Ten takeaways from the EDPB's draft guidelines on scientific research

I have now waded through all 66 pages of the European Data Protection Board’s draft guidelines on scientific research, and here’s a brief(?) download:

1. The EDPB proposes six key indicators for what constitutes “scientific research”:
   • a methodological and systematic approach, e.g. following a comprehensive research plan;
   • adherence to ethical standards;
   • verifiability & transparency (i.e. allowing peer review);
   • autonomy & independence for the research team, e.g. to define their own research questions;
   • the aim of the research is to contribute to the growth of society’s general knowledge & well-being; and
   • the activities have the potential to contribute to existing scientific knowledge or apply it in novel ways. You don’t have to meet all the factors – but the fewer you hit, the harder it will be to claim your activity is scientific research.
      
2. The guidance is clear that scientific research can be for-profit and on a commercial basis.
    
3. There’s nothing on technological development. Which is a big gap, IMHO, given that “product development” (especially medtech) is where a lot of the uncertainty lies.
    
4. There’s a surprising emphasis on consent, with not much concern about the “freely given” element for patients needing medical treatment. This is something of a departure from their position in the 2019 guidance on clinical trials.
    
5. The guidance introduces helpful concept of a “broad consent” (i.e. covering broad research purposes) and a “dynamic consent” (i.e. that can change over time).
    
6. The guidelines confirm that scientific research is a legitimate interest, and can be of “significant weight” in the balancing test. Which is definitely good news for those of us who are still nervous relying on consent (not least because it can be withdrawn).
    
7. The EDPB go big on ongoing transparency as the research evolves. They even suggest controllers should make reasonable efforts to acquire contact details for participants, if they don’t have them already. This seems somewhat at odds with Art 11 GDPR.
    
8. However, there is some helpful stuff on “disproportionate effort” in Art 14, where controllers are allowed to take into account: (1) a high number of data subjects; (2) difficulties finding contact details; and (3) the age of the personal data (e.g. if it is 10+ years old).
    
9. Erasure requests must be assessed based on the individual circumstances of each request – so no blanket refusals.
    
10. Joint controllers: the fact that an organisation provides funding or is “consulted” in drafting a research protocol is not alone sufficient to make it a joint controller. But later in the guidance “participating jointly in the drafting of the research protocol” could well be.

There’s more to say, but I’m going to leave it there. But would be interested in others' thoughts!