Science and Privacy: Data Protection Laws and Their Impact on Research
35 Pages Posted: 19 Jun 2019 Last revised: 5 Jul 2019
Date Written: June 11, 2019
While privacy laws differ in their scope, focus, and approach, they all involve restrictions on the collection, use, sharing, or retention of information about people. In practice, these requirements can lead organizations to refrain from collecting certain data, only use data with the consent of the individual, or to delete data after a certain timeframe or at the request of the individual. At the same time, scientific research is increasingly using the tools of data analytics and machine learning. These tools rely on “big data” and the idea that powerful computers and sophisticated analytical tools can examine very large data sets to reveal new insights and discoveries. Scientists believe this data-driven approach to research will lead to stunning breakthroughs in medicine, education, and many other fields that can dramatically advance human knowledge and well-being.
The tension between these two trends is clear. Most privacy laws acknowledge and address that tension. While privacy laws aim to restrict harmful data practices, they typically also are designed to allow for, or even encourage, uses of personal information that are beneficial and valuable to the individual or society. The inherent tension is often resolved by including reasonable exceptions in the laws to allow for necessary or beneficial data uses. But these exceptions are not complete exemptions from privacy obligations; even such beneficial uses of personal information typically remain subject to other protections in privacy laws such as an obligation to maintain the security of the data.
This article addresses how privacy laws can and should allow for scientific research while still providing meaningful protections for personal information. Part I discuses key principles found in many privacy laws and how each can potentially impact scientific research. Part II describes several prominent privacy laws across different jurisdictions and how each addresses research as a type of data use. Part III briefly discusses the distinction between academic or public-interest research and commercial research. Finally, Part IV provides specific recommendations to lawmakers and regulators on how privacy law should address and accommodate scientific research.
Keywords: privacy, data protection, research, science, big data, machine learning, artificial intelligence
Suggested Citation: Suggested Citation