Data processing for scientific research during COVID-19

WG Regulatory, Ethics & GDPR realised a webinar on "Data processing for scientific research during COVID.-19." At 05.05.2020, the webinar was held. The webinar aims were the analysis of "Guidelines on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak" adopted on 21 April 2020 by European Data Protection Board. The European Data Protection Board realised Guidelines shed light on legal questions concerning 1) the use of health data for the purpose of scientific research 2) the application of GDPR for the processing of health data for the purpose of scientific research in the context of the COVID-19 pandemic. The main point underlined by the European Data Protection Board is that GDPR provides special rules for the processing of health data for the purpose of scientific research that is also applicable in the context of the COVID-19 pandemic. Thus, no special rules for the processing of health data in research activity in this period, also if there are currently great scientific research efforts in the fight against the SARS-CoV-2 in order to produce research results as fast as possible. As matter of fact, GDPR already foresees a specific derogation to the prohibition of processing of certain special categories of personal data, such as health data, where it is necessary for these purposes of scientific research (See: Article 9 (2) (j) GDPR and Article 89 (2) GDPR.) The GDPR contains a special regime affording a degree of flexibility to genuine research projects that operate within an ethical framework and aim to improve society's collective knowledge and wellbeing. The way in which this special regime should operate in practice is under discussion. For this reason, the national legislator of each Member State may enact specific laws pursuant to Article (9) (2) (i) and (j) GDPR to enable the processing of health data for scientific research purposes. Therefore, the conditions and the extent for such processing varies depending on the enacted laws of the particular member state. So, it could be possible that special legal basis shall be laid down by Union or Member State law Article 6(3) GDPR, like f.i. a large population-based study conducted on medical charts of COVID-19 patients. Out of the above-mentioned hypothesis, processing of health data for the purpose of scientific research must be covered by one of the legal bases in Article 6 (1) GDPR. Anyway, considering the processing risks in the context of the COVID-19 outbreak, high emphasise must be put on compliance with Article 5 (1) (f), Article 32 (1) and Article 89 (1) GDPR. There must be, also, an assessment if a DPIA pursuant to Article 35 GDPR has to be carried out.