The secondary use of data refers to any usage of personal and health information, other than the use for which the information was initially collected. For instance, this use may pertain to information that was collected over the course of a medical treatment and will now be used for research purposes, or information that was collected for an initial study, and is now being used in a second study not falling within the scope of the original consent.

Generally, the secondary use of data from deceased individuals requires, a priori, the consent of the individual himself (consent which was given prior to his death), of his legal representative (in the case where the deceased was of full age but incapable of giving consent), or of the person having parental authority or the tutor (in the case where the deceased was a minor).

Under certain conditions, an organization or an enterprise is legally authorized to communicate personal information belonging to a deceased individual for research purposes.

Few international documents directly address the secondary use of deceased individual’s personal information. The United Nations Education, Scientific and Cultural Organization (UNESCO) and the International Bioethics Committee (IBC) recognize that the access to genetic data from deceased individuals raises interesting questions.

However, many documents address the secondary use of data when it is impossible to obtain consent from the individual, for instance, when this person is deceased. For example:
- The Declaration of Helsinki (World Medical Association, 2008) mentions that there may be situations in which it is unpractical, even impossible, to obtain consent, or that obtaining consent would compromise the validity of the study. In such cases, research may be undertaken only after evaluation and approval by a research ethics committee.
- The International Declaration on Human Genetic Data (UNESCO, 2003), mentions that when prior consent cannot be obtained, human genetic data may be used under conditions provided by national legislation and after consultation and approval by an independent ethics committee.
- The International Guidelines for Research Involving Human Subjects (CIOMS, 2003) also mention that if the requirement for individual informed consent would render the course of research impossible, ethics committees may bypass some, or sometimes all, of the elements constituting consent.

The Personal Information Protection and Electronic Document Act and the Privacy Act are two Canadian federal acts pertaining to the secondary use of information concerning living and dead individuals.

Under these acts, a researcher may, in the scope of a study or research, use personal information contained within federal organizations, if he demonstrates that:
1) The study or research cannot be achieved without the use of the data;
2) The information is used in a manner that ensures its confidential nature; and
3) Consent is practically impossible to obtain.

Furthermore, the researcher or organization must commit (in writing and to the person in charge of the institution) to abstain from all subsequent disclosure of the information as long as its format seemingly allows for identification of the individual concerned.

In addition, the first edition of the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (TCPS) (1998, 2000 and 2005) and the CIHR Best Practices for Protecting Privacy in Health Research both mention that ethics review committees can approve a consent procedure that renounces or modifies, in part or fully, the obligation of obtaining informed consent when:
1) The identifying data is essential to the study;
2) Measures are put in place in order to protect confidentiality of participants and to reduce the inconveniences of research; and
3) Individuals to whom the data refers to are not opposed to the re-use of their data.

These criteria seemingly apply to data from deceased individuals, as long as these individuals did not manifest, before their deaths, any objection to the use of their data.

In Quebec, the Act respecting health services and social services, the Act respecting access to documents held by public bodies and the protection of personal information and the Act respecting the protection of personal information in the private sector frame issues concerning the confidentiality of personal information of all living or deceased individuals. According to these acts, access to personal information from deceased individuals can be obtained for studies, research or teaching purposes. The access to the information can be obtained in three ways: with the (initial) consent of the user, with the authorization of the Director of professional services of a health care establishment, or with the authorization of Quebec’s Comité d’accès à l’information, if the researcher demonstrates that:
1) The projected use is not frivolous;
2) The intended goals can only be attained if the information is communicated in an identifying fashion; and
3) The personal information will be used in a way that ensures its confidentiality.