Scientific research Guidelines: challenging the EDPB interpretation

EDPB excluding R&D & product development from “scientific research” under the GDPR? “The results of the research are shared with other parties, for example by publication, or will be shared in the future, with due regard to legitimate limitations to access such as protection of intellectual property and trade secrets.
(Newly published Guidelines 1/2026 on processing of personal data for scientific research purposes, version for public consultation – https://lnkd.in/e2kQPvHE )

But that is just a portion of scientific research, and the EDPB quote goes further than the European Code of Conduct for Research Integrity to which they refer in support of their text. The ECCRI states that researchers “respect confidentiality of data or findings when legitimately required to do so”. So the findings themselves – the results – can be kept confidential, and not just because of trade secret justifications.

Next: “The research activities are carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing”, with a footnote specifying that to assess this, “controllers should consider reviews of the scientific merit of their research projects that, for example, can have been undertaken by independent review bodies”.

=> Difficult to assess in many fields, and this is one point that is not even present in the ECCRI (which the EDPB quotes everywhere else but not here).

The EDPB does specify that “If the research activities do not meet all factors, the controller needs to justify and be able to demonstrate why the activities should nonetheless be considered scientific research, within the meaning of the GDPR”, leaving a door open to justification that something *is* scientific research, but it’s definitely going to be an uphill battle if an organisation is required to demonstrate this.

Yet it is the counterexample given by the EDPB – sales data analysis to gain insights into customer categories, purchases and frequency – that exposes the fundamental question regarding the EDPB’s new Guidelines.

After all, “scientific research” doesn’t exist in isolation in the GDPR: Art. 5(1)(b) GDPR states regarding compatibility of purposes that “further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes”. “Statistical purposes” – next to scientific research purposes. Same in *every* GDPR Article featuring the word “scientific”, including Art. 89(1).

So perhaps these Guidelines will serve as an invitation to push R&D under “statistical purposes” rather than “scientific […] research purposes”, thus enabling the sales data analysis example under another label? (provided transparency/etc. Data protection obligations are met, of course)

I’m continuing my reading. But check out Dr M.R. (Mark) Leiser’s post on “scientific research” too: https://lnkd.in/em_TtvZt