Article 89(2) of the GDPR states: “Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.” Together with Article 14(5)(b), this clause introduces several derogations regarding data subject rights (see “Data subjects rights” section in the General Part of these Guidelines), namely:
- Right of access (Article 15 GDPR): According to Article 89, it is possible to limit the right of access to data subjects. This limitation covers both personal data that was processed for the research and personal data that was obtained as a result of the analysis or procedures developed. In the biomedical field, for example, this concerns any results obtained from body examinations or procedures, analysis of their samples or data, etc.
- Right to rectification (Article 16 GDPR): The right to have inaccurate data rectified or completed is not of great significance in scientific research (it may be more relevant, for example, in historical research). Neither is its limitation. The methodology of scientific research requires accuracy and reliability of the information being handled in order that solid conclusions are obtained, so it will be in its own interest to demand such accuracy;
- Restriction of processing (Art. 18 GDPR): Restriction of processing “means the marking of stored personal data with the aim of limiting their processing in the future” (Article 4(3) GDPR). Personal data whose processing is limited are not deleted and are kept for different purposes, but cannot be used or transferred beyond that scope. In the framework of an investigation, the exercise of this right could hinder the continuity of the investigation or the publication of results in its first phase (limitation of the continuity of its use). This is why this derogation makes sense.
- Right to object (Art. 21 GDPR): The right of objection allows the data subject whose personal data is being processed pursuant to any legal grounds other than consent to object to the processing. This possibility is the basis of so-called opt-out systems (in which consent to the use of data for research purposes is presumed), and fundamental for cases in which consent to processing is not required (Articles 5 and 9 GDPR). Raising exceptions to this right has important consequences for the autonomy of the data subjects, since it may imply that the data are used against their will. Justifying these exceptions as obstacle they may represent for research, would be fairly simple in any case where such data are relevant for research.
| Example: Research on rare diseases
Research on rare diseases often relies on personal data obtained from a quite small number of data subjects (due to the pure nature of rare diseases). Therefore, if a significant number of individuals participating in the research decide to exercise their rights to restriction and/or objection, the representativeness and reliability of the research data might be significantly undermined as a consequence. Furthermore, researchers might face serious issues in terms of publishing, since they could not provide those data to the publisher. Therefore, under such circumstances, the controller could use the derogations to those rights settled by Article 89. |
Controllers shall always keep in mind that “any derogation from these essential data subject rights must be subject to a particularly high level of scrutiny in line with the standards required by Article 52(1) of the Charter”. As a result, derogations under GDPR Article 89(2) are only possible if the conditions and safeguards required under Article 89(1) are satisfied.
Furthermore, under Article 89(2), derogations can be applied only “in so far as” the rights to be derogated from are “likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes”.[1] Lastly, controllers must consider that “the fact that putting in place technical and organizational measures to provide access and other rights to individuals may require financial and human resources is by itself not a valid justification to derogate from the rights of individuals under the GDPR”.[2]
Finally, as regards only to the data processed for archiving purposes in the public interest, Union or Member State law may provide, in addition to those above-mentioned, for derogations to the right of notification regarding rectification, erasure or restriction of processing (Article 19) and to the right of portability (Article 20)[3]. Once again, this requires that the exercise of these rights may render impossible or seriously impair the achievement of the specific purposes and that such derogations may be, as a result, necessary for the fulfilment of those purposes.
Derogations to the right to erasure or right to be forgotten
According to Article 17(3)(d), this right shall not apply to the extent that processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as it is likely to render impossible or seriously impair the achievement of the objectives of that processing.
Similarly, derogations to the right to erasure will directly apply, without the need of further development by Member States.
References
1EDPS, A Preliminary Opinion on data protection and scientific research, 2020, p. 21. At: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202003_healthdatascientificresearchcovid19_en.pdf Accessed: 15 January 2020. ↑
2EDPS Opinion on safeguards and derogations under Article 89 GDPR in the context of a proposal for a Regulation on integrated farm statistics, 2017. p.3. At: https://edps.europa.eu/sites/edp/files/publication/17-11-20_opinion_farm_statistics_en.pdf. Accessed: 17 January 2020. ↑
3See Article 89(3) of the Regulation. ↑