Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

SECTION 7  INTERNATIONAL DATA TRANSFERS FOR SCIENTIFIC RESEARCH PURPOSES

58. Within the context of research and specifically in the context of the COVID-19 pandemic, there will probably be a need for international cooperation that may also imply international transfers of health data for the purpose of scientific research outside of the EEA.

59. When personal data is transferred to a non-EEA country or international organisation, in addition to complying with the rules set out in GDPR, especially its Articles 5 (data protection principles), Article 6 (lawfulness) and Article 9 (special categories of data), the data exporter shall also comply with Chapter V (data transfers).

60. In addition to the regular transparency requirement as mentioned on page 7 of the present guidelines, a duty rests on the data exporter to inform data subjects that it intends to transfer personal data to a third country or international organisation. This includes information about the existence or absence of an adequacy decision by the European Commission, or whether the transfer is based on a suitable safeguard from Article 46 or on a derogation of Article 49 (1). This duty exists irrespective of whether the personal data was obtained directly from the data subject or not.

61. In general, when considering how to address such conditions for transfers of personal data to third countries or international organisations, data exporters should assess the risks to the rights and the freedoms of data subjects of each transfer and favour solutions that guarantee data subjects the continuous protection of their fundamental rights and safeguards as regards the processing of their data, even after it has been transferred. This will be the case for transfers to countries having an adequate level of protection, or in case of use of one of the appropriate safeguards included in Article46 GDPR, ensuring that enforceable rights and effective legal remedies are available for data subjects.

62. In the absence of an adequacy decision pursuant to Article 45 (3) GDPR or appropriate safeguards pursuant to Article 46 GDPR, Article 49 GDPR envisages certain specific situations under which transfers of personal data can take place as an exception. The derogations enshrined in Article 49 GDPR are thus exemptions from the general rule and, therefore, must be interpreted restrictively, and on a case-by-case basis. Applied to the current COVID-19 crisis, those addressed in Article 49 (1) (d) (“transfer necessary for important reasons of public interest”) and (a) (“explicit consent”) may apply.

63. The COVID-19 pandemic causes an exceptional sanitary crisis of an unprecedented nature and scale. In this context, the EDPB considers that the fight against COVID-19 has been recognised by the EU and most of its Member States as an important public interest, which may require urgent action in the field of scientific research (for example to identify treatments and/or develop vaccines), and may also involve transfers to third countries or international organisations.

64. Not only public authorities, but also private entities playing a role in pursuing such public interest (for example,a university’s research institute cooperating on the development of a vaccine in the context of an international partnership) could, under the current pandemic context, rely upon the derogation mentioned above.

65. In addition, in certain situations, in particular where transfers are performed by private entities for the purpose of medical research aiming at fighting the COVID-19 pandemic, such transfers of personal data could alternatively take place on the basis of the explicit consent of the data subjects.

66. Public authorities and private entities may, under the current pandemic context, when it is not possible to rely on an adequacy decision pursuant to Article 45 (3) or on appropriate safeguards pursuant to Article 46, rely upon the applicable derogations mentioned above, mainly as a temporary measure due to the urgency of the medical situation globally.

67. Indeed, if the nature of the COVID-19 crisis may justify the use of the applicable derogations for initial transfers carried out for the purpose of research in this context, repetitive transfers of data to third countries part of a long lasting research project in this regard would need to be framed with appropriate safeguards in accordance with Article 46 GDPR.

68. Finally, it has to be noted that any such transfers will need to take into consideration on a case-by-case basis the respective roles (controller, processor, joint controller) and related obligations of the actors involved (sponsor, investigator) in order to identify the appropriate measures for framing the transfer.