GDPR question about processing personal data for research purposes that yield aggregated results

Question

So my thesis proposal is about predicting mortality rates. I will work with a company (insuretech) that already has database of 2m+ people with death dates (if dead), birth date, transaction volume (money), and which collective insurance this person have (out of 4 possible).

Now, I'm will use machine learning to predict mortality rate of, for example, a group of people that are X years old, male and has insurance A. So the overall published results are very aggregated (For example: 40% of all 90 year old males will die this year, according to my predictions).

I will never ever publish the data of ANY individual, all the machine learning and data processing will be done in house of the company, locally on their computers. I also only have clearance to anonymised data (pseudo addresses and names).

This will be my research paper at my university, done together with a company for academic purposes as well as for the interests of the company.

So to sum this up:

1. Personal data will be used, it was already legally obtained as it's necessary information for my host company (insuretech).
2. The results are not targeted to any of the individuals from the database, but only aggregated statistical results are published regarding groups of people.
3. No data that can identify anyone is published whatsoever. Again, only aggregated results from personal data will be presented.
4. I will take precautions to process the data in a safe environment
5. This will be a published paper

Is this ok within the scope of GDPR?

Answer 1

Let me start by saying based on your posted information it is a breach of GDPR.

Well, do not take this wrong, yet to answer your question I have to play the "devil's advocate" role.

1st, machine learning = automated processing (meaning the Data Subject must be informed and be entitled to opt-out) then "... predicting mortality rates (...) of, for example, a group of people that are X years old, male and has insurance A (...) data processing will be done in-house of the company, locally on their computers..." then "... I will never ever publish the data of ANY individual..." then "... my research paper at my university, y, done together with a company for academic purposes..." + conclusions which are assumptions "... Personal data will (...) was already legally obtained..." - WHY is it legal?! "... No data that can identify anyone is published whatsoever (...) only aggregated results..."

So many wrong things in this entire text (or at least in need of clarification), namely: The Lawful Base is not transferable when you are not part of the "Process", meaning even if the insurance company has a LAwful Base to Process the Data in detail (being able to identify the natural persons, you are not a Processor under that scope, so once you come into the equation, the Lawful Base needs to be validated and most likely changed to Consent.

Then your thesis is not Scientific Investigation, unless the community will end up benefiting from it... a medical trial means potential benefit for the community; your thesis directly means benefit for you... so unless you raise a clear benefit for the community you are unlikely to be able to argue Scientific Investigation purposes as your exemption base.

The fact that a company is involved in the process (if other than the one which already has the Data and under a Lawful Basis) renders the entire topic even more delicate...

Last, but not least, given the way those natural persons are "clustered" in the publishing materials in terms of geography and ciclographics... that may still enable their individual identification... meaning, let's imagine statistics demonstrate that in Scotland any male with 95 years of age or more has a 90% probability of dying within the next 12 months and there are towns where only a couple of individuals in these circumstances live... Remember, Personal DAta is any Data that either on its won OR WHEN CROSS-REFERENCED with OTHER DATA enables the identification of a natural person.

Sorry, this is my interpretation of the entire matter as you have posted it.

Answer 2

The GDPR defines personal data as any information related to a natural person (data subject) that can be used to directly or indirectly identify that person.

So I would think you are ok it that respect, question is "insuretech" allowed to pass the information on to you in the first place, it would depend on how they stated how the data would be used when they collected the information.