The EU GDPR and secondary use of health and genetic data for research support purposes

Abstract Under European Union law, the processing of health and genetic data, which are special categories of personal data under the General Data Protection Regulation (GDPR), is prohibited under Article 9(1) GDPR unless at least one of the 10 exemptions under Article 9(2) is fulfilled. A common interpretation among legal commentators and policymakers is that where an entity discloses (ie shares or otherwise makes available) health and genetic data under its control to various external scientific research organizations and projects for secondary use purposes, the Article 9(2)(j) scientific research exemption applies to that data disclosure. We challenge this common interpretation of the GDPR. Our aim is to provide more clarity around the ancillary aspect in secondary use, allowing for a more coherent, consistent, and efficient interpretation of the interplay between secondary use research and its closely related activities, such as the disclosure of data for such research. We argue there should be more nuance in interpreting the underlying processing activities: where the purpose of the requesting data user is scientific research, the purpose for the data-holding entity’s data disclosure to them ought not generally be construed as a research purpose itself, such that reliance on Article 9(2)(j) could obtain. Instead, there may be greater legal suitability in relying on another, hitherto under-explored exemption under Article 9(2)(g), that is, processing is necessary for reasons of substantial public interest, namely for research support purposes, and where such research can be considered as bona fide and in the public interest.