RESPECTGuidelines regarding data protection aspects whithin socio-economic research

Y. Poullet, K. Rosier, I. Vereecken

CRID-FUNDP in cooperation with ITM

1. Introduction2. Guidelines

2.1. Guidelines’ philosophy2.2. Scope of the guidelines2.3. Content of the guidelines

3. Conclusions

1 Introduction

What is meant by data protection ? Specific rules established by UE

within the Directive 95/46/CE regarding the processing of personal data, i.e. information related to an identified or identifiable person

Data protection distinct from the protection of privacy or of intimacy

Data protection is not only data security

1. Introduction

Why is there a need for data protection guidelines ? Implementation of Directive 95/46/CE on

data protection in EU Member States Socio-economic research generally

involves processing of personal data Existence of rules specific to processing of

personal data for scientific and statistical purposes

Non-compliance with data protection requirements is sanctioned by law, including by criminal sanctions

2.1. The guidelines’ philosophy

Based on the Member States laws implementing the Directive 95/46/CE, to provide milestones to researchers in order to allow them to know what to do to comply with legal requirements

2.2. Scope of the guidelines

The guidelines focus on data protection issues strictly in the framework of scientific projects in the field of socio-economic research as defined for the purpose of the RESPECT project

2.2. Scope of the guidelines The existence of substantial

differences between the Member States’ data protection statutes

=> Guidelines focus on common concepts and principles standards with short description of existing differences

2.3. Content of the guidelines

Definition of key concepts and terms such as:

• Personal data, anonymous data, sensitive data

• Data subject

• Processing

• Purpose

• Controller and processor

2.3. Content of the guidelines

Recommendations regarding a socio-economic research project management with respect to data protection issues, for example:

=> Necessity to deal with data protection aspects of the project prior starting to process personal data

2.3. Content of the guidelines

Presentation of the legal requirements governing data protection for scientific and statistical purposes :

a.Comply with the conditions regarding the selection and use of the data

f.e. data must be collected and processed for specific purposes and must be necessary, adequate and proportionate with regard to these purposes

2.3. Content of the guidelines

b. Comply with the conditions regarding the legitimacy of the processing i.e. processing personal data corresponding to

social justifications enumerated by law such as with the consent of the data subject, processing in the public interest, legitimate interests not overridden by the data subject’s interests,…

c. Comply with the information duty towards the data subjects

i.e. provide the data subject with the information regarding the processing

2.3. Content of the guidelines

d. Comply with duties towards the National Data Protection Authorities f.e. notification of the required information

regarding the processing to be carried out

e. Respect the rights of the data subject i.e. rights of access, of rectification, of

oppostion and of retrieval of the consent to the processing

2.3. Content of the guidelines

f. Take technical and organizational measures ensuring the security and confidentiality of the personal data

g. Comply with requirements regarding re-use of personal data for other purposes than the initial purposes of collection

2.3. Content of the guidelines

R e -use o f pe rson a l d a ta

B y th e co n tro lle r B y a th ird p a rty

S e con d a ry U se

P rim a ry U se

2.3. Content of the guidelines

Conditions for re-use • Secondary processing admitted for

purposes compatible with initial purposes

• Specific exemptions provided for re-use for statistical and scientific purposes

2.3. Content of the guidelines

h. Comply with the conditions for communication of personal data to third parties or recipients

i. Comply with the conditions for the transfer of personal data to countries outside of the European Unioni.e. adequate protection requirement /

contractual commitment

3. Conclusions

Guidelines will be a useful tool to understand data protection requirements but will not replace national legal expert advice for critical questions because of differences existing : In the implementation of the Directive

95/46/CE legal requirements In the interpretation of the concepts

(personal data,…) In the application of the Member States

laws by National Data Protection Authorities

3. Conclusions

Differences between Member States legislations create obstacles to international exchange of personal data

f.i. differences in the conditions to process sensitive data may entail the impossibility to process them for a researcher established in one Member State while this is allowed for another researcher established in another Member State