Answer to request

ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST Ombeline Verite Yours: 04.04.2025 nr LYSARC Centre Hospitalier Lyon-Sud [email protected] Ours: 28.04.2025 nr 2.2-9/25/1071-2 Answer to request Estonian Data Protection Inspectorate (DPI) has received your letter. I apologize for the late reply. I would like to explain that it is important that the data processor first determines what data will be processed in the study, including the exact composition of the data and where it will be collected. All processing of personal data (also reusing existing personal data etc) requires a legal basis1. I would like to point out that personal data is not anonymous in most of these cases. It is rather pseudonymized and in that case it is still personal data2 and should be handled accordingly. You have sent questions to Estonian DPI. Therefore I explain that the approval of the Data Protection Inspectorate is required in the cases provided for in § 6(4) or (5) of the Personal Data Protection Act3, i.e. if the study is based on special categories of personal data and there is no ethics committee in the field, or if it is a study or analysis by the executive branch of government that is conducted for the purpose of policy-making. In your case, we assume that there is a valid ethics committee. You can contact, for example, TAIEK NIH Human Research Ethics Committee | National Institute for Health Development or University of Tartu Research Ethics Committee of the University of Tartu | Tartu Ülikool for more information. Hope our answer is helpful and if you have any more questions, please don´t hesitate to contact us. Respectfully Liina Kroonberg lawyer authorized by Director General 1 GDPR art 6 2 GDPR justification clause 26 3 Personal Data protection Act, https://www.riigiteataja.ee/en/eli/515012025002/consolide Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee Registrikood 70004235