Open access to research data is a growing trend, especially in the case of publicly funded research. Secondary use of personal data might be however legally challenging especially when processing of personal data is involved In this short paper, we deal with two issues namely use of open-ended and vague consent forms by researchers and the static perception of anonymization. To overcome these problems, we theorize a complex institutional approach employing various means to provide the needed legal certainty for secondary use of research data.