According to Article 5(1)(b), the further processing for the purposes of archiving in the public interest, scientific or historical research purposes or statistical purposes is compatible even if the data were collected initially for other purposes (provided that technical and organizational measures are in place that ensure respect for the rights and freedoms of the data subject). However, it remains under discussion whether other provisions may apply e.g., the compatibility test under Article 6(4) of the GDPR.
However, in relation to special categories of data, Article 9(2) (j) explicitly mentions that processing must be “based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”.
This apparent legal issue requires an interpretative effort that could resolve the matter in two ways. First, since Article 5 does not refer to special categories of personal data, it could be understood as limited to cases where no such information is used. If we were to speak of personal data of these categories, Article 9, which is more specific, would apply.
The second solution is based on an interpretation of Article 5 merely as general principles, and in light of recital 50, which outlines a number of conditions for secondary use, representing the requirement of enhanced self-monitoring by the controller, as well as a “reasonable expectation” on the part of the data subject that this secondary processing can take place. In addition, Art. 6(4) establishes a number of criteria to determine the compatibility of a processing operation with the (different) purpose for which the personal data were collected, which should also be taken into account in these cases: “a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing; b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller; c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10; d) the possible consequences of the intended further processing for data subjects; e) the existence of appropriate safeguards, which may include encryption or pseudonymization” (see the “Identification, pseudonymization, anonymization” subsection in the “Concepts” section of the General Part of these Guidelines). Therefore, it seems that Articles 5, 6 and 9 should be read and interpreted together[1].
References
1EDPS, A Preliminary Opinion on data protection and scientific research, 2020, p. 23. At: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202003_healthdatascientificresearchcovid19_en.pdf Accessed: 15 January 2020. ↑