The processing of particular data and scientific research: between a permissive GDPR and restrictive national legislation

The data processing in question is, in fact, legitimate pursuant to art. 9 GDPR, provided that adequate technical and organizational measures are adopted, including: information to the data subject; data minimization; security measures (e.g. pseudonymisation); adequate data retention period.

However, the Italian legislation - with a provision of 19/12/18 - has added to the above measures the deontological rules already issued in the past, which impose, among other things, the obligation of consent and a more limited retention.

Basically, the GDPR reduces the obligations of confidentiality in the case of scientific research, taking into account the usefulness of the personal data prevailing over the right of the data subject to confidentiality. On the contrary, there is a closing of the Italian national legislation to scientific research, with a consequent greater favour for the privacy of the data subjects and major prejudice to research investments.