When complying with appropriate safeguards, the processing of personal data for scientifc research under the GDPR benefts from a special regime which is of interest for biobank research. On the one hand, under this condition, the further processing of personal data will not be incompatible with the initial purposes for which the data were originally collected and processed and it allows for retaining data for longer periods of time for scientifc research. Complying with this condition is a condition to lift the prohibition to process special categories of personal data in the context of scientifc research. On the other hand, complying with this condition makes it possible to derogate to some extent to several data subjects’ rights such as the right of access, the right to rectifcation, the right to the restriction of processing and the right to object to the processing.
Possible safeguards range from specifc procedures to support the exercise of data subjects’ rights to the use of anonymous data or (where necessary) of pseudonymised data, the appointment of a data protection offcer, enforcing a procedure to ensure a feedback to data subjects on the results of the research, requiring specifc professional accreditations, creating a specifc supervisory body for the biobank research, or the creation of a specifc Code of conduct for biobank research activities.
This double regime under the GDPR is fnally compared with the 2009 OECD Guidelines in biobanks and genetic research databases.