Article 89 GDPR: Difference between revisions
| Line 198: | Line 198: | ||
== Commentary == | == Commentary == | ||
Article 89 GDPR specifically regulates the processing of personal data for | Article 89 GDPR specifically regulates the processing of personal data for four distinct purposes: (i) archiving in the public interest, (ii) scientific research, (iii) historical research and (iii) statistical purposes. In many instances, collecting large quantities of personal data is a key component, if not a prerequisite for achieving such purposes. Clinical trials or political polls, for example, are based on the collection and analysis, on a large scale, of sensitive personal data. Because of the large scope of such processing operations, as well as the risks they entail, the EU legislator has introduced specific safeguards in Article 89(1) GDPR for protecting the rights and freedoms of data subjects. | ||
At the same time, overburdening controllers with legal obligations may ultimately impede research, or even defeat the very purpose of the processing. This, in turn, may become detrimental for society, as many societal advances are based on | At the same time, overburdening controllers with legal obligations may ultimately impede research, or even defeat the very purpose of the processing. This, in turn, may become detrimental for society, as many societal advances are based on archiving systems, scientific and historical research, or statistical studies. Hence, Article 89(2) and (3) GDPR also allow for specific derogations to the GDPR for these purposes, as further detailed below. | ||
=== (1) Mandatory Appropriate Safeguards for Archiving Purposes in the Public Interest, Scientific or Historical Research Purposes, or Statistical Purposes === | === (1) Mandatory Appropriate Safeguards for Archiving Purposes in the Public Interest, Scientific or Historical Research Purposes, or Statistical Purposes === | ||
| Line 209: | Line 209: | ||
Among the organisational and technical measures that controllers or processors should put in place, the provision specifically mentions pseudonymisation and anonymisation.<ref>The GDPR uses this wording: “''Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner''”, generally understood as anonymization.</ref> This list is of course non-exhaustive and there may well be other suitable measures that adequately reduce the risks associated with the processing of personal data in those areas.<ref>For example, use of encryption, employees’ confidentiality obligations, sufficiently specific work instructions and computer access authorizations are to be checked even more strictly in these cases.</ref> | Among the organisational and technical measures that controllers or processors should put in place, the provision specifically mentions pseudonymisation and anonymisation.<ref>The GDPR uses this wording: “''Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner''”, generally understood as anonymization.</ref> This list is of course non-exhaustive and there may well be other suitable measures that adequately reduce the risks associated with the processing of personal data in those areas.<ref>For example, use of encryption, employees’ confidentiality obligations, sufficiently specific work instructions and computer access authorizations are to be checked even more strictly in these cases.</ref> | ||
===== Pseudonymisation ===== | ===== Pseudonymisation ===== | ||
Under [[Article 4 GDPR|Article 4(5) GDPR,]] pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately. Pseudonymised data are thus personal data, since the individuals to whom they relate remain identifiable (Recital 26). Through | Under [[Article 4 GDPR|Article 4(5) GDPR,]] pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately. Pseudonymised data are thus personal data, since the individuals to whom they relate remain identifiable (Recital 26). Through pseudonimisation, controllers are therefore not exempted from complying with the GDPR, but are simply reducing the overall risks linked to the processing of personal data. | ||
===== Anonymisation ===== | ===== Anonymisation ===== | ||
According to Recital 26 of the GDPR, anonymisation is the process of rendering personal data anonymous, in the sense that the data subject is no longer identified or identifiable. The anonymisation process must be robust enough to prevent any risk of reidentification. Hence, the technical requirements | According to Recital 26 of the GDPR, anonymisation is the process of rendering personal data anonymous, in the sense that the data subject is no longer identified or identifiable. The anonymisation process must be robust enough to prevent any risk of reidentification. Hence, the technical requirements of anonymisation may vary from one case to another depending on the data available, and may become increasingly difficult to achieve as re-identification techniques are evolving in parallel.<ref>WP29, Opinion 05/2014 on Anonymisation Techniques, 0829/14/EN, 10 April 2014.</ref> | ||
While Article 89(1) GDPR states that pseudonymisation "''may''" be used as a technical measure, anonymisation becomes | While Article 89(1) GDPR states that pseudonymisation "''may''" be used as a technical measure, anonymisation, for its part, becomes mandatory when it does not prevent or defeat the purpose of the processing. For example, if a public authority orders a statistical survey on household water consumption to improve water management in a specific region, such study should be based on anonymised data, since identifying the respondents is not necessary to reach valid findings. By contrast, clinical trials may require the collection and monitoring of personal data of identified patients while being conducted, including for legal reasons. In that case, anonymisation would therefore not be required. All in all, it can therefore be concluded that anonymization only becomes a mandatory technical measure if the research purpose allows for it.<ref>''Eichler'', in BeckOK DatenschutzR, Article 89 GDPR, margin number 15 (Beck 2020, 36th ed.) (accessed 11 August 2021). See also Recital 156 which states that “''The further processing of personal data for archiving purposes'' […] ''is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist''”.</ref> | ||
==== Archiving Purposes in the Public Interest ==== | ==== Archiving Purposes in the Public Interest ==== | ||
According to Recital 158 of the GDPR, processing for archiving purposes in the public interest can be defined as any | According to Recital 158 of the GDPR, processing for archiving purposes in the public interest can be defined as any operation “''to acquire, preserve, appraise, arrange, describe, communicate, promote, disseminate and provide access to records of enduring value for general public interest''”. This means that archives such as personal or family archives, or company records will generally not be covered by Article 89 GDPR, unless they also fulfil the criteria of being kept in the “''public interest''”.<ref>See, ''Wiese Svanberg,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also points out that the requirement that archiving "''must take place 'in the public interest' should be regarded as satisfied as long as any individual archiving activity is set out-even broadly in Member State law. Thus, the GDPR does not limit the extent to which Member States can delimit what materials are of sufficient historical interest to warrant subjecting them to archiving rules''”.</ref> | ||
==== Scientific Research Purposes ==== | ==== Scientific Research Purposes ==== | ||
Recital 159 states that “''the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research''”. Recital 157 makes it clear that | Recital 159 states that “''the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research''”. Recital 157 makes it clear that scientific research also includes processing generating “''new knowledge of great value with regard to widespread medical conditions such as cardiovascular disease, cancer and depression''. […] ''Within social science, research on the basis of registries enables researchers to obtain essential knowledge about the long-term correlation of a number of social conditions such as unemployment and education with other life conditions''”. | ||
The GDPR as a whole, and Article 89 in particular, do not distinguish between scientific research pursuing public interests and that pursuing private or purely commercial ones. It follows that, if the applicable requirements are met, "''purely private or commercial interests can be pursued through the processing of personal data for scientific research purposes''”.<ref>See, ''Wiese Svanberg,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also specifies that any other relevant legislation (such as legislation on clinical trials in the case of medical or scientific research) may also apply.</ref> | The GDPR as a whole, and Article 89 in particular, do not distinguish between scientific research pursuing public interests and that pursuing private or purely commercial ones. It follows that, if the applicable requirements are met, "''purely private or commercial interests can be pursued through the processing of personal data for scientific research purposes''”.<ref>See, ''Wiese Svanberg,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also specifies that any other relevant legislation (such as legislation on clinical trials in the case of medical or scientific research) may also apply.</ref> | ||
Revision as of 15:30, 3 December 2021
Legal Text
1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.
2. Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
3. Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
4. Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs.
Relevant Recitals
Commentary
Article 89 GDPR specifically regulates the processing of personal data for four distinct purposes: (i) archiving in the public interest, (ii) scientific research, (iii) historical research and (iii) statistical purposes. In many instances, collecting large quantities of personal data is a key component, if not a prerequisite for achieving such purposes. Clinical trials or political polls, for example, are based on the collection and analysis, on a large scale, of sensitive personal data. Because of the large scope of such processing operations, as well as the risks they entail, the EU legislator has introduced specific safeguards in Article 89(1) GDPR for protecting the rights and freedoms of data subjects.
At the same time, overburdening controllers with legal obligations may ultimately impede research, or even defeat the very purpose of the processing. This, in turn, may become detrimental for society, as many societal advances are based on archiving systems, scientific and historical research, or statistical studies. Hence, Article 89(2) and (3) GDPR also allow for specific derogations to the GDPR for these purposes, as further detailed below.
(1) Mandatory Appropriate Safeguards for Archiving Purposes in the Public Interest, Scientific or Historical Research Purposes, or Statistical Purposes
Obligation to implement appropriate safeguards
Article 89(1) GDPR provides that when processing operations take place for (i) archiving in the public interest, (ii) scientific or historical research or (iii) statistical purposes, appropriate safeguards for the rights and freedoms of the data subject must be implemented. Those safeguards require, among others, that controllers and processors put in place technical and organisational measures to ensure respect for the principle of data minimisation, as set in Article 5(1)(c) GDPR. This means in particular that the collection of personal data should be limited from the outset to what is appropriate, relevant and necessary for the purpose of processing. The far-reaching derogations granted under Article 89 GDPR can only be justified under this strictly applicable premise.[1]
Among the organisational and technical measures that controllers or processors should put in place, the provision specifically mentions pseudonymisation and anonymisation.[2] This list is of course non-exhaustive and there may well be other suitable measures that adequately reduce the risks associated with the processing of personal data in those areas.[3]
Pseudonymisation
Under Article 4(5) GDPR, pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately. Pseudonymised data are thus personal data, since the individuals to whom they relate remain identifiable (Recital 26). Through pseudonimisation, controllers are therefore not exempted from complying with the GDPR, but are simply reducing the overall risks linked to the processing of personal data.
Anonymisation
According to Recital 26 of the GDPR, anonymisation is the process of rendering personal data anonymous, in the sense that the data subject is no longer identified or identifiable. The anonymisation process must be robust enough to prevent any risk of reidentification. Hence, the technical requirements of anonymisation may vary from one case to another depending on the data available, and may become increasingly difficult to achieve as re-identification techniques are evolving in parallel.[4]
While Article 89(1) GDPR states that pseudonymisation "may" be used as a technical measure, anonymisation, for its part, becomes mandatory when it does not prevent or defeat the purpose of the processing. For example, if a public authority orders a statistical survey on household water consumption to improve water management in a specific region, such study should be based on anonymised data, since identifying the respondents is not necessary to reach valid findings. By contrast, clinical trials may require the collection and monitoring of personal data of identified patients while being conducted, including for legal reasons. In that case, anonymisation would therefore not be required. All in all, it can therefore be concluded that anonymization only becomes a mandatory technical measure if the research purpose allows for it.[5]
Archiving Purposes in the Public Interest
According to Recital 158 of the GDPR, processing for archiving purposes in the public interest can be defined as any operation “to acquire, preserve, appraise, arrange, describe, communicate, promote, disseminate and provide access to records of enduring value for general public interest”. This means that archives such as personal or family archives, or company records will generally not be covered by Article 89 GDPR, unless they also fulfil the criteria of being kept in the “public interest”.[6]
Scientific Research Purposes
Recital 159 states that “the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research”. Recital 157 makes it clear that scientific research also includes processing generating “new knowledge of great value with regard to widespread medical conditions such as cardiovascular disease, cancer and depression. […] Within social science, research on the basis of registries enables researchers to obtain essential knowledge about the long-term correlation of a number of social conditions such as unemployment and education with other life conditions”.
The GDPR as a whole, and Article 89 in particular, do not distinguish between scientific research pursuing public interests and that pursuing private or purely commercial ones. It follows that, if the applicable requirements are met, "purely private or commercial interests can be pursued through the processing of personal data for scientific research purposes”.[7]
Historical Research Purposes
Under Recital 160 “Where personal data are processed for historical research purposes, this Regulation should also apply to that processing. This should also include historical research and research for genealogical purposes, bearing in mind that this Regulation should not apply to deceased persons”. In ruling out data of deceased persons, this Recital confirms Recital 27, according to which “This Regulation does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data of deceased persons”. It should be noted, however, that genealogy research may relate to living relatives.[8]
Statistical Purposes
According to Recital 162 “statistical purposes” include “any operation of collection and the processing of personal data necessary for statistical surveys or for the production of statistical results”.
Recital 162 specifies that “The statistical purpose implies that the result of processing for statistical purposes is not personal data, but aggregate data, and that this result or the personal data are not used in support of measures or decisions regarding any particular natural person”. This sentence seems to suggest that aggregated data are never, by definition, personal data, with the concomitant non-application of the GDPR. From a logical point of view, this conclusion seems to be correct. However, the main assumption must be true: in particular, that aggregated data are actually anonymous and therefore not referable to a data subject. In practice, also given the high threshold required by the WP29 to achieve true anonymisation, it seems rather unlikely.[9]
The risk of re-identification is indeed inherent to the processing of large amounts of data.[10] For these reasons, scholars whose conclusions we share, found that “a better reading of recital 162 is that it is only intended to make clear that data processed for statistical purposes remain personal data (subject to the GDPR) until they are anonymised through aggregation (i.e. until the 'result' of the statistical processing operation is achieved)”.[11]
(2) Derogations Possible for Scientific or Historical Research Purposes or Statistical Purposes
Under Article 89(2), where personal data are processed for statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15 (right of access by the data subject), 16 (right to rectification), 18 (right to restriction of processing) and 21 (right to object) GDPR.
Such derogations are still subject to the conditions and safeguards referred to in Article 89(1).
Furthermore, other two requirements have to be simultaneously met in order for them to be applicable in the specific case. First, the data subjects’ rights are likely to render impossible or seriously impair the achievement of the specific purposes. Second, such derogations are necessary for the fulfilment of those purposes. It follows that the scope of the exceptions must be limited to what is necessary.
(3) Derogations are Possible for Archiving Purposes in the Public Interest
Under Article 89(3) GDPR, where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15 (right of access by the data subject), 16 (right to rectification), 18 (right to restriction of processing), 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing), 20 (right to data portability) and 21 (right to object) GDPR.
Conditions for the Derogations to Apply
See relevant section under paragraph 2.
(4) Derogations do not Extend to Other Purposes that Require the Same Processing
Article 89(4) makes it clear that these exceptions are only available for processing specified in Article 89 and not for other purposes that may be pursued at the same time on the same dataset.
Decisions
→ You can find all related decisions in Category:Article 89 GDPR
References
- ↑ Eichler, in BeckOK DatenschutzR, Article 89 GDPR, margin number 12-13 (Beck 2020, 36th ed.) (accessed 11 August 2021).
- ↑ The GDPR uses this wording: “Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner”, generally understood as anonymization.
- ↑ For example, use of encryption, employees’ confidentiality obligations, sufficiently specific work instructions and computer access authorizations are to be checked even more strictly in these cases.
- ↑ WP29, Opinion 05/2014 on Anonymisation Techniques, 0829/14/EN, 10 April 2014.
- ↑ Eichler, in BeckOK DatenschutzR, Article 89 GDPR, margin number 15 (Beck 2020, 36th ed.) (accessed 11 August 2021). See also Recital 156 which states that “The further processing of personal data for archiving purposes […] is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist”.
- ↑ See, Wiese Svanberg, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also points out that the requirement that archiving "must take place 'in the public interest' should be regarded as satisfied as long as any individual archiving activity is set out-even broadly in Member State law. Thus, the GDPR does not limit the extent to which Member States can delimit what materials are of sufficient historical interest to warrant subjecting them to archiving rules”.
- ↑ See, Wiese Svanberg, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also specifies that any other relevant legislation (such as legislation on clinical trials in the case of medical or scientific research) may also apply.
- ↑ Eichler, in BeckOK DatenschutzR, Article 89 GDPR, margin number 6a (Beck 2020, 36th ed.) (accessed 11 August 2021).
- ↑ WP29, Opinion 05/2014 on Anonymisation Techniques, 10 April 2014 (available here) (accessed on 12 August 2021).
- ↑ Rocher et al., Estimating the success of re-identifications in incomplete datasets using generative models. Nature Communications 10 (2019).
- ↑ Wiese Svanberg, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1250 (Oxford University Press 2020).
