Country
Last reviewed
Scientific, historical or statistical purposes

Austria 05.06.2018 Sec 7 ADPA governs special provisions for the processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes:

Provided that the processing is not intended to result in a personalized outcome, it is admissible in case the used data is (i) publicly accessible, (ii) lawfully collected for other legitimate purposes or (iii) pseudonymised.

All other data processing activities for scientific, historical or statistical purposes require (i) a specific statutory authorization, (ii) the consent of the data subject or (iii) approval by the Austrian Data Protection Authority.

Since these provisions are quite restrictive, special regulations for certain areas (especially health-care and pharma sector) are currently in legislation process.
Belgium 08.10.2018 The BPA contains an entire title (Title 4) on processing for archiving purposes in the public interest, for scientific or historic purposes or statistical purposes. It sets out the necessary safeguards that must be taken into account when not applying certain data subject rights because they threaten to render impossible or seriously impair the achievement of those purposes.

The general safeguards consist of:

- The requirement to appoint a DPO in case the processing is likely to result in a high risk to the rights and freedoms of natural persons within the meaning of Article 35 GDPR; and
- The requirement to add specific additional information to the register of processing activities, including (among others) justification of the (non-)use of pseudonymised data in case of processing for scientific, historical or statistical purposes and justification of the public interest in case of preserved archives.

Where the personal data are obtained directly from the individual, the BPA requires additional information to be provided to the individual, notably on whether or not the personal data will be anonymized and the reasons why the data subject's rights threaten to render impossible or seriously impair achievement of the relevant purposes. Where the personal data are not obtained directly from the individual, an agreement must in principle be concluded with the controller of the initial processing activity. This is however subject to exceptions.

Additionally, the BPA establishes a number of anonymization and pseudonymisation requirements for on processing for archiving purposes in the public interest, for scientific or historic purposes or statistical purposes. It also distinguishes between the concepts of "communication of data", which means the communication of data to an identified third party, and "dissemination of data", which means disclosure of data without identifying the relevant third party and stipulates requirements and safeguards for each situation.
Czech Republic 13.09.2018 n/a
Denmark 06.09.2018 § 10 permits  processing of special category data and data related to criminal offences for statistical or scientific purposes  when necessary for reasons of substantial public interest and if necessary for the research;
§ 11(3) permits  processing of personal identification numbers by private organisations for statistical or scientific purposes; 
§ 22(5) restricts data subjects' rights in relation to statistical or scientific purposes.
Finland 13.11.2018 The Data Protection Act includes derogations and safeguards in accordance with Article 89 GDPR.  These mostly carry forward rules which already applied under the Personal Data Act. Processing for scientific, historical or statistical purposes is permissible as long as the safeguards in the Data Protection Act are met.
France 22.05.2018 The New Data Protection Act adds a provision on the data subjects rights in case of processing for archiving purposes. The right of access, the right to rectification, the right to restriction of processing, the right to data portability and the right to object do not apply for this type of processing.
Germany 23.05.2018

§ 27 FDPA permits processing of sensitive data without consent: 
- for scientific or historical research; and 
- for statistical purposes 
if the processing is necessary for these purposes and the data controller’s interest to process data significantly outweighs the data subject’s interest. 
The data controller must apply certain "suitable and specific" measures. 

Provision also restricts data subjects' rights in the context of  processing for research and statistical purposes, and sets out  requirements for the publication of such data. 

§ 32-37  FDPA also contain other (general) restrictions of data subjects' rights on the basis of Art. 23 GDPR.

Hungary 17.05.2018 n/a 
Ireland  7.06.2018  Under section 42 of the Act, personal data may be processed for (a) archiving purposes in the public interest; (b) scientific or historical research purposes; or (c) statistical purposes, subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects.
Italy 17.05.2018

Amended Section 99 IDPA, allows personal data to be processed; stored; & transferred to another controller after the normal period for processing of personal data and even after the termination of the main data processing if these processing will be carried out for scientific, historical or statistical purposes as well as at archiving in the public interest.

Amended Section 106 IDPA - the Italian DPA is to promote rules for professional and ethical conduct for processing for statistical purposes or for scientific research. Rules to apply both to public and private bodies, scientific societies and professional associations. Aim of the guidance is to 
identify adequate guarantees for the rights and freedoms of the data subject in accordance with Article 89 GDPR. 
 
Amended Section 110 IDPA: possible to carry out scientific and medical research, using special categories of data, without consent in certain circumstances. 
 
Amended Section 110-bis IDPA: ability for the Italian DPA to authorise secondary uses of special category data for scientific and statistical research, in situations where it is impossible or would involve a disproportionate effort to inform all  data subjects. Does not apply to genetic data. 

Netherlands 17.09.2018 Article 42 GDPR Execution Act provides that where processing takes place solely for scientific or historical research purposes, or statistical purposes, the controller may declare articles 15, 16 and 18 of the GDPR inapplicable. Data subjects will not have rights of access, rectification or restriction of processing for this data.
Poland 07.09.2018 n/a
Slovakia 13.09.2018 Processing of information for scientific, historical and statistical purposes is allowed, if it is adequate, respects the essence of personal data protection and appropriate measures for the protection of the rights and interests of data subjects are taken (Article 16 k) of New DPA).

These measures are of a technical and organisational nature and must respect the principle of data minimisation and pseudonymisation (Article 78 (8) of New DPA).

Article 78 (9) of New DPA restricts data subjects' rights in this context under certain conditions. 
Spain 07.09.2018

Article 25 - regarding processing of personal data for statistical purposes:
a) it will be lawful only if the information is required by an EU rule or by the statistical programming rules;
b) the Spanish Government Statistics Act provides that processing of special category data for statistical purposes must be based on the express and voluntary consent of the data subject;
c) If statistical secrecy guarantees under Spanish legislation apply, competent bodies for the public statistical function can deny data subject rights in Articles 15 to 22 of the GDPR . Article 26 - processing of personal data for archiving purposes in the public interest is subject to the Spanish Historical Heritage Act and other related regulations.

The draft Bill does not provide information about the processing for scientific or historical research purposes.

Sweden 06.09.2018 The Personal Data Act paragraph 3:7: Sensitive personal data can be processed according to the GDPR Art. 9(2)(j) if the processing is necessary for statistical purposes and the public interest, for the statistics project for which the processing takes place, clearly outweighs the risk for unfair infringement of the individuals' integrity that the processing may cause.
UK 22.05.2018

Sched.1, part 1, §4 Processing of special category data and criminal offence data for archiving purposes, scientific or historical research purposes, or statistical purposes permitted if:
- in accordance with GDPR (Art.81) (use of t.o.m.s and data minimisation; anonymise if possible; pseudonymise if possible); and
- must not be likely to cause damage or distress; must not be used for measures or decisions with respect to a particular data subject unless is approved medical research (s.19); and
- is in the public interest.

Exemptions from data subject rights (access; rectification; restriction; portability; right to object) where processing meets conditions set out in Art.89 (1) & s.19 DP Act; and
- compliance would prejudice the ability to achieve the purposes of the research/ statistics/ archiving; and
- for research/ statistics: the results must not be made available in identifiable form.