and to ensure our laws more accurately reflect people’s views about how they expect their data should be used and when they should actively give consent. 32.
A further source of ambiguity and potential confusion is the legislative design of our existing regime. The UK GDPR incorporates a large number of recitals that act as an explanatory or interpretative guide to the articles of the legislation. They offer information about the intended scope, purpose or effects of the law, which are valuable for understanding how it should operate in practice. The recitals do not, however, form part of the operative text in legal terms and their contents are not fully mirrored in the main body of the UK GDPR. Consequently, organisations may be reluctant to adopt an interpretation of the legislation that relies on a reading of the recitals that is not supported by an appropriately literal reading of the operative text, even if such an interpretation is likely to be in keeping with the intent of the law. To address this, the government proposes to transfer certain recitals into the articles of the legislation itself.
33.
Proposals to provide greater clarity in legislation will complement the ICO's ongoing work to offer guidance and support about how to apply the rules. This will help innovators achieve their goal of creating the next wave of ground-breaking data-enabled products and services in ways that preserve public trust.
1.2 Research Purposes 34.
The UK is ranked second in the world for science and research, and 54% of our output is worldleading. Personal data lies at the heart of a wide range of research activities across many sectors, spanning international networks of researchers. The sharing of scientific data with international partners helps to advance research in the UK and global capacity building in areas such as climate, biodiversity and health. 6
35.
The importance of personal data in research activities to our economy and wider society is reflected in the UK GDPR. The legislation provides specific allowances and derogations in relation to processing for archiving purposes in the public interest, scientific or historical research and statistical purposes (defined more generally in this chapter as 'research purposes'), which are designed to make it easier for researchers to: a. Re-use personal datasets for different research projects, subject to safeguards such as techniques that make it less easy to identify individuals from data sets (generically known as pseudonymisation techniques) 7 b. Retain personal datasets, and maintain their integrity and utility 8
36.
Both the UK GDPR and the Data Protection Act 2018 provide additional safeguards for research purposes to ensure that individuals’ rights are given a sufficient level of protection. These safeguards include: a. Article 89(1) UK GDPR, which provides that processing for research purposes shall be subject to appropriate safeguards, including technological and organisational techniques which may include pseudonymisation
6 European Academies, Science Advisory Council, ‘International Sharing of Personal Health Data for Research’, April 2021 7 Article 5(1)(b) and Article 89(1) UK GDPR 8 Article 5(1)(e) UK GDPR
12
