Below are the recommendations listed in the European Data Protection Board’s Guidelines 4/2019 on Article 25 of the GDPR, “Data protection by design and by default”, and a brief explanation of how to comply with the fairness principle for processing personal data in research.
2.6.1. Processing of personal data should correspond with people’s expectations
The description of the processing of personal data used in research must be as accurate as possible and include all the circumstances that could be reasonably expected to be of importance to people or likely to cause distress. Information about the research and personal data processing must not be misleading or create unjustified expectations in the data subject.
Example It is explained to participants in the survey that their data and the interview contents are confidential, and no one other than the organiser can see them. After the end of the survey, a participant discovers in the published final results that an extract from the interview made with them has been published: although the participant’s name has not been revealed, the words are recognisable. The person is disappointed and informs the author because they had understood that the interview would remain completely confidential. The researcher, however, explains that it is a common academic practice to quote extracts from interviews in qualitative analysis. Such a situation may seem unfair to the participants as they do not need to know academic practice. The researcher’s actions are not legal from the perspective of data protection, but the case illustrates how the individual’s expectations and the researcher’s assumptions may differ. Additional explanations about the purposes of the research and data processing would help prevent such situations. In qualitative social science research with small, homogeneous samples, it is a common practice to show the research results to the respondents before publication. This helps get feedback and better understand the respondents’ expectations. It also improves the transparency of the research, and ensures that people’s expectations are aligned with work done for the study. |
2.6.2. It must be possible to communicate directly with the controller
The possibility to contact researchers at any time helps ensure transparent, fair and reliable processing of personal data. That may be more difficult when data collection has been delegated to a processor (for example, a survey company) and their staff, who may not know in detail the purposes of the survey, the data processing conditions, or any other relevant information that people may ask for. In that case, the research team responsible for the survey should include information on how to contact them and provide their contact details. In addition, the contact details of the controller’s specialist for data protection may be supplied.
2.6.3. Discrimination in the processing of personal data must be avoided
The non-discrimination principle is universal and does not concern data protection only. If someone has been discriminated, all the data processing may become unfair and, therefore, unlawful.
In the case of scientific research, it is not always clear which processing can be considered discriminatory. Certain groups in society may be under- or overrepresented in studies, depending on how easy or convenient it is to collect data from them. Such discrimination may diminish the quality of the study, as conclusions drawn from a biased sample may not be valid, especially if they should represent a cross-section of society. It is common practice to impose additional conditions on survey participants to obtain a representative sample; certain participants are favoured based on those conditions. For example, in threshold surveys, it is common practice to interview the youngest male at home first, as this segment of the sample is the most difficult to reach. Sample-based criteria may be considered non-discriminatory, as people get no benefits for participation in the survey.
2.6.4. Exploitation of people’s needs or vulnerabilities must be avoided
People must not be manipulated or exploited for research purposes. In research, it is essential to ensure voluntary participation because any form of manipulation limits the person’s ability to make independent decisions. Particular care should be taken when subjects are not completely free or do not perceive their actions or behaviour as being researched. The issue of vulnerability and exploitation is closely linked to research ethics. From the data protection perspective, everyone has equal rights to the data about themselves, regardless of their vulnerability. The only exception is children: their data must be processed with particular care to their rights and to ensuring that the children’s rights are not harmed.
2.6.5. Asymmetric power balance must be avoided
Power relations must be taken into account when assessing whether participation is voluntary because, in the sphere of influence of someone in a higher position, the respondent may feel pressured to disclose personal data. Therefore, it may be unfair for a lecturer to include in a survey the students studying in a course they teach and whose exam results depend on the lecturer. Similarly, voluntariness can be problematic when a doctor wants to involve his patients, or a manager of an institution invites staff members to the survey.
2.6.6. Processing of personal data is ethical
Personal data processing that does not comply with the ethical principles of the field of research may be regarded as unlawful. The importance of research ethics is underlined by the requirement to obtain approval from the ethics committee for processing special categories of personal data. It should be taken into account that a breach of the principles of research ethics could, in the worst case, lead to data protection prosecution.