2.3 What should I do in the case of further/secondary processing of personal data?

In addition to a new collection of personal data, the AVG explicitly mentions the possibility of further processing for the purpose of scientific research.

Personal data that you have collected yourself for a specific purpose and that you want to process for a different research question in a subsequent investigation, is also considered as further processing.

For further processing, we recommend that you thoroughly read the information that was provided to the data subjects and possibly the informed consent. This makes it possible to evaluate whether the processing of personal data (in the context of a new research project or a new research question) is compatible with the purposes for which the data were originally collected.

To legally process personal data, you need a legal basis (see 2.2). this is determined in the primary data collection. If your investigation involves further processing of personal data, you should check with the person who primarily collected the data on which legal basis this occurred.

Even with the further processing of personal data, it remains important to be transparent to those involved. For example, the data subject must also be informed about this new processing during further processing of their personal data (see 4.1)