A top data protection expert has described Graduate Students’ Union (GSU) President Gisèle Scanlon’s decision not to share survey data with the TCD PhD Workers’ Rights Group as “very valid”.
Scanlon has come under fire from the rights group for refusing to share the findings of the survey, which was carried out to understand the effects of the coronavirus on PhD students.
Simon McGarr, the director of Data Compliance Europe, said that the decision was valid, since the data collected could potentially be used to identify the respondents.
Under GDPR – the stringent EU data protection regulation introduced in 2018 – respondents to a survey must be told how their data will be processed before their responses are collected.
In this instance, respondents to the survey were told that the survey was “anonymous”, and that no personal details would be collected.
However, McGarr told The University Times that the data provided by the respondents could potentially allow for their reidentification, and thus may not be anonymous – even if the survey did not explicitly ask for their names or email addresses.
Because this is contrary to what respondents were told when their data was collected, this could mean that processing the data would be unlawful. This could impede even the release of the data in aggregate form, such as in an infographic.
“Processing means doing anything with the data,” McGarr said. “If it turns out to accidentally collect personal data, and unfortunately, due to the manner in which you designed your survey, you mix in questions that were collecting sensitive personal data with sufficient other questions as to create the ‘guess who’ problem, then it seems to me like you’re now in difficulties.”
Several of the questions – such as those that asked respondents where they were from, what faculty they were studying in, what the duration of their PhD was, what year they were in, and what age they were – could conceivably allow for reidentification.
“Legitimately you have difficulties in respect of the processing of that data in a public way and the sharing of it”, he said.
He added: “If I were in the position of being the person who was the data controller or joint controller, I would be extremely cautious with this raw data.”
McGarr also warned that, if a group running a survey “inadvertently” gathered personal information, they “absolutely shouldn’t share them on”.
Instead of releasing the information, Scanlon set a list of conditions of use for the information, which the rights group said they could not abide by.
Scanlon had previously approached the College solicitors and data protection officers for advice, and they had given her a template data sharing agreement on an informal basis, while emphasising that the GSU should take its own independent legal and data protection advice.
“You really need to move into the frame of considering doing a DPIA – that’s a data protection impact assessment – which is meant to be done before you do any processing of sensitive personal data,” said McGarr.
“You should do an assessment and see whether or not the processing you intended originally is still appropriate.”
McGarr said that it would only be appropriate to use the data in a survey if the information given to participants prior to carrying out the survey is agreeable to them – and “that the usage matches exactly what it is you actually do”.
McGarr, a solicitor and renowned data protection expert, is often called on by the media to speak on matters related to GDPR. He has been central to landmark legal cases involving EU data protection, including the Schrems I case at the European Court of Justice.
In a statement to The University Times, Chair of the TCD PhD Workers’ Rights Group Thomas Dineen said: “We are the shared owners of this data. We should have access to it and we commit preserving the anonymity of participants.”
“As co-owners of the data, we have as much a right to publish the survey report as the GSU has to lobby college with the survey information”, he said. “Furthermore, there is an important distinction to be made between the survey report and survey data.”
“We never intended to publish the data – only a summary report of the data. The GSU and the [TCD PhD Workers’ Rights Group] agreed that the survey report would be released as a publicly available infographic document and the survey participants consented to this. It’s totally unacceptable for the GSU to revise the terms of our collaboration after the fact.”
“As a point of further clarification, we would contest that any single participant would be identifiable in the survey report.”
Scanlon did not respond to a request for comment by the time of publication.
Update: 12:17, November 13th, 2020
This piece has been updated to reflect the fact that when Scanlon approached Trinity’s data protection officer and College solicitors for advice, they gave her a template data sharing agreement on an informal basis and emphasised that the GSU should take its own independent legal and data protection advice.
