According to Article 9.2 of the GDPR, there are several exceptions that allow for the processing of special categories of personal data, despite the general prohibition. On this page we will discuss these exceptions and look at an example that illustrates the rationale behind them.

Let us start by looking at how the exception for scientific research is included in the GDPR. With respect to research, Article 9.2j applies:

9.2. Paragraph 1 shall not apply if one of the following applies:

(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

 

Therefore, the researcher must always assess and substantiate the reason or reasons why the processing of special categories of personal data is necessary in relation to the scientific purpose of the research in question (this refers to the principles of subsidiarity and proportionality in relation to the research question – see here for an explanation of these terms).

 

The researcher must look carefully for alternative and less drastic ways to achieve the same purpose. This always starts with two considerations:

 

1.     Are the special categories of personal data really needed in this research?

2.     As a researcher, how do you collect these data in the least harmful or risky manner?

An answer to the second question might be, for example, to extract these necessary special categories of personal data from existing records, rather than collect them again via surveys. Researchers should be well aware of the need to provide for even greater and better protection for this type of sensitive personal data.


In the spotlight



A researcher or organisation is not permitted to use sensitive personal data unless one of the exceptions mentioned in Article 9.2 applies. This is different from working with regular personal data; a researcher may use such data as long as there is a basis for this and appropriate measures have been taken. The prohibition against processing sensitive personal data seems to contradict the objective of the GDPR which is to encourage a ‘free movement of data’ as mentioned in the title of the GDPR:

regulationsHowever, since there are established control mechanisms in the field of research based on scientific methodology and traditions, it is possible to process sensitive data within the framework of the GDPR under certain conditions. These exceptions can found in Article 89 of the GDPR and are further explained for the Dutch context specifically in Article 24 of the UAVG (in Dutch only).

Listing the exceptions

Article 89(2) (GDPR) lays down the main exception based on which the processing of sensitive personal data is permitted for research purposes. The Article mentions certain derogations with regard to the rights of participants in scientific research (i.e. the data subjects):

Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.

In the Netherlands, the room for interpretation provided for in Article 89(2) of the GDPR has been filled in via Article 44 of the UAVG (in Dutch only) (Member State law). Pursuant to Article 44 (UAVG) (in Dutch only), Articles 15, 16, and 18 of the GDPR can be disregarded. These concern:

For example, for reasons of reproducibility and scientific integrity, further processing of new data from the individual must be suspended once the consent is withdrawn. Personal data processed till the time of withdrawal of consent (and which therefore have been legitimately collected and processed) may remain processed. This should be clearly communicated in advance to the possible research participants.