The right to protection of personal data is established by the charter of fundamental rights, the treaty on the functioning of the European Union and the European convention on human rights. As underlined by the court of justice, the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society. Data protection is closely linked to the respect for private and family life protected by the charter.
"Rapid technological developments have brought new challenges for the protection of personal data. The scale of data sharing and collection has increased dramatically"
On the other hand research and innovation help deliver jobs, prosperity, quality of life and global public goods and therefore research and innovation have been placed at the centre of the Europe 2020 strategy to promote smart, sustainable and inclusive growth.
Rapid technological developments have brought new challenges for the protection of personal data. The scale of data sharing and collection has increased dramatically. Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale in order to pursue their activities.
Individuals increasingly make personal information available publicly and it is time to build a stronger and more coherent data protection framework in the EU, backed by strong enforcement that will allow the digital economy to develop across the internal market, put individuals in control of their own data and reinforce legal and practical certainty for economic operators and public authorities.
Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject (lawfulness, fairness and transparency) and collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes (purpose limitation). Also, personal data shall be adequate, relevant, and limited to the minimum necessary in relation to the purposes for which they are processed.
Personal data may be stored for longer periods insofar as the data will be processed solely for historical, statistical or scientific research. Also, for archive purposes in accordance with the rules and conditions of the ‘regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data’ and if a periodic review is carried out to assess the necessity to continue the storage, and, if appropriate, technical and organisational measures are put in place to limit access to the data only for these purposes (storage minimisation).
Any person should have the right to have personal data concerning them rectified and a ‘right to erasure’. In particular, data subjects should have the right that their personal data are erased and no longer processed, where the data are no longer necessary in relation to the purposes for which it was collected or otherwise processed, where subjects have withdrawn their consent or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with the regulation on data protection.
However, the further retention of the data should be allowed where it is necessary for historical, statistical and scientific research purposes, for reasons of public interest in the area of public health, for exercising the right of freedom of expression, when required by law or where there is a reason to restrict the processing of the data instead of erasing them. Also, the right to erasure should not apply when the retention of personal data is necessary for the performance of a contract with the data subject, or when there is a legal obligation to retain this data.
For the purposes of processing for historical, statistical and scientific research purposes, the legitimate expectations of society for an increase of knowledge should be taken into consideration. The processing of personal data concerning health, as a special category of data, may be necessary for reasons of historical, statistical or scientific research. Therefore this regulation foresees an exemption from the requirement of consent in cases of research that serves a high public interest.
Processing of personal data concerning health which is necessary for historical, statistical or scientific research purposes shall be permitted only with the consent of the data subject, and shall be subject to the conditions and safeguards referred to in the regulation on data protection.
Member state law may provide for exceptions to the requirement of consent with regard to research that serves a high public interest, if that research cannot possibly be carried out otherwise. The data in question shall be anonymised, or if that is not possible for the research purposes, pseudonymised under the highest technical standards, and all necessary measures shall be taken to prevent unwarranted re-identification of the data subjects. However, the data subject shall have the right to object at any time in accordance with the data protection regulation.