In various provisions of the GDPR, processing for statistical purposes is privileged. In particular, it should be emphasized that the further processing of personal data for statistical purposes is generally permissible, Art. 5 I b GDPR. Art. 89 GDPR provides for derogations from some provisions of the DS-GVO, but also requires appropriate safeguards.

Statistics-specific provisions:

Articles: 5 I b/e; 9 II j; 14 V b; 17 III d; 21 VI and 89 I/II/IV GDPR.

 

Recitals: 50, 52, 53, 62, 65, 113, 156, 162 and 163 GDPR.

The GDPR defines in Rec. 162 (3) what it means by "statistical purposes":

"[...] any operation of collection and the processing of personal data necessary for statistical surveys or for the production of statistical results."

This definition is not very helpful, as it does not go beyond circular reasoning. Outside of the GDPR, statistics is understood as a scientifically validated methodical handling of quantitative information, which represents a possibility to establish a systematic connection between empiricism and theory.

Rec. 162 (4) GDPR states that the statistical results may further be used for different purposes. This further purpose can be both a legally protected interest of the controller (e.g. scientific freedom [Tile CO.14], but also commercial interest [Tile CO.17]) and a public interest [Tiles P.12 and P.13].

The results of the processing must be aggregated (i.e., non-personal) data and may not be used for measures/decisions regarding any particular natural person (Rec. 162 (5) GDPR). If this requirement is fulfilled, the further purpose of use should not play a role in the question of whether data processing for statistical purposes is permissible under less strict conditions.