Dara Murphy (Cork North Central, Fine Gael)
Link to this: Individually | In context | Oireachtas source

According to the "purpose limitation" principle set out in Article 5 of the General Data Protection Regulation (GDPR), personal data should be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. However, paragraph 1(b) provides that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to appropriate safeguards, not be considered incompatible with the initial purposes. Likewise, while the "storage limitation" principle requires that personal data should be kept in a form which permits identification of individuals for no longer than is necessary for the purposes for which the data are collected and processed, paragraph 1(e) provides that personal data may be stored for longer periods insofar as the data will  be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required in order to safeguard the rights and freedoms of individuals.

Article 89 confirms that data processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is permitted, subject to appropriate safeguards for the rights and freedoms of individuals. It states that such safeguards should ensure that technical and organisational measures are put in place in order to ensure respect for the principle of data minimisation and cites the process of "pseudonymisation" of personal data as a possible safeguard if the purposes concerned can be fulfilled in that manner. It also permits Member States to provide for derogations from certain data subject rights where personal data are processed for these purposes. Proposals for legislation which are currently being prepared in my Department to give further effect to the GDPR will contain a number of derogations in line with Article 89.

It should be noted that the Regulation recognises the importance of research activity, including the processing of personal data for scientific purposes. For example, it specifically cites the significance of medical research which can yield new knowledge of great value concerning diseases such as cardiovascular disease, cancer and depression. In the social science field, it acknowledges that research enables researchers to obtain essential knowledge about the long-term correlation of a number of social conditions such as unemployment and education with other life conditions. The processing of personal data for scientific research purposes includes technological development, fundamental research, applied research and privately-funded research.

I want to reassure the Deputy that I, together with my Department, have participated in a constructive and active manner in the negotiations which resulted in agreement on the GDPR. The GDPR will enter into force in May 2018 and all Government Departments are currently giving consideration to the manner in which its provisions will apply in practice to their respective areas of activity, including scientific research, and assessing the need for any necessary further action.