EDPB Guidelines on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

Important scientific research efforts are currently being made in order to provide rapid research results in the fight against the COVID-19 pandemic. This involves the processing of health data of many individuals. In its Guidelines adopted on 21 April 2020¹ , the European Data Protection Board ("EDPB") addresses relevant legal questions concerning the use of health data for scientific research purposes in light of the General Data Protection Regulation ("GDPR")²  such as the legal basis, the rights of the data subjects including the right of information, data protection principles and international data transfers for scientific research purposes.

The EDPB underlines that several provisions of the GDPR govern the use of personal data for scientific research purposes and that those provisions shall of course apply in the Covid-19 context. For example, the GDPR provides a derogation from the prohibition of processing sensitive data such as health data (referred to as a “special category of personal data” under the GDPR) where it is necessary for scientific research purposes.

The EDPB points out that the processing of health data for scientific research purposes refers to two types of processing: (i) “primary use” where health data is directly collected for the purpose of scientific studies (in the case of clinical trials on individuals suspected of being infected) and (ii) “secondary use” where health data initially collected for another purpose (as part of a medical consultation, for example) are further processed for scientific research purposes. The above distinction has implications on the other obligations set out in the GDPR.

The EDPB also recommends the use of anonymised data (i.e. where no one can refer back to data subjects, as opposed to pseudonymised data) whenever possible and to define proportionate and adequate storage periods (the length and the purpose of the scientific research can serve as criteria to set storage periods).