Purpose definition as a crucial step for determining the legal basis under the GDPR: implications for scientific research — TEI-tagged view

Regina BeckerpersName, Davit ChokoshvilipersName, Adrian ThorogoodpersName, Edward S DovepersName, Fruzsina Molnár-GáborpersName, Alexandra ZiakapersName, Olga Tzortzatou-NanopouloupersName, Giovanni ComandèpersName (2024date). “Purpose definition as a crucial step for determining the legal basis under the GDPR: implications for scientific research.” Journal of Law and the Biosciencestitle·j.

Object of study — purpose specificationterm·dom under the GDPRterm·key and its role in choosing a legal basisterm·dom for research processing

Research question — how purposesterm·dom of personal data processing should be specified under the GDPRterm·key, and how that bears on the legal basisterm·dom in scientific researchterm·dom

Contribution — a GDPR-derived framework and a four-step iterative approach for specifying valid purposesterm·dom, applied to research scenarios and to the choice of legal basisterm·dom

Full text — tagged

The reference list is not part of the text we hold for this paper. Our copy was extracted from the publisher's page and the bibliography did not survive that extraction, so the article below ends before its references. Nothing has been removed by us.

Purposeterm·dom definition as a crucial step for determining the legal basisterm·dom under the GDPRterm·key: implications for scientific researchterm·dom Abstract The General Data Protection Regulation (GDPRterm·key) of the European Union, which became applicable in 2018, contains a new accountability principleterm·dom. Under this principle, controllersterm·dom (ie parties determining the purposesterm·dom and the means of the processing of personal data) are responsible for ensuring and demonstrating the overall compliance with the GDPRterm·key. However, interpretive uncertainties of the GDPRterm·key mean that controllersterm·dom must exercise considerable judgement in designing and implementing an appropriate compliance strategy, making GDPRterm·key compliance both complex and resource-intensive. In this article, we provide conceptual clarity around GDPRterm·key compliance with respect to one core aspect of the law: the determination and relevance of the purposeterm·dom of personal data processing. We derive from the GDPRterm·key’s text concrete requirements for purpose specificationterm·dom, which we subsequently apply to the area of secondary useterm·key of personal data for scientific researchterm·dom. We offer guidance for correctly specifying purposesterm·dom of data processing under different research scenarios. To illustrate the practical necessity of purpose specificationterm·dom for GDPRterm·key compliance, we then show how our proposed approach can enable controllersterm·dom to meet their compliance obligations, using the example of the overarching GDPRterm·key principle of lawfulness to highlight the relevance of purpose specificationterm·dom for the identification of a suitable legal basisterm·dom.

Keywords: data protection, GDPRterm·key, lawfulness, legal basisterm·dom, purpose specificationterm·dom, scientific researchterm·dom I. INTRODUCTION The General Data Protection Regulation of the European Union (EU), henceforth the GDPRterm·key, became applicable in all EU Member States in May 2018, and also applies to all countries in the European Economic Area (the EEA), being Iceland, Norway, and Liechtenstein. The GDPRterm·key replaced the previous Data Protection Directive 95/46/EC (DPD), and doing so, established a more comprehensive and up-to-date legal framework around data protection. The overarching objective of the GDPRterm·key is to ensure that the fundamental rights and freedoms of natural persons, ‘in particular their right to the protection of personal data’, are respected. 1 At the same time, the GDPRterm·key seeks to facilitate the use of personal data pertaining to natural persons in a manner that benefits broader society, achieving greater economic and social integration goals of the EU. 2 This dual objective of the GDPRterm·key is reaffirmed in Article 1, which states that ‘[the] free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data’. 3 The GDPRterm·key departs from its predecessor DPD in various substantive ways. One such departure is reflected in the fundamental approach to assessing GDPRterm·key compliance among the parties engaged in processing of personal data. Most notably, the GDPRterm·key redefines the compliance obligations of data controllersterm·dom, that is, parties determining the purposesterm·dom and the essential means (or the ‘why’ and the ‘how’) of the processing of personal data. 4 Whereas under the DPD, controllersterm·dom already had the responsibility to design processing in a compliant manner, the GDPRterm·key introduces the accountability principleterm·dom, which additionally requires the controllersterm·dom to also be able to demonstrate that processing complies with all the principles of the GDPRterm·key under Article 5(1). 5 By emphasizing the controllerterm·dom’s accountability, the GDPRterm·key effectively promotes a more deliberative approach to designing data processing operations undertaken by controllersterm·dom. 6 The controllersterm·dom are required to exercise considerable judgement in ascertaining that not only have they taken adequate steps to comply with the principles of the GDPRterm·key, but they have also implemented appropriate procedural and documentation strategies whereby this compliance can be demonstrated. The purposeterm·dom serves an important point of departure in the determining and justification of what is necessary in terms of processing, and thus the demonstrated compliance. At the same time, the abstraction of terms in the GDPRterm·key and the lack of translation of these terms into concrete instructions (including, as will be seen, concrete guidance to date from the European Data Protection Board, or EDPB, an independent body tasked with ensuring consistent application of the GDPRterm·key and promoting cooperation among the EU’s data protection authorities) require a good deal of rigorous interpretation and create an inherent legal uncertainty.

The resultant legal uncertainty makes it challenging for controllersterm·dom to ensure that the processing of personal data they undertake remains compliant with the GDPRterm·key. In this regard, GDPRterm·key compliance has been described as both broad and resource-intensive, requiring not only significant legal expertise, but also the resources to implement appropriate technical and organizational measures for ensuring compliance. 7 Moreover, owing to the legal uncertainties of the GDPRterm·key, the risk of non-compliance and the resultant repercussions, including potential fines imposed by data protection authorities, are difficult to fully eliminate, effectively making processing of personal data an inherently liability-prone activity under the current regulatory regime. 8 One area where the GDPRterm·key compliance challenges, due to legal uncertainties, have been associated with negative societal consequences is scientific researchterm·dom. Organizations undertaking processing of personal data for scientific researchterm·dom are often public universities; a fair number may be under-funded and lack adequate resources and legal expertise to ensure GDPRterm·key compliance. 9 The GDPRterm·key compliance challenges faced by universities and research organizations (eg charities, non-profit organizations, start-up companies) are further amplified by the fact that scientific researchterm·dom is a collaborative endeavor, often requiring data sharing among institutions. In practice, this means that organizations participating in collaborative research projects must assess their compliance obligations in the context of the overall data processing, which additionally requires considerable coordination to achieve GDPRterm·key compliance across all research collaborators. 10 The outcome is that research organizations are often discouraged from engaging in research collaborations, as they tend to perceive data sharing under the GDPRterm·key as inherently more risky and liable to fines, which may translate into foregone societal benefits in the EU. 11 Interestingly, this happens despite the research-friendly legal regime created by the GDPRterm·key, whereby scientific researchterm·dom is often deemed to have a privileged position. 12 In this article, we set out to describe an approach aimed at guiding researchers’ GDPRterm·key compliance efforts. The cornerstone of this proposed approach is correct specification of the purposesterm·dom of processing personal data: that is, explicitly delineating and describing, in an appropriate level of detail, the purposesterm·dom for which the controllerterm·dom intends to process personal data. We start by outlining the relevance of purpose specificationterm·dom for GDPRterm·key compliance, followed by proposing a general framework for determining purposesterm·dom, which we derive from the provisions of the GDPRterm·key. Subsequently, in applying this general framework to scientific researchterm·dom and secondary useterm·key of data, we highlight the unique challenges to purpose specificationterm·dom in the context of secondary useterm·key of data for scientific researchterm·dom and provide guidance for correctly specifying purposesterm·dom for the intended processing under different research scenarios. To conclude, we illustrate how for controllersterm·dom, purpose specificationterm·dom can act as a critical enabler for meeting compliance obligations, using the example of compliance with the overarching GDPRterm·key principle of lawfulness.

II. GDPRterm·key COMPLIANCE FRAMEWORK: FOCUS ON SPECIFIED PURPOSESterm·dom Defining purposesterm·dom of processing personal data is a crucial component for the controllerterm·dom’s overall GDPRterm·key compliance. Already in the core paragraph, Article 5(1) of the GDPRterm·key, which lays down the data protection principles, four out of the six subparagraphs explicitly mention the purposeterm·dom(s) of processing personal data. The crucial importance of purposeterm·dom(s) is subsequently reinforced throughout Chapters III and IV of the GDPRterm·key, where the majority of the articles also refer at least in part to the purposeterm·dom(s) of the processing.

In terms of Article 5 principles of the GDPRterm·key, purpose specificationterm·dom is most directly linked to the principle of purpose limitationterm·dom, according to which personal data shall be ‘collected for specified, explicit and legitimate purposesterm·dom and not further processed in a manner that is incompatible with those purposesterm·dom’. 13 When viewed through the lens of the purpose limitationterm·dom principle, purpose specificationterm·dom can be seen as the first step in a three-step compliance process. First, the controllerterm·dom must clearly specify and delineate all distinct purposesterm·dom for which processing of personal data is undertaken. 14 This, in the second step, will allow the controllerterm·dom to determine whether or not further processingterm·dom, within the meaning of Article 5(1)(b) of the GDPRterm·key, also takes place. 15 Third, assuming further processingterm·dom does indeed occur under the envisaged set-up, the controllerterm·dom must then assess whether this further processingterm·dom can be deemed compatible with the initial purposeterm·dom. Thus, through purpose specificationterm·dom, followed by the compatibility assessment (if applicable), the controllerterm·dom is enabled to demonstrate its compliance with the purpose limitationterm·dom principle. 16 However, purpose specificationterm·dom is also central to controllersterm·dom’ compliance with other principles of the GDPRterm·key. For example, with respect to the principle of lawfulness, the EDPB states in their Guidelines 4/2019 in paragraph 68 that ‘the appropriate legal basisterm·dom must be clearly connected to the specific purposeterm·dom of processing’. 17 The EDPB also stresses that in identifying the lawful basis for the processing, the ‘starting point is to identify the purposeterm·dom for the processing’. 18 As we will show in the subsequent sections, such analysis is particularly important in the context of scientific researchterm·dom, where the GDPRterm·key legal basisterm·dom, within the meaning of Article 6(1) of the Regulation, is often (but not invariably) consent in many EU countries. 19 Where researchers rely on a data subject’s consent as the GDPRterm·key legal basisterm·dom for processing personal data, they must pay particular attention to ensure that they have correctly specified the purposesterm·dom of processing. Consent is directly related to the purposeterm·dom and where purpose specificationterm·dom does not comply with GDPRterm·key requirements, consent as a legal basisterm·dom for the processing becomes invalid and the processing unlawful.

Cumulative requirements are created where the tripartite principle of lawfulness, fairness, and transparency under Article 5(1)(a) is considered through the lens of both purposeterm·dom and legal basisterm·dom. For example, the applicability of some of the data subject rights (under Chapter III of the GDPRterm·key) depends on the selected Article 6(1) legal basisterm·dom, whereas the transparency principle requires controllersterm·dom to provide appropriate information to data subjects regarding both the purposeterm·dom(s) and the associated legal basisterm·dom, as elaborated in Articles 13 and 14 of the GDPRterm·key. 20 Similarly, a clearly specified purposeterm·dom can help controllersterm·dom determine what types of data they need to process in order to accomplish the purposeterm·dom, alongside the required duration of processing, thus potentially enabling compliance with the GDPRterm·key Article 5(1) principles of data minimizationterm·key and storage limitation, respectively. 21 Purpose specificationterm·dom is also relevant for the accuracy principle, which explicitly states under Article 5(1)(d) that controllersterm·dom, ‘having regard to the purposesterm·dom for which [personal data] are processed’, must take every reasonable step to ensure that the data are accurate and up to date. 22 The relevance of purposesterm·dom for which data are processed in relation to the principle of accuracy is also stressed by the EDPB. According to the EDPB, ‘[each] personal data element should be as accurate as necessary for the specified purposesterm·dom’. 23 Finally, the dual principle of integrity and confidentiality 24 largely concerns the conditions under which personal data should be stored, including choosing appropriate security and other technical measures, as well as determining who is authorized to access the data. Once again, defining these conditions requires a clear understanding of the specific purposesterm·dom for which the personal data are processed.

Beyond the overarching Article 5(1) GDPRterm·key principles, the relevance of purpose specificationterm·dom for GDPRterm·key compliance can be further highlighted in the context of a controllerterm·dom’s concrete procedural and accountability obligations. For example, purpose specificationterm·dom by the controllerterm·dom is directly linked to the controllerterm·dom’s obligation to maintain a Record of data Processing Activities (RoPA) that are taking place under the controllerterm·dom’s responsibility. 25 Paragraph (b) of Article 30 explicitly mandates that each entry on the RoPA must be accompanied by the description of the purposesterm·dom for which the processing is carried out. This is a logical requirement, since the nature of processing operations is dictated by the purposesterm·dom for which the controllerterm·dom intends to process the data, as will be further discussed in the subsequent sections of this article. In other words, purpose specificationterm·dom will typically precede, and directly influence, the design of processing operations. However, in some cases, purpose specificationterm·dom and design of processing operations can also be done iteratively: the initial formulation of a purposeterm·dom can help identify the types of processing operations required to accomplish the purposeterm·dom, whereas the nature of these processing operations, in turn, may allow the controllerterm·dom to further specify and delineate purposesterm·dom.

Beyond compliance with the concrete documentation obligations under Article 30(1) of the GDPRterm·key, maintaining a detailed overview of the purposesterm·dom and their associated processing operations is also a necessity in the context of assigning GDPRterm·key roles in complex data processing environments, where personal data are processed by multiple parties across longer processing chains, potentially for multiple, distinct purposesterm·dom. The GDPRterm·key mandates that the parties involved in processing chains contractually agree on their respective roles under the Regulation (eg the roles of controllersterm·dom and processors, but also processor and sub-processor), alongside their respective GDPRterm·key compliance obligations. The determination of the roles must take place in a manner that objectively reflects the nature and the extent of the parties’ involvement in data processing. 26 Having a holistic understanding of the processing operations across the chains of processing, and their exact purposeterm·dom(s), is therefore essential for a correct allocation of the GDPRterm·key roles, as well as for contractual clarity among the parties in relation to their respective obligations and potential liabilities. 27 As such, purpose specificationterm·dom, by virtue of its inextricable link to the design of processing operations, is also vitally important for ensuring the collective GDPRterm·key compliance by multiple parties involved in complex processing environments.

Based on these considerations, it is clear that purpose specificationterm·dom plays a key role in controllersterm·dom’ overall GDPRterm·key compliance obligations. The next section explores the question of how purposesterm·dom should be specified under the GDPRterm·key.

III. HOW NARROWLY OR BROADLY SHOULD PURPOSESterm·dom BE SPECIFIED?

Considering the critical role of purpose specificationterm·dom for key compliance elements, it is surprising that neither the GDPRterm·key nor the interpretive guidance of it by the EDPB prescribes how purposesterm·dom should be specified. This is largely due to the fact that the term ‘purposeterm·dom’ is not explicitly defined under the GDPRterm·key. 28 On the one hand, the concept of ‘purposeterm·dom’ in the sense of the GDPRterm·key is somewhat intuitive: put simply, ‘the purposeterm·dom pertains to the aims of processing’, as also stated by the EDPB. 29 On the other hand, the lack of a more precise legal definition makes it challenging for controllersterm·dom to specify the purposesterm·dom for which they intend to process the data in a manner that is demonstrably compliant with the GDPRterm·key.

The lack of more prescriptive guidance by the EDPB in relation to purpose specificationterm·dom reflects the approach adopted by the EDPB’s predecessor Article 29 Working Party (hereafter WP29), in the context of purpose specificationterm·dom under the previous DPD. In their Opinion 03/2013, WP29 states the following: Vague or general purposesterm·dom such as ‘improving users’ ‘experience’, ‘marketing’, ‘IT-security’ or ‘future research’ will - without more detail - usually not meet the criteria of being ‘specific’. However, the degree of detail in which a purposeterm·dom should be specified depends on the particular context in which the data are collected and the personal data involved. 30 This lack of precise guidance on purpose specificationterm·dom by regulatory authorities is at odds with the controllersterm·dom’ need to define their purposesterm·dom of data processing in a sufficiently specific manner that enables demonstrable compliance with the GDPRterm·key. This unmet need of controllersterm·dom is reflected in the growing body of literature exploring various approaches to establishing consistent frameworks for purpose specificationterm·dom. 31 Recently, in certain domains of data processing traditionally characterized by a high reliance on standardized and interoperable information technology systems, community-wide shared standards and best practices have emerged around purpose specificationterm·dom. For example, Fouad and colleagues have proposed a taxonomy describing purposesterm·dom of internet cookies in a standardized manner (also known as ‘purpose standardizationterm·dom’), with the aim of enabling GDPRterm·key compliance. 32 However, many other areas where personal data are processed lack a similar level of technical interoperability and standardization, making it more challenging to develop GDPR-compliant comprehensive taxonomies of purposesterm·dom for the processing of personal data. This is, for example, the case with scientific researchterm·dom. The concrete challenges and their potential solutions associated with purpose specificationterm·dom in scientific researchterm·dom will be discussed more extensively in the next section.

Owing to the difficulties with developing comprehensive taxonomies of purposesterm·dom, it is useful to approach the question of purpose specificationterm·dom from a conceptual standpoint. Below, we outline a proposed general framework for specifying purposesterm·dom for processing personal data in a GDPR-compliant manner. Our proposed framework consists of rules for defining a valid purposeterm·dom under the GDPRterm·key, which have been derived from the data protection principles in Article 5(1) of the GDPRterm·key, their implementation through subsequent GDPRterm·key articles, as well as other concrete GDPR-based obligations of the controllersterm·dom.

From the GDPRterm·key, the following key preconditions for specifying a valid purposeterm·dom can be distilled: – Purposesterm·dom of the processing must be specific 33 and specified. 34 – A purposeterm·dom must be specific enough to inform the processing, ie it must be possible to demonstrate that processing operations are necessary for the stated purposeterm·dom. 35 The assumption that the purposeterm·dom must reflect the associated processing is supported by cumulative requirements for a valid consent under the GDPRterm·key: Article 6(1)(a) of the GDPRterm·key states that consent must be provided by the data subject for a specific purposeterm·dom, while according to Article 7(1) of the GDPRterm·key, the controllerterm·dom must be able to demonstrate that the data subject has consented to the processing of their data. Furthermore, it must be possible to assess whether data are accurate and up to date with regard to the purposeterm·dom for which they are processed. 36 – A purposeterm·dom must allow the determination of how long the data should be processed. 37 This implies that a valid purposeterm·dom cannot give rise to an indefinite duration of processing without a clearly determined or determinable end-result. Such understanding of a purposeterm·dom is also reflected in the French translation of the GDPRterm·key, which uses the word ‘finalitéterm·dom’ in reference to purposeterm·dom: finalitéterm·dom, similar to the English ‘end’ as in ‘means to an end’, implies that the activity in question has a clear endpoint marking its accomplishment or conclusion. If establishing the precise duration of processing is not feasible, at a minimum, clear criteria for determining whether the purposeterm·dom has been achieved must be articulated.

– The controllerterm·dom must be able to demonstrate that the envisaged data that are collected are necessary for achieving the purposeterm·dom. 38 Of note, a valid purposeterm·dom does not have to explicitly specify the data subjects or categories of data subjects, data types, and recipients or categories of recipients. This interpretation can be derived from Article 4(7) of the GDPRterm·key, which states that: ‘the controllerterm·dom […] determines the purposesterm·dom and means of the processing of personal data’ (emphasis added). The wording of Article 4(7) of the GDPRterm·key implies that purposesterm·dom do not have to be specified narrowly enough so as to directly encompass all the means of the processing (eg categories of data subjects, types of the data, categories of recipients). Rather, the controllerterm·dom has the discretion to choose the appropriate means for achieving the specified purposesterm·dom, though these must be specified before commencing the processing. 39 As a practical example, ‘determination of a suitable biomarker to predict the progression of disease XY’ would qualify as a purposeterm·dom. It leaves the discretion to researchers to investigate various data types that might qualify for such biomarker without having to know upfront which data types may be most suited. The information provided to data subjects must specify which data types will be investigated, but this can be done outside the actual purposeterm·dom definition. A purposeterm·dom can therefore be phrased without a prior hypothesis about which datatypes will eventually constitute the biomarker.

To be able to demonstrate compliance with the principles of the GDPRterm·key as required under the newly introduced accountability principleterm·dom of Article 5(2), purposeterm·dom(s) of processing personal data must be specified in a manner that fulfills all of the conditions listed above. Hence, a valid purposeterm·dom under the GDPRterm·key must be specific enough to inform the design of the processing, ie determine what processing is or is not included, to justify collected data types and chosen category of data subjects, and should aim at an achievement that allows to determine the duration of the processing for this purposeterm·dom. This compliance-enabling approach to purpose specificationterm·dom is also reflected by the EDPB in their Guidelines 2/2019: ‘The purposeterm·dom of the collection must be clearly and specifically identified: it must be detailed enough to determine what kind of processing is and is not included within the specified purposeterm·dom, and to allow that compliance with the law can be assessed and data protection safeguards applied.’ 40 Correctly defining the purposeterm·dom for the processing is not always straightforward in a more complex processing chain and may necessitate multiple steps of refinement, to be performed in an iterative manner. Namely, the controllerterm·dom may need to first identify preliminary (‘draft’) purposeterm·dom(s), and subsequently refine it/them in a manner that complies with the GDPRterm·key requirements for purpose specificationterm·dom. To help controllersterm·dom with this task, we recommend that controllersterm·dom adopt an iterative approach to purpose specificationterm·dom by following the steps described below: Step 1. Define the aim of the processing and its endpoint as a first ‘draft purposeterm·dom’ : what is the reason for the collection and/or otherwise processing the personal data? What result is to be achieved? The formulation of the draft purposeterm·dom should be such that it entails a defined or definable endpoint that is to be achieved, which will mark the conclusion of data processing for that purposeterm·dom. An open-ended objective such as ‘cancer research’, for example, does not enable the controllerterm·dom to define concrete endpoint(s) corresponding to the accomplishment of the purposeterm·dom.

Step 2. Ascertain the adequacy of purpose specificationterm·dom: is the (draft) purposeterm·dom specific enough to inform the design of the processing required for achieving the purposeterm·dom? What are the envisaged categories of data subjects concerned and the data types to be collected (or otherwise processed)? Can the selection be justified by the purposeterm·dom? (Phrased another way, why these categories of data subjects and data types, and not others?) Under the GDPRterm·key, a valid purposeterm·dom must be specified in a manner that enables the controllerterm·dom to justify the design of the project by demonstrating the necessity of the chosen essential means (including categories of data subjects and data types) in achieving the purposeterm·dom. Where the formulation of the draft purposeterm·dom lacks this information, the controllerterm·dom will need to incorporate a more detailed description of the envisaged data processing activities. This means that a purpose specificationterm·dom will often need to include more details than the mere result that is to be achieved. The ‘how’ and the ‘why’ will become part of the description to elucidate the choices made. A properly defined purposeterm·dom promotes accountability for data minimizationterm·key: if the stated purposeterm·dom can be achieved without certain data, then those data should not be collected in the first place.

Step 3. Assess whether further processingterm·dom of personal data takes place: can the controllerterm·dom clearly justify that each processing of personal data is necessary to achieve the defined purposeterm·dom? Building on the description of intended processing performed in Step 2, the controllerterm·dom should map out the envisaged data processing operations in a reasonably comprehensive manner, reflecting the totality of the information available to the controllerterm·dom regarding the planned processing. Subsequently, the controllerterm·dom needs to evaluate whether a particular processing operation is strictly necessary to achieve the purposeterm·dom for which the controllerterm·dom seeks to obtain the data. If the result could be obtained without a certain processing operation, the processing operation in question constitutes further processingterm·dom of the data for another purposeterm·dom that the controllerterm·dom must also specify in a GDPR-compliant manner.

Step 4. (In complex processing environments), ascertain that no unnecessary purposeterm·dom fragmentation takes place: along a processing chain involving a number of steps, are the different processing operations performed for multiple distinct purposesterm·dom, or for a single overarching purposeterm·dom? To assess whether purposesterm·dom are distinct or part of an overarching purposeterm·dom, the controllerterm·dom should determine which of the defined purposesterm·dom would by itself be a sufficient result that justified data collection and where subsequent processing operations and purposesterm·dom are opportunistic rather than necessary. In some complex processing environments, there is a risk that the controllerterm·dom could misattribute different processing operations to distinct purposesterm·dom, while in reality they are performed to achieve a single overarching (macro) purposeterm·dom. This could happen in particular where the processing along a processing chain uses different subsets of the data. Nevertheless, these different phases may be necessary to achieve only interim results, which alone would not justify the collection of data. An example could be the establishment of a database or a research cohort, which constitutes a clearly defined, achievable endpoint, but in itself is not a sufficient purposeterm·dom to justify the processing. It is only in view of the intended subsequent use of the data stored in the database that the collection of the data can be justified and the corresponding processing designed (we draw the reader’s attention to the section below on ‘Micro-level and macro-level purposesterm·dom in research’ for a more detailed analysis of this scenario based on a real-world example).

With respect to Step 4, it is essential that controllersterm·dom adopt a careful and differentiated approach to purpose specificationterm·dom, that is, by taking into account different phases of processing throughout the data lifecycle. In this respect, the EDPB cautions in its Guidelines 07/2020 41 that in complex processing chains involving several actors, different processing operations along the chain may appear disconnected (and hence, performed for independent purposesterm·dom) on a micro-level, whereas a closer inspection of the influence and definition of means might reveal that the processing operations are pursued to achieve the same macro-level purposeterm·dom that provides a justification for the overall collection. We would like to add that, even where only one controllerterm·dom is involved, the separation of the primary purposeterm·dom and further processingterm·dom is not always clear. 42 The above questions are designed to guide the controllerterm·dom in this separation.

In the following section, we apply the proposed iterative approach to purpose specificationterm·dom to the context of scientific researchterm·dom, illustrating how the approach can help researchers identify and refine the purposeterm·dom(s) for processing personal data under different relevant scenarios.

IV. DEFINING VALID PURPOSESterm·dom FOR SCIENTIFIC RESEARCHterm·dom Within the legal framework established by the GDPRterm·key, ‘scientific researchterm·dom’ is an important concept whose exact meaning can differ across contexts. Recital 159 of the GDPRterm·key frames the concept in a broad manner: [...] For the purposesterm·dom of this Regulation, the processing of personal data for scientific researchterm·dom purposesterm·dom should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research. [...] 43 However, depending on the context, ‘scientific researchterm·dom’ can also have a narrower meaning, referring to a particular research project pursued by the controllerterm·dom. This is reflected in the EDPB Guidelines 05/2020, which define scientific researchterm·dom as ‘a research project set up in accordance with relevant sector-related methodological and ethical standards, in conformity with good practice’. 44 Given this semantic ambiguity, below we discuss multiple scenarios of processing personal data for scientific researchterm·dom, in a broad sense of the term. Collectively, these scenarios capture the following cases: (i) the researcher processes personal data to perform a research project according to the design that the researcher developed; (ii) the researcher shares the data with another researcher for the latter’s research project; (iii) the researcher deposits personal data in a dedicated data repository in order to make the data widely available for qualified third parties pursuing their own research projects. 45 IV.A. Pursuit of an Own Research Project As discussed previously, the controllerterm·dom must define the purposeterm·dom(s) of processing in a manner that is sufficiently specific to inform the design of the processing. Translated to the research context, this means a valid purposeterm·dom under the GDPRterm·key must allow the design of the data processing activities envisaged within the intended research project. The controllerterm·dom must also be able to specify the personal data categories and the categories of data subjects to be included in the proposed research activities. In practice, this can be accomplished by elaborating an appropriate data analysis methodology and a comprehensive data analysis plan prior to initiating the data collection, with a clear link between the purposesterm·dom of the study and the description of the processing. It follows that a GDPR-compliant purposeterm·dom in scientific researchterm·dom should be formulated such that its scope is focused on an individual research project. The iterative approach to purpose specificationterm·dom outlined in the previous section helps explain the logic behind this conclusion.

As per the proposed framework for purpose specificationterm·dom, a valid purposeterm·dom must be achievable and have a clearly defined endpoint. That is, it must be able to answer the question, ‘what result is to be achieved?’ A broadly formulated purposeterm·dom, such as ‘research on new therapeutic approaches in oncology’, will not fulfill this requirement. Another insufficiently specified (and hence, invalid under the GDPRterm·key) formulation of the purposeterm·dom would be ‘finding new therapies in oncology’: although this formulation describes the nature of the achievement sought by the controllerterm·dom, it fails to provide an affirmative answer to another key question, namely, ‘is the (draft) purposeterm·dom specific enough to inform the design of the processing required for achieving the purposeterm·dom?’ In order to determine which processing activities are (not) included to achieve the purposeterm·dom, the controllerterm·dom must further specify the purposeterm·dom. Effectively, in this scenario, a correctly formulated purposeterm·dom should directly encapsulate the specific research question(s) that have motivated the design of the planned research project. When specified in this manner, the purposeterm·dom will also inform a research methodology, which justifies the (essential) means of processing, eg the categories of data subjects concerned (corresponding to study recruitment or inclusion criteria) and the personal data categories processed (corresponding to elements of the data analysis plan). The outcome of the intended processing, and hence the end-result marking the achievement of the purposeterm·dom, will be the generation of knowledge based on the question of the research project.

Specifying the purposeterm·dom in a manner that not only informs the design of processing but also links it to a well-defined end-goal may appear too narrow and hence overly restrictive for the pursuit of research. However, this interpretation is in line with the broadly accepted requirements for good scientific researchterm·dom practices. For example, the European Science Foundation (ESF), in its ‘Good Scientific Practice in Research and Scholarship’ policy briefing, lays down the same substantive requirements: All research should be designed so that it has a clear objective, either answering a valid scientific question or, in scholarship […]. The design of the study must be robust, the procedures proposed technically feasible and the intended methods of analysis appropriate. Protocols and plans should, therefore, be written in clear and unambiguous terms. They should include specific details of the aim, materials, methods, time schedules and analytical approaches to be used. 46 As such, the GDPR-derived criteria for purpose specificationterm·dom in the context of pursuing a scientific researchterm·dom project are closely aligned with the requirements dictated by good scientific researchterm·dom practices. Hence, by following the latter, researchers will also effectively lay the groundwork for specifying purposesterm·dom of processing personal data in a GDPR-compliant manner.

Nevertheless, a difference is to be made between a purposeterm·dom definition that reflects the scientific protocol and the narrative that is to be provided to the data subjects. The latter needs to be done in accordance with Article 12 GDPRterm·key and should focus on relating the scope and the consequences of the processing.

It is debatable to what extent it will always be possible to specify the full purposeterm·dom prior to the data collection. Recital 33 GDPRterm·key, focusing on scientific researchterm·dom, states that this will not always be feasible. An example can be found in population-level cohorts of a longitudinal character where the precise research questions emerge over time and are determined also by the disease trajectories observed among the research participants. Purpose specificationterm·dom in such cases would have to be more generic based on the range of research questions that are to be pursued with an emphasis on how the research questions will be determined and with the possibility to inform data subjects more precisely once the individual research questions crystallize. This is typically done through the webpage of such cohorts as well as in regular communication (eg via newsletters) provided to the participants of these cohorts.

IV.B. Data Sharing with an External Researcher Pursuing their Own Research An example of such a scenario may arise where a research organization that has established a cohort (in the following also called the ‘initial controllerterm·dom’) is approached by an external researcher with a request to access and use the data, for a study the external researcher has designed and is pursuing independently. (Re)use of the data by the external researcher therefore gives rise to a new purposeterm·dom of processing under the GDPRterm·key. The initial controllerterm·dom will assess such requests individually and decide whether to disclose data to the requestor. Reasons for a decision to disclose the data may include, for example, seeking greater visibility for the initial controllerterm·dom’s cohort, or shared research intereststerm·dom with the external researcher, which feeds into an intention to pursue collaborative projects in the future. The initial controllerterm·dom may also be motivated by a wish to further scientific advances or to enable reproducibility studies. With respect to the recipient researcher’s purposesterm·dom when requesting data access: the original research project for which the initial controllerterm·dom collected the data was designed prior to the intended recipient’s request. Hence, in order to comply with the GDPRterm·key, it is necessary to specify a new purposeterm·dom, for which the recipient researcher’s organization will be the controllerterm·dom. This effectively precludes joint controllership, making the party that initially collected the data for its purposesterm·dom and the intended recipient independent controllersterm·dom for data sharing and data use for own research, respectively. 47 The initial controllerterm·dom may disclose the data to allow the external researcher to pursue the validation, but they will not be involved any further. The processing of the initial controllerterm·dom is limited to the disclosure, without exercising influence on the research by the recipient, or any further processingterm·dom following the disclosure. This has to be reflected in the purpose specificationterm·dom.

Importantly, ‘data sharing’ or ‘data sharing for research’, while describing the overall nature of the processing, does not provide the justification of categories of data subjects and personal data categories undergoing processing. These essential means depend on the objectives and the research question of the external researcher requesting data access. Data sharing is a processing operation rather than an achievement. Only by specifying that sharing takes place for the external party’s research project is it possible for the initial controllerterm·dom to design processing in a manner that enables compliance with the GDPRterm·key principles. For example, by ensuring that the shared data are limited to the data strictly necessary for addressing the external party’s research question, the initial controllerterm·dom could demonstrate its compliance with the data minimizationterm·key principle. In view of these considerations, it is suggested that a valid purposeterm·dom, in the sense of the GDPRterm·key, should be framed along the lines of ‘data contribution to the external party’s research project’, where the specific research project of the external party provides the justification for the scope and nature of processing, including with regard to personal data categories and categories of data subjects.

Data sharing by the initial controllerterm·dom could also take place for a defined scope of research by the intended recipient beyond a specific project as long as the data use conditions agreed upon previously allow this. An illustrative example in this respect is generation of large-scale genomic data, such as whole-exome or whole-genome sequence (WES/WGS) data. WES/WGS data constitute valuable resources for exploratory research, particularly where they are associated with other information (eg health data and family medical history) from a well-defined clinical or research cohort. Researchers may generate WES/WGS data from biosamples acquired together with relevant clinical information. These data can be utilized by researchers iteratively, whereby results of initial data analyses inform the refinement of the research question, potentially leading to the formulation of new related hypotheses based on recently generated insights. 48 The investment into WES/WGS data is justified by their high utility for exploratory research, which, however, depends on the accompanying clinical data. Contractually limiting external researchers’ use of the clinical data obtained to one-off applications such as performing single, narrowly defined data analysis, would result in undue administrative burden for the subsequent use of the WES/WGS data generated by the external researcher. Namely, the external researcher would be required to obtain a new approval from the initial controllerterm·dom each time it seeks to perform a new query on the WES/WGS data and linked health data in the context of evolving research question(s).

A more research-enabling approach would be for the initial controllerterm·dom to contractually permit the use of its data by the specified recipient for an entire area of research. Here, the initial controllerterm·dom has the purposeterm·dom of contributing data to the defined research areas of the recipient researcher, provided that doing so by the initial controllerterm·dom is in line with the data use conditions defined vis-à-vis the data subjects. Using our proposed 4-step approach to purpose specificationterm·dom, it can be shown that data contribution by the initial controllerterm·dom for the recipient controllerterm·dom’s use within defined research areas constitutes a valid purposeterm·dom under the GDPRterm·key. This purposeterm·dom allows the initial controllerterm·dom to answer all of the required questions; for example, the initial controllerterm·dom can specify the categories of personal data being shared, alongside the categories of the data subjects concerned, owing to the fact that the transfer is taking place for a defined area of research. The initial controllerterm·dom can also describe what processing is and is not included as part of data sharing, while the achievement of the purposeterm·dom pursued by the initial controllerterm·dom can be defined as successfully disclosing the data to the recipient. It is the decision of the initial controllerterm·dom to choose between the specific purposeterm·dom of sharing data for an individual project only or for defined categories of purposesterm·dom. This will lead to different specific purposesterm·dom on the side of the initial controllerterm·dom: contribution of data toward a single research question or a range of research questions.

However, it is worth highlighting that the aforementioned purposeterm·dom of contributing data toward a range of research questions is only valid (i) from the initial controllerterm·dom’s standpoint, and (ii) with respect to the contribution of the data to a particular recipient. The possibility to cover areas of research, ie a range of research questions, does not stretch to the subsequent use of the data by the recipient controllerterm·dom for its research project(s). The research pursued by the recipient will have to comply with the requirements of purpose specificationterm·dom, requiring the recipient to carry out the 4-step analysis from its own perspective. The areas of research for which the initial controllerterm·dom contributes the data (which can be sufficient to specify the initial controllerterm·dom’s purposeterm·dom for data contribution) are not a specific enough purposeterm·dom for the recipient controllerterm·dom to describe its own research processing. Instead, each distinct research question for which the data are processed by the recipient will constitute a separate purposeterm·dom under the GDPRterm·key. Similarly, from the initial controllerterm·dom’s point of view, although the disclosure of the data to the recipient for a defined area of research constitutes a valid GDPRterm·key purposeterm·dom, this purposeterm·dom only covers a particular recipient controllerterm·dom. Data sharing by the initial controllerterm·dom with another recipient should be framed as an activity carried out to accomplish a different purposeterm·dom within the meaning of the GDPRterm·key.

The practical consequences of these considerations are reflected in the information obligations. Where an initial controllerterm·dom shares data with a recipient for the recipient’s defined research project, the initial controllerterm·dom needs to inform the data subject about the specific recipient and the specific research project, being able to cover the information obligations of the recipient under Article 14 GDPRterm·key, as well if the recipient provides the relevant information to the initial controllerterm·dom. On the other hand, where the initial controllerterm·dom decides to share data for an area of research pursued by the recipient, it would also inform the data subject, but in this case about the range of research questions that will be pursued by the recipient. By contrast, informing the data subject about each research question, to the extent applicable under GDPRterm·key Article 14(5)(b), becomes the recipient controllerterm·dom’s obligation (as the information provided by the initial controllerterm·dom on the areas of research will not suffice).

An initial controllerterm·dom may also decide to make data available to a range of (independent) recipients for areas of research. However, this scenario is different, being akin to the establishment of a data repository as a first step prior to subsequent instances of data disclosure to recipient users. Corresponding scenarios are addressed in the next section.

IV.C. Contributing Data to Biobanks and Data Repositories The scenario above describes an incidental sharing of data that are held by the initial controllerterm·dom for its own research purposesterm·dom. The initial controllerterm·dom may also decide to make data systematically available to the research community for defined areas of research, as opposed to assessing the acceptability of data sharing only after a data access request has been made. Such systematic availability is typically facilitated through data repositories or, where data are held in conjunction with biosamples, a biobank. 49 There are different processing steps along the data lifecycle in repositories, which are in large part determined by the choice of the repository. Some repositories only accept data in certain formats, which may require transformation of the data into specific semantic data models. Once included in the repository, data can be discovered by researchers from data catalogues and access can be requested for a defined research project’s purposeterm·dom. Personal data may be processed to generate the information necessary to be included in the data catalog of the repository that make the data findable, such as maximum and minimum values within the dataset, which can be established by consulting the underlying dataset. The data access decision can follow different approaches. In some cases, the access decisions are taken by the data access committee of the initial controllerterm·dom that submitted the data to the repository; an example of this access modality is the European Genome Phenome Archive (EGA) hosted by the research infrastructure European Bioinformatics Institute (EBI) and the ELIXIR Node in Spain. 50 In other cases, the decision is taken by the central data access committee established through the repository’s host, where such decision can be taken independently of the initial controllerterm·dom; an example is the database of Genotypes and Phenotypes (dbGaP) operated by the National Center for Biotechnology Information (NCBI) in the USA. 51 Following a decision to grant access, data are disclosed to the requesting scientist, who can either download the data or process them in a dedicated secure processing environment, depending on the data access conditions of the repository.

In the processing chain, the pursuit of a specific research project by the external researcher provides the basis to specify purposeterm·dom(s) of processing in a GDPR-compliant manner. This is the responsibility of the data-requesting researcher, whose organization acts as a controllerterm·dom under the GDPRterm·key with respect to the processing following data disclosure. On the other hand, the step of disclosing the data requires processing operations where the controllerterm·dom is either the initial controllerterm·dom or the repository, depending on the precise functional roles of the parties. For these processing operations, the purposeterm·dom of the controllerterm·dom should be contribution of data to the external researcher’s specific research project, which is identical to the scenario discussed above.

In the research context, the reason for a deposition of data in a repository is often the initial controllerterm·dom’s aim to make data available for future research, eg based on institutional policies or requirements of public funders. 52 The initial controllerterm·dom’s purposeterm·dom, in the sense of the GDPRterm·key, should be defined accordingly, ie in relation to making data available through the repository with a view to downstream sharing with external data users. An important element here as compared with our example in the previous section is an added step preceding data sharing with downstream recipients. First, rules for data availability are established, which includes not only the categories of recipients and the areas of research for which data can be disclosed, but also the mechanisms for taking decisions regarding data disclosure. Under these circumstances, making data available constitutes a valid purposeterm·dom in the sense of the GDPRterm·key, not only for its specificity, but also for having a well-defined end-result. This purposeterm·dom of creating availability is achieved once the data are made findable through the catalog of the repository and can be requested by external researchers. 53 All the processing steps in the processing chain that take place before the data are made findable will therefore be necessary to achieve the purposeterm·dom. This purposeterm·dom does not cover the actual downstream sharing for a specific research project, which will require the specification of another valid purposeterm·dom.

When pursuing the purposeterm·dom of making data widely available through a repository, the exact nature of the processing operations required to achieve the purposeterm·dom will depend on the choice of the repository. While some repositories ask for only very minimal data description for their catalogues and require no data curation (eg EGA), others have more elaborate requirements (eg dbGaP) that could even warrant change of controllership for the downstream data disclosures. Depending on the choice of repository, the deposition in the repository may also include a transfer to a third country (eg dbGaP) or international organization (eg EGA), as well as subjecting the data to different access and use conditions for future research reuse. This implies that the choice of repository will generally amount to more than deciding on the means of processing to achieve the purposeterm·dom specified by the initial controllerterm·dom. Rather, the choice of the repository will typically influence the nature of the processing in a substantive manner, thus bearing on purpose specificationterm·dom. 54 To specify the purposeterm·dom in a GDPR-compliant manner, we once again turn to the guiding question: ‘is the (draft) purposeterm·dom specific enough to inform the design of the processing required for achieving the purposeterm·dom?’ It follows that the specified purposeterm·dom for depositing data in a repository for future research use must include the choice of repository or otherwise provide information about the related processing operations. As with other scenarios of data sharing, the areas of research or, if applicable, other relevant purposesterm·dom (eg policy development) for which the data are to be made available should be captured in the initial controllerterm·dom’s purposeterm·dom. The availability of data for a scope of purposesterm·dom for which data can be lawfully disclosed to third parties and according to defined procedures is a legal status that data assume through the series of processing operations leading up to the inclusion of the data in the repository.

To cover these operations, the decision-making regarding future reuse and therefore potential changes in controllership needs to be captured, as applicable. We therefore recommend that the purposeterm·dom for a deposition in a repository for future research should be framed as ‘making data available for future research in the area of NN through the repository XY’. NN in this case includes the data use conditions. For fairness and transparency reasons, the implications of the choice of repository, such as the data governance framework, potential change of controllership, and transfers to a third country should be explicitly included in the description of the purposeterm·dom. In particular, where consent is supposed to be the legal basisterm·dom under the GDPRterm·key for making data available for future research, this comprehensive information is essential to obtain a valid consent.

This requirement can be seen as limiting in that it necessitates that the initial controllerterm·dom actively restrict its choice of repositories through which the data can be made available. However, it is worth noting that the GDPR-derived requirement to specify the purposesterm·dom of processing in this manner is in line with the spirit of existing bioethics guidance concerning valid informed consent in biobanking research. For example, according to the International Ethical Guidelines for Health-related Research Involving Humans by the Council for International Organizations of Medical Sciences (CIOMS) in collaboration with the World Health Organization (WHO), a valid informed consent to future use of biosamples in biobanks and/or data in data repositories should specify: the purposeterm·dom 55 of the biobank, the conditions and duration of storage; the rules of access to the biobank; the ways in which the donor can contact the biobank custodian and can remain informed about future use; the foreseeable uses of the materials, whether limited to an already fully defined study or extending to a number of wholly or partially undefined studies; the intended goal of such use, whether only for research, basic or applied, or also for commercial purposesterm·dom, [...]. 56 V. MICRO-LEVEL AND MACRO-LEVEL PURPOSESterm·dom IN RESEARCH The EDPB introduces in its Guidelines 07/2020 the notion of micro-level and macro-level purposesterm·dom to help controllersterm·dom correctly define purposesterm·dom of data processing under complex processing chains. Micro-level purposesterm·dom are pursued during specific stages of processing along a processing chain, whereas the macro-level purposeterm·dom describes the overall intended achievement justifying the processing. Micro-level purposesterm·dom are particularly relevant in research. Recital 33 of the GDPRterm·key states that it is often not possible to fully identify the purposeterm·dom of personal data processing for scientific researchterm·dom purposesterm·dom at the time of data collection. 57 This means that only micro-level purposesterm·dom can be specified, whereas the macro-level purposesterm·dom can only be described on an overall generic level, referred to as areas of research, at least at the time of the data collection.

Population-level studies such as birth cohorts are a typical example of purposesterm·dom that cannot be fully identified at the time of collection: the precise research question will depend on the health and disease progression of the research participants, which can only be defined at a later stage. Revisiting Step 4 in the purpose specificationterm·dom methodology described above, it becomes clear that building up a cohort without pursuing any research questions would not be justified. As such, the establishment of the cohort per se is not an independent purposeterm·dom, even though the establishment of the baseline of the cohort often leads already to a first publication; the cohort is designed based on an envisaged scope of research questions to be addressed later. Therefore, the establishment of a cohort merely constitutes accomplishment of a micro-level purposeterm·dom across the processing chain whose macro-level purposesterm·dom will be further specified once downstream research questions are clearly defined.

A recent example of a controllerterm·dom that misjudged a micro-level purposeterm·dom as an independent purposeterm·dom can be found in the June 30, 2022 Opinion, pursuant to Article 110 of the Italian Personal Data Protection Code (Legislative Decree June 30, 2003) and Article 36 GDPRterm·key, by the Italian data protection supervisory authority, the Garante per la Protezione dei dati Personali (hereafter, Garante). 58 In the case addressed by the Opinion, a university hospital had defined separate purposesterm·dom for the following activities: (i) establishment of a database on which to build future analyses and studies aimed at improving knowledge and clinical practice in the field of pathologies of the thorax; and (ii) the specific studies to be performed in these areas as well as the further studies beyond the specified scope of questions. The Garante emphasized in its Opinion that the collection (generation) and storage of data in the database without linking the processing to the subsequent research in the defined areas would not have been legally possible. The studies in the envisaged areas are therefore the macro-level purposeterm·dom for which the database is built. The creation of a database by itself is not a valid purposeterm·dom; it is no ‘end’ in itself, but a continued processing to answer downstream questions envisaged for the creation and design of the database, and which become progressively more concrete.

VI. RELEVANCE OF PURPOSE SPECIFICATIONterm·dom FOR THE DETERMINATION OF THE LEGAL BASISterm·dom Following the discussion of purpose specificationterm·dom under different scenarios relevant to scientific researchterm·dom, in this section we elaborate on how purpose specificationterm·dom can help researchers ensure that their organizations are compliant with their GDPRterm·key obligations as controllersterm·dom. We use the example of compliance with the principle of lawfulness, which, among other things, obliges the controllerterm·dom to select a basis to legitimize processing of personal data from the six options commonly referred to as GDPRterm·key legal bases listed under Article 6 (1) of the GDPRterm·key. When the controllerterm·dom processes special categories of personal data, which include health data and genetic data, the controllerterm·dom must additionally select a suitable Article 9(2) exemption from the 10 available options.

We choose to focus on this particular aspect of GDPRterm·key compliance because the absence of an appropriate legal basisterm·dom to legitimize processing has been reported as the single most common GDPRterm·key violation cited in fines imposed by data protection authorities. For example, a 2022 quantitative analysis of all fines issued by national data protection authorities revealed that processing personal data without a sufficient legal basisterm·dom had been cited in 409 cases out of the total 856 decisions (48 per cent), significantly exceeding the proportion of other cited GDPRterm·key violations that resulted in a fine. 59 Another reason for focusing our subsequent analyses on legal basisterm·dom is the conceptually challenging nature of interpreting Article 6(1) and 9(2) GDPRterm·key requirements in the context of secondary data use in scientific researchterm·dom, including a widespread confusion around whether identifying a valid legal basisterm·dom is even necessary. 60 As the analysis below will demonstrate, a GDPRterm·key compliance approach with purpose specificationterm·dom at its core allows to not only ascertain whether a legal basisterm·dom is required, but also determine which of the available legal bases are appropriate for the data processing at hand.

As highlighted previously, the EDPB states that the appropriate legal basisterm·dom must be clearly connected to the specific purposeterm·dom of processing. When processing personal data for research purposesterm·dom, the following Article 6(1) legal bases are of particular relevance: – The data subject’s consent to one or more specific purposesterm·dom (Article 6(1)(a)); – Legal obligation (Article 6(1)(c)); – Task carried out in the public interestterm·dom (Article 6(1)(e)); and – The legitimate interestterm·key pursued by the controllerterm·dom or a third party (Article 6(1)(f)).

Of the four legal bases, Article 6(1)(a) makes the most direct reference to purpose specificationterm·dom, reiterating that the validity of consent as the legal basisterm·dom for processing personal data depends on whether the consent has been obtained for one or more specific purposesterm·dom. The connection between Article 6(1)(c) of the GDPRterm·key and the concept of purposeterm·dom is more indirect. Article 6(1)(c) as a legal basisterm·dom to process personal data requires the existence of a legislative act mandating the controllerterm·dom to undertake the relevant processing activity. Article 6(1)(c) is complemented by Article 6(3) of the GDPRterm·key, which states that in this case the law must also determine the purposeterm·dom of the processing, hence linking the legal basisterm·dom with the purposeterm·dom also for Article 6(1)(c) GDPRterm·key. A direct purposeterm·dom reference is again included in Article 6(1)(f) of the GDPRterm·key, albeit summarily: the processing must contribute to purposesterm·dom in the legitimate interestterm·key of the controllerterm·dom or a third party. It is this legal basisterm·dom that makes a clear distinction among the overall aim that motivated the processing, the interestterm·dom of the controllerterm·dom, and the more granular aims, the purposesterm·dom, that inform the design of the processing and that are focused exclusively on the results of that processing. The distinction between ‘interestterm·dom’ and ‘purposeterm·dom’ is an important one in the EU’s data protection legislative framework. WP29 clarified this distinction in their Opinion 06/2014: The concept of ‘interestterm·dom’ is closely related to, but distinct from, the concept of ‘purposeterm·dom’ [...]. In data protection discourse, ‘purposeterm·dom’ is the specific reason why the data are processed: the aim or intention of the data processing. An interestterm·dom, on the other hand, is the broader stake that a controllerterm·dom may have in the processing, or the benefit that the controllerterm·dom derives - or that society might derive - from the processing. 61 There is an overlap in scope between Articles 6(1)(f) and 6(1)(e): the latter also refers to an interestterm·dom; the relevant interestterm·dom here is that of society. In the interestterm·dom of society, tasks are assigned to a controllerterm·dom, or are carried out under the official authority vested in a controllerterm·dom. The respective interestterm·dom has to be defined by the legislator: a legal measure is needed to invoke Article 6(1)(e). 62 A difference between the legal bases is that Article 6(1)(e) refers to a task rather than to purposesterm·dom. Here, greater flexibility is provided. A task in the public interestterm·dom can be framed in a broad way where it is established through a mandate or mission vested in a public or private body by national or EU law. 63 On the other hand, a task can also be relatively narrow where processing is only applicable to a party’s supporting role in a wider context of processing. An example of a narrowly defined task is the assignment of the responsibility for technical and organizational measures to ensure a level of security appropriate to the risk to a processor, which, among others, include encryption and pseudonymizationterm·key of data. Purposesterm·dom in the context of the tasks assigned based on Article 6(1)(e) therefore must fall under the scope of the assigned tasks. The controllerterm·dom needs to perform a test to demonstrate that the purposesterm·dom envisaged are covered by the mandate, mission, or task given to the controllerterm·dom.

VII. UTILITY OF PURPOSE SPECIFICATIONterm·dom IN IDENTIFYING A SUITABLE LEGAL BASISterm·dom FOR DATA PROCESSING IN THE RESEARCH CONTEXT In what follows, we demonstrate, based on relevant examples in the context of research, how purpose specificationterm·dom can help researchers identify a suitable legal basisterm·dom for data processing.

VII.A. Publication of Research Results Publication of research results follows the finalization of a defined research project. Since the publication is a step taking place after the research questions have been answered, it may appear to necessitate a separate purposeterm·dom under the GDPRterm·key, in particular as it requires considerable related processing. For example, such related processing operations may include transforming part of the raw data into a more intuitive or presentable medium (eg tables or figures) and providing access to the raw data, possibly in its entirety, for reviewers as part of the standard scientific peer-review process. To assess the relevance of the processing necessary for the publication of research results, it is instructive to revisit the proposed definitions of scientific researchterm·dom under the EU’s data protection legal framework.

As discussed previously, according to the EDPB Guidelines 05/2020, (paragraph 153), 64 scientific researchterm·dom in the context of the GDPRterm·key means a research project set up in accordance with relevant sector related methodological and ethical standards, in conformity with good practice. We use as reference for good practice in scientific researchterm·dom the ‘Good Scientific Practice in Research and Scholarship’ policy briefing of the ESF, and for methodological and ethical standards in the sector of health-related research, the CIOMS International Ethical Guidelines for Health-related Research Involving Humans.

The ESF defines research in rule 1: Scientific researchterm·dom and scholarship are diverse and multifaceted activities embracing a wide range of intellectual and practical endeavours. These include theoretical studies, experimental work and surveys, as well as the verification, further analysis and extension of earlier work. The objective is always to extend human knowledge and our understanding of the physical, biological and social worlds. 65 It further elaborates in rule 38: ‘Publication in a peer-reviewed journal or as a scholarly book is an important stage in the scientific process, marking the point when data, theories, interpretations and paradigms formally enter the public domain.’ 66 CIOMS also states in Guideline 24 the following: Public accountability is necessary for realizing the social and scientific value of health related research. [...] Researchers have a duty to make the results of their health-related research involving human beings publicly available and are accountable for the completeness and accuracy of their reports. 67 Based on this information, we can proceed to specify the purposeterm·dom in a GDPR-compliant manner by revisiting Step 4 of the proposed approach to purpose specificationterm·dom, which concerns complex chains of data processing consisting of multiple phases of processing. Namely, we can examine whether a particular achievement along the processing chain, in and of itself, would be necessary and sufficient to justify the data collection, absent any downstream processing. Translated to the case of publishing scientific results, this essentially means asking the following question: can the data collection and the conduct of research be justified if results are not to be published? Given the widely accepted ethical and methodological standards governing scientific researchterm·dom, it is clear that the answer to this question is ‘no’. Therefore, we suggest that the publication of research results, including the archiving of related data for reproducibility reasons as required for the integrity of scientific researchterm·dom, should be considered as part of the primary purposeterm·dom of knowledge generation on the defined research question and is therefore covered by the same legal basisterm·dom. In other words, no independent legal basisterm·dom needs to be established; the legal basisterm·dom applicable to the research project also applies to the publication of the project results. This is particularly relevant where consent is the legal basisterm·dom for the research: no separate consent is needed for pursuing the research and the data processing for the publishing of results. 68 VII.B. Pseudonymizationterm·key and Anonymizationterm·key of Data Pseudonymizationterm·key or, where possible, anonymizationterm·key of personal data, is an integral element of processing carried out routinely as part of research projects. It may therefore appear that pseudonymizationterm·key is a necessary processing step for research and hence covered by the GDPRterm·key legal basisterm·dom under which the research is pursued. However, posing the question, ‘can the controllerterm·dom clearly justify that each processing of personal data is necessary to achieve the defined purposeterm·dom?’ (Step 3 of our proposed approach to purpose specificationterm·dom), reveals that the necessity for pseudonymizationterm·key or anonymizationterm·key does not arise from the research question: pseudonymizationterm·key or anonymizationterm·key does not advance the pursuit of a specific research project and may even inhibit the researcher’s objectives by introducing additional hurdles to the use of the data. Hence, it is helpful to take a step back and ask the starting question from the proposed purpose specificationterm·dom framework: ‘what is the reason for the processing?’ In doing so, it becomes clear that pseudonymizationterm·key or anonymizationterm·key is necessary to comply with the obligations laid down in Article 89(1) of the GDPRterm·key for scientific researchterm·dom. Consequently, the legal basisterm·dom for the processing is rather Article 6(1)(c), ie a legal obligation based on Article 89(1). In some cases, where these obligations have become part of mandatory safeguards under Article 9(2)(j) or Article 9(4) of the GDPRterm·key for processing health and genetic data in the context of scientific researchterm·dom, also national legislation may be relevant.

Anonymizationterm·key may also take place instead of erasure of data at the end of a research project. Both anonymizationterm·key and erasure are once again based on obligations under the GDPRterm·key, in this case, derived from the Article 5(1)(e) requirement (viz., the storage limitation principleterm·dom) that data should not be kept in a form that permits identification of data subjects for longer than is necessary for the purposesterm·dom for which the personal data are processed. Here, too, posing the initial question, ‘what is the reason for the processing?’, allows the controllerterm·dom to not only correctly specify the purposeterm·dom of processing, but also to select the appropriate GDPRterm·key legal basisterm·dom for the processing. The suitable legal basisterm·dom remains Article 6(1)(c).

Anonymized data are no longer subject to the GDPRterm·key and can be used for any research, also beyond the scope originally agreed with the research participants as data subjects. This will be possible where data are anonymized as part of or following a research project. The situation is different where anonymized data are created as a separate dataset from the original pseudonymized data to enable research beyond the previously agreed scope. Here, the reason for the processing, ie anonymizationterm·key, cannot build on Article 5(1)(e) because the original dataset remains in an identifiable format, ie no irreversible de-identification of the dataset has taken place.

Also, Article 89(1) is not applicable as the processing is not related to a legitimate research project, so the conditions of Article 89(1) are not fulfilled. The purposeterm·dom for the processing is not required by law but driven by the research intentions of the controllerterm·dom: to generate an anonymous dataset that can be used for yet undefined research questions. Although some public bodies have received a legal mandate to create anonymous datasets that can be used for research purposesterm·dom, 69 other organizations will not be able to rely on such a mandate to anonymize data for future research. Consequently, a legal basisterm·dom outside of an assigned task, mission or mandate, or a legal obligation must be established.

Consent is a possible option: the purposeterm·dom to create non-personal data for future research questions that do not have to rely on identifiable natural persons allows a valid consent under the GDPRterm·key. The controllerterm·dom could also invoke legitimate interestterm·key as a legal basisterm·dom under Article 6(1)(f) to have a wider pool of data flexibly available for research. To invoke a legitimate interestterm·key, however, a balancing testterm·mth needs to be performed that weighs the intereststerm·dom of the controllerterm·dom against the intereststerm·dom of the data subject. 70 To achieve a positive outcome of the balancing testterm·mth, the reasonable expectations of the data subject must be taken into consideration. The data subject should be aware of the processing and should have an easy way to object. The information about the planned processing should therefore be made available at the time of collection or, at a minimum, prior to the anonymizationterm·key, with the availability of an easy mechanism to object. It should be noted that without the transparency and possibility to object to the processing, the controllerterm·dom may not be able to rely on legitimate interestterm·key. The dedicated creation of a parallel anonymized dataset to rely on for future research outside the scope agreed with the data subjects may therefore not be possible without recontacting the data subjects.

VII.C. Contributing Data to a Recipient Scientist’s Research Project Above we described a scenario where the initial controllerterm·dom is approached to make their data available for an external scientist’s research project. We can now modify the scenario to one in which a project has progressed in a way that does not reasonably justify a collaboration with an external party, or the research may be outside the expertise of the data-holding researchers. In this case, no joint research will take place, precluding joint controllership under the GDPRterm·key. We have established that each such disclosure will require a separate purposeterm·dom as the intended research purposesterm·dom of the recipient scientist will be decisive for framing the purposeterm·dom of the disclosure. This makes Article 6(1)(a) (consent) as a legal basisterm·dom for the disclosure rather cumbersome, because each disclosure will require a separate consent. 71 While the reuse of data in research is, in principle, in the public interestterm·dom, eg by recognizing further processingterm·dom for scientific researchterm·dom is seen as compatible under the GDPRterm·key, this is not sufficient to establish a legal basisterm·dom. 72 The mission of public research organizations and universities may be focused on their own in-house research, also highlighted by key performance indicators such as publications and patents. These tasks may not necessarily cover supporting the research of others (ie those who are not staff or students), depending on the precise scope of the legal mandate given to the research organization under the relevant national law. Consequently, purposesterm·dom related to contributing data to research without own participation cannot always be justified by an own research mission. Article 6(1)(e), a task in the public interestterm·dom, will therefore not always be a suitable legal basisterm·dom because merely disclosing data without further engagement does not constitute research processing even though it is feeding into the research of another researcher.

An interesting alternative to investigate is legitimate interestterm·key. The purposesterm·dom of legitimate interestterm·key must be related to a real and present interestterm·dom. 73 The EDPB clarifies further with reference to the judgment by the Court of Justice of the European Union 74 in TK v Asociaţia de Proprietari bloc M5A-ScaraA that the interestterm·dom of the controllerterm·dom must be present and effective as at the date of the data processing. 75 This means that any future collaboration the data-providing scientist may expect to materialize at a later time cannot be relied upon. Even the possibility to be cited may provide too weak an argument. However, the data-providing scientist can also rely on the interestterm·dom of the recipient as Article 6(1)(f) states that the legitimate interestterm·key may be that of a third party. As the data-providing scientist’s organization is the sole controllerterm·dom for the disclosure, 76 the recipient scientist is such a third party whose legitimate interestterm·key is demonstrated through the existence of the research project pursued by the third party. Nevertheless, to rely on Article 6(1)(f), the initial controllerterm·dom still needs to perform the balancing testterm·mth, having to demonstrate that the disclosure meets the reasonable expectations of the data subject. This obligation goes along with the transparency requirements of Article 13(3) that any further processingterm·dom must be communicated to the data subject with clear information on the right to object.

VIII. DISCUSSION OF RESULTS IN THE CONTEXT OF THE CHANGING EU LEGISLATIVE FRAMEWORK We have demonstrated how correctly specifying purposesterm·dom and mapping them to the processing operations helps the controllerterm·dom identify a suitable GDPRterm·key legal basisterm·dom for the processing of personal data. The case of the research database in Italy referenced above clearly highlights that it is not always easy for the controllerterm·dom to correctly delineate purposesterm·dom or indeed recognize micro-level purposesterm·dom that, without an explicit link to an overarching macro-purpose, do not allow the controllerterm·dom to demonstrate compliance with the GDPRterm·key, including the principle of lawfulness. This separation is all the more important if the controllerterm·dom wants to rely on consent as a legal basisterm·dom or base the processing on a legislation. In relation to the latter, that is, legal bases under Articles 6(1)(c) or 6(1)(e), the landscape is constantly changing both on the national and EU levels, especially in terms of secondary useterm·key of personal data. While the principles remain, the underlying national and EU legislation that controllersterm·dom can cite when relying on Articles 6(1)(c) or 6(1)(e) is still taking shape.

The newer EU Regulation 2022/868, known as the Data Governance Act (DGA), provides a framework for secondary useterm·key of protected data, including personal data. The secondary usesterm·key within the scope of the DGA include scientific researchterm·dom. 77 However, as the EDPB and the European Data Protection Supervisor (EDPS) point out in their Joint Opinion 03/2021 (paragraph 56), the DGA does not provide sufficiently for purposesterm·dom and tasks assigned to stakeholders involved in the secondary useterm·key and therefore does not provide a legal basisterm·dom under Article 6(1) of the GDPRterm·key. 78 The creation of a legal basisterm·dom for the processing of personal data was indeed not an intention of the legislator, as has been clarified in the preamble of the DGA (Recital 4). This is left to the legislators on the level of the EU Member States, as envisaged under the GDPRterm·key, as well as applicable sector-specific legislation on the EU level.

In this respect, a particularly relevant EU legislation is the proposed EU Regulation for a European Health Data Space. 79 The current draft of the EHDSterm·key Regulation, as of the time of writing, states in the Impact Assessment section that one objective is to offer an alternative to consent as the legal basisterm·dom for processing personal data in the context of secondary useterm·key. A list of a permitted scope of purposesterm·dom for secondary useterm·key is provided. Where users can legitimately request access for one of these purposesterm·dom, the draft EHDSterm·key Regulation creates a legal obligation for certain controllersterm·dom, known as ‘data holders’, to disclose electronic health data to ‘health data access bodies’ that act as permit authorities. The draft legislation further provides a legal basisterm·dom as a task in the public interestterm·dom for the health data access bodies to process the data to the extent necessary for the individual data access request and to disclose the data in a secure processing environment, also mandated to the health data access bodies. Under certain circumstances, data holders are foreseen to also disclose electronic health data to users applying for access directly.

The aim of the EHDSterm·key is to provide a mechanism for secondary useterm·key of health data for research and to overcome some of the identified challenges in establishing a valid legal basisterm·dom. However, the current draft only provides legal bases for a limited set of relevant processing activities because most of the processing is related directly to the data access request. The only data processing independent of a data access request is the characterization of data for data catalogues and the classification of data according to quality labels, which still need to be further defined and which may or may not require the processing of personal data. Any processing of personal health data outside the data access request within the EHDSterm·key framework still needs its own legal basisterm·dom. This means that a careful analysis of the processing activities taking place around research and secondary useterm·key and their mapping on either the EHDSterm·key framework or indeed a purposeterm·dom not foreseen in the EHDSterm·key Regulation will still be required in the future. This will be particularly relevant for pan-European research infrastructures as envisaged, for example, in the area of genetic data and health data through the European ‘1+ Million Genomes Initiative’, a joint declaration signed by most of the EU Member States as well as Norway and the UK in a collaborative manner, where existing data will be harmonized across Europe and made available for secondary useterm·key according to a common data governance framework. 80 Even within the EHDSterm·key, there may be limitations for the scientific researchterm·dom use of data, particularly as regards to preserving data from a study to ensure reproducibility or to enable reuse. Article 46(9) of the proposed EHDSterm·key Regulation states that a ‘data permit shall be issued for the duration necessary to fulfil the requested purposesterm·dom which shall not exceed 5 years’. The permit can be extended once, with the extension also limited to 5 years maximum. The proposed rule is that data must be deleted from the secure processing environment within 6 months after the expiry of the data permit. The duration of the permit is intended to provide sufficient time for the user to complete an analysis, but not to preserve the data for reproducibility. However, in research, it is not possible to define the purposeterm·dom such that it fits into a certain time frame. Rather, as we described above, the time frame during which the data needs to be processed will vary across research projects depending on the nature of their specific purposeterm·dom(s). An option is given by the EHDSterm·key Regulation to store formulas under which data were processed and pre-processed, but the main element, the underlying data, are not held and the data holder who originally provided the data has no legal basisterm·dom to keep these data longer than needed for its own purposesterm·dom. In short, the proposed EHDSterm·key Regulation does not appear to give sufficient consideration to study data preservation and reproducibility. One could therefore question if a researcher can pursue scientific researchterm·dom in the EHDSterm·key that is in keeping with the ethical and methodological standards of biomedical research.

The approach to limit data processing to the user’s purposesterm·dom and not to keep data beyond the duration of a data permit also limits opportunities for re-use of ‘enriched dataterm·dom’. These are data that have been transformed eg from unstructured into structured data and/or have been cleaned for the purposesterm·dom of secondary useterm·key, generated only in the context of a defined purposeterm·dom for data use. Subsequently, these enriched dataterm·dom are to be returned to the data holder 81 who has to decide if these data are valuable or not, and whether the enriched dataterm·dom should be retained. 82 However, the data holder can only decide to retain data within the scope of its own purposesterm·dom. As the initial data were generated in a setting fit for the data holder’s own purposesterm·dom, the data suitable for secondary useterm·key purposesterm·dom will often not meet the needs of the data holder. Where the data holder has no necessity to hold on to the enriched dataterm·dom for its own purposesterm·dom, the lack of a legal basisterm·dom means the data must be deleted. The principal shortcoming of this approach is that, for any future requests by other (prospective) data users, the steps of structuring and cleaning the data would need to be performed anew, creating undue inefficiencies.

The above-described weaknesses demonstrate that even for legislators, it is relevant to expend efforts to ensure that sector-specific legislative proposals define purposesterm·dom of processing personal data in a manner that is consistent with the GDPRterm·key requirements for purpose specificationterm·dom.

IX. CONCLUSION The purposeterm·dom behind data processing has a central role in many of the GDPRterm·key's articles. Yet, its conceptual underpinnings and practical implications remain under-explored in both regulatory guidance and academic literature. Seeking to fill these lacunae, in this article, we have argued that an adequate determination of the purposeterm·dom requires building on the relevant data protection principles of Article 5, as well the related concrete compliance obligations under various articles of the GDPRterm·key. Based on this approach, we provide actionable guidance designed to help researchers correctly specify purposesterm·dom for the intended processing of personal data. This exercise serves as both an accountability tool and a rules-based methodology for specifying purposesterm·dom in a manner that will simplify the controllerterm·dom’s subsequent GDPRterm·key compliance. We also show that in the research context, the full and precise purposeterm·dom is not always obvious; controllersterm·dom are prone to confusing the overall interestterm·dom in the processing with the processing-related outcome. In multi-stage processing environments involving long chains of processing, there is also a danger that micro-level purposesterm·dom may be misconstrued as distinct purposesterm·dom, while in reality they serve the same overarching purposeterm·dom. On the other hand, researchers may fail to ascertain that processing operations are performed for distinct purposesterm·dom, giving rise to different non-compliance risks.

Purpose specificationterm·dom is further important for defining the correct legal basisterm·dom for the processing of personal data. As discussed in this article, in order to establish a valid legal basisterm·dom, controllersterm·dom must correctly specify the purposeterm·dom(s) for which they intend to process personal data. Illustrative examples of this dependency are legal obligations that are associated with research such as pseudonymizationterm·key of research data or reporting requirements in clinical trials. Such obligations fall under a different legal basisterm·dom, Article 6(1)(c), rather than the processing for the actual primary purposesterm·dom that led to the data collection by the researcher. We also show by way of a recent example that where consent, reflected in Article 6(1)(a), is the legal basisterm·dom for processing personal data, and it fails to correctly link micro-purposes with the macro-purpose, it may jeopardize the researcher’s ability to lawfully use the data for the macro-purpose. This will likely be the case where the researcher has obtained the data subject’s explicit consent for the micro-purpose only, rendering the consent invalid for the overall (macro-level) purposesterm·dom the researcher intends to pursue.

The necessity to frame the relevant purposesterm·dom for the processing is not only relevant to data controllersterm·dom, but also extends to any legislator that seeks to create a legal basisterm·dom for the processing of personal data. As illustrated by the legislative process around the proposed EHDSterm·key Regulation, without giving purpose specificationterm·dom a careful consideration, the proposed legislation may fail to describe in sufficient detail the envisaged processing activities necessary for performing a task in the public interestterm·dom, ie to comply with Articles 6(1)(e) and 9(2) of the GDPRterm·key. The full scope of the processing must be reflected in the eventually finalized version of the EHDSterm·key Regulation, as otherwise controllersterm·dom may be left in a situation that impedes their ability to perform their mission under that law, or that intended objectives cannot be achieved.

It is worth highlighting that the establishment of a valid legal basisterm·dom is but one obligation incumbent upon the controllerterm·dom during the phase of designing data processing. Both purpose specificationterm·dom and identification of the legal basisterm·dom are necessary for enabling the controllerterm·dom as a first step to subsequently comply with other GDPRterm·key compliance obligations, including, for example: complying with transparency requirements vis-à-vis the data subject, demonstrating fairness of processing, as well as respecting the principles of data minimizationterm·key and storage limitation. As shown in this article, some of the specific compliance requirements vary depending on the selected legal basisterm·dom. For example, relying on consent or the legitimate interestterm·key requires the controllerterm·dom to take additional steps to comply with the transparency and fairness obligations.

Correctly framing the purposeterm·dom(s) of processing personal data under the GDPRterm·key requires domain expertise in order to delineate and accurately describe the envisaged achievements. The controllerterm·dom must also have a good understanding of the processing chain and be aware of the applicable legal framework under which the controllerterm·dom operates. Therefore, an interdisciplinary cooperation between scientific domain experts, data scientists, and legal experts is highly recommended for correctly specifying the purposesterm·dom and the associated GDPRterm·key legal bases. This cooperation is particularly important during the design phase of a scientific researchterm·dom project, that is, prior to initiating data processing. In this manner, the controllerterm·dom can comprehensively map out its GDPRterm·key compliance obligations throughout the envisaged data lifecycle, including any data processing activities occurring downstream. Having correctly defined the purposesterm·dom of processing and their associated GDPRterm·key legal bases is a vital precondition to enabling this overall compliance.

FUNDING Work of RB was supported by the European Union’s Horizon 2020 research and innovation programme Coordination and Support Action ‘Beyond 1 Million Genomes (B1MG)’ (grant agreement no. 951724) and the European Union’s Digital Europe Programme project ‘Genomic Data Infrastructure (GDI)’ (grant agreement no. 101081813).

Work of DC was supported by the European Union’s Horizon 2020 research and innovation programme Coordination and Support Action HealthyCloud (grant agreement no. 965345) and the Innovative Medicines Initiative 2 Joint Undertaking Research and Innovation Action European Platform for Neurodegenerative Diseases (EPND, grant agreement no. 101034344).

Work of FMG was supported by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) — NFDI 1/1 ‘GHGA — German Human Genome-Phenome Archive’ and by the German Federal Ministry of Education and Research, Project TrustDNA (Grant Number: 16DTM108A).

ACKNOWLEDGEMENTS The authors thank Ilaria Colussi, Irith Kist, Guillermo Lazcoz, Maria Pilar Nicolas, Susanne Rebers, Marjanka Schmidt, and Bert Verdonck for their comments and suggestions.

Footnotes Contributor Information Regina BeckerpersName, Luxembourg National Data Service, L-4362 Esch-sur-Alzette, Luxembourg.

Davit ChokoshvilipersName, Luxembourg National Data Service, L-4362 Esch-sur-Alzette, Luxembourg.

Adrian ThorogoodpersName, Terry Fox Research Institute, V5Z 1L3 Vancouver, Canada.

Edward S DovepersName, School of Law, University of Edinburgh, EH8 9YL, Edinburgh, UK.

Fruzsina Molnár-GáborpersName, Faculty of Law, Heidelberg University, 69117, Heidelberg, Germany.

Alexandra ZiakapersName, Tilburg Institute for Law, Technology & Society (TILT), Tilburg University, Tilburg 5037 DB, Netherlands; MPLegal, Athens 15231, Greece.

Olga Tzortzatou-NanopouloupersName, Legal Department, Biomedical Research Foundation of the Academy of Athens, Athens 11527, Greece.

Giovanni ComandèpersName, Sant’Anna School of Advanced Studies, 56127, Pisa, Italy.