18 - In the Name of Scientific Advancement: How to Assess What Constitutes ‘Scientific Research’ in the GDPR to Protect Data Subjects and Democracy

Summary

One of the biggest failures of Facebook is to excessively legalize its terms and conditions and forget something so important as the reasonable expectation of the user .

– Christopher Wylie, Cambridge Analytica whistleblower

INTRODUCTION

The Cambridge Analytica scandal was not the first scandal involving research on Facebook data and is likely not to be the last. An academic researcher obtained data from 87 million Facebook users under the pretence of scientific research and sold it on to the commercial company Cambridge Analytica, which subsequently used the data with the aim of influencing democratic elections. A few years earlier, Facebook conducted a psychological experiment designed to determine whether it could alter emotional states on nearly 700,000 of its users without their knowledge, consent or ethical review. Facebook admitted to having been unprepared for the negative reactions that followed, conceding that the research should have been conducted differently. The editor-in-chief of the Proceedings of the National Academy of Sciences of the USA ( PNAS ), which published the research, expressed concern that Facebook's data collection ‘may have involved practices that were not fully consistent with the principles of obtaining informed consent and allowing participants to opt out’. Nevertheless, the research project appears to have been legal, but not necessarily ethical or well conducted.

In acknowledgement of the importance of scientific research, the EU General Data Protection Regulation 2016/679 (GDPR) offers it a number of concessions. However, the GDPR does not provide a definition of ‘scientific research’ , making it unclear which practices are afforded this privileged position. As the examples above illustrate and as elaborated below, use of research data for other purposes – including those that may pose a threat to democracy – is a well-recognised and frequent problem. Unethically and/or poorly conducted research is similarly a known problem, which may also pose a challenge to democracy.

Sometimes, personal data is seemingly not collected for scientific research purposes, although that may be the primary purpose. Some businesses are, for instance, built for the purpose of obtaining and reselling sensitive data for research, although the business model can be hidden from plain sight.