Reuse of already collected datasets (secondary use)
In academic research, it often happens that data collected for research is reused in a new study. This is referred to as secondary use, for which the GDPR has included specific regulations.
The use of an already existing dataset is permitted under the GDPR because of the importance of academic research, subject to such conditions as appropriate safeguards, technical and organizational measures, pseudonymization, etc. Where possible, only anonymized or pseudonymized data will be shared when reusing already existing data sets, whereby, in case of pseudonymized data, the researcher does not receive the link file.
If special personal data (Article 9, paragraph 2, under j, GDPR) are processed, an additional test applies to academic research: only allowed if necessary and-, proportionate and if appropriate measures are taken.
Finally, on the basis of Article 14, paragraph 5b, of the GDPR, the data subject has the right to be informed immediately about the processing if personal data have not been received from the data subject unless this requires a disproportionate effort. In the latter case, the data subject must be informed either publicly or by means of a privacy statement.
| Anonymizing or Pseudonymizing | When using existing datasets, personal data should be anonymized as much as possible. If the primary data set is anonymized, no longer applies and the processing register does not need to be updated either. If anonymization is not possible, personal data should be pseudonymized as much as possible. |
| Data minimalization |
If traceable personal data is necessary for academic research:
|
| Security |
If personal data are used for research purpose, they must processed in an adequately secured manner. |
| Obligation to inform respondents | Respondents have a right to information and need to be adequately informed. |
| Registration |
Research should be recorded in a processing register. |
Establishing legitimate interest and purpose limitation
If personal data are processed in academic research project, firstly legitimate interest must first be established and, secondly, the purpose limitation. After this, the so-called material requirements must be taken into account to ensure that personal data are handled with care.
Legitimate interest
- Do we have a legitimate basis for processing?
Purpose limitation
- What do we want to do?
Material requirements
- Are personal Data handled with sufficient care?
Processing base
In case of secondary use of already collected data sets, a number of scenarios can be distinguished to determine which processing basis applies:
- If the initial data collection was based on permission:
- Permission for re-use for future research & new research in the research area for which permission has been granted (Theme policy Privacy & Protection of Personal Data - Scientific Research 14 Version 1.0 - May 2018).
- Permission for reuse in future research & new research in other research area.
- No Permission for reuse for future research.
- The initial data collection was not based on consent, but had a different processing basis.
Permission for reuse in the same research area
The processing basis is consent, but the researcher does not have to ask for renewed consent. However, an obligation to provide information applies.
- If contact details of the data subject are available: personal information, unless this requires a disproportionate effort.
- If contact details are not available: public information.
Please note that respondents always have the right to withdraw their consent. If this happens the data of this respondent can no longer be used for follow-up research as far as it can be traced.
Example:
A researcher uses the data from previous study for a follow-up research within the same research area. The previous study was based on consent and the respondent has agreed to his data being used in future research.
Permission for reuse in OTHER research areas
The processing basis is consent. Because no permission has been requested for this research area at the time of the primary study, permission should be requested if reasonably possible.
- If the contact details of the respondent are available: ask for personal permission
- If the contact details are not available: the processing basis is legitimate interest. In connection with the right to information: public information.
Example:
- A researcher uses the data from a previous study for a follow-up study within a different research area. The earlier study took place in the field of marketing and the respondent was asked for permission to reuse the data, but only within the field of marketing. The new study takes place within the field of law.
No permission for reuse
The processing basis is, in principle, consent, but could in exceptional cases also be one of the other principles mentioned above (for example, legitimate interest). The researcher should still request consent for the reuse of these data if possible.
Example:
A researcher uses the data from a previous investigation for a follow-up investigation. In this earlier research no consent was requested for reuse. If possible (i.e. contact details are available), the researcher must ask permission. If this is not possible, a different processing basis such as legitimate interest may apply, in which case the researcher must carefully weigh the interest of the study against the privacy interest of the data subject. He must record the considerations in the research in the questionnaire.
Primary data set NOT based on Consent
In this case, the processing basis for the reuse of data could be a legitimate interest, with the researcher having to weigh up the importance of the academic research against the privacy interests of the data subject. He must record the considerations in the research questionnaire.
Special personal data
According to the GDPR, special personal data may only be processed under strict conditions. In the case of academic research, the ban on processing special personal data may not apply subject to certain conditions.
- If, for the initial study, consent was given to process special personal data and to reuse the data in the same or other defined research area(s):
- No new consent required if within specified research area. An obligation to inform applies though.
- If, for the initial study, NO consent was given to process special personal data or to reuse them for a different research area or for new research:
- Request consent for special personal data unless the above-mentioned exception applies (researcher must substantiate why the exception was applied).
- If the initial study involved PUBLIC data:
- no specific consent is necessary because the data are public.
Please note: The obligation to inform always applies.
Purpose limitation
The second requirement is that there must be a well-defined, clearly defined purpose.
- Academic research using an existing data set that contains personal data is always considered compatible with the original purpose for which the data set was collected.
- The purpose of the new processing of personal data is: Performing academic research as referred to in the Higher Education and Scientific Research Act and the Code of Conduct for Scientific Research.