If data will be used for research purposes, consent of the data subject is not needed for the disclosure. According to article 5(b) of the GDPR, using the data gathered for research purposes is lawful and compatible with the purposes for which the personal data were initially collected (provided that technical and organizational measures are in place in particular in order to ensure respect for the rights and freedoms of the data subject and that article 89(1) applies) (see “Purpose limitation principle” subsection in the “Principles” section of the General Part of these Guidelines).

Further regulatory previsions do not seem to be necessary, either, even though article 9(2) (j) explicitly mentions the need for processing to be “based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”.  Recital 159 and 33 introduce the notion of broad consent for scientific research, meaning that the exact processing must not be fully specified in advance. Data subjects should however be given the option to give consent to specific areas of research and to withdraw consent for other parts of the research objective. (see “Data protection and scientific research” subsection in the Main Concepts section of these Guidelines).