Source: https://gdpr-expert.com/article.html?mid=6&id=89
Timestamp: 2020-04-03 17:14:03
Document Index: 772417895

Matched Legal Cases: ['§ 2', '§ 2', '§ 38', '§ 2', '§ 2', '§ 13', '§ 367']

Lex specialis for data processing by scientific institutions within the meaning of § 2b No 12 FOG (Federal Act on Research Organisations- "Forschungsorganisationsgesetz")
(2) [...] For the purpose of the FOG, in particular based on Article 9 para 2 lit g, i and j GDPR, scientific institutions ( § 2b No 12 FOG) may
process all personal data in any case, especially in the context of Big data, personalized medicine, biomedical research, biobanks and the transmission to other scientific institutions and Processors, if (a) instead of the name, bPK or other unique identifiers are used for identification; or (b) the processing takes place in a pseudonymised form (Article 4 No 5 GDPR); or (c) publications/ disclosure to the public are made (aa) not at all; (bb) only in an anonymous or pseudonymous form; or (cc) without name, home address or photo; or (d) the processing is done exclusively for the purpose of anonymization or pseudonymisation and there is no disclosure of personal data directly to third parties (Article 4 No 10 GDPR);
obtain from controllers, which are keeping statutory registers – except for registers kept by jurisdiction, lawyers and notaries within their statutory field of action and criminal records as well as – regarding ELGA ( Electronic health record) – from the ELGA ombudsman service, (personal) data from those registers , whereas the name must be replaced by bPKs, unless the name is necessary for the accomplishment of purposes according to Article 89 (1) GDPR, in electronic format within the time mentioned in Article 12 (3) GDPR and against appropriate remuneration if (a) the processing serves only purposes of life and social sciences; (b) the register is listed in an ordinance according to § 38b FOG [Ordinance by the Minister of Education, Science and Research listing all the registers that are open for “registry research”]; (c) the applicant is a scientific institution listed in § 2c (1) FOG or was explicitly entitled to use specific bPKs by the Minister of Transport, Innovation and Technology by notice in accordance with § 2c (2) FOG; (d) the costs of the data provision are reimbursed; and (e) in case the application includes the matching with available data, the application for data provision provides the specific bPKs according to § 13 (2) E-GovG of the data subjects.
(1) For the purpose of scientific or statistical research projects whose goal is not to obtain results in a form relating to specific data subjects, the controller shall have the right to use all data that
1. are accessible in public or
2. he has lawfully collected for other research projects or other purposes or
3. are only indirectly personal for him/her.
Other data shall only be used under the conditions specified in para. 2 sub-paras. 1 to 3.
(2) In case of the use of data for purposes of scientific research or statistics that do not fall under para. 1 shall be used only
1. pursuant to specific legal provisions or
2. with the consent of the data subject or
3. with a permit of the Data Protection Authority pursuant to para. 3.
(3) A permit of the Data Protection Authority for the use of data for purposes of scientific research or statistics shall be granted upon request of the controller ordering the research project, if
1. the consent of the data subjects is impossible to obtain because they cannot be reached or the effort would otherwise be unreasonable and
2. there is a public interest in the use of data for which a permit is sought and
3. the professional aptitude of the applicant has satisfactorily been demonstrated.
If sensitive data are to be collected an important public interest in the research must exist; furthermore, it must be ensured that the data at the controller ordering the research project the data shall only be used by persons who are subject to a statutory duty to confidentiality or whose reliability in this respect is otherwise credible. The Data Protection Authority may issue its permit subject to terms and conditions insofar as this is necessary to safeguard the data subjects’ interests deserving protection, in particular, with regard to the use of sensitive data.
(3a) An application according to para. 3 must, however, be accompanied by a statement signed by the person authorized to dispose of the collection of information from which the data shall be collected or by another authorized person that he/she makes available the collection of information for the research. Such statement may be replaced by a writ of execution (§ 367 para. 1 Foreclosure Act, RGBl. No. 79/1896) replacing such statement.
(4) Legal restrictions on the right to make use of data for other reasons, in particular copyright, shall not be affected.