GDPR in a scientific, transborder scenario
<p>Let us assume that a dental clinic, in a country that is <strong>not</strong> part of EU, is making dental x-rays for its patients, which may or may not be EU citizens. By the law of this country, the clinic is sole owner of these x-ray images. These images would be stored in something called DICOM format that, besides the image itself, contains metadata that uniquely identifies the patient. Now, let say that a researcher employed in this clinic conducts a research within clinic, with permission of legal dept. and ethics board of the clinic, such that through automatic processing of these images, the researcher derives some data from these images. As an example, let say that the result of the processing is a radiation dose received by the patient undergoing the procedure. So, all that is left from processing is a single number which <strong>cannot</strong> by reversed to identify patient. </p>

<p>The question is, can a researcher use these numbers, with the permission of ones employer, use these numbers in a master thesis submitted on a university within a EU country? If so, what are the obligations of the researcher?</p>

<p>The doses of radiation are not unique identifiers. Should those numbers be transferred to a controller established in the EU (and thus to whom the GDPR applies), that controller may not identify the natural persons to whom the dosage pertained, without correlating each dosage with information held by the non-EU lab. As such, it is not personal data and the activity does not fall within the scope of the GDPR.</p>

<p>In the event that one or more dosage figures were to be unique, and given that the dosage and the corresponding patient files from which it is possible to reliably recreate that figure were transferred to a controller established in the EU, and given that the original subjects were still alive, the unique dosage figure could be said to have made it possible to indirectly identify natural persons and would therefore be personal data within the scope of the GDPR. I find this unlikely and believe my first paragraph is still a complete answer.</p>

gdpr research