§ 27 FDPA permits processing of sensitive data without consent:
- for scientific or historical research; and
- for statistical purposes
if the processing is necessary for these purposes and the data controller’s interest to process data significantly outweighs the data subject’s interest.
The data controller must apply certain "suitable and specific" measures.
Provision also restricts data subjects' rights in the context of processing for research and statistical purposes, and sets out requirements for the publication of such data.
§ 32-37 FDPA also contain other (general) restrictions of data subjects' rights on the basis of Art. 23 GDPR.
Amended Section 99 IDPA, allows personal data to be processed; stored; & transferred to another controller after the normal period for processing of personal data and even after the termination of the main data processing if these processing will be carried out for scientific, historical or statistical purposes as well as at archiving in the public interest.
Amended Section 106 IDPA - the Italian DPA is to promote rules for professional and ethical conduct for processing for statistical purposes or for scientific research. Rules to apply both to public and private bodies, scientific societies and professional associations. Aim of the guidance is to
identify adequate guarantees for the rights and freedoms of the data subject in accordance with Article 89 GDPR.
Amended Section 110 IDPA: possible to carry out scientific and medical research, using special categories of data, without consent in certain circumstances.
Amended Section 110-bis IDPA: ability for the Italian DPA to authorise secondary uses of special category data for scientific and statistical research, in situations where it is impossible or would involve a disproportionate effort to inform all data subjects. Does not apply to genetic data.
Article 25 - regarding processing of personal data for statistical purposes:
a) it will be lawful only if the information is required by an EU rule or by the statistical programming rules;
b) the Spanish Government Statistics Act provides that processing of special category data for statistical purposes must be based on the express and voluntary consent of the data subject;
c) If statistical secrecy guarantees under Spanish legislation apply, competent bodies for the public statistical function can deny data subject rights in Articles 15 to 22 of the GDPR .
Article 26 - processing of personal data for archiving purposes in the public interest is subject to the Spanish Historical Heritage Act and other related regulations.
The draft Bill does not provide information about the processing for scientific or historical research purposes.
Sched.1, part 1, §4 Processing of special category data and criminal offence data for archiving purposes, scientific or historical research purposes, or statistical purposes permitted if:
- in accordance with GDPR (Art.81) (use of t.o.m.s and data minimisation; anonymise if possible; pseudonymise if possible); and
- must not be likely to cause damage or distress; must not be used for measures or decisions with respect to a particular data subject unless is approved medical research (s.19); and
- is in the public interest.
Exemptions from data subject rights (access; rectification; restriction; portability; right to object) where processing meets conditions set out in Art.89 (1) & s.19 DP Act; and
- compliance would prejudice the ability to achieve the purposes of the research/ statistics/ archiving; and
- for research/ statistics: the results must not be made available in identifiable form.