Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
If a company is receiving anonymized x-ray images (for research purposes) from outside the EU (e.g. US), does the company have to treat the data as if it came from inside the EU?
In particular, does the company have to follow the strict requirements of Article 28 GDPR (requiring from th eprocessors a DPA, TOMs, data protection officer, and certification) when sending this data back to a processor in the US?
GDPR only applies to processing of personal data. Anonymized data no longer is personal data. A more important question is whether the data was anonymized in the sense of the GDPR. It would still be personal data if it was merely pseudonymized. The difference is whether a key exists that allows the data subjects to be reidentified.
If the medical data is personal data, it might fall under special categories of data where processing is restricted. Possibly, processing for the purpose of research would require consent. This is the kind of stuff where a company might want to ask their in-house counsel for advice, and may have to confer with their supervision authority.
GDPR does not consider the location or origin of personal data, except for controller → non-EU country data transfers. Receiving/collecting data from outside the EU has no additional restrictions and the same considerations apply as if the data was collected within the EU.
If the controller's processing is subject to the GDPR (e.g. because the controller is established in the EU and dealing with personal data) then yes, international transfers do require extra care.
