SpainLOPDGDD Additional Provision 17(2), Pseudonymized Data in Health Research in Spain
In force since .
A de-identification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- If you use pseudonymized personal data in Spain for health research, and in particular biomedical research, keep the research team technically and functionally separate from whoever carries out the pseudonymization and holds the information that makes re-identification possible, under LOPDGDD additional provision 17(2)(d)1.
- Give the research team access to pseudonymized health research data in Spain only where it has expressly committed to confidentiality and to carrying out no re-identification activity, and specific security measures are in place to prevent re-identification and access by unauthorized third parties, under LOPDGDD additional provision 17(2)(d)2.
- Re-identify pseudonymized health research data at its source in Spain only where the research reveals a real and concrete danger to the safety or health of a person or group, a serious threat to their rights, or re-identification is necessary to guarantee adequate health care, under LOPDGDD additional provision 17(2)(d).
- If you process personal data in Spain for public health or biomedical research under the safeguards of General Data Protection Regulation (GDPR) Article 89, carry out an impact assessment that specifically covers the risks of re-identification linked to the anonymization or pseudonymization of the data, under LOPDGDD additional provision 17(2)(f)1.
- Obtain the prior report of the research ethics committee before using pseudonymized personal data in Spain for public health or biomedical research, or, where no committee exists, the prior report of the data protection officer or an expert, under LOPDGDD additional provision 17(2)(g).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
The provision states no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Additional provision 17(2)(d) of the LOPDGDD makes lawful the use of pseudonymized personal data for health research, and in particular biomedical research. Additional provision 17(2)(d)1 requires a technical and functional separation between the research team and whoever carries out the pseudonymization and keeps the information that makes re-identification possible.
The research team may be given access to the data only where it has expressly committed to confidentiality and to carrying out no re-identification activity, and specific security measures guard against re-identification and access by unauthorized third parties.
The data may be re-identified at its source where research on pseudonymized data reveals a real and concrete danger to the safety or health of a person or group, a serious threat to their rights, or where re-identification is necessary to guarantee adequate health care.
Where personal data is processed for public health or biomedical research under Article 89 of the General Data Protection Regulation (GDPR), additional provision 17(2)(f) requires an impact assessment that specifically covers the risks of re-identification linked to anonymization or pseudonymization. The use of pseudonymized personal data for public health or biomedical research must have the prior report of the research ethics committee or, where there is none, of the data protection officer or an expert.
When LexLint raises it
When your app profile says your app handles health records, processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .