Let us assume that a dental clinic, in a country that is not part of EU, is making dental x-rays for its patients, which may or may not be EU citizens. By the law of this country, the clinic is sole owner of these x-ray images. These images would be stored in something called DICOM format that, besides the image itself, contains metadata that uniquely identifies the patient. Now, let say that a researcher employed in this clinic conducts a research within clinic, with permission of legal dept. and ethics board of the clinic, such that through automatic processing of these images, the researcher derives some data from these images. As an example, let say that the result of the processing is a radiation dose received by the patient undergoing the procedure. So, all that is left from processing is a single number which cannot by reversed to identify patient.
The question is, can a researcher use these numbers, with the permission of ones employer, use these numbers in a master thesis submitted on a university within a EU country? If so, what are the obligations of the researcher?