Skip to ContentSkip to Navigation
Research Research Data Management Data Protection & GDPR Re-use Data or Secondary Data

Previously collected data (‘secondary use’)

Page under construction

A current situation in research is the re-use of personal data. That includes, for instance, data collected in the context of previous research projects, data collected by companies for running their business activities or data publicly available (e.g. data on social media).

The use of previously collected data may raise issues concerning the transparency of the processing, the rights and expectations of the data subjects. For that reason, it is essential to assess whether consent is required and/or which information should be provided to the data subjects. Specific derogation for research purpose may apply.

Possible situations:

  • The data were collected on the basis of consent. In this case, the data can be re-used only for the purpose(s) covered by the consent. Further processing not covered would require obtaining new consent or a new legal basis.
  • The data were collected on the basis of another legal ground, such as legitimate interest or a contract. In that case, the data may be re-used only after checking that the new purpose is compatible with the original purpose (compatibility test).

If you are using data from social media networks you must also ensure that your intended use of the data complies with any terms and conditions published by the network.

Compatibility test

The European Commission indicates some elements that should be considered to assess the compatibility between two purposes:

  • the link between the original purpose and the new/upcoming purpose;
  • the context in which the data was collected;
  • the type and nature of the data;
  • the possible consequences of the intended further processing;
  • the existence of appropriate safeguards (such as encryption or pseudonymisation).

Last modified:30 April 2019 1.18 p.m.