Safeguards and derogations relating to processing for scientific purposes: Article 89 analysis for biobank research

When complying with appropriate safeguards, the processing of personal data for scientific research under the GDPR benefits from a special regime which is of interest for biobank research. On the one hand, under this condition, the further processing of personal data will not be incompatible with the initial purposes for which the data were originally collected and processed and it allows for retaining data for longer periods of time for scientific research. Complying with this condition is a condition to lift the prohibition to process special categories of personal data in the context of scientific research. On the other hand, complying with this condition makes it possible to derogate to some extent to several data subjects’ rights such as the right of access, the right to rectification, the right to the restriction of processing and the right to object to the processing.

Possible safeguards range from specific procedures to support the exercise of data subjects’ rights to the use of anonymous data or (where necessary) of pseudonymised data, the appointment of a data protection officer, enforcing a procedure to ensure a feedback to data subjects on the results of the research, requiring specific professional accreditations, creating a specific supervisory body for the biobank research, or the creation of a specific Code of conduct for biobank research activities.

This double regime under the GDPR is finally compared with the 2009 OECD Guidelines in biobanks and genetic research databases.