Scientific, historical or statistical purposes

Home
Capabilities
Privacy and Data Protection
General Data Protection Regulation
GDPR Tracker
Scientific, historical or statistical purposes

Country	Last reviewed	Scientific, historical or statistical purposes
Austria	05.06.2018	Sec 7 ADPA governs special provisions for the processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes: Provided that the processing is not intended to result in a personalized outcome, it is admissible in case the used data is (i) publicly accessible, (ii) lawfully collected for other legitimate purposes or (iii) pseudonymised. All other data processing activities for scientific, historical or statistical purposes require (i) a specific statutory authorization, (ii) the consent of the data subject or (iii) approval by the Austrian Data Protection Authority. Since these provisions are quite restrictive, special regulations for certain areas (especially health-care and pharma sector) are currently in legislation process.
Belgium	08.10.2018	BPA Title 4 is on processing for archiving purposes in the public interest, for scientific or historic purposes or statistical purposes. It sets out the necessary safeguards that must be taken into account when not applying certain data subject rights because they threaten to render impossible or seriously impair the achievement of those purposes. The general safeguards consist of: The requirement to appoint a DPO in case the processing is likely to result in a high risk to the rights and freedoms of natural persons within the meaning of Article 35 GDPR; and The requirement to add specific additional information to the register of processing activities, including (among others) justification of the (non-)use of pseudonymised data in case of processing for scientific, historical or statistical purposes and justification of the public interest in case of preserved archives. Where the personal data are obtained directly from the individual, the BPA requires additional information to be provided to the individual, notably on whether or not the personal data will be anonymized and the reasons why the data subject's rights threaten to render impossible or seriously impair achievement of the relevant purposes. Where the personal data are not obtained directly from the individual, an agreement must in principle be concluded with the controller of the initial processing activity. This is subject to exceptions. Additionally, the BPA establishes a number of anonymization and pseudonymisation requirements for processing for archiving purposes in the public interest, for scientific or historic purposes or statistical purposes. It also distinguishes between the concepts of "communication of data", which means the communication of data to an identified third party, and "dissemination of data", which means disclosure of data without identifying the relevant third party and stipulates requirements and safeguards for each situation.
Czech Republic	13.09.2018	n/a
Denmark	06.09.2018	§ 10 permits processing of special category data and data related to criminal offences for statistical or scientific purposes when necessary for reasons of substantial public interest and if necessary for the research; § 11(3) permits processing of personal identification numbers by private organisations for statistical or scientific purposes; § 22(5) restricts data subjects' rights in relation to statistical or scientific puArticle 42 GDPR Execution Act: where processing takes place solely for scientific or historical research purposes, or statistical purposes, the controller may declare articles 15, 16 and 18 of the GDPR inapplicable. Data subjects will not have rights of access, rectification or restriction of processing for this data.rposes.
Finland	13.11.2018	The Data Protection Act includes derogations and safeguards in accordance with Article 89 GDPR. These mostly carry forward rules which already applied under the Personal Data Act. Processing for scientific, historical or statistical purposes is permissible as long as the safeguards in the Data Protection Act are met.
France	11.02.2019	Article 36. Where the processing of personal data is carried out by the public archive services for archival purposes in the public interest, for scientific, historical or statistical purposes: the right of access, rectification, to restrict the processing, and the notification obligation regarding rectification or erasure of personal data or restriction of processing, to data portability and the right to object do not apply. Article 100-1 of the Decree specifies the conditions and guarantees for this derogation.
Germany	23.05.2018	§ 27 FDPA permits processing of sensitive data without consent: - for scientific or historical research; and - for statistical purposes if the processing is necessary for these purposes and the data controller’s interest to process data significantly outweighs the data subject’s interest. The data controller must apply certain "suitable and specific" measures. Provision also restricts data subjects' rights in the context of processing for research and statistical purposes, and sets out requirements for the publication of such data. § 32-37 FDPA also contain other (general) restrictions of data subjects' rights on the basis of Art. 23 GDPR.
Hungary	01/04/2019	Covered by separate legislation.
Ireland	7.06.2018	Under section 42 of the Act, personal data may be processed for (a) archiving purposes in the public interest; (b) scientific or historical research purposes; or (c) statistical purposes, subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects.
Italy	25.10.2018	IDPA Section 99, allows personal data to be processed; stored; & transferred to another controller after the normal period for processing and even after the termination of the main processing if carried out for scientific, historical or statistical purposes as well as archiving in the public interest. Section 106 IDPA - the Authority will issue guidance for the processing of personal data for statistical or scientific research purposes. These rules will apply both to public and private bodies, scientific societies and professional associations. The aim of the guidance is to identify adequate guarantees for the rights and freedoms of the data subject in accordance with Article 89 GDPR. Section 110 IDPA: provides for the possibility to carry out scientific and medical research, using special categories of data, without consent in certain circumstances. Section 110-bis IDPA: ability for the Authority to authorize secondary uses of special category data for scientific and statistical research, in situations where it is impossible or would involve a disproportionate effort to inform all data subjects. It does not apply to genetic data.
Netherlands	17.09.2018	Article 42 GDPR Execution Act: where processing takes place solely for scientific or historical research purposes, or statistical purposes, the controller may declare articles 15, 16 and 18 of the GDPR inapplicable. Data subjects will not have rights of access, rectification or restriction of processing for this data.
Poland	07.09.2018	n/a
Slovakia	13.09.2018	Processing of information for scientific, historical and statistical purposes is allowed, if it is adequate, respects the essence of personal data protection and appropriate measures for the protection of the rights and interests of data subjects are taken (Article 16 k) of New DPA). These measures are of a technical and organisational nature and must respect the principle of data minimisation and pseudonymisation (Article 78 (8) of New DPA). Article 78 (9) of New DPA restricts data subjects' rights in this context under certain conditions.
Spain	05.03.2019	Article 25 of the SDPA states that: a) The processing of personal data carried out by the bodies entrusted with competences related to the exercise of the public statistical function shall be subject to the provisions of their specific legislation, as well as of GDPR and of this SDPA; b) the communication of data to the competent bodies in statistical matters shall only be understood to be covered by the public interest in cases in which the statistics for which the information is required are required by a EU law or are included in the legally foreseen statistical programming instruments (the legislation establishes certain instruments by means of which the statistical function is to be carried out. In Spain, in the production of statistics for State purposes, the same standardised system of concepts, definitions, statistical units, classifications, nomenclatures and codes shall be applied, making comparability, integration and analysis of the data and the results obtained feasible, for this, the state and autonomous statistical services may establish agreements to homogenise statistical instruments). c) Spanish Government Statistics Act : processing of special category of data for statistical purposes must be based on express and voluntary consent of the data subject; d) If the statistical secrecy guarantees provided for under Spanish legislation apply (statistical secrecy obliges statistical services not to disclose, in any case, personal data whatever their origin is), competent bodies for the public statistical function can deny data subject rights set forth in Articles 15 to 22 of the GDPR . Article 26 - processing of personal data for archiving purposes by the public administrations and in the public interest is subject to the Spanish Historical Heritage Act and other related regulations.
Sweden	06.09.2018	The Personal Data Act paragraph 3:7: Sensitive personal data can be processed according to the GDPR Art. 9(2)(j) if the processing is necessary for statistical purposes and the public interest, for the statistics project for which the processing takes place, clearly outweighs the risk for unfair infringement of the individuals' integrity that the processing may cause.
UK	22.05.2018	Sched.1, part 1, §4 Processing of special category data and criminal offence data for archiving purposes, scientific or historical research purposes, or statistical purposes permitted if: - in accordance with GDPR (Art.81) (use of t.o.m.s and data minimisation; anonymise if possible; pseudonymise if possible); and - must not be likely to cause damage or distress; must not be used for measures or decisions with respect to a particular data subject unless is approved medical research (s.19); and - is in the public interest. Exemptions from data subject rights (access; rectification; restriction; portability; right to object) where processing meets conditions set out in Art.89 (1) & s.19 DP Act; and - compliance would prejudice the ability to achieve the purposes of the research/ statistics/ archiving; and - for research/ statistics: the results must not be made available in identifiable form.