A. Notion of “purposes of archiving in the public interest”
Archives in the public interest are understood to be those of public or private bodies that hold records of public interest and which, pursuant to Union or Member State law, have a legal obligation to acquire, preserve, appraise, arrange, describe, communicate, promote, disseminate and provide access to records of enduring value for general public interest[1]. Nevertheless, it does not apply to deceased persons’ data (see “personal data” subsection in the “Concepts” Section of the General Part of these Guidelines).
B.Notion of “scientific research”
Scientific research is an overly broad term that generally refers to the search for knowledge, through a certain methodology, in any area of human knowledge. The GDPR does not include a definition of “scientific research” as such but introduces a series of considerations that allow us to define its main characteristics. Firstly, “scientific” research is different from “historical research purposes” and “statistical purposes”. Furthermore, it covers different fields e.g., research in the life sciences related to human health, but also the social sciences (recitals 157 and 159). It must bring “benefits”, at least potentially. This expectation justifies a unique regime that allows exceptions and derogations of certain rights (Art. 89.2)[2]
Within this framework, the GDPR undertakes a broad interpretation of scientific activity, including “technological development and demonstration, fundamental research, applied research and privately funded research” (recital 159). This broad conception includes research projects with publishable results and other analytical studies, without excluding privately funded research or research funded by profit-seeking commercial companies. However, it also contains certain limits, some criteria that make it possible to determine the extent to which the exceptions provided for throughout the GDPR can be applied in a scenario of increasing data analysis procedures. However, the Regulation remains ambiguous about what parameters an activity or processing operation must meet in order to be considered “scientific research”. The EDPS has, in an attempt to shed some light on this, alluded to the following parameters in its Preliminary Opinion on data protection and scientific research[3]:
- The activity must contribute to the increase of knowledge (scientific research in the strict sense) or the use of knowledge for the production of devices, materials, services, processes or products (technological development and demonstration).
- The activity must be developed under certain quality standards (professional, methodological and institutional), “including the notion of informed consent, accountability and oversight”[4].
- “The research is carried out with the aim of growing society’s collective knowledge and wellbeing, as opposed to serving primarily one or several private interests”.[5]
According to this perspective, scientific research, for the purposes of the GDPR, covers the activity of both generating and applying knowledge and excludes activity that does not present a guarantee of rigour in its development. Thus, scientific research requires research projects to be “set up in accordance with relevant sector-related methodological and ethical standards, in conformity with good practice”.[6] The procedures that allow the adequate evaluation of these parameters, which may vary from case to case, will represent for the processing of the data in the sense of Article 89.1.
It is important to underline that teaching[7] cannot be considered a scientific activity, even if it is aimed at training professionals in this sector. Consequently, given that the GDPR does not include any mention of it, the processing of data for this purpose is subject to the general regime, which can lead to many dysfunctions in practice.[8]
C. Notion of “historical research”
The GDPR applies this description to data processed for the purposes of historical research. This is a broad notion that includes both historical research itself and research for genealogical purposes[9]. However, it does not apply to research carried out with deceased persons’ data.
D. Notion of “processing for statistical purposes”
Statistical purposes mean any operation of collection and the processing of personal data necessary for statistical surveys or for the production of statistical results[10]. However, the resulting data must be non-personal data (aggregate data), and it is further required that neither this result nor the personal data are used in support of measures or decisions regarding any particular natural person.
In addition, once again, Union or Member State law, within the limits of the GDPR, should determine most of the practical and particular aspects of the processing (what data is considered as statistical content, control of access, and appropriate measures to safeguard the rights and freedoms of the data subject and for ensuring statistical confidentiality, etc.).
References
1Recital 158 of the GDPR. ↑
2Recital 157 GDPR. ↑
3EDPS, A Preliminary Opinion on data protection and scientific research, 2020, p. 12. At: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202003_healthdatascientificresearchcovid19_en.pdf Accessed: 15 January 2020. ↑
4Ibid. ↑
5Ibid. ↑
6EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, adopted on 4 May 2020, v1.1., p. 30. Available at: https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf Accesed 16 September 2021. ↑
7“Teaching” must not be identified with “academic expression” in the context of Art. 85 GDPR. ↑
8See, about “academic expression”, EDPS, p. 10. ↑
9Recital 160 GDPR. ↑
10Recital 162 GDPR. ↑