Big Data and Scientific Research: The Secondary Use of Personal Data under the Research Exemption in the GDPR

Abstract

In the age of big data and AI, the ability to extract knowledge and value from personal data is promising, especially for researchers and policymakers. The new findings based on the vast amount of data have the potential to save lives and reduce expenses for the whole society. However, processing sensitive data for a new purpose poses complex ethical, legal and technical challenges. The EU General Data Protection Regulation (GDPR) accounts for this challenge by allowing researchers to process and further use personal data under the 'research exemption'. However, many aspects of this exemption would need further clarification: what level of public interest is necessary e.g., general, important or substantial, how the data should be de-identified and what kind of activities can fit in the definition of 'scientific research'. The issue is elaborated through the GDPR and its implementation in England and Germany, focusing on the secondary use of health data.

The future regulation of artificial intelligence systems in healthcare services and medical research in the European Union

“…35 However, both do not detail these safeguards due to the rapidly changing technological environment, providing “future-proof” regulation. The necessary safeguards, such as “pseudonymisation”, differ among the EU Member States ( Meszaros and Ho, 2018 ). Therefore, the required safeguards and the review process by authorities need harmonisation, especially in the case of AI systems for healthcare services and medical research ( Malgieri, 2019 ).…”

Unwinding a Legal and Ethical Ariadne’s Thread Out of the Twitter Scraping Maze

“…4). Our approach resorts to a classical desk review that analyses inputs from relevant articles of the GDPR; their scholarly interpretation, with a focus on academic research [16,29,40,45,51]; and official guidance from data protection and cybersecurity authorities (like the European Data Protection Board-EDPB-and the European Union Agency for Cybersecurity-ENISA) [4-6, 20, 22, 31]. Similarly, to address the ethics-oriented questions (Sect.…”

“…Even isolated pieces of information, when linked together, can lead to the identification of a person. Pseudonymized [40] data is considered personal data because it can be recombined to identify individuals, and so is encrypted data, when it can be easily decrypted. On the contrary, anonymized data that is irreversibly unlinkable to any individual is no longer considered personal data.…”

Using Secondary Health Data in Research

“…These contain provisions related to the use of secondary data for medical research, including that no third party can access data without the consent of the individual concerned. However, the legislation makes specific and broad exemptions for research if it does not cause "substantial damage or distress" (ICO, 2020) and if pseudonymisation is applied (Mészáros, 2018). Despite this, it has been argued that this creates an imbalance by favouring data controllers at the expense of subjects (Pormeister, 2017).…”