The point of departure for the EU personal data protection regulatory framework is that everyone has the right to the protection of personal data concerning him or her. While the GDPR sets forth a number of requirements to ensure that a high level of protection to individuals’ data is secured, for scientific research, it has taken a somewhat different approach.
Through a two-tiered framework, it enables extensive derogations from many individual rights. In that way, it considerably facilitates research and could be said to further the public interest to benefit from scientific advances. However, coupled with the limited oversight requirements, the GDPR sets forth and the long-standing ethical traditions in the field in a pre-research stage, one can question what the real price is that is being paid for furthering the public interest, how this relates to data sharing within the EU and with the third countries and international organizations, and whether the GDPR is not creating an illusion about fundamental rights protection.