Mustn't ask, mustn't tell

Source: Miles Cole

Even with the advent of Web 2.0, data protection law is still often seen as technical and only narrowly applicable. Technical abstruseness aside (and data protection’s reputation here is certainly deserved), this understanding could not be more wrong. The existing European data protection framework really is breathtaking in scope. It applies to anything done electronically with any information about an identified or identifiable person - possibly including the dead. According to the European Union, even innocuous details in the public domain are protected (perhaps even the title of an author’s book). Moreover, if the information reveals the particulars of, for example, a person’s ethnic origin, political opinions, religious belief, trade union membership, health or criminality, then it is classed as “sensitive” and subject to even tighter controls. The European data protection framework is not only broad but often onerous. Barring specific exceptions (including a liberal one that can be invoked for journalism, literature and the arts), there is a presumption that individuals will be informed about the processing of data about them and given a right to object, that the processing of “sensitive” personal information will be banned and that no personal information will be transferred outside the European Economic Area without “adequate protection”.

So the popular perception of data protection is woefully inaccurate - which leads to a radical underestimation of the threat these regulations pose to the enjoyment of other fundamental rights and the pursuit of legitimate activities. Nowhere is this more the case than in social science and humanities research. Since the advent of the EU’s framework in the 1990s, researchers have witnessed dramatic restrictions on their freedom to use “sensitive” data and to deploy covert methods. Coupled with the growth of sometimes intrusive “ethical review” policies, the barriers and burdens placed in the way of even ordinary, innocuous, yet socially beneficial research and on researchers have become considerable.

It might have been hoped that the proposed EU Data Protection Regulation would provide an opportunity to reverse this. But if the European Parliament’s recently published draft amendments are anything to go by, the converse is true. Startlingly, these stringent proposals would effectively outlaw almost all research in law and in contemporary history, as well as a great deal of work in sociology and political science. When data are processed for historical, statistical or scientific research purposes, there would be a complete ban on publishing even the most innocuous personal information in identifiable form unless the individual in question has either themselves put it into the public domain or has freely given specific, informed and rescindable consent. This would, for example, deny a historical researcher the right to publish information from a newspaper article accurately reporting the public activities of a public official (such as Tony Blair’s involvement in the decision to go to war in Iraq). It would also prohibit the citation and publication of analyses of already published court judgments.

If the details in question reveal any “sensitive” categories of information, the restrictions would be even greater. So a historian would have no right to report that Emma Nicholson, now a Liberal Democrat peer, used to be a Conservative MP despite this being public knowledge freely available on Wikipedia. (According to the Information Commissioner’s Office, the political affiliation of an MP is “sensitive” personal data.)

We are also told that in all cases “data enabling the attribution of information to an identified or identifiable data subject” must be “kept separately from the other information”. This would prevent a researcher from saving a court judgment or a newspaper report on a laptop without having first replaced all personal identifiers with a pseudonymised code, the key to which would then have to be stored elsewhere.

Finally, the clause allowing the European Commission to propose delegated legislation to allow for covert research has simply been deleted. But, subject to suitable safeguards, such research has often been essential in bringing to light important facts including illegal police practices and discriminatory attitudes on the grounds of sex, ethnicity or race. People are obviously not going to be willing to give consent to their wrongdoing being researched.

The MEP who has drawn up the report, Jan Albrecht, is candid about the restrictions on research freedom that are being proposed. We are told baldly that “research purposes should not override the interests of the data subject in not having his or her personal data published”. Ironically, alongside the harsh restrictions on research, he proposes broadening protections for journalism, literature and the arts so as to protect freedom of expression per se. However, the one type of actor whose freedom of expression is not protected by this proposed revision is researchers (historical or otherwise).

It is vital that this draft regulation is amended. We must ensure that social and humanities research is unequivocally included within freedom of expression protection. The proposals should also prompt a rethink of the overregulation of research compared with other, often less socially valuable, activities.

It is not too late to press for the necessary changes: the proposals are still being considered by both the European Parliament and the Council of Ministers. All who care about the future vitality of academic enquiry need to wake up to the realities of data protection. Universities and other research organisations must be forthright and assertive in opposing these unjustified and unworkable plans. Everyone acknowledges that, in some contexts, genuinely sensitive personal data needs protection. But when this balloons into wide, and wild, overreaction we find ourselves able to know less and less about the societies we live in - including, paradoxically, about the nature of privacy and the effects of data protection regulation itself.