Preservation for research purposes
According to Article 10.1 of the DPA, personal data shall not be kept in a form which allows the data subject to be identified for any longer than is necessary for achieving the purposes for which they were collected or processed.
However, personal data may be kept longer for historical, statistical or scientific purposes, and where the data controller has made the necessary arrangements to ensure that the data concerned are used solely for these specific purposes (cf. Article 10.2).
It does not matter in this case whether the data was originally collected for the said historical, scientific or statistical purpose, as long as safeguards are taken to ensure that the data are stored (and reused) exclusively for research purposes (Ministry of Justice, Guidelines for Personal Data Processors 2001:40).
The Code of Conduct for Health Research states that data exempted from consent (cf. Exemption from consent) may be stored for a longer period than necessary for the relevant investigation, provided that it is reasonable to expect that they may be needed later for research. Further, the storing must be in accordance with the following “special measures for the use of directly identifying personal data” (cf. chapter 7 of The Code of Conduct for Health Research):
· In the course of processing directly identifying personal data, a distinction should be made insofar as possible between a database of communication data for the one involved and a database of research data. Coupling between the two occurs by means of a meaningless administration number.
· The regulations for access and the possibilities for processing the communication data and the research data should differ. For this purpose, adequate safety measures must be taken.
· If no distinction is made between communication data and research data, then the data must be destroyed as soon as reasonably can be predicted that it will no longer be need for this investigation.
· If a communication file has been created, then this file should be removed as soon as it is no longer needed for this investigation. What then is left over for the researcher is a database without directly identifying data. This may only be stored for as long as can reasonably be predicted that it will be needed for a health research project.
· If directly identifying personal data are processed, the data subject has the right to access, the right to correction and the right to block or remove data which are directly related to him.
Ministry of Justice, 2001. Guidelines for Personal Data Processors (Personal Data Protection Act) [pdf]. Available at: <http://www.privacy.nl/uploads/guide_for_controller_ministry_justice.pdf>. [Accessed 22 August 2014].
The Council of the Federation of Medical Scientific Societies: Code of Conduct for Medical Research, 2004 [pdf]. Available at: <http://www.federa.org/sites/default/files/bijlagen/coreon/code_of_conduc... [Accessed 22 August 2014].
The Dutch Personal Data Act, 2000 [online] Available at:
<http://www.dutchdpa.nl/Pages/en_wetten_wbp.aspx> [Accessed 22 August 2014].