Secondary use of personal health data: When Is It "further processing" under the GDPR, and what are the implications for data controllers?

Regina Becker, Davit Chokoshvili, Giovanni Comandé, Edward S. Dove, Alison Hall, Colin Mitchell, Fruzsina Molnár-Gábor, Pilar Nicolàs, Sini Tervo, Adrian Thorogood

Research output: Contribution to journalArticlepeer-review

Abstract / Description of output

Contemporary biomedical research heavily relies on secondary use of personal health data that were obtained in a different clinical or research setting. Under the European Union's General Data Protection Regulation (GDPR), data controllers processing personal data must comply with the principle of purpose limitation, which restricts further processing of personal data beyond the purpose for which the data were initially collected. However, "further processing"is not explicitly defined, resulting in considerable interpretive ambiguities as to whether "secondary use"of data by researchers constitutes "further processing"under the GDPR. This ambiguity is problematic as it exposes researchers to potential non-compliance risks. In this article, we analyse the term "further processing"within the meaning of the GDPR, elucidate important aspects in which it differs from "secondary use", and discuss the implications for data controllers' GDPR compliance obligations. Subsequently, we contextualise this analysis within a broader discussion of regulating scientific research under the GDPR.

Original languageEnglish
Pages (from-to)1-29
Number of pages29
JournalEuropean Journal of Health Law
Early online date1 Aug 2022
DOIs
Publication statusE-pub ahead of print - 1 Aug 2022

Keywords / Materials (for Non-textual outputs)

  • biomedical research
  • further processing
  • GDPR
  • personal data
  • scientific research
  • secondary use

Fingerprint

Dive into the research topics of 'Secondary use of personal health data: When Is It "further processing" under the GDPR, and what are the implications for data controllers?'. Together they form a unique fingerprint.

Cite this