Alternative legal bases for processing health data for scientific research purposes

Abstract

The processing of health data for scientific research purposes requires a legal basis under Article 6 and a justification under Article 9 (2) GDPR by way of an exception to the general prohibition in Art. 9(1) of the processing of special category data. Consent tends to be highly advocated for in this regard, in both literature and practice. However, the GDPR permits an alternative option: processing for scientific research purposes based on Union or Member State law which provides for suitable and specific safeguarding measures. This paper undertakes an in-depth examination of the ‘research exception’ in Art. 9 (2) (j) GDPR permitting the processing of health data for scientific research purposes, thoroughly considering its elements and its implications. It refers to examples of Member State implementing legislation and the proposed European Health Data Space Regulation for illustration purposes and argues that if implemented faithfully, Art. 9 (2) (j) strikes a better balance between the interests of the various stakeholders than consent, which is overall burdensome and may hinder research. Finally, in light of the uneven implementation of the GDPR’s research exception by the Member States which creates considerable legal uncertainties and results in barriers to the free flow of research data across the EU, this paper calls for a harmonised implementing Union law in this regard.