The ICO is seeking feedback on the draft guidance on the research provisions in the UK GDPR and the DPA 2018.
The UK GDPR and the DPA 2018 contain several provisions for processing personal data for research purposes. These provisions refer to three types of research related purposes for processing:
· archiving purposes in the public interest;
· scientific or historical research purposes; and
· statistical purposes.
The research provisions are not set out in one location in the UK GDPR or the DPA 2018. Instead, they are contained in a number of articles and paragraphs in both pieces of legislation. These provisions cover three broad areas of data protection:
· the data protection principles;
· a condition for processing special category data and criminal offence data; and
· exemptions from data subjects’ rights.
The aim of the guidance is to highlight where in the legislation the various provisions that relate to research can be found, how they fit together and their practical effect. It also provides guidance on the definition of key terms, which will help organisations understand when they can rely on the research provisions. The ICO has developed a set of indicative criteria for each of the three types of research.
The guidance is intended to provide more detail and clarity about this complicated area of data protection. It will help those engaged in research to carry out their processing while being compliant with the law. It should give researchers confidence to make use of the provisions where appropriate.
The research provisions are currently under consideration as part of the UK government’s stated intent to reform data protection. However, the ICO says that it is important for the ICO to develop guidance on the current legislation to support organisations using personal data for research purposes now. The ICO further says that it is crucial that it continues to support stakeholders in this complex area, making compliance with data protection easier. The ICO also believes that the draft guidance addresses some of the issues identified in the data protection reform consultation as being problematic to organisations engaging in research. It will keep any guidance it produces in this area under review to ensure it reflects any future changes.
The consultation ends on 22 April 2022.
