Definition of Personal Data

Among the several categories of data specified in the GDPR are categories defined by their identifiability of individuals. Here, three categories of data exist: personal, anonymous, and pseudonymous. Health data, as long as they are associated with an identified or identifiable individual, constitute personal data, and are therefore subject to the GDPR.⁷ Under Article 4(15), data concerning health is defined as “personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.” In the GDPR Recitals (i.e., the context-providing paragraphs that appear before the Articles), it is clarified that “Personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject.”⁸

Conversely, anonymous data do not concern an identified or identifiable individual and are therefore not subject to the GDPR. As Recital 26 states:

Should citizen scientists collect anonymous data, they need not comply with the GDPR. It is, however, not always straightforward to ascertain whether a set of health data are fully anonymous. If the data subject can be re-identified by “means likely reasonably to be used either by the controller or by any other person”⁹ then the data concerned would remain personal data. There have been various studies showing how seemingly perfectly anonymized health data can be re-identified with additional information that is publicly available.^{Reference Culnane, Rubinstein, Teague, Rocher, Hendrickx and de Montjoye10}

Finally, pseudonymous data are personal data that have been processed in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.¹¹ Since pseudonymous data remain personal data under the GDPR, the GDPR applies even where the data in question have gone through pseudonymization.¹² However, pseudonymization may help demonstrate compliance with requirements under the GDPR, such as making the secondary use of personal data compatible with the primary purpose,¹³ as well as data protection by design¹⁴ and robust security measures,¹⁵ particularly in the context of scientific research.¹⁶

In our view, health data collected through mobile devices is highly unlikely to qualify as anonymous data, as they are usually associated with a specific device, which de facto renders the individual identifiable, even without such details as the individual’s name or specific whereabouts. This position is supported by Recital 30, which states:

Thus, health data collected through mobile devices, including those that are pseudonymized, are most likely to fall within the definition of “personal data” and “data concerning health” under the GDPR.

Territorial Scope and the Household Exemption

We must next consider the territorial scope of the GDPR, which has expanded the reach of European data protection law compared to the previous 1995 Data Protection Directive. Under Article 3, the GDPR applies to the processing of personal data in the context of the activities of an establishment (e.g., office or site) of a controller or a processor in the EU, regardless of whether the processing takes place in the EU or not. Hence, if a citizen scientist is conducting their research in the EU and personal data are processed as part of that research, the GDPR will apply. The GDPR also applies to the processing of personal data of data subjects who are in the EU by a controller or processor not established in the EU, where the processing activities are related to:

• the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the EU; or

• the monitoring of their behavior as far as their behavior takes place within the EU.

So, where health research is being conducted through a mobile or wearable device with users situated in the EU, even when the citizen scientist is situated outside the EU, in our view, the GDPR would apply, as the scientist is arguably monitoring the users of mobile devices, or even providing a service (namely, research involving the users, with results that are likely fed back to the user in real time).

A more interesting question to consider in the citizen science context, though, is the GDPR’s so-called “household exemption.” Under Article 2(2)(c), the GDPR states: “This Regulation does not apply to the processing of personal data: […] by a natural person in the course of a purely personal or household activity.” To put this in context, it may not be necessary for a mobile device to transmit any data beyond the confines of one’s device. If data processing only takes place on the device itself and no personal data are transmitted beyond the device to some third-party entity or processor, the GDPR would seem to not apply. This is known as the household (or domestic) exemption and explained in Recital 18 of the GDPR:

As two EU data protection law scholars comment:

The Court of Justice of the European Union (CJEU) has clarified the scope of the household exemption in a few cases, which, though handed down during the time of the previous 1995 Data Protection Directive, should remain valid law given the unchanged wording of the household exemption from the Directive to the GDPR.

In the case of Bodil Lindqvist v Åklagarkammaren i Jönköping (Case C-101/01), the CJEU was asked to consider, among other questions, whether uploading personal data, including health data, onto an internet website by an individual can be regarded as outside the scope of the 1995 Data Protection Directive on the ground that it is covered by one of the exceptions in Article 3(2), namely the household exemption. The CJEU ruled that posting data online about colleagues amounts to processing of personal data and cannot be exempted on the basis of personal or household activities, as the details are “accessible to and indefinite number of people” on the internet. According to the Court:

This reasoning was elaborated in the subsequent case of František Ryneš v Úrad pro ochranu osobních údajů (Case C-212/13), concerning the domestic use of a closed-circuit television camera (CCTV) around the front door of a family home, which happened also to capture partially images from a public street. Here, the CJEU was asked to consider, among other questions, whether the operation of a camera system installed on a family home for the purposes of the protection of the property, health, and life of the owners could be regarded as outside the scope of the 1995 Data Protection Directive on the ground that it is covered by the household exemption, even though such a system also monitors, in part, a public space. Again, the CJEU maintained a narrow interpretation of what “personal or household activity” means:

However, the CJEU also pointed out that the applicability of data protection law does not mean that such activities (i.e. CCTV around one’s home) are disallowed, as there are certain mechanisms provided by law whereby data controllers may possibly justify the collection and use of personal data through those activities.²⁰

The more recent judgment of Tietosuojavaltuutettu v Jehovan todistajat (Case C-25/17) upholds the criteria set out in the previous cases. In this case, the CJEU considered whether the collection of personal data by members of the Jehovah’s Witness Community constituted a purely personal or household activity within the meaning of Article 3(2) of Directive 95/46. Here, the facts concerned collecting personal data through door-to-door preaching of households. The CJEU held that:

What we gather from these three cases is that the household exemption, both under the old Data Protection Directive and now the GDPR, is narrowly construed. Namely, only those activities which are purely personal or within a household may be exempt from the reach of the law. The GDPR has provided two examples of such activities: 1) correspondence and the holding of addresses (e.g. writing emails and maintaining an address book), or 2) social networking and online activity undertaken within the context of such activities (e.g. Facebook chat and postings within one’s social network). It is also made clear that any connection to a commercial or professional activity would preclude the activity in question from being purely personal or household.²²

The use of personal data for health research by citizen scientists is clearly not covered by the two examples provided by the GDPR, but it does not necessarily involve any commercial or professional interest, either. This means that the nature of such research activities and whether they can benefit from the household exemption are at least open to question. Provided that mobile devices monitor the health conditions only of the citizen scientists themselves and/or family members, and provided that such data are accessible only within the family and not transmitted to a third party or external device or processor (as otherwise the use of data will essentially break out into the “public space” and thus lose its “purely personal or household” nature), it would be plausible to argue for the exemption for such activities. As a Council of Europe and EU handbook on data protection law observes, context matters in determining whether the household exemption applies:

In the case of “self-experimenters,” i.e., individuals who gather personal data about their own health and bio-metric measurements and then voluntarily attempt to experiment in some way to alter their health, it seems likely this activity would fall within the household exemption, provided these self-experimenters used or disclosed their own data or findings to only a small number of individuals (e.g., a small social network of fellow self-experimenters). As the Council of Europe and EU handbook states: “An individual who keeps his or her correspondence, a personal diary describing incidents with friends and colleagues and health records of family members, may be exempt from data protection rules, as these activities could be purely personal or merely household activities.”²⁴ But as the same handbook goes on to note: “…another factor that must be taken into account is whether personal data are made available to a large number of persons, obviously external to the private sphere of the individual.”²⁵ We know, based on the case law discussed above, that the household exemption will not extend to the publication of personal data to an unlimited number of recipients on the internet, as opposed to say, a small social network that is available to members only. In this scenario, the household exemption will therefore likely apply where individuals have performed an experiment and in the course of doing so (including before and after the experimentation), process personal data and disseminate it to a small number of persons. However, were the “self-experimenter” to disseminate their personal data to large number of persons; post personal data about other individuals; commercialize the findings in some way, such as selling results or holding him- or herself out for hire for guinea-pig testing; or otherwise undertake self-experimentations as a full-time activity, then it seems more likely that the household exemption would disapply.

It should also be pointed out that just because the self-experimenter is the data subject, or one of the data subjects, does not mean that they cannot be a (joint) data controller at the same time. At the time of the 1995 Data Protection Directive, there were discussions about social media users as data controllers jointly with the platform.^{Reference Wong and Van Alsenoy26} Although much of the legal uncertainty in this context has been dispelled by GDPR Recital 18 (“[p]ersonal or household activities could include […] social networking […]”), there is no doctrinal reason why a data subject cannot be a data controller at the same time in other scenarios. In fact, the idea of “data subjects as data controllers” has recently been subject to further debates amid a number of CJEU cases,^{Reference Edwards27} but further research is needed to clarify such a possibility in a setting of citizen science.

Considering the CJEU’s consistently narrow interpretation of the household exemption in existing case law, other forms of citizen scientist-led research are unlikely to be exempted if they are challenged in legal proceedings. For example, collecting and analyzing behavioral data from smartphones, even only within a group of citizen scientists or a limited number of pilot users, can hardly be exempted as purely personal or domestic. This interpretation is in line with the Court’s reasoning that allowing such activities to fall outside the scope of data protection law would place individuals under serious data protection risks if the citizen scientists do not use such data with reasonable care.

Thus, in our view, while the GDPR has not expressly precluded the possibility of relying on the household exemption, it would be difficult for citizen scientists to make such a case for their health research that processes health data using mobile devices beyond their own or their family members’.

Lawful Bases for Processing Personal Data

Having considered that the GDPR likely applies to most forms of citizen-scientist led health research with mobile devices (assuming either the citizen scientist and/or the users are based in the EU), we must now turn to consider which lawful bases might be appropriate to process personal data. It is a principle under EU data protection law that processing of personal data is generally prohibited unless it is based on one of the legal grounds explicitly afforded by law. This is particularly the case for certain special categories of data (i.e. “sensitive data”), including health-related data, which is the data type most likely to apply in this specific context.²⁸ It should be noted that a number of legal bases applicable to personal data of a general nature (“non-sensitive data”), such as “performance of a contract” or “legitimate interests” of the data controller,²⁹ cannot sufficiently legitimize the collection and use of sensitive data. Since health data are undoubtedly sensitive data, this section of our article will only look into the legal grounds applicable to sensitive data.

In the context of mobile device-driven health research carried out by citizen scientists, the following legal bases for processing sensitive data can be considered:

• vital interests;

• provision of health and social care;

• public health;

• explicit consent; and

• scientific research purposes.

We assess the strength of each of these lawful bases below.

Compatible Use

While collecting sensitive data for health research purposes can be a complex legal process in the EU, once the data have been lawfully collected for a primary purpose — which does not have to be related to health research — it should be much more straightforward for citizen scientists to reuse such data for research purposes. This is because GDPR Article 5(1)(b) — which states the data protection principle of purpose limitation — expressly recognizes the compatibility of scientific research as a secondary purpose, as long as the conditions set out in Article 89(1) are met.³³ This means that even if personal data were collected for a different purpose, further processing of such data by the same data controller (i.e. citizen scientist) for research purposes will be considered compatible,^{Reference Pormeister, Shabani and Borry34} and therefore will not require a separate legal basis.³⁵ Accordingly, for citizen scientists to rely on this principle to reuse pre-collected health data, three conditions must be fulfilled:

1. The data concerned must have been lawfully collected in the first place.

2. The processing must and must only serve the sole purpose of research. The GDPR acknowledges a broad definition of “scientific research,”³⁶ including privately funded research, and there is no compelling reason to not accept citizen scientist-led research as a valid form of “scientific research.”

3. Such processing must be in line with the requirements laid down by Article 89(1), in particular with appropriate safeguards to ensure compliance with the principle of data minimization.³⁷ It should be noted that, unlike Article 9(2)(i) analyzed above, neither Article 5(1)(b) nor Article 89(1) requires EU or Member State law to provide a legal basis. It follows then that where citizen scientists (as opposed to institutional researchers) have difficulty relying on Article 9(2)(i), they should be able to process already lawfully collected data for the secondary purpose of scientific research.

In this regard, research activities carried out by citizen scientists are to some extent privileged under the GDPR, especially with regard to reusing lawfully collected data. Compared to institutional scientists, however, primary collection and use of health data with mobile devices remain legally challenging for citizen scientists.