1.3 Further Processing

The government welcomes views on the following questions:

Q1.2.10. To what extent do you agree with the proposals to disapply the current requirement for controllers who collected personal data directly from the data subject to provide further information to the data subject prior to any further processing, but only where that further processing is for a research purpose and it where it would require a disproportionate effort to do so? ○ Strongly agree ○ Somewhat agree ○ Neither agree nor disagree ○ Somewhat disagree ○ Strongly disagree

Please explain your answer, and provide supporting evidence where possible.

Q1.2.11. What, if any, additional safeguards should be considered as part of this exemption?

1.3 Further Processing

51. Re-use (also known as 'further processing') of personal data can provide economic and societal benefits through facilitating innovation. Clarity on when data can lawfully be reused is important: data subjects benefit from transparency, data controllers benefit from certainty, and society benefits from unlocking the opportunities of re-use.

52. The UK GDPR states that personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. In recognition of the value of re-use of data in certain circumstances, the UK GDPR sets out rules for when further processing of personal data is considered compatible with the purpose for which it was collected. Article 5(1)(b) of the UK GDPR states that, subject to safeguards, further processing of personal data for scientific or historical research purposes shall ’not be considered to be incompatible with the initial purposes’.

53. The broader conditions for determining compatibility of purposes for further processing personal data are set out in Article 6(4) of the UK GDPR:

a. Any link between the purposes for which the personal data have been collected and the purposes of the intended further processing

b. The context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller

c. The nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9 of the UK GDPR, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10 of the UK GDPR

d. The possible consequences of the intended further processing for data subjects

e. The existence of appropriate safeguards, which may include encryption or pseudonymisation

54. These conditions amount to a compatibility test for data controllers. There is a risk of uncertainty about how to interpret these rules. The government has identified three key areas of uncertainty. In each area, there may be benefits to improving clarity and thereby facilitating innovative re-use of data. However, there will also be challenges to ensure re-use remains fair and within reasonable expectations.

a. When personal data may be re-used for a purpose different from that for which it was collected. Personal data must be collected for a specific purpose. If a controller then seeks to re-use the data for a new purpose, the UK GDPR distinguishes between purposes that are compatible with the original one and those that are incompatible. The recitals to the UK GDPR support Article 6(4) in setting out the factors to consider when determining compatible processing operations. The recitals also suggest that further processing should be permitted in some circumstances regardless of the compatibility of the purposes, and Article 6(4) seems to attempt to reflect this but its wording lacks clarity.

The government proposes to clarify that further processing for an incompatible purpose may be permitted when it safeguards an important public interest.

b. When personal data may be re-used by a different controller than the original controller who collected the data, and whether this constitutes further processing. Innovative data uses may involve sharing personal data sets between different controllers. Organisations seeking to process personal data for incompatible purposes, or historical, scientific, or statistical research purposes, may not be certain that they can do so lawfully if they are not the original controller. The government is considering whether it would be useful

to clarify the circumstances, if any, in which further processing can be undertaken by a controller different from the original controller, while ensuring fairness and transparency.

c. When further processing is taking place, and whether the original lawful ground may be relied on, when personal data is re-used. When the new purposes for processing are compatible with the original purpose, the recitals suggest that the original lawful ground for processing may still be relied on for the further processing. However, it is not always sufficiently clear what constitutes further processing and if this applies in all circumstances. For instance, when the purposes are incompatible as in section (a) above, controllers may face uncertainty about whether their new purposes constitute further processing and what their lawful ground is. The government considers that a

clarification in law may be helpful to confirm that further processing may be permitted, whether it is compatible or incompatible, when it is based on a law that safeguards an important public interest.

The government welcomes views on the following questions:

Q1.3.1. To what extent do you agree that the provisions in Article 6(4) of the UK GDPR on further processing can cause confusion when determining what is lawful, including on the application of the elements in the compatibility test? ○ Strongly agree ○ Somewhat agree ○ Neither agree nor disagree ○ Somewhat disagree ○ Strongly disagree

Please explain your answer, and provide supporting evidence where possible.

Q1.3.2. To what extent do you agree that the government should seek to clarify in the legislative text itself that further processing may be lawful when it is a) compatible or b) incompatible but based on a law that safeguards an important public interest? ○ Strongly agree ○ Somewhat agree ○ Neither agree nor disagree ○ Somewhat disagree ○ Strongly disagree

Please explain your answer and provide supporting evidence where possible, including on: ○ What risks and benefits you envisage ○ What limitations or safeguards should be considered

Q1.3.3. To what extent do you agree that the government should seek to clarify when further processing can be undertaken by a controller different from the original controller? ○ Strongly agree ○ Somewhat agree ○ Neither agree nor disagree ○ Somewhat disagree ○ Strongly disagree

Please explain your answer and provide supporting evidence where possible, including on: ○ How you envisage clarifying when further processing can take place ○ How you envisage clarifying the distinction between further processing and new processing ○ What risks and benefits you envisage ○ What limitations or safeguards should be considered

Q1.3.4 To what extent do you agree that the government should seek to clarify when further processing may occur, when the original lawful ground was consent? ○ Strongly agree ○ Somewhat agree ○ Neither agree nor disagree ○ Somewhat disagree ○ Strongly disagree

Please explain your answer and provide supporting evidence where possible, including on: ○ How you envisage clarifying when further processing can take place