EPIC Submits Feedback on UK GDPR Research Provisions

EPIC has submitted written feedback for a consultation by the UK Information Commissioner’s Office (ICO) regarding draft guidance on research provisions on the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018). The draft guidance is intended to assist organizations in understanding key terms, evaluating whether research provisions apply to their operations, and ensure compliance with requirements for research operations.

EPIC recommended that additional language be added addressing accountability for organizations using research provisions, including setting forth standards for how a “clear and positive benefit” of research can be determined. EPIC also recommended that examples be added of where it is unclear if a research provision should apply in order to walk organizations through the evaluation process in those circumstances.

EPIC has engaged in previous UK consultations as well, including in comments to the Biometrics and Surveillance Commissioner of the United Kingdom on proposed updates to the Surveillance Camera Code of Practice.