Answer to request

ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST

Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee

Registrikood 70004235

Ombeline Verite

LYSARC Centre Hospitalier Lyon-Sud

[email protected]

Yours: 04.04.2025 nr Ours: 28.04.2025 nr 2.2-9/25/1071-2

Answer to request Estonian Data Protection Inspectorate (DPI) has received your letter.

I apologize for the late reply.

I would like to explain that it is important that the data processor first determines what data will

be processed in the study, including the exact composition of the data and where it will be

collected. All processing of personal data (also reusing existing personal data etc) requires a legal

basis1. I would like to point out that personal data is not anonymous in most of these cases. It is

rather pseudonymized and in that case it is still personal data2 and should be handled accordingly.

You have sent questions to Estonian DPI. Therefore I explain that the approval of the Data

Protection Inspectorate is required in the cases provided for in § 6(4) or (5) of the Personal Data

Protection Act3, i.e. if the study is based on special categories of personal data and there is no

ethics committee in the field, or if it is a study or analysis by the executive branch of government

that is conducted for the purpose of policy-making.

In your case, we assume that there is a valid ethics committee. You can contact, for example,

TAIEK NIH Human Research Ethics Committee | National Institute for Health Development or

University of Tartu Research Ethics Committee of the University of Tartu | Tartu Ülikool for

more information.

Hope our answer is helpful and if you have any more questions, please don´t hesitate to contact

us.

Respectfully

Liina Kroonberg

lawyer

authorized by Director General

1 GDPR art 6 2 GDPR justification clause 26 3 Personal Data protection Act, https://www.riigiteataja.ee/en/eli/515012025002/consolide