1

Let us assume that a dental clinic, in a country that is not part of EU, is making dental x-rays for its patients, which may or may not be EU citizens. By the law of this country, the clinic is sole owner of these x-ray images. These images would be stored in something called DICOM format that, besides the image itself, contains metadata that uniquely identifies the patient. Now, let say that a researcher employed in this clinic conducts a research within clinic, with permission of legal dept. and ethics board of the clinic, such that through automatic processing of these images, the researcher derives some data from these images. As an example, let say that the result of the processing is a radiation dose received by the patient undergoing the procedure. So, all that is left from processing is a single number which cannot by reversed to identify patient.

The question is, can a researcher use these numbers, with the permission of ones employer, use these numbers in a master thesis submitted on a university within a EU country? If so, what are the obligations of the researcher?

|improve this question
  • Hello! Welcome to Law.SE. Please read our tour page. – isakbob Nov 12 at 21:29
  • 1
    If the dental clinic is not located in the EU, and makes a x-ray for a patient, that patient will also not be located in the EU at the moment the x-ray is made. Is that correct? Does the researcher which conducts a research within clinic perform that research while the patient is still outside the EU? Because in that case the GDPR would not apply at all, not even for EU citizens. – wimh Nov 12 at 22:05
  • @wimh but when the data are transferred to the EU university, the GDPR will apply, even for non-EU citizens. As you correctly imply, citizenship is not relevant to the GDPR. Neither is the fact that the data were originally collected outside the EU. – phoog Nov 13 at 13:14
  • @phoog, if only that single number (radiation dose) is transferred, without any identity information (not even pseudomized), I don't think the GDPR would apply to that information. – wimh Nov 13 at 13:20
  • 1
    @wimh perhaps. But to the extent that a person could be identified from the data, the GDPR does apply (for example if individual radiation dose numbers are correlated with other data in some way so as to allow one to work out which dose was received by which person). – phoog Nov 13 at 13:36
1

The doses of radiation are not unique identifiers. Should those numbers be transferred to a controller established in the EU (and thus to whom the GDPR applies), that controller may not identify the natural persons to whom the dosage pertained, without correlating each dosage with information held by the non-EU lab. As such, it is not personal data and the activity does not fall within the scope of the GDPR.

In the event that one or more dosage figures were to be unique, and given that the dosage and the corresponding patient files from which it is possible to reliably recreate that figure were transferred to a controller established in the EU, and given that the original subjects were still alive, the unique dosage figure could be said to have made it possible to indirectly identify natural persons and would therefore be personal data within the scope of the GDPR. I find this unlikely and believe my first paragraph is still a complete answer.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.