Authors: Laura Carmichael, Emma Cradock & Sophie Stalla-Bourdillon

1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.
2. Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
3. Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
4. Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs.

I. General remarks

Archiving purposes in the public interest, scientific or historical research purposes, and statistical purposes occupy “a privileged position” under the GDPR: it recognises that, in some cases, the fulfilment of these particular purposes could be rendered impossible or be seriously impaired, if the GDPR-framework were applied in its entirety (→ mn. 21). For instance, in certain circumstances, the achievement of certain statistical purposes pursued by data collection could be seriously impaired in terms of “representativeness and reliability”, if a significant amount of people raised an objection to that collection. Furthermore, without such special considerations for archiving purposes in the public interest, personal data of “enduring value” could be destroyed or anonymised before acquisition by archives.

Moreover, it is important to note that the creation of a European Research Area (ERA) remains a key strategic priority for the EU (→ Art. 179 para. 1 of the TFEU and recital 159 sentence 3 of the GDPR). Research is also important in the context of the pursuance of the EU Digital Single Market, which encourages innovation. Given that the ability to conduct good quality research is key to both these priorities and that “collection and processing of personal information is fundamental to the work of researchers”, the processing for the purposes of research also occupies a privileged position under the GDPR. Certain provisions and principles of the GDPR could seriously impair or even render impossible, the ability to deliver high quality research necessary to create an ERA and boost innovation.

Member States are therefore able to provide for derogations from certain data subject rights (→ mn. 16–17, also recital 156); and a number of special provisions are also introduced with a view to relaxing some of the requirements in relation to the processing for these purposes. Art. 89 can be viewed as a “gateway” – at the centre of this “special data protection regime” – to these special provisions, including: Art. 5 para. 1 lit. b and lit. e; Art. 6 para. 4; Art. 9 para. 2 lit. j; and Art. 14 para. 5 lit. b. This “interplay” is clearly shown by the special treatment these types of processing activities are afforded by Art. 5 in that: (i) there is an assumption that secondary uses for these purposes will be compatible with initial purposes (Art. 5 para. 1 lit. b, and also → Art. 5 mn. 71–88, and Art. 6 para. 4, concerning ‘purpose limitation’); and (ii) personal data processed (solely) for these purposes can be stored for longer periods in accordance with Art. 89 para. 1 (Art. 5 para. 1 lit. e, and → Art. 5 mn. 122–136, concerning ‘storage limitation’). Furthermore, compliance with Art. 89 para. 1 is one condition to which an exemption to the general prohibition on the processing of special categories of data applies (Art. 9 para. 2 lit. j, and also → Art. 9 mn. 75 – also see recital 52).

A balance must therefore be reached between the protection of fundamental rights of data subjects and the “legitimate expectations of society” (as per recital 113 sentence 4) for the (preservation and) advancement of knowledge. The GDPR specifies that these derogations and special provisions can only be used if safeguards are in place. Moreover, these derogations can only apply where “such rights are likely to render impossible or seriously impair the achievement of the specific purposes” (as per Art. 89 para. 2 and para. 3, also → mn. 1, 21 and 22).

Organisations have to assess whether any applicable Member State law provides for specific safeguards that they must implement when processing personal data for these purposes. They must furthermore monitor the applicable Member State implementations of the GDPR and observe any nuances that they mandate in relation to the processing for these purposes. They also need to examine and identify where it is possible to process personal data that do not permit the identification of the data subjects for these purposes. This can be assessed and documented as part of a DPIA (→ Art. 35). The processing of personal data for scientific purposes should moreover comply with all relevant legislation. The GDPR specifically highlights processing in the context of clinical trials (see recital 156 sentence 7), with the relevant provisions of Regulation (EU) No 536/2014 highlighted in recital 161 (referring to obtaining consent).

[…]