DPA case 07120-1/2020/358 – Violation Found (Slovenia, 2020)

The NIJZ, using its Infectious Diseases Register, contacted 48 individuals who had survived COIVD-19. The NIJZ contacted these individuals to invite them to visit the Institute of Transfusion Medicine (ZTM), who were investigating the treatment of critically ill COVID-19 patients and needed the blood of individuals who had survived the disease in order to conduct its research. Under GDPR rules, can the NIJZ use the data in its Infectious Diseases Register to invite data subjects to participate in another body’s treatments and give that body their health data? The IP said that the NIJZ was allowed to use the data it had to invite patients to participate in the ZTM's research and data collection. To illustrate how the GDPR could be applied to allow the NIJZ data to be used in this way, the IP cited examples from Article 9(2) GDPR, which lists the exceptions to the prohibition of processing special categories of data. The examples used were the following: • Article 9(2)(c), where the patient is physically incapable of giving consent because they are seriously ill, and processing is necessary prevent further deterioration of health; • Article 9(2)(h), where research involving persons who have survived COVID-19 patients is necessary for providing healthcare; • Article 9(2)(j), which permits processing for scientific research purposes related to treatments. For the secondary processing of the patients’ contact details, the IP suggested that under Article 6(4) GDPR, the NIJZ would be permitted to do so because of the link between the purpose of the initial collecting of the data (the keeping of infectious disease records) and the purposes of the intended further processing (the monitoring of infectious diseases and their characteristics). The IP also noted that further processing for scientific research purposes is permitted under Article 5(1)(b) GDPR, and recalled that Recital 159 GDPR provides that “the processing of personal data for scientific research purpos