GDPR Tip: Know the difference between obtaining consent and using ‘scientific research purposes’ to gain a legal basis
Consent is not the only way to gain a legal basis for processing personal data as a researcher. In many cases, you can use ‘scientific research purposes’ as a basis – and this can be an advantage.
GDPR
AU’s website about GDPR for researchers contains useful information on how you can keep personal data safe when conducting research projects.
Over the next few months, AU’s data protection unit will focus on various aspects of GDPR using researchers’ dilemmas and experiences as a point of departure.
This time, they are focusing on the legal basis for processing data.
Many researchers assume that the only way to gain a legal basis for processing personal data in their research is to acquire consent pursuant to data protection laws. But this is not the only way – and, often, it is not the most expedient way. The Danish Data Protection Agency actually recommends that researchers do not obtain consent unless they specifically need to do so.
In many cases, researchers can achieve this legal basis by saying they need to process data for scientific research purposes.
This applies if you will only process personal data for scientific or statistical purposes, and if the processing is necessary for the research.
Researcher: Using ‘scientific research purposes’ as a legal basis is an advantage for me
Caroline Howard Grøn is associate professor in political science at the Crown Prince Frederik Center for Public Leadership, and she often processes large datasets as part of her research. She believes the ‘scientific research purposes’ justification can benefit researchers.
”I work with data sets about employees evaluating their managers, and here it is essential that I can make use of the scientific research purposes legal basis rather than obtaining consent from every single person,” she says.
She also points out that it is not always expedient to obtain consent if doing so is not required. Therefore, it is also important to have a clear reason why processing the data is necessary for your research.
If consent has been obtained, the personal data collected can only be used for the specific purpose stated in the consent document. Whereas if you use scientific research purposes as your legal basis, you can use the personal data collected for a new research purpose.
“Using this basis gives us a bit more scope to conduct our research, and this is clearly an advantage for us as researchers,” says Caroline Howard Grøn.
It is often necessary to obtain consent, however, in cases in which personal data will be used for purposes other than research. For example, if it is to be used as part of teaching, in collaboration with a company, or for an administrative reason.
Facts: When working with personal data, you must always ensure that you have a legal basis for processing this data. You can generally do this in two ways:
|
More information
Read more about how you can ensure you have a legal basis for processing data.
Next time: Here you will receive tips on how identify personal data in your research. Here you can listen to Karen Thodberg, senior researcher at the Department of Animal Science, talk about her research.