Academic and Research Exceptions to GDPR- When do they apply?

2021-09-15

There are times when researchers may be able to make use of the exceptions to GDPR.  There are circumstances where your research may not need to comply with all of the obligations.  Examples of potential exemptions:

• The right to be informed
• The right of access
• The right of rectification
• The right to object
• The right to data portability
• Consent

These are not well understood, and as a result, exceptions are under-utilised.  One of the difficulties in giving general advice to GDPR exceptions, is that they differ from country to country, and decisions about exemptions are decided on a case-by-case basis by the relevant authority.  The data protection authority in the country where you are based will be able to provide specific guidance on these.   However generally, exemptions may apply in the following circumstances:

• Complying with the obligation would prevent or seriously impair the likelihood of you successfully achieving your purposes (if the purposes are public research or research in the public interest)
• The processing is not likely to cause damage or distress to an individual
• You continue to employ measures to protect that data e.g through data minimisation
• You carefully document the decision not to comply, specifically explaining the reasons

Generally, you do not apply in advance for an exemption under GDPR, instead you document the instance where it was not possible to comply in the event of an investigation.  For example:

Case Study

You are involved in an automated vehicle user trial on a public road.  The vehicle is fitted with cameras and it is expected that occasionally the cameras will pick up a member of the public (such as a cyclist, other vehicle or pedestrian) who is not part of the trial.  It is not practicable to stop every person who may be caught be the camera to request their permission to have their data processed, and it also may not be practicable to offer a ‘right to object’ to those people.  Consequently, you document the incidents of where the vehicle cameras picked up members of the public, and noting your obligations under GDPR, and why you were not able to comply (ie that it would have made collecting your data impossible).  However, you must also ensure that recording the data will not harm any of the subjects, and you must undertake organisational and technical measures to keep that data protected (such as employing data minimisation techniques).