Data Protection, Scientific Research, and the Role of Information

Computer Law and Security Review, https://doi.org/10.1016/j.clsr.2020.105412

16 Pages Posted: 11 Mar 2020 Last revised: 26 Jun 2020

See all articles by Rossana Ducato

Rossana Ducato

School of Law, University of Aberdeen; Université Catholique de Louvain

Date Written: January 10, 2020

Abstract

This paper aims to critically assess the information duties set out in the General Data Protection Regulation (GDPR) and national adaptations when the purpose of processing is scientific research. Due to the peculiarities of the legal regime applicable to the research context information about the processing plays a crucial role for data subjects. However, the analysis points out that the information obligations, or mandated disclosures, introduced in the GDPR are not entirely satisfying and present some flaws.

In addition, the GDPR information duties risk suffering from the same shortcomings usually addressed in the literature about mandated disclosures. The paper argues that the principle of transparency, developed as a “user-centric” concept, can support the adoption of solutions that embed behavioural insights to support the rationale of the information provision better.

This article is structured as follows. A preliminary issue to untangle is the definition of "scientific research" under the GDPR: what kinds of activities fall under this notion? What are the differences from neighbouring concepts, such as statistical purposes? (Section 2).

Once the boundaries of the concept of scientific research are clarified the applicable legal regime will be reconstructed. As will be shown in Section 3 the GDPR establishes a framework particularly favourable for research purposes. Such processing can benefit from some exceptions to data protection principles and derogations to data subjects' rights. However, this special regime comes with a set of obligations. Data controllers, in particular, have to set up appropriate measures and safeguards to protect the rights and freedoms of individuals. How these safeguards look is not an entirely clear matter in either the GDPR or national adaptations.

Section 4 will complete the analysis of the legal regime by investigating the lawful basis that can legitimise processing for research purposes. As the analysis will show, on the one hand data subjects’ consent is not always necessary for processing. On the other hand, research can open the door to secondary uses and indefinite retention of personal data originally collected for other purposes. Therefore, information duties established at Articles 13 and 14 GDPR remain a fundamental tool for data subjects to exert some form of control over their data.

However, mandated disclosures are a policy instrument that has been highly criticised in the literature. In particular, they are unable to preserve the autonomy of the data subject for several reasons: people are decision-averse, data subjects suffer from a certain degree of illiteracy and innumeracy, readers are unable to cope with the overload and accumulation problem, and cognitive biases and heuristics interfere - often in unpredictable ways – in the decision-making process of individuals. In Section 5 such criticisms will be addressed and contextualised within the framework of the GDPR. In particular, identification of potential shortcomings will be used to pave the way for possible interventions to effectively and dynamically inform data subjects. Such solutions, coupled with the controller’s accountability duties, can help shape the abstract principle of transparency in practice and promote the data subject’s informationelle Selbstbestimmung.

Keywords: Data protection, Scientific research purposes, Statistical purposes, Information duties, Transparency, GDPR, Law and behavioural science, Legal design

Suggested Citation

Ducato, Rossana, Data Protection, Scientific Research, and the Role of Information (January 10, 2020). Computer Law and Security Review, https://doi.org/10.1016/j.clsr.2020.105412, Available at SSRN: https://ssrn.com/abstract=3537186 or http://dx.doi.org/10.2139/ssrn.3537186

Rossana Ducato (Contact Author)

School of Law, University of Aberdeen ( email )

Taylor Building
King's College
Aberdeen, Scotland AB24 3UB
United Kingdom

Université Catholique de Louvain ( email )

Bruxelles, 1000
Belgium

HOME PAGE: http://www.rosels.eu/member/rossana-ducato/

Do you have negative results from your research you’d like to share?

Paper statistics

Downloads
243
Abstract Views
1,337
Rank
228,791
PlumX Metrics