The processing of special categories of personal data is prohibited unless there is a legal basis for the processing and, in addition, one of the circumstances specified in Article 9 (2) of the GDPR applies. Two of them concern research most directly: if an individual has given consent to the processing of special categories of personal data or if the processing is necessary for scientific research in the public interest. In the latter case, however, there must be additional safeguards, the processing must be lawful, and the rights of the people must be respected. In Estonia, the processing of special categories of personal data must also comply with section 6 of the Personal Data Protection Act.
2.11.1. Processing special categories of personal data without consent requires the ethics committee’s approval
The obligation to obtain the consent of the ethics committee is laid down in subsection 6 (4) of the Personal Data Protection Act. It applies if the research involves processing special categories of personal data without the data subject’s consent. The obligation can be seen as an additional safeguard measure within Article 9 (2) j) of the GDPR. The request for consent submitted to the ethics committee must describe the measures envisaged to protect the data subject’s rights and personal data.
2.11.2. Processing special categories of personal data requires additional safeguards
As special categories of personal data are highly sensitive information, they involve a risk of harming people’s interests and rights. Therefore, special categories of personal data need more protection.
- Preference should be given to processing pseudonymised data or using other means of protection, such as encryption;
- Before processing, it is necessary to assess whether a data protection impact assessment (see 2.14.3) should be carried out, especially if data subjects include vulnerable persons.
2.11.3. The concept of special categories of personal data can be difficult to apply
Sometimes it is not easy to draw the line between special categories and ordinary data. For example, it may not be certain when mental health is being studied and when the mood or attitudes are. A purpose-based approach can be helpful. When data on a person’s attitudes and well-being are collected to draw conclusions about, for example, their stress level or stress tolerance, it is mental health research. However, when such data are asked to examine the person’s satisfaction with a job or service, it does not concern mental health but other qualities.