Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

Section 5.3  Data minimisation and storage limitation

46. In scientific research, data minimisation can be achieved through the requirement of specifying the research questions and assessing the type and amount of data necessary to properly answer these research questions. Which data is needed depends on the purpose of the research even when the research has an explorative nature and should always comply with the purpose limitation principle pursuant to Article 5 (1) (b) GDPR. It has to be noted that the data has to be anonymised where it is possible to perform the scientific research with anonymised data.

47. In addition, proportionate storage periods shall be set. As stipulated by Article 5 (1) (e) GDPR “personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving […] scientific purposes […] in accordance with Article 89 (1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject”

48. In order to define storage periods (timelines), criteria such as the length and the purpose of the research should be taken into account. It has to be noted that national provisions may stipulate rules concerning the storage period as well.