According to section 6 of the Personal Data Protection Act, personal data can, in certain cases, be processed without a person’s consent, relying on another legal basis, for example, performing a task in the public interest. There is, however, little clarity about situations where the legal basis for the research is a public interest task, and it is therefore not possible at this stage to make specific recommendations for research without consent. Below, a few general recommendations are given, which should be taken into account when carrying out research in the public interest without consent.
2.4.1. Data must be pseudonymised or additional requirements met
According to subsection 6 (1) of the Personal Data Protection Act, personal data may be processed for research purposes without the person’s consent in a pseudonymised format or a format providing an equivalent level of protection. In particular, the pseudonymisation requirement concerns secondary research, for example, where the researcher wishes to use information from a public database or personal data previously collected for another purpose and the legal basis is a public interest task.
As an exception, personalised data may be processed without consent if all the conditions specified in subsection 6 (3) have been met.
- The purpose of research can only be achieved with personalised data
Personalised data may be used if the purpose of research is drawing conclusions about particular individuals, the information of interest is very closely linked to the specific individuals, or the research relates directly to the interests and rights of the specific individuals. The researcher must always justify the need for personalised data and explain why they cannot carry out the planned research with the consent of the persons.
- There is an overriding public interest in the research
Public interest may be involved in both applied and basic research. Performing a task in the public interest implies that the planned research has a scientific or social value that the researcher must explain. The public interest must be overriding – for example, if the study involves a significant interference with people’s rights and freedoms, it can be justified by a very high public interest.
- The research must not damage the data subjects’ rights
The researcher must assess the potential harm to the data subject’s rights. If there is no risk of harm, the planned research is very likely to be allowed. However, if there is still a risk of harm to the rights, it is necessary to take mitigating measures or find another way to carry out the research.
In most cases, it can be presumed that if all the criteria of section 6 of the Personal Data Protection Act are met and the reasons given are convincing, a public interest task can be established as the legal basis.
Preparing a justification and assessment under section 6 (3) is the responsibility of the researcher or the research institution. If the personalised data fall under a special category of personal data, the ethics committee’s approval must be obtained.
2.4.2. Reference should be made to the legal provision
A task carried out in the public interest must result from the law. Therefore, for the sake of transparency, the public interest of the planned research should always be indicated, and reference should also be made to the legislative act specifying this public task.
The research mission of some public research organisations has been laid down in a separate law under which the organisation operates. In this case, it is possible to refer to a specific provision. In other cases, the Personal Data Protection Act may be the only relevant legal instrument, however, it does not guarantee that there is automatically a public interest in every planned research project. In this case, researchers need to provide further justification or explanation of the public interest.