The recent introduction of the European Union General Data Protection Regulation (GDPR) on 25 May 2018 will no doubt have a range of implications for anthropological research and practice, but what will the extent of these implications be and how can we expect them to shape future work and methodological developments? In early May, I spent an afternoon at a half-day workshop, hosted by the School of Oriental and African Studies (SOAS), University of London, which set out to clarify the recent legislation and tackle the issues and challenges born at the interface of new regulatory frameworks, technological advancements and anthropological fieldwork. In this article, I set out to report and reflect on the workshop and the possible futures, both hopeful and murky, that we are being propelled to by the evolving legislation of governance.
What Is the GDPR?
By now, in Europe, our inboxes have been flooded with e-mails similar to Figure 1 alerting us to the update in privacy policies and requesting consent to continue using our personal data for marketing purposes. The effect of the GDPR has been widespread from inboxes to cookie flags at the bottom of websites to university data guidelines. The most practically elucidating part of my afternoon at the SOAS workshop centred on getting to know the GDPR as a piece of legislation, most of which appears to be targeted at companies, such as Virgin Trains East Coast, but some of which affects research communities globally. The bare bones of the new legislation consists of an attempt to establish further transparency and accountability about how data is processed and used and to provide enhanced rights for individuals. In doing so, the GDPR gives individuals greater controlover their personal data and strengthens their previous rights from the Data Protection Act while also unifying European data protection rules and requiring data controllers to provide clarity about how and why personal data is being processed. It also inhabits a section of law, data protection, that is particularly fluid, which means that interpretations are variable and potentially subject to change.
The articles pertaining to the grounds for processing personal data, the territorial scope of research, and anonymity are pertinent to anthropologists, and provide the best spaces for consideration and critique. The primary grounds for processing personal data, for example, may no longer require consent from the data subject; instead, it could be obtained if research is deemed to be in the ‘public interest’, and this presents a contradiction: pursuing this clause as the primary grounds for processing personal data removes power that individuals have over their rights, even though the new GDPR is centred on their protection and enhancement. Put simply, who decides what is in the public interest and what is not? Since the GDPR’s adoption, research councils and universities alike have taken on the public interest data processing clause, and reactions from the anthropological sphere have been mixed. One attendee at the SOAS workshop declared that processing on the basis of public interest ‘makes us no better than journalists’, while some may see the change as providing a legal basis for established anthropological research methods and ethics. If the latter is true, then we find our answer to the eponymous question, and anthropologists can now focus on the logistics of including the public interest clause on their consent forms, which is required under the GDPR.
Consent is an area in which the new legislation will likely affect how anthropologists conduct ethno-graphic studies. The processes for consent in ethnography and in the GDPR are at odds: while the former is fluid and negotiated, the latter is rigid and concrete. In anthropology, informed consent is gained, sometimes verbally, and then negotiated and renegotiated as fieldwork progresses and evolves; there is an understanding built into the procedure that a researcher does not always know what will happen in the field and how the scope of enquiry will extend and expand. Under the GDPR, clear and affirmative consent must be gained for every research activity with a signature obtained on the dotted line of a long form. While safeguarding the identities and rights of participants is at the core of each process, it will be difficult for us as anthropologists to abide by the GDPR legislation when we are asked to obtain consent for research activities that we do not yet know about. Discussions at the SOAS workshop revolved around how the GDPR’s notion of consent conflicts with the traditional anthropological method of participant observation and around what we, as practitioners of anthropology, should use as a basis for data processing if clear, affirmative consent is difficult to obtain. There were also more specific concerns raised at the workshop about the feasibility of using paper consent forms or recording verbal consent amongst activists and groups experiencing political pressure, where symbols of bureaucracy and governmentality might induce mistrust.
Within the bounds of the new legislation, the anthropological consent process and its documentation, which are often connected to the relationships built during intensive fieldwork, the nature of research collaboration, and the act of co-producing findings have the potential to be thorny issues. There was a common thread during the SOAS workshop that focused on how the GDPR will alter research collaboration and co-production, on how it will affect the territorial scope of research, and on under what conditions it will be applied geographically. Plainly put, the GDPR applies to:
- EU researchers collecting and storing data in the United Kingdom or elsewhere;
- EU and non-EU researchers collecting data outside the United Kingdom but storing it in the United Kingdom; and
- Non-EU researchers collecting data on EU citizens, regardless of where it is eventually stored.
The GDPR does not apply when non-EU researchers collect and store data outside the United Kingdom, but many attendees were curious about collaborations between EU and non-EU researchers and how the legislation might impact on what and how ideas and data are shared. As with previous data protection laws, we must be aware of how to store and share data securely, despite the lure of new technologies streamlining international communication. Moving forward, ownership of ideas and authorship in research conducted on a global scale may need to be re-navigated and renegotiated, particularly in the light of the increasing preference amongst scholars for collaboration (both within and across disciplines) and data sharing.
Because the GDPR works to enhance transparency and accountability for individuals and their processed data, open-access or sharing research will likely become progressively desirable, if not necessary. Durham University’s website, for example, reads: ‘Broadly speaking the University defines research as being in the public interest where the outputs of the research will be made publicly available without undue restriction’. The prospect of sharing all the aspects of research – including field notes – sparked a discussion at SOAS around the nature of anthropological research, recording field notes, and anonymity. What changes when we write field notes not just for ourselves but for others, future and unknown? This matter should be scrutinised, especially if anthropologists deposit research into the United Kingdom Data Archive (UKDA), an archive that manages social science and humanities research and makes it available to other researchers. Currently, anthropologists seldom deposit their work into the archive, since we cannot confirm the anonymity of our participants, a key requirement for maintaining open-access projects on the archive. Depositing into the UKDA is not strictly required, but, as Edward Simpson provocatively pointed out, what if we have to do it in order to obtain funding? Archiving implicates three areas of data management – informed consent, protection of identities, and regulation of access – in pursuit of providing a service that is ‘as open as possible, as closed as necessary’. In order for anthropologists to engage with this framework, we must unpack how our ways of doing research negotiate and ensure each of these processes, an exercise that has the potential to illuminate where our research does not mesh with the new legislation. It is only then that we can visualise the archived research project – where we have already unfolded and refolded our questions and wrangled the study documents, field notes and transcripts into a cohesive whole – ready to be audited by data managers and then neatly put on the proverbial shelf for later consideration.
Complying with the GDPR and archiving anthropological research require a more thorough consent process, which must now detail exactly what participants are giving consent for and must encompass participation, personal data usage and future information usage by others. As a researcher with the National Health Service (NHS), this granular consent process is typical for recruiting on clinical sites and necessary in order to obtain ethical approval to do so, even if this framework is ill-fitted for ethnographic projects. There is often tension between the phenomenological nature of anthropological research and unbending ethics procedures, which may not identify the extent to which reflexive practices remain central to and ground anthropology. In the GDPR, there are similar tensions when it comes to data sharing and anonymisation, which run counter to the self-governance that anthropologists employ during research and practice. There are several ways in which anthropological research is regulated. One way is through the Association of Social Anthropology’s (ASA) code of conduct, which provides an ethical framework that relies on the researcher’s own ideas of good governance and acceptable practice. The ASA guidelines emphasise that the researcher is at the centre of this ethical practice through being reflexive and receiving strong training, which should establish moral obligations, such as ensuring protection and trust, avoiding intrusion, and negotiating consent and relationships. These moral obligations and negotiated relationships engender the ‘meaningful involvement’ of individuals in research and can facilitate the co-production of data and analysis. What if these discipline-related moral obligations contradict the GDPR? We promise to ‘do no harm’ as anthropologists, but what if sharing research findings becomes harmful? Moreover, how does total anonymisation affect co-production in research and the intellectual property rights of participants, and would these two things still be possible?
Despite this loosening of data-processing grounds, there are other articles within the GDPR that broaden the definition of anonymity to better serve the protection of identities and data. Sharing on an archival platform is easier said than done, and it is not built into the research procedures of ethnography. Field notes are often personal and messy, and are often replete with details about places and people. Anonymisation is a hazy place to stand as an anthropologist. Complete anonymisation murkies the waters for anthropologists. The GDPR clearly states that both direct and indirect data that can lead to identification fall within the realm of personal data, and thus efforts must be made to absolutely anonymise this information. Codification with a master key will not suffice – this is called pseudonymisation – the key must be destroyed in order for complete anonymity, though, if personal data now includes indirect information, can we ever truly anonymise data?
Pseudonymisation, as David Mosse pointed out during the SOAS workshop, is inherent in anthropological practice, but ‘un-naming’ has repercussions – once the master key is destroyed, so is the individual’s identity in the research, which can never be reclaimed by that person or their family members. The cleansing of personal data, direct and indirect, remains a mammoth task for qualitative researchers, but, realistically, is it even preferable to sterilise our research reports? Stripping away the personal data, particularly indirect personal data, arguably strips away the person, and anthropology is built upon writing about people, their lives, their practices and their being, so what would be left to deposit into an archive once those details are erased? Furthermore, there are issues with the anonymisation of those who explicitly do not want to be anonymous. Activists, for instance, may wish to remain named, in essence refusing to become ethnographic and retaining their identity as a political and personal force that cannot be generalised.
Anonymisation and the protection that it hypothetically provides are further convoluted when participants become unhappy with or object to research findings. A prominent example is, of course, Nancy Scheper-Hughes’s ethnography (1979) of a rural Irish village exploring the high rates of hospitalised mental illness in the country. The monograph received the Margaret Mead Award, but alighted controversy in the United States and Ireland. A journalist subsequently identified the village after asking local people and published a series of articles in The Irish Times. Two decades later, Scheper-Hughes retuned to the village only to be quickly forced to leave, an experience which she poignantly recounts in an article (2000) that reflects on her research, the following controversy and the nature of intrusion, protection and anonymity in anthropological research. It is an intimate account that is critical of reflexivity, citing its shortcomings in trying to peel back our own subjectivities, and it charges the practice of anonymisation with rendering our writing less altruistic and more beneficial to the researcher:
Still, were I to be writing the book for the first time and with hindsight, of course there are things I would do differently. I would be inclined to avoid the ‘cute’ and ‘conventional’ use of pseudonyms. Nor would I attempt to scramble certain identifying features of the individuals portrayed on the naive assumption that these masks and disguises could not be rather easily decoded by the villagers themselves. I have come to see that the time-honoured practice of bestowing anonymity on ‘our’ communities and informants fools few and protects no one—save, perhaps, the anthropologist’s own skin. And I fear that the practice makes rogues of us all—too free with our pens, with the government of our tongues, and with our loose traditions and interpretations of village life.(Scheper-Hughes 2000: 128)
‘Naming’, then, creates the possibility for more robust fieldwork and reporting of findings, and it enhances the ethical conduct of researchers who, without the protection of anonymity, can no longer conceal poor evidence. It is an exercise in transparency, which the GDPR espouses, albeit from a very different viewpoint.
Like Nancy Scheper-Hughes, both Edward Simpson (2016) and David Mosse (2006) have encountered and written on participants’ objections to their ethnographic work, meditating on the ‘general disparity between how critical social anthropologists describe the world and how others see the world as working’ (Simpson 2016: 118) and on how the protection and preservation of anonymisation are associated with this gap. Jan Nespor (2000: 549) neatly sums up the issue:
Anonymization protects participants from identification and consequent harm or embarrassment only insofar as local people have no objection to what’s written (or cannot be bothered to read it) and what’s written is of too little import to attract the scrutiny of outsiders.
The relationships between the researcher, the participants and the findings appear to dictate how anonymisation functions, while the relationship of the outside world to research output establishes who ultimately benefits from anonymisation and indicates the reach of published work. At the SOAS workshop, David Mosse proposed that anthropologists be more judicious with anonymisation, discerning how partnerships and ownership in research and knowledge production are adjusted by the extent to which we ‘protect’ identities. Anonymising should not affect collaboration, particularly with organisations, nor should it imply that collaboration was not desirable; however, we should be concerned that the total anonymisation of participants and places diminishes co-production in research and the dissemination of research, in that we cannot co-produce with those who have been permanently un-named. Moreover, the anonymisation of indirect personal data implicates geographical area and period in history, effectively disassociating time and place, which has ontological and political ramifications (Nespor 2000). Can we understand how the hospital copes with changes to service implementation if we do not know the sociopolitical history and location of the hospital? Given these intricacies of identity, time, and place, anonymisation, especially in the new legislative context, demands more critical anthropological engagement.
We must adapt, but how much before experiencing further limitations to the subjects we explore and the communities with which we interact? As Edward Simpson pointed out at the SOAS workshop, codification and institutional demands often render meaningful action increasingly difficult, if not impossible, as they impose conflicting demands on social scientists, and this tension is apparent in our treatment of anonymisation – or rather pseudonymisation – and the expectations of the GDPR and the archival framework. It appears that Simpson is on the right track in suggesting that we need lawyers, not ethics committees, to help us navigate the complexities of the legislation and how we adhere to it. To coexist and thrive, we will need to have an honest, consistent dialogue with data managers and a retooling of disciplinary frameworks of conduct, but this is merely a starting point. The ASA, for instance, is looking to amend its guidelines, with consultation amongst its membership expected in the coming year; however, this and future discussions about the GDPR will soon need to bridge over to solutions concerning student training, research methods, funding and archiving.
When the day closed at SOAS, questions remained about what the GDPR actually means for anthropological practice, as opposed to what it could mean. There was a general consensus that the impact would be distributed generationally: seasoned researchers will need to adapt their practice and train students differently, and graduate students, both current and future, will need to find innovative ways to gain funding and manage their work in the face of potential legislative challenges. I left that evening feeling informed but unsatisfied about what to expect realistically and what a ‘precise’ discussion about anthropological practice under the GDPR will entail. The public interest clause, for example, will likely continue to be problematic, no matter how much we charge the GDPR as legislation that brings power back to the people. These unanswered concerns, and the many I have raised above, leave the future murky, and I wonder whether my fellow attendees also felt the weight of the unknowns.
Despite the murkiness that it creates, the GDPR offers new but not entirely unfamiliar spaces for anthropologists, who, as a habit, discuss the ethical implications of ethnography and the role of anthropology in the public sphere. Conducting research and processing data in the public interest gives weight and explicit legality to arguments about the legitimacy of the field, while encouraging greater participation in archives provides visibility and fills in the gap of publicly available knowledge. After all, why should publicly funded anthropology not be publicly available? There are more personal reasons to embrace archiving and by default compliance with the GDPR; field notes can function as a way to curate a body of work and offer readers the chance to understand the research through the writer. Despite the beauty and richness of building ethnographic records, the reality of archiving studies and field notes could alter the nature of co-production in research and become a burden, especially if they are of little interest to future readers or if they take on unintended meanings. The question remains whether there is space to rectify these two views. This atmosphere of dissonance is prevalent in the ongoing discussions. Issues of harmonising the traditions of anthropology and the demands of the GDPR and with how we rise as a discipline to meet the ensuing challenges will undeniably usher in a new dimension to how anthropology engages with the public.
Mosse, D. (2006), ‘Anti-Social Anthropology? Objectivity, Objection, and the Ethnography of Public Policy and Professional Communities’, Journal of the Royal Anthropological Institute 12, no. 4: 935–956. doi:10.1111/j.1467-9655.2006.00371.x.
Scheper-Hughes, N. (1979), Saints, Scholars and Schizophrenics: Mental Illness in Rural Ireland (Berkeley: University of California Press).
Simpson, E. (2016), ‘Is Anthropology Legal? Earthquakes, Blitzkrieg, and Ethical Futures’, Focaal – Journal of Global and Historical Anthropology 74: 113–128. doi:10.3167/fcl.2016.740109.