Poorly designed ethics regulation has long obstructed social scientists¡¯ mission to inform publics and policymakers about current social and economic conditions. This role is only becoming more vital as misinformation circulates ever more freely. But fulfilling it is only getting harder.

In particular, a new threat is emerging from the European Union¡¯s General Data Protection Regulation (GDPR), adopted in 2018.

The GDPR controls the collection and retention of European citizens¡¯ personal data by private and public organisations. It was mainly intended to protect individuals from commercial abuses, but some clauses also affect data used in social research.

In France, for instance, it extends a 1978 law with similar objectives, which created a regulator, the Commission Nationale de l¡¯Informatique et des Libert¨¦s (CNIL). With the exception of some large national surveys, social research was not affected by this law. But the GDPR has a more expansive remit and every French university and research organisation now has a named data protection officer (DPO) to oversee its use of personal data ¨C accountable to the CNIL for compliance with both European and domestic law.

51³Ô¹Ï

There is a similar situation in other European countries ¨C including the UK, which, despite leaving the EU, is bound by its own of the GDPR. However, overcompliance with the law is a peculiarly French phenomenon.

The GDPR covers all kinds of directly or indirectly identifiable personal data. Research leaders ¨C group directors and principal investigators ¨C are required to define the purpose of any data processing; explain its legal basis; specify the period for which data will be retained (which needs to be the shortest period necessary for the project); and show that data collection is limited to what is strictly necessary.

51³Ô¹Ï

They must also describe how data security will be ensured (such as by anonymisation) and how they will inform research participants about the project¡¯s purpose: who is responsible for it; how data will be used; how they can exercise their rights to access their data, have it deleted or corrected; and how their consent to participation will be documented.

Apart from the bureaucratic burden of doing all this, the regulations about informing research participants and obtaining consent are difficult to implement when a project requires some informality in the relationship between researcher and researched. Having participants sign a legally exhaustive form is unrealistic in such circumstances, but not all French DPOs accept an audio recording of consent ¨C which would be acceptable to many ethics regulators in other countries.

Moreover, the regulations make fieldwork more difficult. Anthropologists and sociologists who use interviews or observation must create data management plans before they can start. If they take field notes, they must quickly transcribe these into a text file, removing all identifiers, and then destroy the originals. They can only create a document to link edited data and original identities if this is kept securely. And they may retain their notebooks only on condition that all identifying details are obliterated, even if this makes analysis difficult.

The GDPR also presents problems in its concern to protect ¡°sensitive¡± data, on subjects such as health, racial origin, sexual identities and religious, philosophical and political opinions. If such data ¨C or data on ¡°vulnerable¡± populations, such as children or the elderly ¨C?is to be collected, the project must pass a DPO ¡°privacy impact assessment¡±, both before it can start and while it is running.

51³Ô¹Ï

The pressure for conformity is increasing because research leaders are personally responsible for every project¡¯s compliance with the GDPR. The regulation does provide exceptions for research carried out by public bodies. If, for example, it would be impossible to get the written consent of participants for sensitive data collection ¨C or if doing so would seriously jeopardise the investigation ¨C a derogation can be obtained from the CNIL by proposing other ways to protect data.

But much rests on the discretion of national agencies and local DPOs. In the UK, advice to researchers tends to be pragmatic and emphasise the available exemptions. French DPOs frequently have a legal background but a poor understanding of social science methods and objectives. Hence, they tend to adopt a risk-averse interpretation of the law and may reject a project simply because they have not understood the proposed approach.

Moreover, their offices are often understaffed, resulting in a rapid turnover of personnel and little organisational memory. An application for an exemption is likely to delay a project by six months ¨C or more if the data has to be shared between several research groups, each requiring local DPO approval.

Institutional ethics committees add further delays. It is not essential to have approval from one in France, but many international English-language journals require it. The problem is that ethics committees often require clearance from a DPO before they will review a project ¨C and sometimes even add requirements if they think the DPO has been too lenient. The time it takes to negotiate all these regulatory hurdles may make it impossible to carry out a project at all.

51³Ô¹Ï

The European Commission is currently reviewing the GDPR. In doing so, it should reflect on the fact that while the regulation provides valuable protections for EU citizens, it is inhibiting them from becoming well informed about the economic and societal issues facing the continent. And it would be naive to assume that this problem will remain confined to France; indeed, it is already spreading beyond its borders.

If the commission really wishes to encourage social science research to improve the lives of European citizens, it must create more explicit exemptions within the GDPR. Otherwise, research will continue to be suffocated by the risk aversion of university managements and DPO lawyers.

51³Ô¹Ï

is deputy director of IRIS (Interdisciplinary Research Institute on Social Issues) and ma?tresse de conf¨¦rences (senior lecturer) at Universit¨¦ Sorbonne Paris Nord. is emeritus professor of sociology at Nottingham Trent University and emeritus professor and founding director of the Institute of Science and Society at the University of Nottingham.