European Data Protection Board Publishes Study On Secondary Use Of Personal Health Data For Scientific Research

The European Data Protection Body (EDPB) has published a  study on how personal health data is and/or can be reused for scientific research in the EU under the EU General Data Protection Regulation (GDPR). The study highlights the related practical challenges due to divergent interpretations of the GDPR and national rules across EU Member States.

The key conclusions of the study are set out below:

1. Select the legal basis for the primary use of personal data on a case-by-case basis, avoid selecting consent by default:

When selecting the legal basis, it is essential to consider the research type and national legal requirements.

The study analyses the suitability of the legal bases below: