Austrian Research Organisation Act
According to § 2f para. 1 of the Austrian Research Organisation Act (Forschungsorganisationsgesetz, FOG), scientific institutions are permitted to collect, archive, and systematically record research material (§ 2b no. 6) for purposes in accordance with Article 89(1) of the General Data Protection Regulation (GDPR). In doing so, they may also process all data (§ 2b no. 5) necessary to ensure optimal access to data and research material for the purposes outlined in Article 89(1) GDPR.
§ 7 of the Austrian Data Protection Act (Datenschutzgesetz, DSG) refers in para. 1 to the possibility of data processing for scientific research purposes in the public interest. This specifically includes data that were lawfully obtained in the context of other investigations (e.g. surplus diagnostic samples) (§ 7 para. 1 no. 2 DSG), or data that are pseudonymised personal data for the data controller (i.e. the biobank), where the identity of the individuals concerned cannot be determined by legally permissible means (§ 7 para. 1 no. 3 DSG).
At the Medical University of Vienna Biobank, all personal data are processed exclusively in pseudonymised form—using unique identifiers or domain-specific personal codes—in accordance with § 2d para. 2 no. 1 FOG and Article 4 no. 5 GDPR. Publications are made either without personal data or solely in anonymised or pseudonymised form, without disclosing names.
In accordance with the purposes set out in §§ 2c to 2i of the FOG and under the conditions specified therein, the transfer of data and research material to scientific institutions (§ 2b no. 12 FOG) or experts within Member States of the European Union is also permissible.