Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

Section 3.3  “Further processing”

11. Finally, when talking about “processing of health data for the purpose of scientific research”, there are two types of data usages:

• 1. Research on personal (health) data which consists in the use of data directly collected for the purpose of scientific studies (“primary use”).

• 2. Research on personal (health) data which consists of the further processing of data initially collected for another purpose (“secondary use”).

12. Example 1:  For conducting a clinical trial on individuals suspected to be infected with SARS-CoV-2, health data are collected and questionnaires are used. This is a case of “primary use” of health data as defined above.

13. Example 2:  A data subject has consulted a health care provider as a patient regarding symptoms of the SARS-CoV-2. If health data recorded by the health care provider is being used for scientific research purposes later on, this usage is classified as further processing of health data (secondary use) that has been collected for another initial purpose.

14. The distinction between scientific research based on primary or secondary usage of health data will become particularly important when talking about the legal basis for the processing, the information obligations and the purpose limitation principle pursuant to Article 5 (1) (b) GDPR as outlined below.