Article 89 GDPR: Difference between revisions

From GDPRhub
Line 200: Line 200:
== Commentary ==
== Commentary ==


Article 89 GDPR regulates three distinct and separate purposes: archiving in the public interest, scientific or historical research purposes and statistical purposes. When these processing operations take place appropriate safeguards for the rights and freedoms of the data subject must be implemented. Further, it provides in paragraphs (2) and (3) for derogations from the rights referred to in the enumerated provisions. Paragraph (4) makes clear that the derogations provided for in paragraphs (2) and (3) only apply to the purposes described in those paragraphs and not to any other purpose.
Article 89 GDPR regulates three distinct and separate purposes: archiving in the public interest, scientific or historical research purposes and statistical purposes. When these processing operations take place appropriate safeguards for the rights and freedoms of the data subject must be implemented. Further, it provides in paragraphs (2) and (3) for derogations from the rights referred to. Paragraph (4) makes clear that the derogations provided for in paragraphs (2) and (3) only apply to the purposes described in those paragraphs and not to any other purpose.


=== (1) Appropriate safeguards are mandatory for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes ===
=== (1) Mandatory Appropriate Safeguards for Archiving Purposes in the Public Interest, Scientific or Historical Research Purposes, or Statistical Purposes ===
Under Article 89(1) GDPR, safeguards must be used whenever personal dara are processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. In particular, the provision requires the use of technical and organisational measures to achieve data minimisation, which is defined in Article 5(1)(c) GDPR as personal data being processed in a way that is 'adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed'.
Under Article 89(1) GDPR, safeguards must be used whenever personal data are processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. In particular, the provision requires the use of technical and organisational measures to achieve data minimisation, which is defined in [[Article 5 GDPR|Article 5(1)(c) GDPR]] as personal data being processed in a way that is 'adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed'.


==== Archiving purposes in the public interest ====
==== Archiving Purposes in the Public Interest ====
Article 89(3) GDPR permits derogations for “''archiving in the public interest''”. Services covered by this definition are, according to Recital 158, those which have a legal obligation “''to acquire, preserve, appraise, arrange, describe, communicate, promote, disseminate and provide access to records of enduring value for general public interest''”. This means that archives such as personal or family, archives or company records will generally not be covered by Article 89, unless they also fulfil the criteria of being kept in the “''public interest''”.<ref>See, ''Wiese Svanberg,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also points out that the requirement that archiving "''must take place 'in the public interest' should be regarded as satisfied as long as any individual archiving activity is set out-even broadlyin Member State law. Thus, the GDPR does not limit the extent to which Member States can delimit what materials are of sufficient historical interest to warrant subjecting them to archiving rules''”.</ref>
Article 89(3) GDPR permits derogations for “''archiving in the public interest''”. Services covered by this definition are, according to Recital 158, those which have a legal obligation “''to acquire, preserve, appraise, arrange, describe, communicate, promote, disseminate and provide access to records of enduring value for general public interest''”. This means that archives such as personal or family, archives or company records will generally not be covered by Article 89, unless they also fulfil the criteria of being kept in the “''public interest''”.<ref>See, ''Wiese Svanberg,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also points out that the requirement that archiving "''must take place 'in the public interest' should be regarded as satisfied as long as any individual archiving activity is set out-even broadlyin Member State law. Thus, the GDPR does not limit the extent to which Member States can delimit what materials are of sufficient historical interest to warrant subjecting them to archiving rules''”.</ref>


==== Scientific research purposes ====
==== Scientific Research Purposes ====
Recital 159 states that “''the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research''”. Recital 157 makes it clear that “scientific research” includes processing generating “''new knowledge of great value with regard to widespread medical conditions such as cardiovascular disease, cancer and depression''. […] ''Within social science, research on the basis of registries enables researchers to obtain essential knowledge about the long-term correlation of a number of social conditions such as unemployment and education with other life conditions''”.  
Recital 159 states that “''the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research''”. Recital 157 makes it clear that “scientific research” includes processing generating “''new knowledge of great value with regard to widespread medical conditions such as cardiovascular disease, cancer and depression''. […] ''Within social science, research on the basis of registries enables researchers to obtain essential knowledge about the long-term correlation of a number of social conditions such as unemployment and education with other life conditions''”.  


Moreover, following the wording of Recital 159, “''specific conditions should apply in particular as regards the publication or otherwise disclosure of personal data in the context of scientific research purposes''”.
Moreover, following the wording of Recital 159, “''specific conditions should apply in particular as regards the publication or otherwise disclosure of personal data in the context of scientific research purposes''”.


The GDPR as a whole, and Article 89 in particular, do not distinguish between scientific research pursuing public interests and that pursuing private or purely commercial ones. It follows that, if the applicable requirements are met, “purely private or commercial interests can be pursued through the processing of personal data for scientific research purposes”.<ref>See, ''Wiese Svanberg,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also specifies that any other relevant legislation (such as legislation on clinical trials in the case of medical or scientific research) will may also apply.</ref>
The GDPR as a whole, and Article 89 in particular, do not distinguish between scientific research pursuing public interests and that pursuing private or purely commercial ones. It follows that, if the applicable requirements are met, "''purely private or commercial interests can be pursued through the processing of personal data for scientific research purposes''”.<ref>See, ''Wiese Svanberg,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also specifies that any other relevant legislation (such as legislation on clinical trials in the case of medical or scientific research) will may also apply.</ref>


==== Historical research purposes ====
==== Historical Research Purposes ====
Under Recital 160 “''Where personal data are processed for historical research purposes, this Regulation should also apply to that processing. This should also include historical research and research for genealogical purposes, bearing in mind that this Regulation should not apply to deceased persons''”. In ruling out data of deceased persons, this Recital confirms Recitals 27, according to which “''This Regulation does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data of deceased persons''”. It should be noted, however, that genealogy research may relate to living relatives.<ref>''Eichler'', in BeckOK DatenschutzR, Article 89 GDPR, margin number 6a (Beck 2020, 36th ed.) (accessed 11.8.2021).</ref>
Under Recital 160 “''Where personal data are processed for historical research purposes, this Regulation should also apply to that processing. This should also include historical research and research for genealogical purposes, bearing in mind that this Regulation should not apply to deceased persons''”. In ruling out data of deceased persons, this Recital confirms Recital 27, according to which “''This Regulation does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data of deceased persons''”. It should be noted, however, that genealogy research may relate to living relatives.<ref>''Eichler'', in BeckOK DatenschutzR, Article 89 GDPR, margin number 6a (Beck 2020, 36th ed.) (accessed 11.8.2021).</ref>


==== Statistical purposes ====
==== Statistical Purposes ====
According to Recital 162 “''statistical purposes''” include “''any operation of collection and the processing of personal data necessary for statistical surveys or for the production of statistical results''”.  
According to Recital 162 “''statistical purposes''” include “''any operation of collection and the processing of personal data necessary for statistical surveys or for the production of statistical results''”.  


Recital 162 specifies that “''The statistical purpose implies that the result of processing for statistical purposes is not personal data, but aggregate data, and that this result or the personal data are not used in support of measures or decisions regarding any particular natural person''”. This sentence seems to suggest that aggregated data are never, by definition, personal data, with the concomitant non-application of the GDPR. From a logical point of view, this conclusion seems to be correct. However, the main assumption must be true: in particular, that aggregated data are actually anonymous and therefore not referable to a data subject. In practice, also given the high threshold required by the WP29 to achieve true anonymisation, it seems rather unlikely.<ref>WP29, Opinion 05/2014 on Anonymisation Techniques, 10.4.2014, available [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf here] (accessed on 12.8.20121)</ref>
Recital 162 specifies that “''The statistical purpose implies that the result of processing for statistical purposes is not personal data, but aggregate data, and that this result or the personal data are not used in support of measures or decisions regarding any particular natural person''”. This sentence seems to suggest that aggregated data are never, by definition, personal data, with the concomitant non-application of the GDPR. From a logical point of view, this conclusion seems to be correct. However, the main assumption must be true: in particular, that aggregated data are actually anonymous and therefore not referable to a data subject. In practice, also given the high threshold required by the WP29 to achieve true anonymisation, it seems rather unlikely.<ref>WP29, Opinion 05/2014 on Anonymisation Techniques, 10.4.2014, available [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf here] (accessed on 12.8.20121)</ref>


The risk of re-identification is indeed inherent to the processing of large amounts of data.<ref>''Rocher, L., Hendrickx, J.M. & de Montjoye'', YA. Estimating the success of re-identifications in incomplete datasets using generative models. ''Nat Commun'' 10''',''' 3069 (2019).</ref> For these reasons, sholars whose conclusions we share, found that “''a better reading of recital 162 is that it is only intended to make clear that data processed for statistical purposes remain personal data (subject to the GDPR) until they are anonymised through aggregation (i.e. until the 'result' of the statistical processing operation is achieved)''”.<ref>''Wiese Svanberg,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1250 (Oxford University Press 2020).</ref>
The risk of re-identification is indeed inherent to the processing of large amounts of data.<ref>''Rocher, L., Hendrickx, J.M. & de Montjoye'', YA. Estimating the success of re-identifications in incomplete datasets using generative models. ''Nat Commun'' 10''',''' 3069 (2019).</ref> For these reasons, scholars whose conclusions we share, found that “''a better reading of recital 162 is that it is only intended to make clear that data processed for statistical purposes remain personal data (subject to the GDPR) until they are anonymised through aggregation (i.e. until the 'result' of the statistical processing operation is achieved)''”.<ref>''Wiese Svanberg,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1250 (Oxford University Press 2020).</ref>


==== Shall be subject to appropriate safeguards ====
==== Shall be Subject to Appropriate Safeguards ====
Under Article 89(1), processing for the above-mentioned purposes shall be subject to “appropriate safeguards” which shall ensure “respect for the principle of data minimisation” under Article 5(1)(c). The personal data to be collected are to be limited from the outset to what is appropriate, significant and necessary for the purpose of processing. The far-reaching privileges can only be justified under this strictly applicable premise.<ref>''Eichler'', in BeckOK DatenschutzR, Article 89 GDPR, margin number 12-13 (Beck 2020, 36th ed.) (accessed 11.8.2021).</ref>
Under Article 89(1), processing for the above-mentioned purposes shall be subject to “''appropriate safeguards''” which shall ensure “''respect for the principle of data minimisation''” under [[Article 5 GDPR|Article 5(1)(c)]]. The personal data to be collected are to be limited from the outset to what is appropriate, significant and necessary for the purpose of processing. The far-reaching privileges can only be justified under this strictly applicable premise.<ref>''Eichler'', in BeckOK DatenschutzR, Article 89 GDPR, margin number 12-13 (Beck 2020, 36th ed.) (accessed 11.8.2021).</ref>


The provision specifically mentions pseudonymisation and anonymisation<ref>The GDPR uses this wording: “''Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner''”, generally understood as anonymization.</ref> as typical safeguards. The list is non-exhaustive and there may well be other suitable safeguards that adequately reduce the risks in the specific case.<ref>For example, use of encryption, employees’ confidentiality obligations, sufficiently specific work instructions and computer access authorizations are to be checked even more strictly in these cases.</ref>  
The provision specifically mentions pseudonymisation and anonymisation<ref>The GDPR uses this wording: “''Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner''”, generally understood as anonymization.</ref> as typical safeguards. The list is non-exhaustive and there may well be other suitable safeguards that adequately reduce the risks in the specific case.<ref>For example, use of encryption, employees’ confidentiality obligations, sufficiently specific work instructions and computer access authorizations are to be checked even more strictly in these cases.</ref>  
Line 233: Line 233:


===== Pseudonymization =====
===== Pseudonymization =====
Under Article 4(5) pseudonymization means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person. Pseudonymized data continue to represent information about an identifiable person (Recital 26).
Under [[Article 4 GDPR|Article 4(5)]] pseudonymization means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person. Pseudonymized data continue to represent information about an identifiable person (Recital 26).


===== Anonymization =====
===== Anonymization =====
Under Article 89(1), where “''those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner''”. Therefore, there is an organizational obligation to carry out anonymization measures as soon as the research purpose allows.<ref>''Eichler'', in BeckOK DatenschutzR, Article 89 GDPR, margin number 15 (Beck 2020, 36th ed.) (accessed 11.8.2021). See also Recital 156 which states that “''The further processing of personal data for archiving purposes'' […] ''is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist''”.</ref>
Under Article 89(1), where “''those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner''”. Therefore, there is an organisational obligation to carry out anonymization measures as soon as the research purpose allows.<ref>''Eichler'', in BeckOK DatenschutzR, Article 89 GDPR, margin number 15 (Beck 2020, 36th ed.) (accessed 11.8.2021). See also Recital 156 which states that “''The further processing of personal data for archiving purposes'' […] ''is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist''”.</ref>


=== (2) Derogations to the GDPR are possible for scientific or historical research purposes or statistical purposes ===
=== (2) Derogations Possible for Scientific or Historical Research Purposes or Statistical Purposes ===
Under Article 89(2), where personal data are processed for statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15 (right of access by the data subject), 16 (right to rectification), 18 (right to restriction of processing) and 21 (right to object) GDPR.  
Under Article 89(2), where personal data are processed for statistical purposes, Union or Member State law may provide for derogations from the rights referred to in [[Article 15 GDPR|Articles 15]] (right of access by the data subject), [[Article 16 GDPR|16]] (right to rectification), [[Article 18 GDPR|18]] (right to restriction of processing) and [[Article 21 GDPR|21]] (right to object) GDPR.  


Such derogations are still subject to the conditions and safeguards referred to in Article 89(1).
Such derogations are still subject to the conditions and safeguards referred to in Article 89(1).
Line 245: Line 245:
Furthermore, other two requirements have to be simultaneously met in order for them to be applicable in the specific case. First, the data subjects’ rights are likely to render impossible or seriously impair the achievement of the specific purposes. Second, such derogations are necessary for the fulfilment of those purposes. It follows that the scope of the exceptions must be limited to what is necessary.
Furthermore, other two requirements have to be simultaneously met in order for them to be applicable in the specific case. First, the data subjects’ rights are likely to render impossible or seriously impair the achievement of the specific purposes. Second, such derogations are necessary for the fulfilment of those purposes. It follows that the scope of the exceptions must be limited to what is necessary.


=== (3) Derogations to the GDPR are possible for archiving purposes in the public interest ===
=== (3) Derogations are Possible for Archiving Purposes in the Public Interest ===
Under Article 89(3) GDPR, where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15 (right of access by the data subject), 16 (right to rectification), 18 (right to restriction of processing), 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing), 20 (right to data portability) and 21 (right to object) GDPR.
Under Article 89(3) GDPR, where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in [[Article 15 GDPR|Articles 15]] (right of access by the data subject), [[Article 16 GDPR|16]] (right to rectification), [[Article 18 GDPR|18]] (right to restriction of processing), [[Article 19 GDPR|19]] (notification obligation regarding rectification or erasure of personal data or restriction of processing), [[Article 20 GDPR|20]] (right to data portability) and [[Article 21 GDPR|21]] (right to object) GDPR.


==== Conditions for the derogations to apply ====
==== Conditions for the Derogations to Apply ====
See relevant section under Paragraph 2.
See relevant section under Paragraph 2.



Revision as of 10:05, 6 September 2021

Article 89 - Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 89 - Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes


1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.

2. Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.

3. Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.

4. Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs.

Relevant Recitals

Recital 27: Not Applicable to Deceased Persons
This Regulation does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data of deceased persons.

Recital 33: Consent for Scientific Research
It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.

Recital 156: Processing of Personal Data for Archiving Purposes in the Public Interest, Scientific, Historical Research or Statistical Purposes
The processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be subject to appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation. Those safeguards should ensure that technical and organisational measures are in place in order to ensure, in particular, the principle of data minimisation. The further processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist (such as, for instance, pseudonymisation of the data). Member States should provide for appropriate safeguards for the processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. Member States should be authorised to provide, under specific conditions and subject to appropriate safeguards for data subjects, specifications and derogations with regard to the information requirements and rights to rectification, to erasure, to be forgotten, to restriction of processing, to data portability, and to object when processing personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. The conditions and safeguards in question may entail specific procedures for data subjects to exercise those rights if this is appropriate in the light of the purposes sought by the specific processing along with technical and organisational measures aimed at minimising the processing of personal data in pursuance of the proportionality and necessity principles. The processing of personal data for scientific purposes should also comply with other relevant legislation such as on clinical trials.

Recital 158: Processing for Archiving Purposes
Where personal data are processed for archiving purposes, this Regulation should also apply to that processing, bearing in mind that this Regulation should not apply to deceased persons. Public authorities or public or private bodies that hold records of public interest should be services which, pursuant to Union or Member State law, have a legal obligation to acquire, preserve, appraise, arrange, describe, communicate, promote, disseminate and provide access to records of enduring value for general public interest. Member States should also be authorised to provide for the further processing of personal data for archiving purposes, for example with a view to providing specific information related to the political behaviour under former totalitarian state regimes, genocide, crimes against humanity, in particular the Holocaust, or war crimes.

Recital 159: Processing for Scientific Research Purposes
Where personal data are processed for scientific research purposes, this Regulation should also apply to that processing. For the purposes of this Regulation, the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research. In addition, it should take into account the Union's objective under Article 179(1) TFEU of achieving a European Research Area. Scientific research purposes should also include studies conducted in the public interest in the area of public health. To meet the specificities of processing personal data for scientific research purposes, specific conditions should apply in particular as regards the publication or otherwise disclosure of personal data in the context of scientific research purposes. If the result of scientific research in particular in the health context gives reason for further measures in the interest of the data subject, the general rules of this Regulation should apply in view of those measures.

Recital 161: Consenting to the Participation in Clinical Trials
For the purpose of consenting to the participation in scientific research activities in clinical trials, the relevant provisions of Regulation (EU) No 536/2014 of the European Parliament and of the Council<ref>Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use, and repealing Directive 2001/20/EC should apply.

Recital 162: Processing for Statistical Purposes
Where personal data are processed for statistical purposes, this Regulation should apply to that processing. Union or Member State law should, within the limits of this Regulation, determine statistical content, control of access, specifications for the processing of personal data for statistical purposes and appropriate measures to safeguard the rights and freedoms of the data subject and for ensuring statistical confidentiality. Statistical purposes mean any operation of collection and the processing of personal data necessary for statistical surveys or for the production of statistical results. Those statistical results may further be used for different purposes, including a scientific research purpose. The statistical purpose implies that the result of processing for statistical purposes is not personal data, but aggregate data, and that this result or the personal data are not used in support of measures or decisions regarding any particular natural person.

Recital 163: Production of Official European and Official National Statistics
The confidential information which the Union and national statistical authorities collect for the production of official European and official national statistics should be protected. European statistics should be developed, produced and disseminated in accordance with the statistical principles as set out in Article 338(2) TFEU, while national statistics should also comply with Member State law. Regulation (EC) No 223/2009 of the European Parliament and of the Council <ref>Regulation (EC) No 223/2009 of the European Parliament and of the Council of 11 March 2009 on European statistics and repealing Regulation (EC, Euratom) No 1101/2008 of the European Parliament and of the Council on the transmission of data subject to statistical confidentiality to the Statistical Office of the European Communities, Council Regulation (EC) No 322/97 on Community Statistics, and Council Decision 89/382/EEC, Euratom establishing a Committee on the Statistical Programmes of the European Communities provides further specifications on statistical confidentiality for European statistics.

Commentary

Article 89 GDPR regulates three distinct and separate purposes: archiving in the public interest, scientific or historical research purposes and statistical purposes. When these processing operations take place appropriate safeguards for the rights and freedoms of the data subject must be implemented. Further, it provides in paragraphs (2) and (3) for derogations from the rights referred to. Paragraph (4) makes clear that the derogations provided for in paragraphs (2) and (3) only apply to the purposes described in those paragraphs and not to any other purpose.

(1) Mandatory Appropriate Safeguards for Archiving Purposes in the Public Interest, Scientific or Historical Research Purposes, or Statistical Purposes

Under Article 89(1) GDPR, safeguards must be used whenever personal data are processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. In particular, the provision requires the use of technical and organisational measures to achieve data minimisation, which is defined in Article 5(1)(c) GDPR as personal data being processed in a way that is 'adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed'.

Archiving Purposes in the Public Interest

Article 89(3) GDPR permits derogations for “archiving in the public interest”. Services covered by this definition are, according to Recital 158, those which have a legal obligation “to acquire, preserve, appraise, arrange, describe, communicate, promote, disseminate and provide access to records of enduring value for general public interest”. This means that archives such as personal or family, archives or company records will generally not be covered by Article 89, unless they also fulfil the criteria of being kept in the “public interest”.[1]

Scientific Research Purposes

Recital 159 states that “the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research”. Recital 157 makes it clear that “scientific research” includes processing generating “new knowledge of great value with regard to widespread medical conditions such as cardiovascular disease, cancer and depression. […] Within social science, research on the basis of registries enables researchers to obtain essential knowledge about the long-term correlation of a number of social conditions such as unemployment and education with other life conditions”.

Moreover, following the wording of Recital 159, “specific conditions should apply in particular as regards the publication or otherwise disclosure of personal data in the context of scientific research purposes”.

The GDPR as a whole, and Article 89 in particular, do not distinguish between scientific research pursuing public interests and that pursuing private or purely commercial ones. It follows that, if the applicable requirements are met, "purely private or commercial interests can be pursued through the processing of personal data for scientific research purposes”.[2]

Historical Research Purposes

Under Recital 160 “Where personal data are processed for historical research purposes, this Regulation should also apply to that processing. This should also include historical research and research for genealogical purposes, bearing in mind that this Regulation should not apply to deceased persons”. In ruling out data of deceased persons, this Recital confirms Recital 27, according to which “This Regulation does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data of deceased persons”. It should be noted, however, that genealogy research may relate to living relatives.[3]

Statistical Purposes

According to Recital 162 “statistical purposes” include “any operation of collection and the processing of personal data necessary for statistical surveys or for the production of statistical results”.

Recital 162 specifies that “The statistical purpose implies that the result of processing for statistical purposes is not personal data, but aggregate data, and that this result or the personal data are not used in support of measures or decisions regarding any particular natural person”. This sentence seems to suggest that aggregated data are never, by definition, personal data, with the concomitant non-application of the GDPR. From a logical point of view, this conclusion seems to be correct. However, the main assumption must be true: in particular, that aggregated data are actually anonymous and therefore not referable to a data subject. In practice, also given the high threshold required by the WP29 to achieve true anonymisation, it seems rather unlikely.[4]

The risk of re-identification is indeed inherent to the processing of large amounts of data.[5] For these reasons, scholars whose conclusions we share, found that “a better reading of recital 162 is that it is only intended to make clear that data processed for statistical purposes remain personal data (subject to the GDPR) until they are anonymised through aggregation (i.e. until the 'result' of the statistical processing operation is achieved)”.[6]

Shall be Subject to Appropriate Safeguards

Under Article 89(1), processing for the above-mentioned purposes shall be subject to “appropriate safeguards” which shall ensure “respect for the principle of data minimisation” under Article 5(1)(c). The personal data to be collected are to be limited from the outset to what is appropriate, significant and necessary for the purpose of processing. The far-reaching privileges can only be justified under this strictly applicable premise.[7]

The provision specifically mentions pseudonymisation and anonymisation[8] as typical safeguards. The list is non-exhaustive and there may well be other suitable safeguards that adequately reduce the risks in the specific case.[9]

Such safeguards are mandatory to processing in these areas and are a pre-requisite should a controller want to take advantage of the derogations set forth in following paragraphs 2 and 3 which both require that derogations may be used “subject to the conditions and safeguards referred to in paragraph 1 of this Article”.

Pseudonymization

Under Article 4(5) pseudonymization means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person. Pseudonymized data continue to represent information about an identifiable person (Recital 26).

Anonymization

Under Article 89(1), where “those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner”. Therefore, there is an organisational obligation to carry out anonymization measures as soon as the research purpose allows.[10]

(2) Derogations Possible for Scientific or Historical Research Purposes or Statistical Purposes

Under Article 89(2), where personal data are processed for statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15 (right of access by the data subject), 16 (right to rectification), 18 (right to restriction of processing) and 21 (right to object) GDPR.

Such derogations are still subject to the conditions and safeguards referred to in Article 89(1).

Furthermore, other two requirements have to be simultaneously met in order for them to be applicable in the specific case. First, the data subjects’ rights are likely to render impossible or seriously impair the achievement of the specific purposes. Second, such derogations are necessary for the fulfilment of those purposes. It follows that the scope of the exceptions must be limited to what is necessary.

(3) Derogations are Possible for Archiving Purposes in the Public Interest

Under Article 89(3) GDPR, where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15 (right of access by the data subject), 16 (right to rectification), 18 (right to restriction of processing), 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing), 20 (right to data portability) and 21 (right to object) GDPR.

Conditions for the Derogations to Apply

See relevant section under Paragraph 2.

(4) Derogations do not extend to other purposes that require the same processing

Paragraph 4 makes it clear that these exceptions are only available for processing specified in Article 89 and not for purposes that may be pursued at the same time on the same dataset.

Decisions

→ You can find all related decisions in Category:Article 89 GDPR

References

  1. See, Wiese Svanberg, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also points out that the requirement that archiving "must take place 'in the public interest' should be regarded as satisfied as long as any individual archiving activity is set out-even broadlyin Member State law. Thus, the GDPR does not limit the extent to which Member States can delimit what materials are of sufficient historical interest to warrant subjecting them to archiving rules”.
  2. See, Wiese Svanberg, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1242 and ss. (Oxford University Press 2020) who also specifies that any other relevant legislation (such as legislation on clinical trials in the case of medical or scientific research) will may also apply.
  3. Eichler, in BeckOK DatenschutzR, Article 89 GDPR, margin number 6a (Beck 2020, 36th ed.) (accessed 11.8.2021).
  4. WP29, Opinion 05/2014 on Anonymisation Techniques, 10.4.2014, available here (accessed on 12.8.20121)
  5. Rocher, L., Hendrickx, J.M. & de Montjoye, YA. Estimating the success of re-identifications in incomplete datasets using generative models. Nat Commun 10, 3069 (2019).
  6. Wiese Svanberg, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 89 GDPR, p. 1250 (Oxford University Press 2020).
  7. Eichler, in BeckOK DatenschutzR, Article 89 GDPR, margin number 12-13 (Beck 2020, 36th ed.) (accessed 11.8.2021).
  8. The GDPR uses this wording: “Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner”, generally understood as anonymization.
  9. For example, use of encryption, employees’ confidentiality obligations, sufficiently specific work instructions and computer access authorizations are to be checked even more strictly in these cases.
  10. Eichler, in BeckOK DatenschutzR, Article 89 GDPR, margin number 15 (Beck 2020, 36th ed.) (accessed 11.8.2021). See also Recital 156 which states that “The further processing of personal data for archiving purposes […] is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist”.