In various provisions of the GDPR, processing for statistical purposes is privileged:

Further processing: In particular, it should be emphasized that the further processing of personal data for statistical purposes is generally permissible (Art. 5 I b GDPR).

 

Derogations: Art. 89 GDPR provides for derogations from some provisions of the DS-GVO, but also requires appropriate safeguards.

 

Public Interest: The GDPR recognises that statistical purposes may serve a public interest: „For […] statistical purposesee, the legitimate expectations of society for an increase of knowledge should be taken into consideration“ (Rec. 113 (4) GDPR).

The GDPR defines in Rec. 162 (3) what it means by "statistical purposes":

"[...] any operation of collection and the processing of personal data necessary for statistical surveys or for the production of statistical results." This definition is not very helpful, as it does not go beyond circular reasoning. Outside of the GDPR, statistics is understood as a scientifically validated methodical handling of quantitative information, which represents a possibility to establish a systematic connection between empiricism and theory.

Rec. 162 (4) GDPR states that the statistical results may further be used for different purposes. This further purpose can be another public interest, but also an individual interest of the controller protected by fundamental right, e.g. scientific freedom [Tile CO.14], but also commercial interest [Tile CO.17].

The results of the processing must be aggregated (i.e., non-personal) data and may not be used for measures/decisions regarding any particular natural person (Rec. 162 (5) GDPR). If this requirement is fulfilled, the further purpose of use should not play a role in the question of whether data processing for statistical purposes is permissible under less strict conditions.

Statistics-specific provisions:

Articles: 5 I b/e, 9 II j, 14 V b, 17 III d, 21 VI and 89 I/II/IV GDPR.

 

Recitals: 50, 52, 53, 62, 65, 113, 156, 162 and 163 GDPR.