Public interest

On this page: public interest, general interest, legal basis, legal ground, data reuse, secondary use
Date of last review: 2023-10-02

Scientific research usually aims to increase general knowledge and improve the workings of society. In the Netherlands, the Higher Education and Scientific Research Act recognises conducting scientific research to be a public task of Dutch universities. Research aimed at increasing knowledge is seen as a task in the public interest. Therefore, Utrecht University researchers can, under certain conditions, use the legal basis of public interest when they process personal data in the context of scientific research.

The use of public interest as a legal basis in scientific research does not apply to all research institutions. Many institutions still use consent as the default legal basis. Moreover, in the Netherlands, consent is also the go-to legal basis for researchers in the health domain.

If you work or study at Utrecht University, you can read more about the reasoning for using public interest for scientific research on this intranet page.

What does it mean to use public interest as a legal basis?

  • No consent, or only for ethical reasons
    If you use public interest as a legal basis, you do not need to obtain consent for processing personal data. In many cases, you only need ethical informed consent, i.e., consent to ascertain that data subjects participate voluntarily.

  • More freedom, easier reuse
    Compared to using consent, you are not bound to the specific conditions set in the consent statement when you rely on public interest. You must do your best to inform data subjects properly, but you do not have to ask (renewed) permission to use their personal data. This is especially advantageous when sharing personal data for reuse: if you use(d) consent, you cannot use the personal data for other scientific purposes besides what was agreed with the data subject. If you use public interest, you can in principle reuse the personal data for any other scientific purposes in the public interest.

  • Data subjects’ rights
    When you use consent, data subjects have the right to withdraw that consent, and when they do, in most cases you are obliged to remove their data. This can have major consequences for the integrity of your dataset. With public interest, data subjects instead have the right to object to your use of their personal data, but only based on their personal, specific situation (art. 21(6)). If a data subject objects, you have to consider both the data subject’s specific situation and the interests of your research. It may be that the interests of your research will prevail and that you can therefore continue your research the same way. In any case, always contact your privacy officer when a data subject wants to exercise (one of) their rights.

  • Only for scientific research
    Public interest is really only suitable for research that is aimed to increase the general knowledge. If you do research on behalf of a commercial party, that research is usually not performed in the public interest.

When to use public interest as a legal basis?

Public interest is very suitable for scientific research in which:

  • it is difficult to obtain consent
    For example:
    • contactless research (i.e., there is no direct contact with data subjects), like public observations, web scraping research or archival research into living individuals.
    • research with societal groups who are wary of providing a name and/or signature for consent, such as youth in problematic areas, research in the LGBTQIA+ community, or when doing field work.
  • data subjects do not have a truly free choice to participate.
    For example:
    • Research into the university’s own students
    • Research performed at schools, in which pupils do not always have a free choice to participate (in many cases public interest is actually already used here under the term “passive consent”).
  • consent cannot be (easily) demonstrated
    For example, if you pseudonymised the personal data (e.g., removed names and contact information), but the data still refer to individuals, you still need to be able to demonstrate that you obtained consent. This can lead to the storage of unnecessary personal data.

When is public interest less suitable as a legal basis?

Public interest is less suitable for research in which:

  • special categories of personal data are indispensable to the dataset, even for reuse
    Sometimes, it is possible to strip a dataset from the special categories of personal data and still keep a usable dataset for reuse. In such cases, public interest can still be the legal basis used in the overall study, and data subjects are then only asked for explicit consent to process the special categories of personal data. The dataset containing “regular” personal data can then be reused after the study on the basis of public interest. However, if a dataset is useless after stripping the special categories from them (like in most health research), the reuse argument does not hold and consent for both the regular and special categories of personal data is preferable, making consent the legal basis used in the overall study.
  • it is important to give data subjects a maximum amount of control over their personal data
    This can be an ethical requirement, but sometimes the possibility of providing (and withdrawing) consent for processing personal data can also be an additional reason for data subjects to participate. It can tip the balance.
  • agreements with data subjects need to be registered anyways
    For example, for the use and storage of audio or video recordings. It could then make more sense to use consent for all processing activities.
  • personal data are collected to be (re)used for purposes other than scientific research
    Reuse for non-scientific purposes would need its own (new) legal basis, such as consent or legitimate interest.

What are my obligations when using public interest?

If you want to use public interest as a legal basis, you need to:

  1. Ascertain that you are performing scientific research
    A scientific research project is “a research project set up in accordance with relevant sector-related methodological and ethical standards” (Article 29 Working Party, 2018).
    Most research performed at a university and reviewed by an ethical committee meets this requirement.

  2. Ascertain that the research project serves the public interest.
    In most cases, this means that it is aimed at knowledge expansion that society can benefit from. This is in principle always the case with university research, unless it is a private party (including the university itself) that alone benefits from the results of the research.

  3. Inform data subjects
    Inform data subjects about what data you are using and why, and about their rights (as you always need to do), but now including the right to object to your processing of their personal data. Read how here.

  4. Plan your research project in line with the GDPR
    Plan your research as you would for all legal bases, using the GDPR principles and Privacy by Design strategies.

  5. Demonstrate that your use of the personal data is necessary and proportionate to your research goal.
    The interests of data subjects must not override your research interests. This obligation is often fulfilled by going through ethical review. We also recommend performing a privacy scan to make sure all important privacy risks in your project are covered. Please contact your privacy officer for the procedure in your faculty, and check out this infographic from the European Data Protection Supervisor (2020) on how to assess necessity and proportionality.

  6. Contact your privacy officer when a data subject objects to your use of their personal data.
    Together, you will come up with a fitting response and plan of action.