Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

Section 4.2  National legislations

23. Article 6 (1) e or 6 (1) f GDPR in combination with the enacted derogations under Article 9 (2) (j) or Article 9 (2) (i) GDPR can provide a legal basis for the processing of personal (health) data for scientific research. In the context of clinical trial this has already been clarified by the Board.

24. Example:  A large population based study conducted on medical charts of COVID-19 patients.

25. As outlined above, the EU as well as the national legislator of each Member State may enact specific laws pursuant to Article 9 (2) (j) or Article 9 (2) (i) GDPR to provide a legal basis for the processing of health data for the purpose of scientific research. Therefore, the conditions and the extent for such processing vary depending on the enacted laws of the particular Member State.

26. As stipulated in Article 9 (2) (i) GDPR, such laws shall provide “for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy”. As similarly stipulated in Article 9 (2) (j) GDPR, such enacted laws “shall be proportionate to theaim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”. 

27. Furthermore, such enacted laws must be interpreted in the light of the principles pursuant to Article 5 GDPR and in consideration of the jurisprudence of the ECJ. In particular, derogations and limitations in relation to the protection of data provided in Article 9 (2) (j) and Article 89 GDPR must apply only in so far as is strictly necessary.