Contemporary biomedical research heavily relies on secondary use of personal health data that was obtained in a different clinical or research setting. Under the European General Data Protection Regulation (GDPR), data controllers processing personal data must comply with the principle of purpose limitation, which restricts further processing of personal data beyond the purpose for which the data was initially collected. However, ‘further processing’, is not explicitly defined, resulting in considerable interpretive ambiguities as to whether ‘secondary use’ of data by researchers constitutes ‘further processing’ under the GDPR. This ambiguity is problematic, as it exposes researchers to potential non-compliance risks. In this article, we analyse the term ‘further processing’ within the meaning of the GDPR, elucidate important aspects in which it differs from ‘secondary use’, and discuss the implications for data controllers’ GDPR compliance obligations. Subsequently, we contextualise this analysis within a broader discussion of regulating scientific research under the GDPR.
Becker, Regina and Chokoshvili, Davit and Comandé, Giovanni and Dove, Edward and Hall, Alison and Mitchell, Colin and Molnar-Gabor, Fruzsina and Nicolás, Pilar and Tervo, Sini and Thorogood, Adrian, Secondary use of Personal Health Data: when is it ‘Further Processing’ under the GDPR, and What Are the Implications for Data Controllers? (March 24, 2022).