Derogating from the rights of data subjects in the context of scientific or historical research or for statistical purposes
Chapter III of the General Data Protection Regulation provides for the rights of the data subject applied to the processing of personal data. The rights available to the data subject are determined by the basis for processing applied under the GDPR. Subject to certain conditions, it is possible to derogate from fulfilling these rights for the purposes of scientific or historical research or for statistical purposes if there is a valid basis for such derogation in the GDPR or Data Protection Act.
The rights of the data subject can be derogated from
- by virtue of section 31 of the Data Protection Act,
- by virtue of Articles 14, 17 and 21 of the GDPR, or
- by virtue of Article 11 of the GDPR.
Read more about the bases for processing personal data
Derogating from the rights of the data subject by virtue of section 31 of the Data Protection Act
The following rights of the data subject may be derogated from subject to the conditions provided for in section 31 of the Data Protection Act:
- Right of access to data
- Right to rectification
- Right to restriction of processing
- Right to object to the data processing
If the controller is processing special categories of personal data or personal data relating to criminal convictions and offences, the controller must conduct the impact assessment referred to in Article 35 o the GDPR or comply with the codes of conduct provided for in Article 40, in which due account has been taken of the derogation from the rights of the data subject.
- The contents of the impact assessment are provided for in Article 35(7) of the GDPR. The impact assessment must include a description of the envisaged processing operations and the purposes of the processing, an assessment of the necessity and proportionality of the processing operations, an assessment of the risks to the rights and freedoms of data subjects as well as measures envisaged to address the risks.
The Office of the Data Protection Ombudsman has drawn up a guide for conducting the impact assessment. The guide and tool can also be used to evaluate the comprehensiveness of an impact assessment already made.
Read more about carrying out an impact assessment
Data protection impact assessment guide (PDF, in Finnish)
Excel tool supporting the impact assessment (XLSX file, in Finnish)
-
You may derogate from the rights of the data subject on the basis of Section 31 of the Data Protection Act only when necessary. The grounds for the necessity of derogating from the rights of the data subject must be stated in the impact assessment. The controller must also ensure that the safeguards provided for in section 31 of the Data Protection Act are in place.
- If the controller transfers personal data to third countries, it should assess whether safeguards to supplement transfer tools are necessary.
Additional information is available from the following guideline of the EDPB: Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (PDF) (see especially paragraph 85).
Read more about the transfers of personal data to a third country
- The impact assessment must be delivered in writing to the Office of the Data Protection Ombudsman before the start of processing.
Our contact information
- Processing of personal data may be started even if the Office of the Data Protection Ombudsman has not yet responded to the submitted impact assessment.
- The impact assessment and other documentation required by accountability must be kept up to date and available to the Data Protection Ombudsman for the entire life cycle of the personal data processing.
Read more about accountability
Derogating from the rights of the data subject by virtue of Articles 14, 17 and 21 of the GDPR
The following rights of the data subject may be derogated from subject to the conditions provided for in Article 14(5)(b), Article 17(3)(d) and Article 21(6) of the GDPR:
- Right to obtain information on the processing of personal data
- Right to erasure
- Right to object to the data processing
If the rights of the data subject are derogated from solely by virtue of Article 14, 17 and/or 21 of the GDPR, there is no need to carry out and deliver an impact assessment as required in section 31 of the Data Protection Act. However, carrying out an impact assessment may be required under Article 35 of the GDPR.
Derogating from the rights of the data subject by virtue of Article 14 is included in the authority's list of processing operations which require an impact assessment. For example, an impact assessment is required if the processing is large in scale.
Derogating from the rights of the data subject by virtue of Article 11 of the GDPR
Article 11 of the GDPR provides for processing of personal data which does not require identification. The following rights of the data subject may be derogated from subject to the conditions laid down in the provision:
- Right of access to data
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to data portability
For a controller to be permitted to derogate from the rights, it must be able to demonstrate that it is not in a position to identify the data subject. As a rule, the rights of the data subject must be fulfilled if the data subject, for the purpose of exercising their rights, provides additional information enabling their identification.
If the rights of the data subject are derogated from solely by virtue of Article 11 of the GDPR, there is no need to carry out and deliver an impact assessment under section 31 of the Data Protection Act. However, carrying out an impact assessment may be required under Article 35 of the GDPR.
Informing data subjects about their rights
Data subjects must be informed of the rights available to them and of the restrictions on the exercise of their rights. The obligations for informing the data subjects cannot be derogated from by virtue of section 31 of the Data Protection Act. If the requirement of informing the data subjects is derogated from by virtue of Article 14(5)(b) of the GDPR, the information of the informing must be made publicly available, for example on the controller's website.
Read more about informing the data subject
More information:
Rights of the data subject in scientific research
Scientific research and data protection