Duty LXD-8308
Processes de-identified data, in Spain
LOPDGDD Article 72(1)(p), Deliberate Reversal of Anonymization in Spainsince 1 line
LOPDGDD, Ley Orgánica 3/2018, de 5 de diciembre, artículo 72.1.p) · Read the law's page
- Do not deliberately reverse an anonymization procedure so as to allow the people concerned to be re-identified; doing so is an infringement considered very serious under LOPDGDD Article 72(1)(p).
LOPDGDD Additional Provision 17(2), Pseudonymized Data in Health Research in Spainsince 5 lines
LOPDGDD, Ley Orgánica 3/2018, de 5 de diciembre, disposición adicional decimoséptima, apartado 2, letras d) a g) · Read the law's page
- If you use pseudonymized personal data in Spain for health research, and in particular biomedical research, keep the research team technically and functionally separate from whoever carries out the pseudonymization and holds the information that makes re-identification possible, under LOPDGDD additional provision 17(2)(d)1.
- Give the research team access to pseudonymized health research data in Spain only where it has expressly committed to confidentiality and to carrying out no re-identification activity, and specific security measures are in place to prevent re-identification and access by unauthorized third parties, under LOPDGDD additional provision 17(2)(d)2.
- Re-identify pseudonymized health research data at its source in Spain only where the research reveals a real and concrete danger to the safety or health of a person or group, a serious threat to their rights, or re-identification is necessary to guarantee adequate health care, under LOPDGDD additional provision 17(2)(d).
- If you process personal data in Spain for public health or biomedical research under the safeguards of GDPR Article 89, carry out an impact assessment that specifically covers the risks of re-identification linked to the anonymization or pseudonymization of the data, under LOPDGDD additional provision 17(2)(f)1.
- Obtain the prior report of the research ethics committee before using pseudonymized personal data in Spain for public health or biomedical research, or, where no committee exists, the prior report of the data protection officer or an expert, under LOPDGDD additional provision 17(2)(g).