[tzs]

GDPR doesn't actually require consent to process personal data. It requires that the processing be lawful. Consent is one basis for lawfulness, but it is not the only one. There are 5 others.

One of these is that the processing is necessary for the performance of a task carried out in the public interest.

You could probably make a colorable argument that research for publication into the effectiveness of GDPR implementation approaches is in the public interest.

[richv]

Not if you're a private company or an individual

[tzs]

That basis of lawfulness, from Article 6 section 1(e), is "processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller".

On the face of it there doesn't appear to be any restriction on who can use that basis.

The only recital I've found that mentions this is Recital 45. It says:

> It should also be for Union or Member State law to determine whether the controller performing a task carried out in the public interest or in the exercise of official authority should be a public authority or another natural or legal person governed by public law, or, where it is in the public interest to do so, including for health purposes such as public health and social protection and the management of health care services, by private law, such as a professional association.

That seems potentially pretty expansive.