← back to the act's dossier

GDPR — Article 89

The article's text

Article 89 Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes 1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. 2. Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referr
full text
ed to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. 3. Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. 4. Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs.

Who wrote about this article in the consultations

Filers who named this exact article number in their own text. It is their sentence, not our reading — and not a causal claim.

8
business association
3
NGO
2
other
2
ACADEMIC_RESEARCH_INSTITTUTION
2
company
WhoCountryWhat they wrote
European Centre for Certification and Privacy (ECCP)LUrmitting the processing of health data for “scientific or historical research purposes or statistical purposes in accordance with Article 89 (1) GDPR based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the ↗
University of PadovaITe basi giuridiche, come il consenso; b) esplicite deroghe, a determinate condizioni, all’esercizio dei diritti degli interessati (art. 89, par. 2) c) possibilità di riutilizzo (o secondary use) e conservazione a fini di ricerca scientifica di dati personali ra ↗
Information Accountability FoundationUScle 5(1)(b) GDPR contains an important provision that further processing for the purposes scientific research, in accordance with Article 89, is “not be considered to be incompatible with the initial purposes”. In practice, organisations undertaking research i ↗
State Archives of BelgiumBEll data without reflections on the potential value of such data from an archival perspective. • Archiving in the public interest: Article 89 GDPR is of great importance for the Belgian State Archives as it forms the basis for the Belgian implementing legislati ↗
German Insurance AssociationDEry for the development and testing of new IT applications, products, and systems. Safeguards could be provided along the lines of Art. 89 GDPR. The interpretation of Art. 6 (1) b GDPR in the Guidelines 2/2019 hamper digitalization because their understanding o ↗
European Blood Alliance (EBA)NLto process that same data lawfully, (in accordance with either Article 9(2)(h) or 9(2)(j)) which in turn permits compliance with Article 89(1). Using the legislation in this specific way facilitates overall compliance with Data Protection principles, in parti ↗
Anonos Inc.USnot have to be communicated to the data subject under Article 34. • Enable Benefits of Expanded Lawful Processing a. Article 89(1) provides that “[p]rocessing for archiving purposes in the public interest, scientific or historical research purposes or statisti ↗
ESOMARNLon the European Commission to clarify the application of Article 89 and the requirements under which it can applied. Different national interpretation While the GDPR aims to harmonise the data protection framework in the EU Members States, its enforcement rema ↗
International Society for Biological and Environmental Repositories (ISBER)USentific or historical research purposes or statistical research purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriousl ↗
Multi-Regional Clinical Trials Center of Harvard University and Brigham and Women’s HospitalUS(Article 9(2)(i)) or processing for scientific research purposes in accordance with Article 89(1) (Article 9(2)(j)). The EDPB also notes that the “legitimate interest” basis under Article 6(1)(f) may be available “where the conduct of clinical trials cannot be ↗
—it is done “pseudonymisation” would improve the reading of the GDPR and help to avoid rather clumsy formulations like the end of Article 89 § 1: “Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. ↗
COCIRBEpplied in other Member States (e.g. Germany). This is very challenging for businesses operating in these different Member States (Art. 89.2 GDPR). Next to that we have also seen diverging views across Member States on the processing activities that should be s ↗
BSA | The Software AllianceBEthe application of additional GDPR provisions, to which Member States can add specific conditions under Article 89. This situation has highlighted the need for a harmonized approach to data protection, as companies and public authorities use data in connection ↗
Pinsent MasonsIEntrollers and processors. 2.12 Corrigendum There are several drafting inconsistencies in the GDPR, such as between Article 17 and Article 89. ↗
Secretariat of COMECE (Commission of the Episcopates of the European Union)BErotection of personal data. Joint DPOs have been appointed where needed. 8. Historical (research) purposes and archiving purposes Article 89 GDPR (and other provisions in the Regulation) refer to "historical research purposes", using a more limited expression ↗
Americans For Tax Reform FoundationUSing various sets of information in inventive ways has resulted in some of the most important recent scientific advances. However, Article 89 on the processing of personal data for research purposes by the private sector reveals additional risks to data users. ↗
ACT | The App AssociationBE0companies/MGI- Artificial-Intelligence-Discussion-paper.ashx. be taken to resolve wide divergences in the implementation of GDPR Article 89 by DPAs, some of which far too narrowly interpret the meaning of scientific research. In these cases, and generally, DP ↗
Österreichische BundesarbeitskammerATt für kommerzielle bzw wissenschaftliche Zwecke weiternutzen zu können. • Die Öffnungsklausel Wissenschaft, Forschung, Statistik (Art 89) ist zu weitreichend. Es braucht sektorspezifischen Datenschutz, damit Trends wie Big Data-Anwendungen, Entscheidungen durc ↗
EFAMROBEaration. o Germany and the Netherlands: traditionally consider market, opinion and social research as falling within the scope of art 89 GDPR o More generally, the case of health research in the context of art 9(4) – art 89 – and the secondary use of data. The ↗
Information Technology Industry CouncilBEpurposes: In light of the GDPR’s risk–based approach, we believe it is important to further explore possibilities mentioned under Article 89 on how the GDPR applies to processing of personal data for research purposes by the private sector. The GDPR assumes a ↗

Source: public consultation submissions and position papers. n = 20 mentions; counted as a literal reference to the article number.

Ask about this article →