whose [[personal data]] is directly collected from the [[data subject]] through an application** > > > A university faculty for arts and music is researching preferences and listening habits for fans of folk music. To gather research [[data]], the researchers have created an extension application to a music platform that contains a survey. [[advertisement|Advertisement]] for the research appears in the news feed of the music platform, whereby [[data subject|data subjects]] can download the extension application. > > The faculty adopts a layered approach when providing information. Therefore, [[data subject|data subjects]] are provided with the information about the central elements of [[processing]] directly in the app before the download starts and their [[personal data]] is processed. The app also provides a link to the faculty's webpage with more detailed information. Since the legal basis for [[processing]] is the [[consent]] of the research [[subject|participants]], [[data subject|data subjects]] are also asked to [[consent]] to the [[processing]] of their [[personal data]], by clicking a clearly distinguished checkbox, before downloading the extension application. 83. The obligation to provide information pursuant to Article 13 of the GDPR applies also if the [[controller]] does not itself process or has access to any [[personal data]], nor has any direct or indirect contact with the [[data subject]][^128]. One such case is if the [[processing]] of [[personal data]] for scientific research is undertaken by a [[processor]] on behalf of the [[controller]], or a joint [[controller]]. In such situations, the [[processor]] or the other [[controller]] may provide information to [[data subject|data subjects]] on the [[controller]]'s behalf[^129]. If a [[controller]] is contacted by a [[data subject]] that requests information, pursuant to Article 15 GDPR, the [[controller]] must fulfil the request for information by the [[data subject]], for example by requesting the [[processor]] or other [[controller]] to reply to the request on their behalf. > [!important]+ **Example 14: Provision of information when a [[controller]] does not have any contact details or direct contact with [[data subject|data subjects]]** > > > A retail analytics company operates a nationwide loyalty card program. The company lawfully collects and stores purchase [[data]] from [[customer|customers]] who have signed up to the program, on the basis of [[consent]]. [[data subject|data subjects]] can also [[consent]] to the use of the [[data]] for scientific research purposes. > > A university business school wants to conduct scientific research on [[consumer]] purchasing behaviour. It decides on the purposes and methodology for the research, and determines what [[data]] it needs to conduct the research. > > The university contracts the retail analytics company to process loyalty card [[data]] on its behalf. Even though the university does not hold or process the [[personal data]], it is the [[controller]] under Article 4(7) GDPR. > > A [[customer]] wants to know more about how their individual [[personal data]] are processed for the scientific research project conducted by the university and contacts the university's DPO. Since the university cannot identify the [[data subject]], the DPO informs the university which in turn instructs the retail analytics company to provide the necessary information to the DPO. Having received the information, the DPO informs the [[data subject]] about the [[processing]] of their [[personal data]] at the retail analytics company. ## 5.3 Further processing of personal data for further scientific purposes (Article 13(3) GDPR) 84. If a [[controller]] that collected [[personal data]] for another purpose than scientific research at a later point in time decides to further process the [[personal data]] for scientific research purposes, then the [[controller]] must inform the [[data subject|data subjects]] accordingly[^130]. In line with the principle of purpose limitation, this also applies if the [[controller]] intends to process the [[personal data]] for a new scientific research purpose that is different from an initial scientific research purpose[^131]. 85. The [[controller]] must inform the [[data subject|data subjects]] in advance of the further [[processing]] operations. Provision of information within a sufficient period before the [[processing]] starts should allow the [[data subject|data subjects]] to consider the impact of the further [[processing]] of their [[personal data]]. Several factors should be taken into account to determine such period, such as the intrusiveness of the [[processing]] into the private life, its impact on the protection of [[personal data]], the [[processing]] of special categories of [[data]] or other types of sensitive [[personal data]], the reasonable expectations of the [[data subject]], or the fact that [[data subject|data subjects]] are in a vulnerable position[^132]. This also allows [[data subject|data subjects]] to exercise their rights under the GDPR, not least to withdraw their [[consent]] in case the [[processing]] operations concerns a certain area of scientific research to which the [[data subject]] has given broad [[consent]],[^133] or to object to the further [[processing]][^134], when applicable. 86. It may be challenging for [[controller|controllers]] to inform [[data subject|data subjects]] of further [[processing]] for scientific research purposes if they have not retained the contact details of the [[data subject|data subjects]], for example due to [[pseudonymisation]] of the [[personal data]] where identifiers or a table of correspondence are not accessible for the [[controller]]. To that end, if the [[controller]] knows at the time of collection (or when contact details are deleted because they are not necessary to process) that the [[personal data]] will be processed for scientific purposes at a later stage, then the [[controller]] should make sure that [[data subject|data subjects]] can stay informed, in accordance with Articles 12 and 13 GDPR[^135]. 87. [[controller|controllers]] should not knowingly delete contact details if they intend to or anticipate that they will further process [[personal data]] for scientific research purposes. If a [[controller]] knowingly deletes contact details and then fails to inform [[data subject|data subjects]] directly when further [[processing]] [[personal data]] for scientific research purposes, this may lead to a breach of the principle of transparency, pursuant to Article 5(1)(a) GDPR, as well as Article 13(3). 88. If the [[controller]] at the time of collection of the [[personal data]] did not know or anticipate that it would process [[personal data]] for scientific research purposes at a later stage, it may not have contact details of the [[data subject|data subjects]]. If the [[controller]] has identifiers, such as a name or administrative identification number[^136], it should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort[^137]. 89. If public registries or other viable means are not available, if their use would require a disproportionate effort,[^138] or if a [[data subject]] is not listed in any of the available sources, then the [[controller]] should inform [[data subject|data subjects]] indirectly[^139]. The provision of such information should ensure that as many [[data subject|data subjects]] concerned as possible are reached. Relevant means to make the information publicly available, which need to be adjusted depending on the context of the research project and the [[data subject|data subjects]] involved, include: - Providing information on a website, as detailed above[^140]; - Posting information in localities where the relevant [[data subject|data subjects]] are present regularly (e.g. schools, universities, correctional facilities, medical [[care]] facilities, pharmacies, etc); - Advertising in public spaces, on the television or radio, in newspapers β€” in particular local media or online; and - Providing information through associations representing research [[subject|subjects]] (e.g. patient organisations, trade unions, non-profit organisations etc). ## 5.4 Provision of information when personal data are not collected directly from the data subject (Article 14(1) GDPR) ### 5.4.1 General 90. When a [[controller]] receives [[personal data]] from another [[controller]] and intends to process it for scientific research purposes, the obligation to inform pursuant to Article 14 GDPR applies. This means that the receiving [[controller]] must make sure that the [[data subject|data subjects]] receive all mandatory information about the [[processing]] of [[personal data]]. 91. New [[personal data]] generated in the course of a research project will fall within the scope of Article 14 of the GDPR and are not considered as collected directly from [[data subject|data subjects]][^141]. For example, a [[controller]] may in the course of scientific research undertake [[data]] analysis which generates new [[personal data]] that is derived from the [[personal data]] provided by [[data subject|data subjects]]. This could occur where a researcher diagnoses a [[data subject]] with a psychological condition, on the basis of [[personal data]] provided by the [[data subject]]. Other situations could be where researchers generate a pseudonym or derive a [[data]] point from an identification or social security number, or add additional information about [[data subject|data subjects]], such as their gender. 92. When a [[controller]] provides [[personal data]] to another [[controller]] for scientific research purposes, it is a good practice for the providing and receiving [[controller|controllers]] to cooperate and adopt measures that enable the receiving [[controller]] to fulfil its obligations to inform. For example, the receiving [[controller]] may ask the providing [[controller]] to share the necessary information to the [[data subject|data subjects]]. An alternative can be that the initial [[controller]] may refer [[data subject|data subjects]] to information provided in accordance with Article 14 GDPR on the webpage of the receiving [[controller]] or another webpage. 93. If [[personal data]] is provided by intermediaries for scientific research purposes, for example where a [[provider]] of a research database collects [[personal data]] from several [[controller|controllers]] that is thereafter provided to researchers conducting individual research projects, the EDPB considers it a good practice for all involved parties to agree on how to comply collectively with their transparency obligations[^142]. 94. If a [[controller]] or [[processor]] receives pseudonymised [[data]] from another [[controller]] to be processed for scientific research, then the [[data subject|data subjects]] should be informed about how they can exercise their rights, for example by providing the pseudonym relating to their [[personal data]][^143]. >[!important]+ **Example 15: Two [[controller|controllers]] liaising in order to fulfil their transparency obligations** > > > A university wishes to study the mental and physical health and well-being of patients with symptoms of post-covid conditions. For this purpose, the university (being the [[controller]] for the [[data]] [[processing]] related to the research) wishes to use [[personal data]] retained by specialised health centres (being [[controller|controllers]] for the [[data]] [[processing]] related to the provision of health [[care]]), that was originally collected for the purposes of providing health [[care]]. > > In this case, the health centre must provide information to the patients, i.e. the [[data subject|data subjects]], about the transmission of their retained [[personal data]] in pseudonymised format to the university. The university must inform the patients of the [[processing]] of their [[personal data]] for the research. > > A good practice in this situation is for the university to liaise with the health centres, and provide the latter with information about their [[processing]] of [[personal data]], where relevant with a reference to e.g. a webpage where all information can be found, that can be provided to the patients, as the health centres hold the contact details of [[data subject|data subjects]]. ### 5.4.2 Exceptions from the obligation to provide information (Article 14(5) GDPR) 95. Pursuant to Article 14(5) GDPR, a [[controller]] that did not collect [[personal data]] directly from the [[data subject|data subjects]] is in certain situations exempt from providing information. Circumstances relevant in the field of scientific research are detailed in the subsections below. 96. The exceptions in Article 14(5) GDPR must be interpreted restrictively and should not be relied on routinely[^144]. #### 5.4.2.1 The data subject already has the information (Article 14(5)(a) GDPR) 97. As further explained in section 5.5, it is not necessary to inform [[data subject|data subjects]] if they already have all the relevant information on the [[processing]] of [[personal data]]. In this respect, the same considerations apply regardless of whether a [[controller]] collects the [[personal data]] directly from the [[data subject]] or not. The receiving [[controller]] should determine whether the [[data subject]] was sufficiently informed when it receives the [[personal data]]. #### 5.4.2.2 Provision of information proves impossible (Article 14(5)(b) GDPR) 98. There will be very few situations in which a [[data]] [[controller]] can demonstrate that it is actually impossible to provide the information to [[data subject|data subjects]][^145]. However, such situations may arise in the context of scientific research, for example when the [[controller]], despite reasonable efforts, cannot obtain contact details of [[data subject|data subjects]]. 99. Even if a [[controller]] may be exempt from providing information to [[data subject|data subjects]] directly, the [[controller]] should still endeavour to provide information by other means, for example via a website or by advertising in relevant channels[^146]. #### 5.4.2.3 Disproportionate effort (Article 14(5)(b) GDPR) 100. If a [[controller]] can demonstrate that it would require a disproportionate effort to inform the [[data subject|data subjects]] individually, it is exempt from doing so, pursuant to Article 14(5)(b) GDPR. In the field of scientific research, the following situations may in particular be associated with a disproportionate effort: - A high number of [[data subject|data subjects]] to inform[^147], for example large registries with patient [[data]], population [[data]] or [[data]] on pupils accumulated nation-wide, while many contact details are outdated due to the age of the [[dataset]]. This exemption cannot be relied on if the [[controller]] can lawfully obtain a high number of contact details easily, for example through the use public registers[^148]; - Difficulties of finding the contact details of the [[data subject]], for example if the contact details were collected a long time ago and might no longer be accurate and there are no reasonable means available to the [[controller]] to obtain current contact details; or - The age of the [[personal data]][^149], e.g. if the [[data]] set is older than 10 years. 100. When assessing the effort involved to provide the information to [[data subject|data subjects]] against the impact and effects on the [[data subject]] if they are not provided with the information directly[^150], the [[controller]] should consider the safeguards that it has adopted pursuant to Article 89(1) of the GDPR, as well as measures to provide information indirectly. #### 5.4.2.4 Individual information which is likely to render impossible or seriously impair the achievement of the scientific research objectives (Article 14(5)(b) GDPR) 102. There are certain types of research where the provision of individual information would render impossible or seriously impair the achievement of the objectives of a scientific research project. For example, the provision of information to [[data subject|data subjects]] may introduce bias to the research or otherwise negatively affect the quality of the [[personal data]] that is collected. In such circumstances, it may be justified to carry out so-called covert research, where it is allowed to not inform [[data subject|data subjects]] individually, pursuant to Article 14(5)(b) GDPR. 103. It should be noted that [[processing]] of [[personal data]] for scientific research without individually informing the [[data subject|data subjects]] should only occur where it is strictly necessary, as it constitutes a serious interference with the fundamental rights and freedoms of [[data subject|data subjects]]. Accordingly, when [[controller|controllers]] conduct covert research, they should adopt appropriate safeguards, pursuant to Article 89(1) GDPR, to counter-act that interference. Such safeguards may include ethical review or monitoring of the [[processing]] of [[personal data]], to ensure that it is conducted with due respect to the fundamental rights and freedoms of [[data subject|data subjects]]. While the provision of individual information during the course of research may render impossible or seriously impair the achievement of the objectives of a scientific research project, [[controller|controllers]] should nonetheless provide public information on the [[processing]], as outlined above[^151]. Alternatively, [[data subject|data subjects]] could be individually informed as soon as provision of information would no longer render impossible or seriously impair the scientific research objectives. >[!important]+ **Example 16: Individual information which is likely to render impossible or seriously impair the achievement of a research project** > > > Researchers at a university faculty in the field of social sciences are carrying out research on public servants, such as medical staff, teachers and police officers, who report suspected parental child abuse to social services. The reports that are examined by the researchers contain highly [[special categories of personal data|sensitive data]], including alleged physical and sexual misconduct and assault, information about sexuality, potentially criminal actions etc. that involves children as well as parents or guardians that are alleged or suspected perpetrators. > > Under Article 14(1) GDPR, the researchers would normally be obliged to inform both the children and parents or guardians of the [[processing]] of [[personal data]]. However, the provision of such information would inevitably lead to the persons being alleged of abuse to object to the [[processing]] of their [[personal data]]. This would in turn render the research impossible or at the very least seriously impair the research. Therefore, the researchers determine that they can rely on the exception provided for in Article 14(5)(b) GDPR, in order to not inform the persons whose [[personal data]] is processed for the scientific research project. > > The researchers adopt safeguards to preserve the integrity of [[data subject|data subjects]], including ethical approval, [[pseudonymisation]] of research [[data]], storage of research [[data]] in secure storage facilities with strict [[data]] controls, as well as limited retention of research [[data]] following peer review and external scrutiny of research results. #### 5.4.2.5 Obtaining or disclosure is expressly laid down by Union or MS law (Article 14(5)(c) GDPR) 104. If, pursuant to Union or MS law, a [[controller]] must obtain or disclose [[personal data]] for scientific research purposes, and that law "imposes on the [[controller]] a sufficiently comprehensive and binding obligation to provide to the [[data subject]] information relating to obtaining or disclosure of [[personal data]]",[^152] then there is no separate obligation to inform the [[data subject|data subjects]] about the [[processing]], at the condition that the information provided to [[data subject|data subjects]] is at least equivalent to that required by Articles 14(1) to (4) GDPR[^153]. #### 5.4.2.6 The personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or MS law, including a statutory obligation of secrecy (Article 14(5)(d) GDPR) 105. In the field of scientific research, the exception from providing information on [[processing]] of [[personal data]] due to obligations of secrecy might be more prevalent than in other fields of activity. This is because there may be statutory requirements that prohibit researchers from disclosing information on the [[processing]] of [[personal data]] to preserve the integrity of the research [[subject]][^154]. Such requirements are particularly important in situations where a research [[subject]] discloses sensitive [[personal data]] about a third person, the disclosure of which could render the relationship between the research [[subject]] and the third person problematic, or even endanger the research [[subject]][^155]. >[!important]+ **Example 17: Confidentiality of information on [[processing]] of [[personal data]] due to statutory obligation of secrecy** > > > A research project is carried out on domestic violence and abuse in relationships. The method for gathering [[data]] is conducting interviews with potential victims. During such interviews, [[personal data]] is gathered on [[data subject|data subjects]] who might be alleged perpetrators of domestic violence and abuse. > > While the GDPR would normally require the [[controller]] to inform the [[data subject|data subjects]] who are alleged perpetrators, doing so could endanger the research [[subject|participants]] who are being interviewed, i.e. the potential victims. For this reason, the researchers carrying out the interviews are bound by a statutory obligation of secrecy, which the research [[subject|participants]] are informed about before the interview. > > In turn, the rights and freedoms of the alleged perpetrators are also protected by mandatory safeguards provided for by the relevant law in question. These safeguards include [[pseudonymisation]] of all [[personal data]], as well as a strict secrecy obligation that prohibits the researchers from disclosing the [[personal data]] to other parties, such as [[law enforcement]] authorities. 106. Another situation where a [[controller]] may be justified in not informing [[data subject|data subjects]] on the [[processing]] of their [[personal data]] is when a [[data subject]] has provided [[personal data]] for medical research and has requested, in line with national law, to not be informed about discoveries about their health or wellbeing[^156]. While this may exclude a [[controller]] from disclosing information to [[data subject|data subjects]] about their medical conditions, they must still be informed about the fact that their [[personal data]] are being processed for scientific research purposes. ## 5.5 Changes to processing operations for scientific research purposes (Article 13(4) and 14(5)(a) GDPR) which data subjects have to be informed of 107. If a [[controller]] makes changes to its [[processing]] operations that renders the information previously provided to [[data subject|data subjects]] obsolete or incomplete, then it must inform the [[data subject|data subjects]] about those changes, pursuant to Article 13(4) and 14(5)(a) GDPR[^157]. When determining whether it is necessary to inform [[data subject|data subjects]] about changes to [[processing]] operations, [[controller|controllers]] should consider that a main objective of the principle of transparency is to ensure that the reasonable expectations of the [[data subject|data subjects]] are met. Conversely, there is no need to inform [[data subject|data subjects]] if they have already been sufficiently informed and if the changes would not go beyond the reasonable expectations of the [[data subject|data subjects]][^158]. 108. In the field of scientific research, changes to the [[processing]] of [[personal data]] that would require additional information include: - Making substantial changes to the objectives of a research project, leading to a change of the purposes of [[processing]] of [[personal data]]; - Determining that the [[personal data]] will be processed on the basis of a different legal basis than the initial one[^159]; - Changes to the identity of the [[controller]] β€” for example if a research laboratory merges with another laboratory, forming a new entity; - Engaging with new research partners that are not reasonably expected by a [[data subject]] and that will receive [[personal data]], in particular if research partners outside the EEA are engaged resulting in transfer to third countries, or [[international organisation|international organisations]][^160]; - Extending the period of [[processing]] [[personal data]], including storage, depending on how substantial the change is and what information on the period of retention that has been communicated to the [[data subject]]; >[!important]+ **Example 18: Extending the period of [[processing]] [[personal data]], including storage** > > > When the sponsor of a research project collects [[personal data]] concerning health, it informs the [[data subject|data subjects]] that their [[personal data]] will be stored for a period of 7 years after the completion of the project. The [[subject|participants]] are also informed that if additional funding for research is made available, the storage period may be extended for another period of time to continue the project. In the information notice, it is specified that the [[data subject|data subjects]] will be notified about that extension, if the further storage will last for a significant period of time. > > Before the completion of the project, [[subject|participants]] are informed that their [[data]] will be stored for an additional period of 7 years after the end of the storage period originally envisaged. - Changes to the [[risk]] profile for the [[processing]] of [[personal data]], for example because of changes to the scientific methods or the use of novel or untested technology; - Adding categories of [[personal data]] to the [[data]] set used in a research project, that have not been communicated to the [[data subject]] previously; and - Changes to the interface for [[data subject|data subjects]] to be able to exercise their rights, such as introducing a dedicated platform for the purpose[^161]. 109. In line with what is stated at para. 85, information on upcoming changes should be provided to the [[data subject|data subjects]] in a timely manner before the changes are implemented, in order to enable the [[data subject|data subjects]] to exercise their rights under the GDPR[^162]. 110. Conversely, changes that would normally not require any additional information to the [[data subject|data subjects]] include: - Regularly re-occurring studies that remain the same from time to time, such as annual surveys; - Inclusion of new research partners that belong to a category of [[recipient|recipients]] of [[personal data]] that has already been communicated to the [[data subject]]; and - Including [[processing]] of additional types of [[personal data]] belonging to a category of [[personal data]] that was previously communicated to the [[data subject]]. --- # 6. Data subjects' rights (Articles 15-21 GDPR) 111. [[SiteMap/Official Texts/GDPR#chapter-iii--rights-of-the-data-subject|Chapter III of the GDPR]], on [[data subject|data subjects]]' rights, includes two specific provisions that are of particular importance when [[controller|controllers]] process [[personal data]] for scientific research purposes. These two provisions are Article 17(3)(d) GDPR that contains an exception from the right to erasure under certain circumstances, and Article 21(6) that provides for specific rules for the right to object when [[processing]] [[personal data]] for scientific research purposes. These two specific provisions, as well as other provisions on [[data subject|data subjects]]' rights in [[SiteMap/Official Texts/GDPR#chapter-iii--rights-of-the-data-subject|Chapter III of the GDPR]] that are relevant when [[personal data]] is processed for scientific research purposes, are addressed in the following section[^163]. ## 6.1 General 112. While the GDPR establishes a general framework for [[data subject|data subjects]]' rights, Union or MS law may provide for restrictions of Articles 12-22 GDPR pursuant to one of the objectives listed in Article 23(1)[^164]. Moreover, Article 89(2) of the GDPR permits derogations β€” In Union or MS law β€” from the rights in Articles 15, 16, 18, 19 and 21, [[subject]] to the conditions and safeguards referred to in Article 89(1)[^165], in so far as the exercise of such rights are likely to render impossible or seriously impair the achievement of the specific scientific research purposes, and only if the derogations are necessary for the fulfilment of those purposes[^166]. Therefore, [[controller|controllers]] should determine if there are any restrictions or derogations under Union or MS law that limit the exercise of [[data subject|data subjects]]' rights and inform [[data subject|data subjects]] of such restrictions or derogations when fulfilling their transparency obligations. Conversely, if Union or MS law provide for additional rights in accordance with the GDPR, for example an unconditional right to object to [[processing]] of [[personal data]] for certain scientific research purposes[^167], then [[controller|controllers]] should adopt measures to be able to fulfil those extensions and inform [[data subject|data subjects]] thereof. ## 6.2 Right to erasure (right to be forgotten) (Article 17 GDPR) 113. If a [[data subject]] requests erasure of their [[personal data]] that are being processed for scientific research purposes, the [[controller]] should first establish whether any of grounds for erasure listed in [[SiteMap/Official Texts/GDPR#article-17--right-to-erasure-right-to-be-forgotten|Article 17(1) GDPR]] apply and, subsequently, whether an exception to the right to erasure in accordance with Article 17(3) applies[^168]. The grounds for erasure for [[personal data]] that are of particular interest in the field of scientific research are delineated in the following sub-section. ### 6.2.1 Grounds for erasure (Article 17(1) GDPR) 114. [[SiteMap/Official Texts/GDPR#article-17--right-to-erasure-right-to-be-forgotten|Article 17(1)(a) GDPR]] provides that [[personal data]] shall, on request of a [[data subject]], be erased when it is no longer necessary in relation to the purpose for which they were collected or otherwise processed. In this regard, it may be relevant to continue [[processing]] [[personal data]] for scientific research purposes after finalisation of a research project, for example if it is necessary for reproducibility of research results. It may also be necessary to retain [[personal data]] for scientific research purposes if that [[data]] is used in multiple research projects. Moreover, if a [[data subject]] had previously objected to the [[processing]] of [[personal data]] for scientific research purposes, pursuant to Article 21(6) GDPR, then the [[data subject]] can also request the [[controller]] to delete the [[data]], pursuant to Article [[SiteMap/Official Texts/GDPR#article-17--right-to-erasure-right-to-be-forgotten|Article 17(1)(a) GDPR]]. 115. [[SiteMap/Official Texts/GDPR#article-17--right-to-erasure-right-to-be-forgotten|Article 17(1)(b) GDPR]] provides that if the [[data subject]] withdraws the [[consent]] on which the [[processing]] is based, according to Article 6(1)(a) (and Article 9(2)(a) GDPR, when special categories of [[data]] are processed), then the [[personal data]] shall be erased at the request of the [[data subject]]. Unless there is another legal basis that justifies continued retention of the [[data]], [[personal data]] must be erased following withdrawal of [[consent]]. 116. Pursuant to [[SiteMap/Official Texts/GDPR#article-17--right-to-erasure-right-to-be-forgotten|Article 17(1)(c) GDPR]], [[data subject|data subjects]] have the right to have their [[personal data]] erased if they objected to the [[processing]] pursuant to Article 21(1) and no overriding legitimate grounds for the [[processing]] apply. Thus, the exercise of the right to request erasure on the basis of Article (17(1)(c) is dependent on a preceding exercise of the right to object, which is explained further below[^169]. When applying Article 17(1)(c), [[controller|controllers]] should consider relevant guidance from the Guidelines on legitimate interest: "[...] the criteria to determine whether an objection or an erasure request should be granted are essentially the same under Article 21 and Article 17 (i.e., the request should be granted unless one can demonstrate 'overriding legitimate grounds'). This implies that, as a rule, if an objection under Article 21(1) GDPR is granted, a related erasure request under [[SiteMap/Official Texts/GDPR#article-17--right-to-erasure-right-to-be-forgotten|Article 17(1)(c) GDPR]] should also be granted"[^170]. 117. Article 17(1)(e) of the GDPR provides that [[personal data]] have to be erased for compliance with a legal obligation in Union or MS law. This ground for erasure may, for example, be relevant if Union or MS law sets up specific [[data]] retention periods for [[personal data]] that is processed for scientific research purposes. ### 6.2.2 Exceptions from the obligation to erase personal data upon request (Article 17(3) GDPR) 118. According to [[SiteMap/Official Texts/GDPR#article-17--right-to-erasure-right-to-be-forgotten|Article 17(3) GDPR]], a [[controller]] can reject a request for erasure if the [[processing]] of [[personal data]] is necessary for any of the grounds listed in that provision[^171]. These grounds may also apply to [[processing]] of [[personal data]] for scientific research purposes[^172]. 119. Necessity, in the first sub-sentence of [[SiteMap/Official Texts/GDPR#article-17--right-to-erasure-right-to-be-forgotten|Article 17(3) GDPR]], must be interpreted restrictively. Accordingly, a [[controller]] must be able to show that the [[processing]] of the [[personal data]] involved is strictly necessary for the application of any of the exception grounds under [[SiteMap/Official Texts/GDPR#article-17--right-to-erasure-right-to-be-forgotten|Article 17(3) GDPR]][^173]. 120. Article 17(3)(d) GDPR provides for a specific exception from the right to erasure if the [[processing]] is necessary for scientific research purposes, in accordance with Article 89(1) GDPR. In addition to assessing the strict necessity of [[processing]] of [[personal data]] in relation to the scientific research purpose, the [[controller]] must also assess the individual circumstances in each request of a [[data subject]] when applying Article 17(1)(d) GDPR. To that end, Article 17(3)(d) GDPR should only be applied in limited circumstances, as it is only when erasure is likely to render impossible or seriously impair the achievement of the scientific research purposes that it is possible for a [[controller]] to reject a request for erasure[^174]. For example, if a [[controller]] processes [[personal data]] from a large number of [[data subject|data subjects]], requests of [[data subject|data subjects]] for erasure of their [[personal data]] may not make it impossible or seriously impair the achievement of the scientific research purposes. However, if a [[controller]] uses [[personal data]] from a small number of [[data subject|data subjects]], where the [[personal data]] of each [[data subject]] is of significant importance for the outcome of a research project, then it is more likely that the [[controller]] is justified in relying on Article 17(3)(d) of the GDPR and reject a request for erasure. A request for erasure of [[personal data]] may also make it impossible or seriously impair the achievement of the scientific research purposes if the [[controller]] researches developments or trends over a longer period of time and the request is received while the research is still in progress. > [!important]+ **Example 19: Rejecting a request of erasure on the basis of Article 17(3)(d) of the GDPR** > > > A private research institute is conducting scientific research on the historical development of a [[software]] that is publicly available in an open-source format in the shape of a merkle tree, which displays the development history of the [[software]]. When searching the merkle tree, it is possible to see the names of the developers of the [[software]] at any given point in time. > > The research institute receives a request from a [[software]] developer to delete an entry in which he is cited as a co-author, because the developer has changed his first name and considers that retaining his old first name for such a long time violates his right to private life. However, as the research needs to reflect the historical facts of the development of the [[software]] at any given point in time, including which individual [[software]] developers were involved, the research institute avails itself of the derogation provided for in Article 17(3)(d) of the GDPR and rejects the request, on the basis that erasure is likely to seriously impair the achievement of the objectives of the research project. 121. If a [[controller]] anticipates that it will apply one of the exceptions from the obligation to erase [[personal data]] upon request, pursuant to [[SiteMap/Official Texts/GDPR#article-17--right-to-erasure-right-to-be-forgotten|Article 17(3) GDPR]], then the [[controller]] should inform [[data subject|data subjects]] when fulfilling its transparency obligations[^175]. ## 6.3 Right to object (Article 21 GDPR) 122. According to Article 21(1) GDPR, a [[data subject]] may at any time object to the [[processing]] of [[personal data]], on grounds relating to their particular situation[^176], insofar as the [[processing]] is based on either Articles 6(1)(e) or (f). 123. If a [[data subject]] exercises his or her right to object under Article 21(1) GDPR, then the [[controller]] must grant such a request, unless it can demonstrate compelling legitimate grounds for the [[processing]] which override the interests, rights and freedoms of the [[data subject]], or for the establishment, exercise or defence of legal claims. The EDPB underlines that it is the [[controller]] that has the burden to prove the existence of compelling legitimate grounds and balance these grounds in relation to the particular situation of the [[data subject]][^177]. 124. Article 21(6) GDPR specifies the provisions of Article 21(1) for objections directed towards [[processing]] of [[personal data]] for scientific research purposes, thus limiting the right to object to [[processing]] operations based on Article 6(1)(e) or (f). Pursuant to Article 21(6) GDPR, a [[controller]] may reject a [[data subject]]'s objection to the [[processing]] of their [[personal data]] for scientific research purposes if the [[processing]] is necessary for the [[performance of an AI system|performance]] of a task carried out for reasons of public interest. Moreover, [[controller|controllers]] should consider any specific provisions in Union or MS law that may complement the provisions of Article 21(6) GDPR. 125. The possibility to reject an objection, pursuant to Article 21(6) GDPR, is not limited to public interest in the meaning of Article (6)(1)(e). A [[controller]] relying on legitimate interest, pursuant to [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]], can also reject an objection under Article 21(6) if the [[controller]] can demonstrate that the [[processing]] of [[personal data]] for scientific research purposes is a legitimate interest that coincides with a public interest[^178]. 126. Necessity must be interpreted restrictively[^179]. Accordingly, a [[controller]] must be able to show that the [[processing]] of the [[personal data]] involved is strictly necessary for performing a task carried out for reasons of public interest, entailing scientific research purposes, and that the task cannot be carried out, or not be carried out as efficiently[^180], unless that [[data]] is processed[^181]. In this regard, the context and nature of the scientific research activities and the reasons of public interest pursued will be determinative for the assessment of necessity. Similar as under the right to erasure, the number of [[data subject|data subjects]] is relevant when assessing necessity of [[processing]][^182]. 127. Moreover, the [[controller]] should verify whether the [[processing]] of [[personal data]] related to the specific objection remains necessary for the [[performance of an AI system|performance]] of a task carried out for reasons of public interest at the time when the request is made[^183]. In this regard, the [[controller]] should, among other things, consider the [[data]] protection principles β€” in particular [[data]] minimisation[^184] β€” and the progress of the scientific research activities since the start of the [[processing]] operations. 128. If a [[controller]] determines that it is necessary to process the [[personal data]] in question for scientific research purposes, it should nonetheless consider the particular situation of the [[data subject]] who objected to the [[processing]][^185]. To that end, [[data subject|data subjects]] should be enabled to present their particular situation, including personal, social or professional circumstances, which distinguishes them from other [[data subject|data subjects]]. Such circumstances could, for example, be suffering from a rare disease, which may render a [[data subject]] identifiable even if their [[data]] are pseudonymised, or being in a family relation with a researcher, which could enable unwarranted identification of the [[data subject]][^186]. However, the fact that a [[data subject]] did not elaborate much on their particular situation in the objection is not sufficient for a [[controller]] to dismiss an objection per se and sometimes the particular situation may be obvious from the context of [[processing]]. If the [[controller]] has doubts as to the particular situation of a [[data subject]], it may ask the [[data subject]] to further specify their request[^187]. # 7. Attribution of responsibility (controller and processor) 129. The EDPB's Guidelines 7/2020 on the concepts of [[controller]] and [[processor]] in the GDPR provide general guidance on the attribution of responsibility when [[processing]] [[personal data]]. The following section provides additional guidance and examples relevant to the [[processing]] of [[personal data]] for scientific research purposes[^188]. 130. The roles of [[controller]], joint [[controller]] and [[processor]] are crucial in the application of the GDPR, since the attribution of roles determines which entity is responsible for compliance with the different provisions of the GDPR and how [[data subject|data subjects]] can exercise their rights in practice[^189]. The EDPB underlines that the determination of roles is functional and aims to allocate responsibilities according to the actual roles of the entities[^190]. Therefore, while the Guidelines provide examples and guidance to help entities determine their responsibilities under the GDPR when [[processing]] [[personal data]] for scientific research purposes, each entity must still assess and be able to demonstrate[^191] their own responsibility for the particular [[processing]] operations in which they are involved[^192]. 131. Where [[personal data]] is processed for scientific research purposes involving several entities, it is necessary to assess and document how responsibility is allocated among the entities. The determination may be particularly relevant where multiple actors are involved in drafting scientific research protocols, such as sponsors, hospitals, private companies etc., or in the case of public-private partnerships (PPPs). ## 7.1 Controller 132. The [[controller]] is the entity that decides on the purpose and the essential elements of the means of the [[processing]][^193], i.e. the reasons of and the ways in which [[processing]] of [[personal data]] is carried out. However, the non-essential means of the [[processing]], including certain practical aspects of implementation (such as the choice of the [[software]] to be used, etc.) may be left to a [[processor]][^194]. 133. Where Union or MS law designates a [[controller]], such designation is determinative for attributing responsibility[^195]. The determination of the purposes and means of [[processing]] must not be explicit in the law but can be implicit. If implicit, the determination must be sufficiently certain from the role, task and powers conferred on the [[controller]][^196]. That condition is met if the purposes and means arise, in essence, from the provisions of the law governing the activity of the [[controller]][^197]. 134. If the [[processing]] of [[personal data]] is to be undertaken in the framework of a scientific research protocol, the EDPB notes that active participation in the determination and the definition of a scientific research protocol, by clearly determining the purpose and essential elements of the means to achieve the objectives pursued, would normally qualify an entity as a [[controller]] for the [[processing]] of [[personal data]] within the meaning of the GDPR. However, the EDPB highlights that the fact that an organisation provides research funding or is consulted in the process of drafting a research protocol (e.g. as an independent consultant, expert, ethical committee etc.) is not in itself sufficient to attribute the role of a [[controller]] (or joint [[controller]][^198]). 135. It is not necessary for the attribution of responsibility for an entity or an individual to actually process [[personal data]][^199]. Therefore, an entity or an individual may be qualified as a [[controller]] even though it does not process [[personal data]] at all, only process [[personal data]] to a limited extent, or only process pseudonymised [[data]]. 136. One example in this regard is clinical trials, where most of the [[processing]] of directly identifiable [[personal data]] takes place at a clinical trial site, such as a health [[care]] facility. The sponsor, which mainly process pseudonymised [[data]], is nonetheless still regarded as a [[controller]] (or a joint-[[controller]]) because it determines purposes and means of [[processing]] [[personal data]] in a clinical trial, in particular in relation to the drafting of the trial protocol.[^200] Another example is if a trusted [[data holder]] processes [[personal data]] on behalf of one (or several) [[controller|controllers]][^201]. The use of a trusted [[data holder]] may be relevant in scientific research activities as a safeguard, to ensure the security of [[personal data]] and for maintaining efficient access controls[^202]. 137. Typically, it is a legal person that determines the purposes and essential means of [[processing]]. When [[processing]] [[personal data]] for scientific research purposes, this could be a research institute, a hospital, a university a commercial company or a non-profit research organisation. This means that individual researchers, such as researching healthcare staff, laboratory technicians or other persons involved in scientific research are generally not considered [[controller|controllers]], but rather acting under the authority of a [[controller]][^203]. Exceptionally, there may be circumstances where researchers as natural persons are considered [[controller|controllers]] for the [[processing]] of [[personal data]] in their own right. This may be the case when the research is carried out at a small healthcare facility or by a researcher that is conducting research in full independence with no affiliation to any research organisation. > [!important]+ **Example 20: A [[controller]] [[processing]] [[personal data]] for scientific research purposes β€” Survey services** > > > Rapid Survey is a private company that offers research and survey services. One of the services that the company offers is providing contact details to potential respondents of surveys. When Rapid Survey's services are procured, a notification is sent out to respondents who can choose to participate or not in the survey at hand. > > A private research institute is conducting a research project in the field of political sciences concerning the political views of citizens. To complete the project, it needs to gather various [[data]] points from [[data subject|data subjects]], including their preferences in current political issues, as well as demographical [[data]]. The research institute procures the services of Rapid Survey, but wants to design the survey and manage all the contacts with the respondents. Therefore, they pay a fee to get access to contact details of Rapid Survey's respondents, which are provided by the company. > > In this situation, the private research institute and Rapid Survey are separate [[controller|controllers]]. Rapid Survey is the [[controller]] for managing and providing the list of contact details to its respondents. When the research institute has gotten access to this list, it becomes the [[controller]] for all the subsequent [[processing]] operations. > [!important]+ **Example 21: A [[controller]] [[processing]] [[personal data]] for scientific research purposes β€” Commercial entity** > > > When [[data subject|data subjects]] sign up for membership to a large chain of fitness studios, they are asked a question whether they provide broad [[consent]] to provide their [[personal data]] (following [[pseudonymisation]]) for certain research projects in the research field of sports medicine. [[consent]]ing to provision of [[data]] is not a condition for membership and [[data subject|data subjects]] can at any time withdraw their [[consent]], either online through a membership portal, or by contacting their local fitness studio. The [[consent]] covers a certain area of research (sports medicine) and all research projects within that area. All research projects must be approved by an internal committee that has been set up by the fitness studio chain and is advised by consultants with academic qualifications. Additionally, [[consent]] must be renewed every three years. > > When the fitness studio chain provides [[personal data]] from their members to individual research projects, it is acting as a [[controller]] and responsible for that provision of [[data]], for scientific research purposes. After the [[personal data]] has been provided, however, it is the entity that requests the [[data]] and conducts the research that becomes the [[controller]]. ## 7.2 Processor 138. A [[processor]] is an entity that is separate from a [[controller]] and that processes [[personal data]] on behalf of a [[controller]][^204]. A [[processor]] may only process [[personal data]] in line with an agreement, or other legal act under EU or MS law, between the [[controller]] and the [[processor]][^205]. It may not process the [[personal data]] covered by the agreement beyond the [[controller]]'s instructions, but a [[processor]] may still have a certain margin of discretion with regards to adopting the most suitable technical and organisational means (non-essential[^206]) to best serve the [[controller]]'s interests[^207]. If a [[processor]] goes beyond the [[controller]]'s explicit instructions, by determining its own purposes and essential elements of the means, a GDPR infringement would occur and the [[processor]] would then be considered as a [[controller]] in respect of that [[processing]][^208], potentially being [[subject]] to corrective measures or liability for infringing the GDPR. 139. In the context of [[processing]] of [[personal data]] for scientific research, different entities can act as [[processor|processors]], e.g. a research institution, a hospital, a [[software]] service [[provider]], a contract research organisation (CRO) or an individual researcher (external to the [[controller]]). While several entities are often co-operatively involved in the [[processing]] of [[personal data]] for scientific research purposes, this does not necessarily mean that any of the entities involved are to be regarded as [[processor|processors]] as they can, depending on the circumstances, instead be joint [[controller|controllers]][^209]. > [!important]+ **Example 23: A [[processor]] [[processing]] [[personal data]] for scientific research purposes β€” contract research organisation (CRO)** > > > A specialised contract research organisation (CRO) provides different services to a sponsor of a clinical trial on a new vaccine. These services include monitoring of the study, translation of study documents, statistical analysis and maintaining the trial master file, including curation of relevant research [[data]] and deletion of unnecessary [[data]]. > > The sponsor defines the purpose and the essential means of the clinical trial in the research protocol and therefore acts as [[controller]]. The CRO provides the services on the basis of a service contract and processes [[personal data]] only as instructed by the sponsor, although the CRO has certain leeway in terms of non-essential means, for example deleting obtained research [[data]] that is not necessary for performing clinical trial. As a result, the CRO processes the [[personal data]] in the capacity as a [[processor]] on behalf of the sponsor. > [!important]+ **Example 24: A [[processor]] [[processing]] [[personal data]] for scientific research purposes β€” Survey services** > > > A research team in a university faculty wants to use a service offered by Rapid Surveys, a private company that offers research and survey services. The service in question consists of recruitment of respondents to a survey for a research project. For this purpose, Rapid Surveys has recruited persons who answer surveys on regular basis, in exchange for a small fee. > > The research team designs a survey for a research project and procures the services of Rapid Surveys. Rapid Surveys gives the research team advice on which questions it could pose to the respondents, but it is ultimately the research team that decides on which questions to ask and therefore which [[personal data]] that needs to be collected. Rapid Surveys uses its own [[software]] and conducts the survey with [[data subject|data subjects]] who have signed up as respondents. When the survey is completed, Rapid Surveys transmits the results of the completed survey, including pseudonymised meta-[[data]] that enables the research team to correlate the answer to different categories of [[data subject|data subjects]] (such as gender, socio-economic conditions, area of residence, etc.). > > In this situation, the university faculty is a [[controller]] and Rapid Surveys is a [[processor]]. This is because even though Rapid Surveys decide on certain aspects of the [[processing]] of [[personal data]] (such as choice of it-system and offers a set of standardised technical security measures), it is ultimately the research team operating at the university faculty that decides the purposes and essential means, including which [[personal data]] are to be processed. ## 7.3 Joint controllers 140. Joint controllership occurs when two or more entities participate jointly in the determination of the purposes and essential elements of the means of [[processing]].[^210] An essential criterion for joint [[controller|controllers]]hip is that the [[processing]] of [[personal data]] would not be possible without the entities' concurrent involvement, meaning that the respective entities' [[processing]] is inextricably linked. One way to identify converging decisions is to determine whether the [[processing]] would not be possible without both (or more) entities' participation in the purposes and essential elements of the means of one or more [[processing]] operations, in the sense that the [[processing]] by each party is somehow inseparable[^211]. Several entities can also be explicitly or implicitly designated as joint [[controller|controllers]] by Union or MS law[^212]. 141. If several parties participate jointly in the drafting of a research protocol that determines the purposes and essential means of [[processing]] of [[personal data]], this may suffice for all the entities involved to be considered joint [[controller|controllers]], even if the actual research and the [[processing]] of [[personal data]] is only carried out by one or some of the entities involved[^213]. In such a context of [[processing]], it is not necessary for all the entities involved to have an equally active participation in the determination of the purpose and essential elements of the means in order to qualify as joint [[controller|controllers]][^214]. 142. Agreeing to and consequently adhering to an already established research protocol or study, without participating in the determination of the purposes and means of [[processing]], is not always sufficient to create a situation of joint [[controller|controllers]]hip within the meaning of Article 26(1) GDPR. Instead, this situation may be indicative of a relationship between a [[controller]] and [[processor]]. 143. If several parties carrying out the research are joint [[controller|controllers]], they can generally rely on the same legal basis. However, the GDPR does not preclude that different joint [[controller|controllers]] rely on different legal bases, depending on their applicability to a given [[processing]] operation[^215]. 144. The allocation of responsibilities must be laid down in an agreement between the joint [[controller|controllers]][^216], that must be made available to [[data subject|data subjects]][^217]. When multiple stakeholders involved in a research project within the scope of a common research protocol, the roles and responsibilities of the various entities should be clearly defined and clarified through an arrangement that reflect each entity's different responsibility. In this regard, the CJEU has clarified that various entities may be involved at different stages of [[processing]], and to different degrees, so that the level of responsibility of each entity must be assessed with regard to all the relevant circumstances of the particular case[^218]. If there are differing levels of responsibility, this must be reflected in the agreement, pursuant to Article 26(2) GDPR, and transparently communicated to the [[data subject|data subjects]]. In addition, even though [[controller|controllers]]' individual responsibilities under the GDPR may differ, [[data subject|data subjects]] retain their right to exercise their rights[^219], or claim compensation for any damage caused by the [[processing]] of [[personal data]][^220], towards any joint [[controller]]. 145. If any of the joint [[controller|controllers]] intends to procure a [[processor]] to process [[personal data]] on their behalf, procurement should be done in line with conditions agreed upon by the joint [[controller|controllers]] in their agreement, pursuant to Article 28(1) GDPR[^221]. > [!important]+ **Example 25: Joint [[controller|controllers]] [[processing]] [[personal data]] in the context of a non-interventional observational clinical study β€” Research consortium** > > > A research consortium pursues a joint research project on the quality and efficacy of an oncological treatment scheme, that is the prescribed method for treating lymphoma in a Member State. The research consortium involves a commercial pharmaceutical company, several university hospitals and a private research institute. > > The research consortium sets out its research activities in a research protocol which includes the setting up of a jointly-operated database and a non-interventional observational study to be conducted at the different university hospitals. The research activities also include several sub-projects to be undertaken following the conclusion of the observational study. The research protocol, which was drafted and approved jointly by all consortium partners, sets out the common purposes and methodology for the study, which research [[data]] (including [[personal data]]) that is to be collected and processed, criteria for inclusion/exclusion of research [[subject|participants]], permitted further use of the [[data]] for future research, etc. > > The university hospitals provide staff and facilities for conducting the observational study. They also collect [[personal data]] (e.g. medical history, demographics, and health status) from the patients that participate in the research project. The research [[data]] is not gathered in a central database, but is instead made available through a database that has a unified interface to access [[data]] from several independent databases, without consolidating or transferring the [[data]]. The database is jointly operated by a steering committee with [[representative|representatives]] from all partners to the research consortium, who are equal in terms of decision-making. > > Because the observational study is conducted in accordance with the same research protocol and methodology, all parties to the research consortium should be considered as joint [[controller|controllers]] for the [[processing]] of [[personal data]] for scientific research purposes within the scope of the study. Furthermore, because the [[processing]] of [[personal data]] in the database is decided on and operated jointly by all partners of the research consortium, and since all [[data]] retained in that database are inseparable for the purposes of conducting further research, all partners to the research consortium are joint [[controller|controllers]] for the [[processing]] of [[personal data]] in the federated database that is necessary to make [[personal data]] available to the consortium partners for future research activities. The respective university hospitals are independent [[controller|controllers]] for the [[processing]] of [[personal data]] that is necessary for the purpose of providing healthcare, under national law and outside the scope of the observational study. > > Following the conclusion of the observational study, a number of sub-projects are initiated, using [[data]] stored in the federated database, as well as [[data]] from other sources. The sub-projects are undertaken in different constellations, involving co-operation between the different parties to research individual questions related to medical treatment of lymphoma. The partners to the research consortium are joint [[controller|controllers]] when [[undertaking]] research in sub-projects subsequent to the conclusion of the observational study, but they are so only in their respective constellations. > > After the research consortium has finalised the research to be undertaken within the scope of the research protocol, the pharmaceutical company initiates a project to develop a pharmaceutical product to treat side-effects associated with medical treatment of lymphoma. This project is undertaken unilaterally by the pharmaceutical company without the involvement of the research consortium partners. Accordingly, the pharmaceutical company is responsible for [[processing]] of [[personal data]] for this purpose as an independent [[controller]]. > > In so far as any partner to the research consortium has sub-contracted any external IT service [[provider|providers]] to process [[personal data]] on their behalf, those service [[provider|providers]] are regarded as [[processor|processors]], in line with Article 28(1) GDPR, and may only be procured in line with the conditions set out in the agreement between the entities, pursuant to Article 26(1) GDPR. # 8. Appropriate safeguards (Article 89(1) of the GDPR) 146. Article 89(1) GDPR requires [[controller|controllers]] to adopt of appropriate safeguards to ensure the rights and freedoms of [[data subject|data subjects]]. How [[controller|controllers]] should apply Article 89(1) GDPR when [[processing]] [[personal data]] for scientific research purposes is explained in the current section. 147. Safeguards pursuant to Article 89(1) GDPR entail that technical and organisational measures are in place, in particular to ensure respect for the principle of [[data]] minimisation, when [[personal data]] is processed for scientific research purposes[^222]. While Article 89(1) GDPR provides that [[personal data]] should be anonymised or pseudonymised, as long as the scientific research purposes can be achieved if the [[data]] is processed in that manner[^223], that provision also requires the adoption of other types of appropriate safeguards, adapted to the specific scientific research purposes for which [[personal data]] are processed. This applies irrespective of the legal basis that the [[processing]] of [[personal data]] is based upon. Moreover, if [[personal data]] is further processed for scientific research purposes, [[controller|controllers]] should assess whether the safeguards applied to the initial [[processing]] are adequate for the further [[processing]]. ## 8.1 General 148. Safeguards adopted under Article 89(1) GDPR must be assessed in relation to the nature, scope, context, purposes and [[risk|risks]] of the scientific research activities. The safeguards should contribute to the fulfilment of the [[data]] protection principles, the requirements of [[data]] protection by design and default, as well as ensure that the rights and freedoms of [[data subject|data subjects]] are guaranteed. While it is the responsibility of the [[controller]] to determine and implement appropriate safeguards, Union or MS law may provide for specific safeguards to be adopted by [[controller|controllers]], when [[processing]] [[personal data]] for scientific research purposes[^224]. 149. Apart from the adoption of safeguards pursuant to Article 89(1) GDPR, [[controller|controllers]] [[processing]] [[personal data]] for scientific research purposes must always adopt the general safeguards and measures required by the GDPR to minimise any negative impact of [[processing]], in line with β€” inter alia β€” Articles 5, 24, 25 and 32 of the GDPR. Such measures include, amongst others: - assessing the [[risk|risks]] of the [[processing]] or carrying out a [[data protection impact assessment]] ([[data protection impact assessment|DPIA]]) when required[^225]; - appointing a [[data]] protection officer (DPO) when required; - implementing technical and organisational measures for [[data]] security, including the establishment of procedures and policies to regularly assess the effectiveness of those measures; and - defining the distribution of tasks in the [[processing]] of [[personal data]] between organisational units and employees, etc. 148. General measures and safeguards adopted by the [[controller]] may, depending on how they are designed and implemented, in some cases overlap with and satisfy both the provisions mentioned in para. 149 and Article 89(1) GDPR. For example, access controls that limit access to [[personal data]] used in scientific research to researching staff only, may satisfy the requirements under both Articles 32 and 89(1) of the GDPR. ## 8.2 Risk analysis and data protection impact assessment (DPIA) 151. The starting point for adopting appropriate safeguards, pursuant to Article 89(1) GDPR, is conducting a [[risk]] analysis or β€” when required β€” a [[data protection impact assessment|DPIA]][^226]. When assessing [[risk|risks]] to rights and freedoms of [[data subject|data subjects]] and determining appropriate safeguards, it is important that [[controller|controllers]] look beyond the scope of the right to private life and protection of [[personal data]][^227]. [[risk|Risks]] to other fundamental rights and freedoms should also be considered[^228]. In particular in the field of medical research, if the [[processing]] of [[personal data]] for scientific research purposes impacts or may impact the provision of health [[care]] to a [[data subject]] (e.g. if a medical condition is identified), [[controller|controllers]] should consider implementing measures for informing [[data subject|data subjects]], taking into account the wishes of [[data subject|data subjects]] not to be informed about findings that are relevant for their health, in accordance with applicable Union or MS law[^229]. 152. When identifying [[data]] protection [[risk|risks]], [[controller|controllers]] should in particular pay attention to the amount of [[personal data]] processed, the type of [[personal data]][^230], whether the collected [[personal data]] is combined with other [[data]] sets, if the [[personal data]] will be retained following a research project, potential [[risk|risks]] of re-identification of [[data subject|data subjects]] β€” including when providing [[data]] to research partners or other [[recipient|recipients]] β€” [[risk|risks]] associated with publishing or sharing research results, as well as the [[controller]]'s relationship with the [[data subject|data subjects]], in particular if the [[data subject]] is in a disadvantaged position in relation to the [[controller]]. 153. Potential consequences of the scientific research, such as adverse outcomes for the [[data subject|data subjects]], should also be considered. If possible, the [[controller]] should consider the impact on individual [[data subject|data subjects]], in particular individuals belonging to vulnerable or disenfranchised categories or groups of [[data subject|data subjects]]. The [[controller]] should also consider if the [[processing]] of [[personal data]] may affect persons related to the [[data subject]], such as family members or friends. Adverse outcomes could be exclusion or discrimination against individuals, defamation, stigmatisation, loss of confidentiality of [[personal data]] or damage to reputation[^231]. ## 8.3 Anonymisation and pseudonymisation of personal data 154. A basic [[data]] protection principle of the GDPR is [[data]] minimisation, pursuant to Article 5(1)(c) GDPR. According to the principle of [[data]] minimisation, [[personal data]] shall be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". Thus, when [[processing]] [[personal data]] for scientific research purposes, [[controller|controllers]] must determine which [[data]] are strictly necessary to process[^232]. 155. [[data|Data]] minimisation is emphasised in Article 89(1) GDPR, which states that where the scientific research purposes "[...] can be fulfilled by further [[processing]] which does not permit or no longer permits the identification of [[data subject|data subjects]], those purposes shall be fulfilled in that manner." Article 89(1) GDPR also states that the technical or organisational measures to be adopted for [[data]] minimisation "[...] may include [[pseudonymisation]] provided that those purposes can be fulfilled in that manner." 156. Consequently, [[personal data]] processed for scientific research should in the first place be anonymised, as long as the purposes of [[processing]] can be fulfilled using anonymised [[data]]. Information that is considered anonymised [[data]], within the meaning of the GDPR, is information that does not (or no longer) relate to an identified or identifiable natural person or is rendered anonymous in such a manner that the [[data subject]] is not or no longer identifiable[^233], which brings any subsequent [[processing]] of the [[data]] outside the scope of the GDPR. The anonymisation process itself, however, is a [[processing]] operation under the GDPR that must comply with the provisions of the GDPR, including the [[data]] protection principles and the requirements of lawfulness. With regards to lawfulness, a [[controller]] may be able to rely on the same legal basis for the process of anonymisation and for the preceding [[processing]] operations, if those [[processing]] operations form part of a set of operations that are undertaken for the same scientific research purposes[^234]. 157. Where the scientific research purposes cannot be fulfilled using anonymised [[data]], for example because [[controller|controllers]] aim to analyse developments related to an individual over time, requiring the need for an identifier, or where anonymisation is not achievable, the [[personal data]] should instead be pseudonymised[^235]. 158. [[pseudonymisation]][^236] is a technical and organisational measure that allows [[controller|controllers]] and [[processor|processors]] to reduce the [[risk|risks]] to [[data subject|data subjects]] and meet their [[data]] protection obligations, for example under Articles 25, 32 and 89 of the GDPR. If a [[controller]] processes [[personal data]] for scientific research purposes and applies [[pseudonymisation]], then the legal basis for the [[processing]] of the [[personal data]] extends to all [[processing]] operations needed to apply the pseudonymising transformation[^237]. 159. The [[processing]] of [[personal data]] for scientific research purposes that can be used to directly identify a person should only be done where it has been deemed strictly necessary and proportionate in order to achieve the purposes of the scientific research. Thus, the [[controller]] should always opt for using anonymised [[data]] or pseudonymised [[personal data]] if the purpose of the scientific research does not require the use of [[personal data]] that can be used to directly identify [[data subject|data subjects]]. 160. Consideration of which format of [[data]] is necessary and justifiable to process for scientific research purposes should take place when a [[controller]] draws up a plan for the [[processing]] of [[personal data]], for example when a database is set up or when a research plan is drafted. The assessment should be undertaken as part of a [[risk]] analysis or, where relevant, a [[data protection impact assessment|DPIA]]. 161. To ensure the proper effectiveness of anonymisation or [[pseudonymisation]], [[controller|controllers]] must use state-of-the-art anonymisation or [[pseudonymisation]] methods, taking into account the most current assessment of effectiveness, [[risk|risks]] of re-identification, threats to security, etc. The EDPB's guidelines on [[pseudonymisation]] provide further guidance on how to assess effectiveness[^238]. There should also be an ongoing process of verification that the measures implemented to ensure anonymisation or [[pseudonymisation]] are effective over the course of a research project, or as long as the [[data]] is otherwise retained, in particular if [[data]] sets are combined, which may increase the [[risk]] for re-identification. 162. [[processing|Processing]] operations for scientific research purposes may entail [[processing]] of [[personal data]] in different formats. For example, if the research activities of a [[controller]] receiving [[data]] from another [[controller]] do not require [[processing]] of [[personal data]] that can be used to directly or indirectly identify [[data subject|data subjects]], the [[personal data]] must be anonymised before transmission. At the same time, the [[controller]] providing the anonymised [[data]] may itself retain the [[personal data]] in a pseudonymised or directly identifiable form if there are purposes that justify such [[processing]], such as reproducibility of research results or review of research [[data]]. 163. Legal or contractual obligations that prohibit the re-identification of individuals can, as organisational measures, complement technical anonymisation or [[pseudonymisation]], in particular when [[data]] sets are shared between research partners or other [[recipient|recipients]]. Contractual obligations should also facilitate requests from [[data subject|data subjects]] exercising their rights in relation to pseudonymised [[personal data]][^239]. Therefore, contractual obligations should ensure that β€” following a request from a [[data subject]] that exercises his or her rights β€” the [[controller]] that pseudonymised the [[personal data]] can provide the information that is necessary to re-identify a [[data subject]] to [[controller|controllers]] or [[processor|processors]] that process the pseudonymised [[data]] for scientific research purposes.[^240] Alternatively, contractual obligations could ensure that the original [[controller]] enables the practical exercise of [[data subject|data subjects]]' rights. 164. Finally, [[data subject|data subjects]] should be informed about the extent to which their [[personal data]] is processed for research purposes in a form that permits identification and, if [[personal data]] is made available to other [[recipient|recipients]], to whom. In particular, [[data subject|data subjects]] should not be given the impression that their [[personal data]] will be anonymised if the [[data]] in fact will be processed in a pseudonymised form and the [[data subject|data subjects]] will still be identifiable, albeit indirectly. Moreover, [[data subject|data subjects]] should β€” prior to the [[processing]] β€” be informed that it will not be possible to retrieve their [[personal data]] from an aggregated [[dataset]] or as part of the research results after the anonymisation of the [[personal data]]. Hence, after anonymisation, [[data subject|data subjects]] will not receive any further individual information on the [[processing]] of their [[data]], such as for instance results of clinical examinations, as it will no longer constitute [[personal data]]. This is without prejudice to the possibility for [[data subject|data subjects]] to receive general and aggregated information on the development of research projects or their results. ## 8.4 Safeguards when processing genetic or biometric data 165. [[genetic data|Genetic data]] is [[personal data]] retrieved from analysis of biological samples of human origin that is related to the inherited or acquired genetic characteristics of an individual, such as a complete genome sequence or certain genetic markers that are unique to an individual[^241]. [[genetic data|Genetic data]] profiles are considered to be [[personal data]] by default and can only be considered anonymous in exceptional circumstances, following a thorough analysis that takes the specific genetic configuration, and how common it is in the population, into account[^242]. 166. [[biometric data|Biometric data]][^243] is, similarly to [[genetic data]], unique to individuals[^244] and can β€” inter alia and depending on the type of [[data]] β€” reveal family relationships. 167. Particular caution must be exercised in any research project where genetic or [[biometric data]] are processed. This is due to the specific nature and [[risk|risks]] with such [[processing]] operations, not only for [[data subject|data subjects]] that participate in scientific research, but also other [[data subject|data subjects]] who are related to the research [[subject|participant]]. For example, [[genetic data]] can be used to obtain information about health predispositions, health [[risk|risks]] and inherited diseases, as well as consanguineal kinship. The fact that [[genetic data]] cannot be changed by [[data subject|data subjects]], but remains with them for the rest of their lives and beyond increases the [[risk|risks]]. Such [[risk|risks]] may also be present when [[processing]] [[biometric data]], depending on the type of [[data]] concerned (e.g. fingerprints). 168. Appropriate safeguards that may be particularly important when [[processing]] genetic or [[biometric data]] include, but are not limited to, [[pseudonymisation]], ethical approval, particularly restrictive purpose limitations, federated storage with access through secure [[processing]] environments, as well as rigid and role-based access controls. 169. Genetic research on isolated population groups should be accompanied by information campaigns directed towards the community involved. Such information campaigns should, in addition to the mandatory information pursuant to Articles 12-14 GDPR, describe the nature and methods of the research, the objectives pursued and the expected [[risk|risks]] or benefits for the population groups involved. Any [[risk|risks]] of discrimination or stigmatisation of members of the population group involved, as well as [[risk|risks]] of unexpected findings, should be clearly and transparently communicated and mitigated[^245]. ## 8.5 Determination of other types of appropriate safeguards 170. As Article 89(1) of the GDPR covers a wide variety of [[processing]] operations that are motivated by scientific research purposes using different methods and technology, it is necessary to adopt different types of safeguards for different types of [[processing]] operations. This is due to the different [[risk|risks]] posed by the nature of research or research methods used. Accordingly, when [[processing]] [[personal data]] for scientific research purposes, it may be necessary to adopt other types of safeguards beyond anonymisation or [[pseudonymisation]]. Examples of such safeguards are: - Governance structures for oversight of the [[processing]] of [[personal data]], such as internal or external review boards or other oversight committees, including representation by [[data subject|data subjects]], when applicable; - Enhanced transparency, beyond the requirements of Articles 12-14 GDPR, towards [[data subject|data subjects]] about the use of their [[personal data]], e.g. by providing information via an [[online platform]], through which [[subject|participants]] can be informed about ongoing and future research projects, their nature and methods, as well as provision of information on the outcome of research projects that have used [[personal data]][^246]; - [[consent]], if not relied upon as a legal basis, as a safeguard[^247]; - Strict purpose-limitation, for example contractually limiting any further [[processing]] of [[personal data]] by a receiving [[controller]]; - An unconditional right to object to the [[processing]] of [[personal data]]; - Providing guarantees to [[data subject|data subjects]], e.g. contractually or by unilateral commitments, that the research results will not be used to directly or indirectly influence or affect the research [[subject|participants]][^248]; - Adherence to ethical rules in the relevant field of science, including ethical approval, when applicable, or advice or oversight by ethics committees or boards; - Procedures for review of [[personal data]] that is continuously stored for scientific research purposes in order to determine the necessity of continued storage and in which format it is appropriate to store the [[personal data]] (i.e. whether it remains necessary to store the [[personal data]] in a pseudonymised or directly identifiable format); - Privacy enhancing technologies (PETs), such as homomorphic encryption or use of synthetic [[data]]; - Adherence to relevant standards or professional conduct in the relevant field of science; - Setting up a secure [[processing]] environment[^249] or an access point through which researchers can gain access to research [[data]] without any need for local storage; - Rules and measures when providing [[personal data]] to other researchers, including contractual arrangements to prevent unauthorised transmissions to [[third party|third parties]], or use of federated databases; - Managing [[pseudonymisation]] and creating barriers between contact [[data]] or other identifiers of research [[subject|participants]] and research [[data]], for example through internal organisational firewalls or by entrusting [[pseudonymisation]] to a trusted [[third party]]; - Complementary measures to prevent re-identification of [[data subject|data subjects]], such as statutory, administrative or contractual penalties for unauthorised attempts of re-identification; - Qualification requirements for researchers, as well as proper training in [[data]] protection for persons authorised to process the research [[data]]; - Measures to protect [[personal data]], such as anonymisation of [[personal data]], when publishing or disseminating research results; and - Confidentiality obligations for researchers and other staff members with access to the [[personal data]] (e.g. IT staff). 170. Codes of conduct[^250] and certification[^251] can be useful tools that provide more concrete guidance on how to identify [[risk|risks]] and adopt mitigating measures, tailored to the specifics of a particular field or type of scientific research and the application of the specific provisions for scientific research in the GDPR. Accordingly, [[controller|controllers]] or [[processor|processors]] may adopt particular safeguards, and measures to manage them, when adhering to a relevant code of conduct or in the process of certification. --- *For the European [[data|Data]] Protection Board* *The Chair* *Anu Talus* --- # Footnotes [^1]: References to 'Member States' (MS) made throughout this document should be understood as references to 'European Economic Area (EEA) Member States'. Cf. Article 2(3) Consolidated version of the Treaty on European Union (TEU) (OJ C 326, 26.10.2012, p. 13); Article 179 Consolidated version of the Treaty on the Functioning of the European Union (TFEU) (OJ C 326, 26.10.2012, p. 47). [^2]: Charter of Fundamental Rights of the European Union (CFREU) (OJ C 326, 26.10.2012, p. 391). [^3]: Recitals 33, 50, 52, 53, 62, 65, 113, 156, 157, 159, 160, 161 and 162 and Articles 5(1)(b) and (e), Article 9(2)(j) and (4), 14(5)(b), 17(3), 21(6) and 89 GDPR. [^4]: Recital 4 GDPR; Recital 32 in Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus) (COM(2025) 837 final). [^5]: In so far as Union or MS laws provide for legal bases for the [[processing]] of [[personal data]] for scientific research purposes, under Article 6(1)(e) GDPR, see further in section 4.2. On derogations under Article 9(2)(g), (i) or (j) GDPR, see further in section 4.4.3. [^6]: In accordance with the principle of accountability, pursuant to Articles 5(2) and 24(1) GDPR. [^7]: The EDPB underlines that the term **scientific research purposes** in the GDPR should be given an autonomous and uniform interpretation in EU law. Cf.: Judgement of 6 February 2003, *Stichting ter Exploitatie van Naburige Rechten (SENA) v Nederlandse Omroep Stichting (NOS)*, C-245/00, EU:C:2002:543, para. 23. [^8]: Recital 157 GDPR. Such registries can for example be [[data]] sets with patient records, in the field of medical research, or databases with information about welfare payments in the field of social sciences. [^9]: EDPB Guidelines 05/2020 on [[consent]] under Regulation 2016/679 (Guidelines on [[consent]]) (Version 1.1, 04.05.2020) para. 153. [^10]: See, *inter alia*: Recital 25 of Regulation (EU) 2024/1689 (Artificial Intelligence Act); Annex I of Regulation (EU) 2021/821; Article 2(1) of Directive (EU) 2019/790; Article 3(1)(b) Digital Omnibus; ALLEA, The European Code of Conduct for Research Integrity (ECCRI) (Revised Edition 2023); UN Special Rapporteur on the Right to Privacy, Recommendation on the protection and use of health-related [[data]] (05.12.2019) p. 7-8; Frascati Manual 2015 paras. 2.26, 2.6 and 2.7; Explanatory Report to Protocol CETS No. 223 para. 50; Council Recommendation of 18 December 2023 (OJ C, C/2023/1640) paras. 1-2. [^11]: UN Recommendation on the protection and use of health-related [[data]], p. 9; OJ C, C/2023/1640, para. 2; Preamble to ECCRI, page 4. [^12]: ECCRI, p. 2.2; Frascati Manual 2015, p. 2.26. [^13]: Guidelines on [[consent]], para. 153; ECCRI, p. 2.2 and 2.4. [^14]: See: WMA Declaration of Helsinki (October 2024) p. 25; Article 5 Convention on Human Rights and Biomedicine (ETS No. 164, Oviedo 4.4.1997); See further in section 4.1.3. [^15]: EDPS, A Preliminary Opinion on [[data]] protection and scientific research (6.1.2020) p. 13. [^16]: ECCRI, p. 2.3; EDPS, A Preliminary Opinion on [[data]] protection and scientific research, p. 10. [^17]: ECCRI, p. 2.1. [^18]: ECCRI, p. 2.1 and 2.3; Cf. also: Pillar 1 Point 2 of the European Charter for Researchers (Annex II OJ C, C/2023/1640). [^19]: ECCRI, p. 2.2. [^20]: When assessing the contribution to the growth of society's collective knowledge and wellbeing, [[controller|controllers]] should consider reviews of the scientific merit of their research projects that, for example, can have been undertaken by independent review bodies. [^21]: To assess this factor, [[controller|controllers]] should have recourse to the goal of the research, as stated in the research or project plan. [^22]: ECCRI, p. 2.8. [^23]: An example is Annex 1 Module 5 p. 5.2 of Directive 2001/83/EC. [^24]: See, for example: Article 2(1) Regulation (EU) 2021/695 (Horizon Europe) and Article 2(a) Council Regulation (EC) No 723/2009 on the Community legal framework for a European Research Infrastructure Consortium (ERIC). [^25]: On the concept of a specific area of research, see further in section 4.1.2.1. [^26]: Curation and categorisation refer to the ordering of [[data]] contained in [[dataset|datasets]] that are to be used for scientific research purposes, including sorting and labelling [[data]] as well as deleting categories of [[personal data]] that are not necessary for the scientific research purposes. [^27]: See further in section 8.3. [^28]: ([[SiteMap/Official Texts/GDPR#^article5|Article 5(1)(b) GDPR]]: "[[personal data]] shall be [...] collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further [[processing]] for [...] scientific [...] research purposes [...] shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes." See also proposed Recital 29 and Article 3(2) Digital Omnibus. [^29]: Nonetheless, the [[controller]] must still adopt appropriate safeguards, in line with Article 89(1) GDPR. See further in section 8 below. [^30]: Unless the purpose for further [[processing]] is archiving in the public interest, historical research or statistical purposes, which also benefit from the presumption of purpose compatibility. [^31]: EDPB, Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General [[data|Data]] Protection regulation (GDPR) (art. 70.1.b)) (23.1.2019) para. 31. [^32]: EDPB-EDPS Joint Opinion 2/2026 On the Proposal for a Regulation as regards the simplification of the digital legislative framework (10.02.2026) para. 32. [^33]: Articles 6(1)(e) and (f) GDPR respectively. See further in sections 4.2 and 4.3. [^34]: A change of purpose could be contradictory to the specificity of [[consent]] or the scope of the legal obligation. See further in section 4.1.2.1. [^35]: See further at para. 61. [^36]: See also the Example 10, where a [[controller]] relies on [[performance of an AI system|performance]] of a contract (Article 6(1)(b) GDPR) for the initial [[processing]], but legitimate interest ([[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]]) for the [[processing]] of [[personal data]] for scientific research purposes. [^37]: See further in section 4.4. [^38]: EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research (2.2.2021) para. 22. [^39]: Both [[controller|controllers]] must still comply with all relevant obligations of the GDPR including, inter alia, determining an appropriate legal basis under Article 6(1) GDPR and, when applicable, which derogation under [[SiteMap/Official Texts/GDPR#article-9--processing-of-special-categories-of-personal-data|Article 9(2) GDPR]] that it can rely on to process special categories of [[personal data]], as well as if any additional conditions or limitations pursuant to Article 9(4) GDPR apply. [^40]: Article 5(1)(e) GDPR: "[[personal data]] shall be [...] kept in a form which permits identification of [[data subject|data subjects]] for no longer than is necessary for the purposes for which the [[personal data]] are processed; [[personal data]] may be stored for longer periods insofar as the [[personal data]] will be processed solely for [...] scientific [...] research purposes [...] in accordance with Article 89(1) [[subject]] to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the [[data subject]] [...]" [^41]: Article 13(2)(a) and 14(2)(a) GDPR. [^42]: Article 25(1) GDPR. [^43]: On the concept of a specific area of research see further in section 4.1.2.1. [^44]: Case C-77/21, paras. 52-59. [^45]: Judgment of 1 August 2022, *OT v Vyriausioji tarnybines etikos komisija*, C-184/20, EU:C:2022:601, para. 99. [^46]: See further in section 8. [^47]: Guidelines on [[consent]], para. 2. [^48]: As further clarified in sections 4.1.2.1 and 4.1.2.2, [[personal data]] processed for scientific research purposes on the basis of [[consent]], pursuant to Article 6(1)(a) GDPR, may be collected using either **broad** or **dynamic** [[consent]]. [^49]: [[processing|Processing]] that is necessary for the protection of vital interests of the [[data subject]] or of another natural person, pursuant to Article 6(1)(d) GDPR, may also be a viable legal basis in rare circumstances (see Recital 46). [^50]: See further in section 4.4. When [[processing]] [[genetic data]], [[biometric data]] or [[data concerning health]], further conditions or limitations, pursuant to Article 9(4) GDPR, might apply. [^51]: Article 10 GDPR. [^52]: Recital 43 GDPR; Judgment of 4 July 2023, *Meta Platforms Inc and Others v Bundeskartellamt*, C-252/21, EU:C:2023:537, para. 144. [^53]: Opinion 3/2019, para. 20; [[controller|controllers]] should consider that there may be provisions in MS law that delegate the authority to [[consent]] to the [[processing]] of [[personal data]] in medical research to spouses, family members or legal guardians in cases where the research [[subject|participant]] is incapacitated. [^54]: EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para. 10. [^55]: Article 7(4) of the GDPR; See also Guidelines on [[consent]], para. 26, and Opinion 3/2019, para. 19. [^56]: See further at para. 48. [^57]: Recital 33 GDPR. [^58]: Article 5(2) and 24(1) GDPR. [^59]: Article 35 GDPR; See also: Article 29 Working Party Guidelines on [[data protection impact assessment|DPIA]] (WP 248 rev.01, endorsed by the EDPB on 25 May 2018). [^60]: Recital 33 GDPR; Cf. also Recital 26 second para. DGA. [^61]: Guidelines on [[consent]], para. 158. [^62]: Guidelines on [[consent]], para. 156. [^63]: See further in Example 10. [^64]: See, by analogy: Judgment of 12 September 2024, *HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG and Okorenta Neue Energien Okostabil IV geschlossene Investment GmbH & Co. KG v Muller Rechtsanwaltsgesellschaft mbH and Others*, Joined Cases C-17/22 and C-18/22, EU:C:2024:738, para. 52. [^65]: Recital 42 GDPR; Guidelines on [[consent]], para. 64. [^66]: Cf. EDPB Guidelines 4/2019 on Article 25 [[data|Data]] Protection by Design and by Default (Version 2.0, 20.10.2020) para. 70. [^67]: See further in section 4.1.2.2. [^68]: Guidelines on [[consent]], para. 160. [^69]: See further in para. 115; Guidelines on [[consent]], para. 117. [^70]: Meaning an entity or individual that acts as a neutral intermediary between the holder of [[data]] and the [[user]] of [[data]], and that manages and oversees the [[processing]] of [[personal data]]. [^71]: While such safeguards should be adopted when a [[controller]] relies on broad [[consent]], they may also be relevant when a [[controller]] processes [[personal data]] for scientific research purposes on the basis of dynamic [[consent]] (see further in section 4.1.2.2) or another legal basis. [^72]: Pursuant to Article 37(1) GDPR. [^73]: Tools for managing [[consent]] can also be provided by [[data intermediation service|data intermediation services]], pursuant to Article 10(b) Regulation (EU) 2022/868 ([[data|Data]] Governance Act (DGA)). [^74]: Cf. DoH, October 2008, para 24; Article 62(4)(f) of Regulation (EU) 2017/745 on medical devices; Article 28(1)(c) CTR. [^75]: In addition, a [[controller]] may β€” as a safeguard pursuant to Article 89(1) GDPR β€” record the agreement of [[data subject|data subjects]] to process their [[personal data]] for scientific research purposes, when relying on another legal basis than [[consent]]. [^76]: Opinion 3/2019 para. 16. [^77]: Guidelines on [[consent]], para. 154; EDPB-EDPS Joint Opinion 3/2026 On the Proposal for a Regulation on establishing a framework of measures for strengthening Union's biotechnology and manufacturing sectors particularly in the area of health (European Biotech Act) (10.03.2026) para. 37. [^78]: EDPB-EDPS Joint Opinion 3/2026, para. 46; EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para. 5. [^79]: Article 5(2) GDPR; Judgment of 11 November 2020, *Orange Romania SA v ANSPDCP*, C-61/19, EU:C:2020:901, para. 42. [^80]: Article 7(2) GDPR. [^81]: Article 12(1) GDPR. See further: Guidelines on transparency, para. 35pp. [^82]: European Commission, Ethics and [[data]] protection (05.07.2021) p. 12. [^83]: Examples of MS laws: Section 4, subsection 1, paragraph 3 of the Finnish [[data|Data]] Protection Act (1050/2018); Article R322-2 of the French Research Code; Article 33 of the Icelandic Information Act (140/2012); Section 12(10-14) of the Italian Law Decree no. 179 of 18 October 2012; 1 Chapter 2 ss 2 p. Swedish law (SFS 1992:1434). [^84]: Official authority, pursuant to Article 6(1)(e) GDPR refers to an authority granted by the European Union, EFTA or a Member State. [^85]: According to Recital 41 GDPR, the legal basis relied upon should be clear and precise. [^86]: Recital 45 GDPR. [^87]: See further in section 4.1. [^88]: See further in section 4.3. [^89]: See e.g.: Judgment of 16 December 2008, *Heinz Huber v Bundesrepublik Deutschland*, C-524/06, EU:C:2008:724, para. 62. [^90]: EDPB Guidelines 1/2024 on [[processing]] of [[personal data]] based on [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]], Version 1.0, Adopted on 8 October 2024 (version for public consultation). [^91]: In accordance with Article 6(1) second para. GDPR, it is noted that public authorities cannot rely on [[SiteMap/Official Texts/GDPR#article-6--lawfulness-of-processing|Article 6(1)(f) GDPR]] when they are [[processing]] [[personal data]] in the [[performance of an AI system|performance]] of their tasks. [^92]: See above at para. 11 lit v; See also: Judgement of 4 October 2024, *Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens*, [[CJEU C-621-22 - Koninklijke Nederlandse Lawn Tennisbond|C-621/22]], EU:C:2024:857, para. 49. [^93]: See further at paras. 1 and 61; See also: Guidelines on legitimate interest, para. 24. [^94]: Guidelines on [[consent]], section 3. [^95]: For a similar reasoning, see further at para. 46. [^96]: The adopted safeguards should go beyond the mandatory measures required by the GDPR, such as performing a [[data protection impact assessment|DPIA]] pursuant to Article 35(1) GDPR. See, to that effect: [[EDPB Opinion 28-2024 on certain data protection aspects related to the processing of [[personal data]] in the context of AI models|Opinion 28/2024]] on certain [[data]] protection aspects related to the [[processing]] of [[personal data]] in the context of AI models (17.12.2024) para. 97. [^97]: See further in section 8.2. [^98]: Guidelines on legitimate interest, para. 57. [^99]: Guidelines on legitimate interest, para. 60. [^100]: Judgement of 21 December 2023, *ZQ v. Medizinischer Dienst*, C-667/21, EU:C:2023:1022, para. 78. [^101]: Judgment of 4 October 2024, *ND v DR*, C-21/23, EU:C:2024:846, paras. 79-83; C-184/20, paras. 120-127. See also Guidelines 1/2024, para. 40. [^102]: EDPB-EDPS Joint Opinion 3/2026, para. 36; See also further in section 8. [^103]: Article 35(3)(b) GDPR. [^104]: Article 9(4) GDPR. The EDPB underlines that such limitations may also be imposed by MS law for [[processing]] operations that are covered by other legal bases than Article 6(1)(e) GDPR. [^105]: See further in section 4.1.2.1. [^106]: See further in section 4.1.2.2. [^107]: Guidelines 8/2020 on the targeting of social media [[user|users]] (Version 2.0, 13.4.2021) para. 127. [^108]: [[CJEU C-252-21 - Meta Platforms Inc., formerly Facebook Inc., Meta Platforms Ireland Ltd v Bundeskartellamt|C-252/21]], p. 77. [^109]: See e.g. Judgement of 4 October 2024, *Maximilian Schrems v Meta Platforms Ireland Limited*, [[CJEU C-446-21 - Schrems v. Meta|C-446/21]], EU:C:2024:834, paras. 78-79. [^110]: C-252/21, paras. 81-82; Guidelines on the targeting of social media [[user|users]], para. 127 lit (i). [^111]: Guidelines on the targeting of social media [[user|users]], paras. 127-128. [^112]: Guidelines 8/2020, para. 127 lit (v). [^113]: C-446/21, para. 80. [^114]: Examples of Union and MS laws: Section 10 of the Danish [[data|Data]] Protection Act; Section 6, subsection 1, paragraph 7 of the Finnish [[data|Data]] Protection Act (1050/2018); Article 44-6 of the French [[data|Data]] Protection Act; Section 27(1) of the German Federal [[data|Data]] Protection Act; Article 11(1)(10) of the Icelandic [[data|Data]] Protection Act; Section 110 of the Italian [[data|Data]] Protection Code; 6 ss Swedish law (2003:460); Article 57(1)(a)(i) Regulation (EU) 2025/327 (EHDS). See also: Recital 151 of Proposal for a Regulation on establishing a framework for Union's biotechnology and biomanufacturing sectors (European Biotech Act) (COM(2025) 1022 final); Recital 30 of Commission Delegated Regulation (EU) 2025/2050. [^115]: C-184/20, para. 70. [^116]: See by analogy: C-439/19, paras. 105-106. [^117]: See further in section 8. [^118]: Recital 52 EHDS. [^119]: Article 29 Working Party β€” Guidelines on transparency under Regulation 2016/679 (WP260 rev.01, endorsed by the EDPB on 25 May 2018). [^120]: Guidelines on transparency, para. 32. [^121]: Guidelines on transparency, para. 35-36. [^122]: Guidelines on transparency, para. 39; Privacy dashboards can be provided for by [[data intermediation service|data intermediation services]], pursuant to Article 10(b) DGA. [^123]: For an example of how implement a [[consent]] record, see: W3C Community Group, [[consent]] Records and Receipts as per ISO/IEC TS 27560:2023 using DPV (01.0.8.2024) https://w3c.github.io/dpv/guides/[[consent]]-27560 (accessed on 24.09.2025). [^124]: Pursuant to Chapter III GDPR. See further in section 6. [^125]: If the [[controller]] relies on [[consent]] for the [[processing]] of [[personal data]], a privacy dashboard can be a particularly useful tool. See further in para. 50. [^126]: See, inter alia, Articles 12(1-2), 13(1)(a) and 14(1)(b) GDPR; See also: Guidelines on transparency, para. 55 and Guidelines on right of access, para. 53. [^127]: This information can also be provided using automated or pre-recorded messages. See: Guidelines on transparency, para. 21. [^128]: Judgment of the Court of 5 December 2023, *Nacionalinis visuomenes sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybine duomenu apsaugos inspekcija*, Case C-683/21, ECLI:EU:C:2023:949, para. 36. [^129]: [[processor|Processors]] should assist the [[controller]] in the fulfilment of [[data subject]]'s rights, pursuant to Article 28(3)(e) GDPR; In cases of joint [[controller|controllers]]hip, the provision of information and fulfilment of [[data subject|data subjects]]' rights should be laid down in the agreement between the [[controller]], pursuant to Article 26(1) GDPR. [^130]: Article 13(3) GDPR. [^131]: See further in section 5.5. [^132]: For a similar reasoning, see: Guidelines on transparency, para. 48. [^133]: See further in section 4.1.2.1. [^134]: Pursuant to Article 21(6) GDPR. See further in section 6.3. [^135]: EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para. 35; See also further at para. 77. [^136]: The EDPB notes that, in accordance with Article 11(1) GDPR, there is no obligation under the GDPR to retain identifiers. [^137]: Recital 37 of the Digital Omnibus. [^138]: See further in section 5.4.2.3. [^139]: Recital 37 of the Digital Omnibus. [^140]: See further at para. 79. [^141]: Judgement of 28 November 2024, *Nemzeti Adatvedelmi es Informacioszabadsag Hatosag v UC*, C-169/23, EU:C:2024:988, para. 49. [^142]: Depending on the context of scientific research and the set-up of the research infrastructure, it may be the case that several entities are joint [[controller|controllers]] when intermediaries are collecting and providing [[personal data]] for scientific research purposes. See further in section 7.3. [^143]: Guidelines on [[pseudonymisation]] (version for public consultation, 16.1.2025) p. 79. [^144]: See in this respect: Guidelines on transparency, paras. 57 and 61. [^145]: Guidelines on transparency, para. 59. [^146]: See further at para. 89. [^147]: Recital 62 of the GDPR; Guidelines on transparency, para. 62. [^148]: This may be the case if digital mail boxes are used in the MS in question. See further at para. 88. [^149]: Guidelines on transparency, para. 63. [^150]: EDPB Guidelines 03/2020 on the [[processing]] of [[data concerning health]] for the purpose of scientific research in the context of the COVID-19 outbreak, para. 37. [^151]: See further at para. 89. [^152]: C-169/23, para. 44. [^153]: C-169/23, para. 54. [^154]: Guidelines on transparency, para. 67. [^155]: Moreover, if scientific research includes [[processing]] of [[personal data]] of persons that are alleged of criminal acts or abusive behaviour, the [[processing]] needs to be lawful under Article 10 of the GDPR and specific safeguards needs to be adopted. [^156]: Cf. Article 17(3) Recommendation (CM/Rec(2016)6) of the Committee of Ministers to member States on research on biological materials of human origin (11.5.2016). [^157]: Guidelines on transparency, paras. 29 and 56. [^158]: Guidelines on transparency, para. 29. [^159]: EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, para. 38. [^160]: Transfers to third countries, or [[international organisation|international organisations]], are [[subject]] to specific provisions in Chapter V of the GDPR. For more information on what constitutes a transfer, see: Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR (Ver. 2.0, 14.2.2023) para. 9. [^161]: Guidelines on transparency, para. 29. [^162]: Guidelines on transparency, paras. 30 and 48. [^163]: The current guidelines do not address Article 15 GDPR on the right of access by the [[data subject]]. Guidance on the right of access is provided in EDPB Guidelines 01/2022 on [[data subject]] rights β€” Right of access (Version 2.1, 28.3.2023). [^164]: Restrictions, pursuant to Article 23 GDPR, in the context of [[processing]] for scientific research purposes may in particular be relevant for safeguarding important objectives of general public interest of the Union or of a MS as listed in Article 23(1)(e) and (i) GDPR. [^165]: See further in section 8. [^166]: Examples of derogations in MS law, pursuant to Article 89(2) of the GDPR include: Article 22(2) of the Danish [[data|Data]] Protection Act; Section 31 of the Finnish [[data|Data]] Protection Act (1050/2018); and Section 110(2) of the Italian [[personal data]] Protection Code. [^167]: See, for example, Article 71 EHDS. [^168]: See further in section 6.2.2. [^169]: Judgment of 4 October 2024, *Agentsia po vpisvaniyata v OL*, C-200/23, EU:C:2024:827, para. 120; Judgement of 7 December 2023, *UF and AB v Land Hessen*, joined cases C-26/22 and C-64/22, EU:C:2023:958, para. 111-112; See also further in section 6.3. [^170]: Guidelines on legitimate interest, para. 79. [^171]: For guidance on how to perform the necessity test, see inter alia: EDPS, Assessing the necessity of measures that limit the fundamental right to the protection of [[personal data]]: A Toolkit (2017). [^172]: In order to rely on the exceptions to the right to erasure under Article 17(3)(b) or (c) GDPR, the Union or MS law on which the [[processing]] is based should clearly identify the scientific research area and be in accordance with the conditions laid down in Article 6(3) and, where applicable, Article 9(2). [^173]: C-200/23, para. 124; C-13/16, para. 30. [^174]: In this regard, the wording **render impossible or seriously impair** implies a high threshold. For a similar reasoning, see: Guidelines on legitimate interest, para. 73 and 79. [^175]: See further in section 5. [^176]: Judgement of 9 March 2017, *Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni*, C-398/15, EU:C:2017:197, p. 47. [^177]: Joined Cases C-26/22 and C-64/22, para. 111. [^178]: Guidelines on legitimate interest, para. 25. [^179]: See also para. 119. [^180]: C-524/06, para. 62; C-184/20, p. 85. [^181]: C-13/16, para. 30. [^182]: See also para. 120. [^183]: See, for a similar reasoning: Guidelines on Automated individual decision-making and [[profiling|Profiling]], page 19. [^184]: Article 5(1)(c) GDPR; C-184/20, p. 93. [^185]: Guidelines on legitimate interest, para. 74. [^186]: C-200/23, para. 125. [^187]: Guidelines on legitimate interest, para. 71. [^188]: Guidelines (07/2020) on the concepts of [[controller]] and [[processor]] in the GDPR (Version 2.1, 7.7.2021). If sub-[[processor|processors]] are involved in the [[processing]] of [[personal data]], [[controller|controllers]] should consider the guidance provided in Opinion 22/2024 on certain obligations following from the reliance on [[processor]](s) and sub-[[processor]](s) (7.10.2024). [^189]: Guidelines on [[controller]] and [[processor]], para. 2. [^190]: Guidelines on [[controller]] and [[processor]], para. 11. [^191]: In line with the principle of accountability, pursuant to Article 5(2) and 24(1) GDPR. [^192]: Guidelines on [[controller]] and [[processor]], para. 12. [^193]: Article 4(7) GDPR. [^194]: Guidelines on [[controller]] and [[processor]], para. 40. [^195]: Judgment of 27 February 2025, *Amt der Tiroler Landesregierung v Datenschutzbehorde and Others*, C-638/23, EU:C:2025:127, paras. 42-47; Guidelines on [[controller]] and [[processor]], para. 23. [^196]: C-638/23, para. 28. [^197]: C-638/23, para. 37. [^198]: See further in section 7.3. [^199]: Judgement of 5 June 2018, *Unabhangiges Landeszentrum fur Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH*, C-210/16, EU:C:2018:388, para. 38; Guidelines on [[controller]] and [[processor]], para. 45. [^200]: The European commission has proposed that sponsors of clinical trials for medicinal products should be designated as [[controller|controllers]] for certain [[processing]] operations. See: Article 58(48) of the Proposal for a Regulation on establishing a framework of measures for strengthening Union's biotechnology and biomanufacturing sectors (European Biotech Act). [^201]: Those [[controller|controllers]] may, depending on the circumstances, also be joint [[controller|controllers]]. See further in section 7.3. [^202]: See further in section 8.5. [^203]: Article 29 GDPR; Guidelines on [[controller]] and [[processor]], para. 19; See also, for a similar reasoning: EDPB-EDPS Joint Opinion 3/2026, para. 25. [^204]: Article 4(8) GDPR; Guidelines on [[controller]] and [[processor]], para. 76. [^205]: Article 28(3) GDPR. [^206]: Guidelines on [[controller]] and [[processor]], para. 39-41. [^207]: Guidelines on [[controller]] and [[processor]], para. 80. [^208]: Art. 28(10) GDPR. [^209]: See further in section 7.3. [^210]: Article 26(1) GDPR. [^211]: Guidelines on [[controller]] and [[processor]], para. 55. [^212]: EDPB-EDPS Joint Opinion 3/2026, paras. 22 and 23; See also at para. 133. [^213]: Guidelines on [[controller]] and [[processor]], page 23 β€” Example on clinical trials. [^214]: See Judgement of 10 July 2018, *Tietosuojavaltuutettu v Jehovan todistajat β€” uskonnollinen yhdyskunta*, C-25/17, EU:C:2018:551, para. 66. [^215]: Guidelines on [[controller]] and [[processor]], para. 166 and footnote 73. [^216]: Article 26(1) GDPR. [^217]: Article 26(2) GDPR. [^218]: Judgement of 7 March 2024, *IAB Europe v Gegevensbeschermingsautoriteit*, C-604/22, EU:C:2024:214, para. 58. [^219]: Article 26(3) GDPR. [^220]: Article 82(4) GDPR. [^221]: Guidelines on [[controller]] and [[processor]], para. 166. [^222]: Article 89(1) GDPR should be read in conjunction with Recital 156. [^223]: See further in section 8.3. [^224]: Specific safeguards required by Union or MS law may be prescribed together with a legal basis that can be relied on for the [[processing]] of [[personal data]] for scientific research purposes. Safeguards can also be provided in Union or MS law together with a derogation from the prohibition of [[processing]] of special categories of [[personal data]], in accordance with Article 9(2)(g), (i) or (j) of the GDPR. Finally, Article 89(1) GDPR can be linked to Article 9(4), which allows MSs to adopt national legislation with additional conditions for the [[processing]] of [[genetic data]], [[biometric data]] and [[data concerning health]]. [^225]: See further in section 8.2. [^226]: See Article 29 Working Party's Guidelines on [[data protection impact assessment]] ([[data protection impact assessment|DPIA]]) (WP 248 rev.01) and determining whether [[processing]] is "likely to result in a high [[risk]]" for the purposes of Regulation 2016/679. [^227]: Articles 7 and 8 CFREU. [^228]: Cf. Guidelines 4/2019 on Article 25 β€” [[data|Data]] Protection by Design and Default (Version 2.0, 20.10.2020) paras. 11-12. [^229]: Cf. Article 17(3) Recommendation (CM/Rec(2016)6) of the Committee of Ministers to member States on research on biological materials of human origin (11.5.2016). [^230]: Concerning genetic and [[biometric data]], see further in section 8.4. [^231]: Recital 75 GDPR. [^232]: Judgment of 24 February 2022, *SIA 'SS' v Valsts ienemumu dienests*, C-175/20, EU:C:2022:124, para. 72-74. [^233]: Recital 26 GDPR; See also Article 29 Working Party, Opinion 05/2014 on Anonymisation Techniques (WP216) p. 5. [^234]: Case C-77/21, para. 34. [^235]: Recital 156 GDPR. [^236]: Article 4(5) GDPR: "[...] the [[processing]] of [[personal data]] in such a manner that the [[personal data]] can no longer be attributed to a specific [[data subject]] without the use of additional information, provided that such additional information is kept separately and is [[subject]] to technical and organisational measures to ensure that the [[personal data]] are not attributed to an identified or identifiable natural person." [^237]: Guidelines on [[pseudonymisation]], para. 23. [^238]: Guidelines on [[pseudonymisation]], section 3.1; See also: ENISA, [[pseudonymisation]] techniques and best practices (November 2019); ENISA, Deploying [[pseudonymisation]] techniques β€” The case of the Health Sector (March 2022). [^239]: Provided that the [[recipient]] has the means reasonably likely to be used to identify the [[data subject]]. See further: Judgment of 4 September 2025, C-413/23 P, *EDPS v. SRB*, EU:C:2025:645, para. 82. [^240]: Guidelines on [[pseudonymisation]], p. 78-79. [^241]: Article 4(13) GDPR: "[[personal data]] relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question." [^242]: A29 WP, Opinion 05/2014, p. 10. [^243]: Article 4(14) GDPR: "[[personal data]] resulting from specific technical [[processing]] relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic [[data]]." [^244]: Judgment of the Court of 17 October 2013, *Michael Schwarz v Stadt Bochum*, C-291/12, EU:C:2013:670, para. 27. [^245]: Cf. Recitals 39 and 75 GDPR. [^246]: See further in section 5.1. [^247]: See further in section 4.1.3. It should be noted that if a [[controller]] commits to [[consent]] as a safeguard, then it needs to adhere to the [[consent]] provided by the [[data subject]], even if the legal basis is not [[consent]]. [^248]: This safeguard is without prejudice to research in the medical field, where the research results may influence the healthcare of [[data subject|data subjects]]. See, to that end: Recital 159 of the GDPR. [^249]: For an example in this regard, see: Article 73 as well as recital 77 EHDS and Articles 2(20), 5(3)-(4) DGA. [^250]: Article 40 GDPR. [^251]: Article 42 GDPR.