CONSTRUCTING THE LABYRINTH: The impact of data protection on the development of ‘ethical’ regulation in social science

Abstract

Through a historical examination of the UK case over the past 40 years, this article argues that, although not drafted with such activities specifically in mind, the growth of legal initiatives protecting personal information have exerted a powerful and under-recognized impact on how social science is ‘ethically’ regulated. This impact has been both direct and indirect. At an indirect level, data protection law has encouraged the development of ‘self-regulation’ by learned societies, research institutions and funding bodies including, most importantly, the recent expansion of the remit of Research Ethics Committees within UK universities. Additionally, interpretations of the 1984 and, even more so, 1998 Data Protection Acts have resulted in the direct imposition by Universities as data controllers of key limitations on research projects. Thus, the infiltration into social science of governance models developed in medical research does not constitute the only important factor in explaining the increase, and shape, of regulation in this area. Legal changes have also been critical. In sum, data protection has helped fuel a radical shift away from a liberal regime based on a high valuation of individual academic autonomy to a much more constrained one where academics are often placed in a formally subordinated position vis-à-vis their institutions and subject to a labyrinth of restrictions and controls.

Keywords:

• surveillance/privacy
• research methodology
• law
• media studies
• academic freedom
• ethical review
• research ethics
• regulation
• self-regulation

Acknowledgements

My Fellowship and Data Protection and the Open Society project currently receive funding support from the Leverhulme Trust under their early career research award scheme. In addition to the Trust I would like to thank those who have provided ideas and/or information related to this piece. I am particularly grateful to the Economic and Social Research Council and the Social Research Association for their assistance as well as to the anonymous reviewer for his/her useful comments. The actual content, including any errors, remain my own.

Notes

Now somewhat dated attempts at providing an overview of these debates are provided by Barnes (1979) and Marsh (1985). A more recent analysis which might be considered supportive of some, but by no means all, of the changes analysed here is provided by Wiles et al. (2007). In contrast Dingwall (2006) provides an analysis which is highly critical of this emerging framework.

The first such parliamentary initiative being Kenneth Baker's Data Surveillance Bill 1969.

Brian Walden's Right of Privacy Bill 1969.

Probably as a result of this evidence being submitted rather late, it is missing from the list detailed in the Committee's final report. (Committee on Privacy 1972, pp. 216–219).

The influence of both Younger and Lindop was mediated by the provisions of the Data Protection Convention 108 which had by then been finalized at a pan-Council of Europe level. A few of the provisions (notably subject access, security and accuracy) were directly enforceable without recourse to the Registrar.

Under s. 33 (6) personal data held exclusively for statistics and research were excluded from the right of subject access so long as the results were not made available in an identifiable form. Meanwhile Section 7, part II of Schedule 1 of the Act provided that so long as the it did not cause, nor was likely to cause, damage or distress, data held for historical, statistical or research purposes would not be found to be obtained unfairly ‘by reason only that its use for any such purpose was not disclosed when it was obtained’ and could also be retained indefinitely. Finally, processing ‘performed only the purpose of preparing the text of documents’ was excluded from the Act (s. 1 (7)). This later exemption, however, was interpreted very restrictively by ODPR such that even the use of simple search facility within a word-processing program was held to potentially invalidate it (Committee of Vice-Chancellors and Principals 1987, p. 15).

The sheer breath of this definition has continued to cause confusion and incomprehension within academia to this date. Thus, in direct contradiction to this statement, the Social Research Association's data protection guidelines drawn up in 2005 stated that the regime did not apply to any ‘data already in the public domain’ (Social Research Association 2005, p. 9).

See Note 6.

Akeroyd had earlier detailed a number of these concerns in an internal report for the ESRC (Akeroyd 1985). Some data protection issues which were emerging within quantitative social science survey research were briefly considered by Raffe et al. (1989).

This document also stated that the new DPA 1998 would significantly widen the scope of data protections laws and significantly strengthen the rights of individuals. The direct impact of this Act will be analysed in full in the next section.

In 2010, this Framework was slightly amended and re-titled. See Economic and Social Research Council (2010).

The Council's production of the REF did not have an immediate impact on the remit of the Department of Health's RGF. In fact in 2005 it published a second edition which actually emphasized its broad scope (Department of Health 2005). In contrast, in 2011 the Department published revised governance arrangements for NHS REC which excluded most research only involving NHS staff or facilities from the scope of such REC review (Department of Health 2011).

Ultimately, however, it states that ‘[r]esponsibility for both interpretation and compliance resides with the research organisations themselves’ (Economic and Social Research Council 2005, p. 19).

It is beyond the scope of this article to provide a detailed analysis of all the DPA 1998s provisions. Interested readers are referred to Erdos (2011a, 2011b).

See Sch. 1 and 3, DPA 1998.

For an argument that, in fact, these provisions might provide protection for social science research please see Erdos (2011c).

The University of Warwick provides an example of the more ‘integrationist’ procedure, while University College London has continued with specialized data protection authorization. See (University of Warwick 2011) and (University College London 2008).

In this context it may be noted that Rosemary Jay, former head of Legal at the Data Protection Registrar, has advised the Socio-Legal Studies Association that, in her opinion, the DPA 1998 does make covert research ‘almost certainly’ illegal. See Barlow (2004).

It should be noted that a number of UK courts have even suggested that the taking of a digital colour photograph will probably amount to the processing of ‘sensitive’ sensitive personal data since it will reveal information as to a person's skin colour and, therefore, their ethnicity. See, for example, Murray v. Express Newspapers [2007] EWHC 1908 (Ch) at 80.

It should be further noted that, once notified, data subjects can exercise their right to claim that such processing should cease (s. 10, DPA 1998). According to the University of Edinburgh should an individual make such contact researchers must ‘take their request seriously’ and ‘contact the records managements [sic] section … for further advice’.