Secondary use of Personal Health Data: when is it 'Further Processing' under the GDPR, and What Are the Implications for Data Controllers?

Abstract

Contemporary biomedical research heavily relies on secondary use of personal health data that was obtained in a different clinical or research setting. Under the European General Data Protection Regulation (GDPR), data controllers processing personal data must comply with the principle of purpose limitation, which restricts further processing of personal data beyond the purpose for which the data was initially collected. However, “further processing”, is not explicitly defined, resulting in considerable interpretive ambiguities as to whether “secondary use” of data by researchers constitutes “further processing” under the GDPR. This ambiguity is problematic, as it exposes researchers to potential non-compliance risks. In this article, we analyse the term “further processing” within the meaning of the GDPR, elucidate important aspects in which it differs from “secondary use”, and discuss the implications for data controllers’ GDPR compliance obligations. Subsequently, we contextualise this analysis within a broader discussion of regulating scientific research under the GDPR.

Note:
Funding Information: Work of RB was supported by ELIXIR-Luxembourg. Work of DC was supported by the European Union's Horizon 2020 research and innovation programme Coordination and Support Action HealthyCloud (grant agreement no. 965345) and the Innovative Medicines Initiative 2 Joint Undertaking Research and Innovation Action European Platform for Neurodegenerative Diseases (EPDN, grant agreement no. 101034344). Work of GC was supported by the Italian Health Ministry under the activity “Strategia Genomica italiana: istituzione di una cabina di regia a supporto dell’iniziativa europea 1+Million Genomes (1+MG) e Beyond 1+MG (B1MG) e del Coordinamento Interistituzionale per la Genomica in Sanità Pubblica” Work of FMG was supported by the European Union's Horizon 2020 research and innovation programme project EUCANCan: a federated network of aligned and interoperable infrastructures for the homogeneous analysis, management and sharing of genomic oncology data for Personalised Medicine (grant agreement no. 825835). Work of PN was supported by the Instituto de Salud Carlos III, Spain under “Infraestructura de Medicina de Precisión asociada a la Ciencia y Tecnología (IMPaCT) de la Acción Estratégica en Salud 2017-2020. IMP/00009”. Work of AT was supported by the European Union's Horizon 2020 research and innovation programme Coordination and Support Action Beyond 1 Million Genome (B1MG, grant agreement no. 951724).

Declaration of Interests: FMG is a member of the European Group on Ethics in Science and New Technologies. This paper is written in a purely private capacity and the views expressed here cannot be attributed to anyone other than the author(s). All others have nothing to declare.

Keywords: GDPR, further processing, secondary use, personal data, biomedical research, scientific research