Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

Paragraph 5.1.1  When must the data subject be informed?

32. When personal data have not been obtained from the data subject, Article 14 (3) (a) GDPR stipulates that the controller shall provide the information “within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed”.

33. In the current context, it has to be particularly noted that according to Article 14 (4) GDPR, where “the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose”.

34. In the case of the further processing of data for scientific purposes and taking into account the sensitivity of the data processed, an appropriate safeguard according to Article 89 (1) is to deliver the information to the data subject within a reasonable period of time before the implementation of the new research project. This allows the data subject to become aware of the research project and enables the possibility to exercise his/her rights beforehand.