So my thesis proposal is about predicting mortality rates. I will work with a company (insuretech) that already has database of 2m+ people with death dates (if dead), birth date, transaction volume (money), and which collective insurance this person have (out of 4 possible).
Now, I'm will use machine learning to predict mortality rate of, for example, a group of people that are X years old, male and has insurance A. So the overall published results are very aggregated (For example: 40% of all 90 year old males will die this year, according to my predictions).
I will never ever publish the data of ANY individual, all the machine learning and data processing will be done in house of the company, locally on their computers. I also only have clearance to anonymised data (pseudo addresses and names).
This will be my research paper at my university, done together with a company for academic purposes as well as for the interests of the company.
So to sum this up:
- Personal data will be used, it was already legally obtained as it's necessary information for my host company (insuretech).
- The results are not targeted to any of the individuals from the database, but only aggregated statistical results are published regarding groups of people.
- No data that can identify anyone is published whatsoever. Again, only aggregated results from personal data will be presented.
- I will take precautions to process the data in a safe environment
- This will be a published paper
Is this ok within the scope of GDPR?