Personal data processing in science is subject to Act No. 101/2000 Coll., on the Protection of Personal Data and on Amendments to Some Related Acts, as amended (hereinafter the “Personal Data Protection Act”). Article 15 of the Charter of Fundamental Rights and Freedoms guarantees the freedom of scientific research; nevertheless, a natural limitation of this right follows from the rights related to personal data protection which are also based on the Charter of Fundamental Rights and Freedoms (Art. 10 and Art. 17) and which are expressed by the Personal Data Protection Act.
A fundamental issue is related to determining and assessing the purpose of processing (see Article 5 (1) of the Personal Data Protection Act). Scientific activities as such constitute a fully legitimate purpose. Therefore, it must be determined whether the activity declared by the controller, in the framework of which personal data are to be processed, complies with the term "science" or "scientific".
With respect to the definition contained in Article 2 of Act No. 130/2002 Coll., to Regulate Support for Research and Development Funded from Public Funds and to Amend Some Associated Legislation (Act on Support for Research and Development), as amended, it can be stated that science means a systematic creative activity extending human knowledge. This activity, which is aimed at obtaining a certain finding, may be concerned with various areas (such as technology, nature, society, etc.) and may concentrate either at basic research or at applied research. There are also certain substantive limitations of research activities, which are more or less moral, consisting in prohibitions of use of the results of such research. This includes, e.g. the aspects of genetic engineering or development of weapon systems, etc.
Thus, the scientific purpose(s) can be determined, for the purposes of application of the Personal Data Protection Act, on the basis of analysis of available documentation of the relevant personal data processing or the entire scientific task, with emphasis on occurrence of certain features:
1. Existence of the terms of reference or a plan for the relevant task, which has the aspects of scientific research: an unambiguously formulated scientific hypothesis has been declared and the methods of verification of the hypothesis are specified; the words “terms of reference” express an externally specified plan, usually as a task that is to be fulfilled by a person other than the person formulating the task (university, scientific institution, provider of a subsidy or some other public support) or a similarly characterized offer.
It can be stated that a research task could consist in development of a new medical substance, provided that this activity entails obtaining of a finding on effects of a chemical substance on a living organism; however, it cannot consist in acquisition of a database of natural persons serving for sale of a new product.
2. A qualified person is the entity carrying out the processing or a more broadly defined activity including processing of personal data. A qualified person is a person who meets a certain formal precondition (legal status which ensures qualification for scientific activities) or publicly or otherwise formally recognized scientific or research experience (“non-official” qualification). Qualified persons include, without limitation, public research institutions established pursuant to Act No. 341/2005 Coll., on Public Research Institutions.
A qualification precondition shall be considered to be met if the condition described in paragraph 1 above is satisfied and if an institutional supervisor is appointed for the person performing the task, where the supervisor himself meets the conditions for formal qualification (e.g. trainer, head of a scientific team).
Both aspects must be determined and verified in the above order. If the result is positive, the purpose of personal data processing shall be accepted as a scientific purpose. A qualified person may be the exclusive originator of a scientific task.
When determining the parameters of a scientific purpose of personal data processing, the following aspects may be used as additional criteria:
- an activity which only formally meets the condition referred to in paragraph 1 above is being performed on an institutional basis (as an approved project, e.g. pursuant to Act No. 130/2002 Coll.);
- information has been published on scientific (research) institutional activities with an identical aim; identical aim means identity or close similarity of contents, as well as identity or close similarity of the instruments, where the relevant plan need not exhibit both characteristics at the same time. Another precondition that must be met in this case consists in publication in a corresponding form, i.e. as a scientific publication, consisting in a publication of assessed works in the name of an institutional scientist or researcher, who is almost always a legal person.
It follows from this fact that, e.g., a direct-marketing company, whose employees cannot prove any research activities on their behalf, including cooperation with scientific workplaces, is not likely to meet these preconditions1).
3. Another principle, which must be simultaneously employed, consists in appropriateness of the procedures to the declared purpose of research, which is also fully concerned with the subject of personal data processing. The principle is derived from Article 2 of the Convention on Human Rights and Biomedicine, according to which the interests and welfare of the human being shall prevail over the sole interest of society or science. Procedures, in which human dignity would be lessened, are inadmissible. Indeed, this principle is fully guaranteed by Article 10 of Act No. 101/2000 Coll.
The aspect of appropriateness must also be evaluated from the viewpoint of other provisions of the Personal Data Protection Act. It must be determined or ascertained whether and to what degree personal data processing is necessary, how will its accuracy be ensured, and whether and when the data should be rendered anonymous. The objective of science is to obtain a certain finding, i.e. generalization, and personal data cannot be the result of research. Personal data may only be a means used to obtain a finding.
Science is characterized by dissemination of findings; nevertheless, it is generally not admissible to publish full identification data of natural persons (addresses, contact details) with whom the scientific work is or was concerned. Other data (e.g. state of health of historic persons) shall be managed with respect to verifiability of the results of research and, at the same time, to the rights of individuals and duties in personal data processing pursuant to the Personal Data Protection Act and pursuant to other laws. The working procedures employed in a project or task must correspond to these requirements. The scientific purpose of personal data processing is determined independently of the Personal Data Protection Act. A decision on the applicable duties in personal data processing is usually made in the phase of formulation of research plans and in preparation of the draft research and development projects. The controller should be aware of this fact and evaluate and determine the parameters of fulfillment of duties in personal data processing with the same care as the actual scientific aspects in a narrower sense.
The Personal Data Protection Act does not stipulate any special regime for scientific activities. From the viewpoint of ascertaining the legal title for personal data processing, preference must be given to informed consent of the data subject. Certain deviations or modifications can be found in relation to testing of medical substances (see Position of the Office No. 3/2004).
The Personal Data Protection Act contains two special provisions concerning science. Both these provisions are bound on scientific purposes of personal data processing; they are not primarily concerned with any qualification or other preconditions and terms applicable to the controller or processor. An exemption from the duty to keep personal data only for a period necessary for the purpose of their processing applies in cases where personal data are processed or are to be processed for scientific purposes only secondarily; i.e. they were obtained for some other purpose. Under certain circumstances, additional or secondary personal data processing for scientific purposes is subject to an exemption from the information duty pursuant to Article 11 (1) of the Personal Data Protection Act. This exemption shall not apply to a controller who has obtained personal data directly from the data subjects. It also does not apply to a person who intends to process personal data for a newly formulated scientific purpose and has obtained or obtains personal data from a source other than the data subject, as the interested person, and the provision of information to the data subject pursuant to Article 11 (1) is within the scope corresponding to the circumstances and terms of the research or other scientific task or project and, not requiring inappropriate efforts or inappropriate costs.
An exemption from the information duty also applies to controllers and processors, as appropriate, who use a public source to obtain personal data that are to be processed for scientific purposes, under the conditions stipulated by other regulations (see particularly Act No. 499/2004 Coll., on archives and the filing service and on amendment to some laws).
All duties following from the Personal Data Protection Act also apply in situations provided for in special laws, if appropriate. This is clearly documented by the aspect of birth numbers. This personal data, as a theoretically unique general identifier, can be easily processed in automated systems and is popular particularly at the stage of collecting empiric data. Decision-making on its use must include assessment of the need for the specified purpose of the actual specific collection or further processing of personal data, rather than the purpose of the research project. The research project must deal, expressly if possible, with the requirement for rendering the maintained personal data anonymous pursuant to Article 5 (1) (e) of the Personal Data Protection Act. A birth number cannot be rendered anonymous; therefore, the birth identification number must be deleted. Simultaneously, it is necessary to fulfill the conditions pursuant to Act No. 133/2000 Coll., on Register of Population and Birth Numbers and on Amendments of Certain Acts, as amended; i.e., in accordance with Article 13 (7) of the Act, it is usually necessary to obtain informed consent of the data subject, as also stipulated in Article 13(c) (1) of the Act and in Article 5 (2) and (4) of the Personal Data Protection Act.
The Office does not recommend that birth numbers be used in processing of sensitive data for research purposes with the consent of the data subject pursuant to Article 9 (a) of the Personal Data Protection Act. Processing of birth numbers for scientific purposes in connection with any sensitive data requires that one of the conditions stipulated in further provisions of Article 9 of the Personal Data Protection Act be met.
1) Excluding cooperation with a scientific institution.
Mode No graphics is currently switched on. Therefore you see the web page with no decorative graphics as well as any advanced formatting. If your browser supports CSS2, you can switch a graphic mode on.