Transferring research data abroad
Can we transfer personal data processed for research purposes abroad?
The GDPR prohibits the transfer of personal data to countries outside of the EEA unless they offer an “adequate level of protection” as determined by the European Commission. A controller also may transfer personal data to a third country if it has implemented specific safeguards, including Binding Corporate Rules and standard contractual clauses, or if the data subject has provided explicit consent after being informed of the risks related to the transfer.
In the absence of any of the above measures, the GDPR introduces a new basis for transferring data which is particularly relevant for researchers and did not exist under the old data protection regime. Under the GDPR, a controller may transfer data to a third country when “necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject.” Recital 113 makes clear that “the legitimate expectations of society for an increase of knowledge” should be taken into account when determining whether a “compelling legitimate interest” exists. It is not entirely clear here whether a hybrid body such as the College (i.e. both a public authority for some functions and a private body for others) can take advantage of this basis when involved in research that is in the public interest. So, specific legal advice should be taken on this point if it arises.
To make use of this transfer mechanism researchers must meet stringent requirements. The transfer may be based on this ground only if it is not repetitive, it concerns a limited number of data subjects, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis on that assessment provided suitable safeguards. Moreover, the controller must inform the data subject as well as the data protection authority of the relevant member state of the international transfer. So, this makes this basis for international transfer very unattractive.
Due to the onerous nature of these requirements researchers may find the other bases for transfer more convenient.