S.L. 586.7 Art. 8Processing for research and statistics purposes.

(1) When processing of personal data is required for research and statistics purposes, all identifiable data shall be rendered anonymous, unless in the case of research, the identification of the data subject is required to fulfil the purposes of such research.

(2) Within the limits of these regulations, where, for the purposes of implementing specific targeted policies, the research being conducted would require the identification details of students, data controllers shall process such data by replacing personal identification data with pseudonymous data, and eventually limiting the re-identification of students only to those cases which specifically fall within the parameters of the target policy.

(3) Where the research is required by other entities, not being the education authorities in terms of regulation 2, and the identification details of students are required for the purposes of the research in question, specific consent shall be obtained from the students themselves where applicable or from the parents or legal guardians concerned.

(4) When, for the purposes of the preceding sub-regulations, pseudonymous data are processed, data controllers shall ensure that:

(a) personal data are not processed for any other purpose that is incompatible with the specific purpose of the targeted policy and, or initiative, and in particular that it is not processed for the purpose of supporting measures or decisions with respect to the student, either specifically related to the targeted policy and, or initiative or otherwise;

(b) data enabling the attribution of information to an identified or identifiable data subject are kept separately from the other data;

(c) adequate organisational and technical safeguards are in place to protect the personal data against any unlawful forms of processing;

(d) personal data shall not be retained for a period which is longer than necessary and all identifiable details shall be rendered anonymous, deleted, or destroyed, following the completion of the policy and, or initiative implementation.

(5) Where the research involves the processing of special categories of data, such processing shall be approved by the Information and Data Protection Commissioner in terms of article 7 of the Act.