Data Protection in Sociological Health Research: A Critical Narrative about the Challenges of a New Regulatory Landscape

Abstract

The recent implementation of the General Data Protection Regulation (GDPR) establishes a set of formal requirements that reinforce personal data protection, namely, those concerning the collection, treatment, and dissemination of data on research participants. With the application of this new legal provision at the European level, new types of restrictions are emerging, whose nature and reach intensify the tension between demands for privacy and scientific freedom in research. In this article, we take as a reference an ongoing research taking place in Portugal, in the field of Sociology of Health, concerning the consumption of medicines by professionals exposed to high-performance pressure. Our main objective is to identify and analyse the implications of regulatory challenges faced in the research process and how the researchers managed and overcame them. We present a critical narrative that sheds light on the nature of the choices taken while also assessing the practical implications for the operationalisation of the research. We conclude by noting that, despite the benefits that may flow from the application of GDPR, the new requirements regarding the protection of personal data may override the ethical principles of scientific research and strengthen regulatory restrictions on conducting research. In the research concerned, the significant practical implications were indirect access to participants, a more time-consuming process in terms of participant adherence and a temporal discrepancy between the different stages of recruitment.

Keywords

data protection regulatory challenges research ethics sociological health research

Introduction

Scientific research is, currently, framed by the latest regulatory instruments for data protection. Since 2018, with the application of the General Data Protection Regulation (GDPR) at the European level, questions regarding the protection of research participants’ personal data have increased, in particular those of identifiable or sensitive nature (EU GDPR).

As a regulatory framework that aims to harmonise the national laws of its member states, the GDPR emerges as a legal directive to regulate the collection and processing of personal data in all countries of the European Union (EU) and Liechtenstein, Norway, and Iceland. The rationale of this EU Directive (2016/680) is to give every citizen of the EU, as well as the European Economic Area (EEA), the right to control his or her personal data.

This new regulation covers all data types that can make any person identifiable, regardless of their importance or sensitivity (Lauber-Rönsberg, 2018). The result is a broadening of the concept of personal data, which makes its use much more restrictive and the procedures for its processing and circulation more demanding.

Although the GDPR was not created to address scientific research issues specifically, it has impacted the development of these activities. In the specific case of health research, these new norms have reinforced the complexity and bureaucracy of a regulatory landscape that was already imposing concrete and standardised ethical guidelines, namely, those derived from the foundational model of bioethics that has been developing since the 1970s. The normative principles of individualism and autonomy, with their focus on privacy protection and integrity, as well as the defence of participants against alleged harmful consequences resulting from biomedical research and experimentation, have become a landmark in establishing forms of regulation and scrutiny in the health research community (Iphofen, 2020; Orfali and DeVries, 2010; Raposo, 2020). Therefore, based on these same principles, ethics committees evaluate (and eventually approve) research instruments and procedures to safeguard the rights of study participants.

However, by giving substantial privilege to the principles of protection of the individual, this dominant ethical framework has allowed the development of a type of regulation that is not always the most appropriate to the reality of research carried out in some areas of the social sciences (Hammersley, 2010). This aspect is relevant because, when considering human research, we must recognise that the risks of clinical research and social sciences research are different (Lauber-Rönsberg, 2018). In the latter case, and given the distinct nature of the interventions, the potential dangers to the research subjects are lower, since they are not the object of experimentation, namely, biological experimentation.

Regarding these differences, we may consider that, although transversal to all scientific research, the restrictions imposed by GDPR end up having a very marked restrictive scope in the social sciences. They reinforce some constraints of the predominant model of ethical regulation in health, mainly those concerning the normativity of the model of protection of the integrity and privacy of the subjects. In other words, the model constitutes itself as a dogmatic requirement that is not always flexible to other research designs and methodological options (Hoeyer et al., 2005).

Putting the discussion on a more general level, we can consider that one of the critical aspects of the above-mentioned regulatory developments is the growing tension between the new demands for privacy and scientific freedom. Any research that intends to use personal data now faces a new set of restrictions, whose nature and scope make it potentially obstructive for the research itself. Therefore, regardless of the diversity of disciplinary traditions in a domain such as health, this new legal framework paves the way to balance research and privacy interests – a balance that, of course, must be carefully assessed.

On the one hand, we acknowledge that the growing concern about data protection is understandable and welcome, given the technological developments that allow new possibilities for aggregating, analysing, and disseminating data (e.g. in social media), as well as new possibilities for managing and storing information (Lauber-Rönsberg, 2018; Vieira et al., 2020). However, on the other hand, the pressure for scrutiny over academic work has increased, reinforcing already established ethical frameworks and setting more regulatory requirements for scientific research. As a result, an intricate reconciliation process arises, as the restrictions now placed on personal data protection make it challenging to achieve the values inherent to research. The freedom of choice on how to obtain the data, define the populations to be studied, the methodological options taken, and the freedom of conceptualisation can thus be conditioned by a set of constraints that conflict with the premises of scientific research (namely in the social sciences), opening space for it to become more defensive or less innovative (Derbyshire, 2008; Kent et al., 2002; Reed, 2007; Truman, 2003; Van den Scott, 2020; Vieira et al., 2020).

For the reflection launched by this article, it thus becomes critical to understand to what extent the legal intention underlying the GDPR reinforces the conflict between the demands of privacy and the nature of scientific research, namely, within disciplinary traditions such as sociology. The latter, like other social sciences, builds its ethical questioning and its respective methodological options reflexively on the assumption that access to data and the guarantees of anonymity are established through a plurality of procedures (depending on the nature of the investigation) that is not limited to the standardised rigidity of institutional mechanisms of scrutiny. Therefore, the discussion here proposed does not intend to be critical to the vital goal of protection of subjects but to the ‘blind’ implications that might ensue for research. The strengthening of legal safeguards and their extension to everything that may constitute personal data closes gaps in some spheres (such as commercial). However, at the same time, it creates overlaps since scientific research is already bound by principles and rules of respect for anonymity and privacy of participants.

To clarify what the GDPR framework consists of and what implications – potential and manifest – it has for research, our reflection will examine the case of an ongoing project in the field of Sociology of Health developed in Portugal, focusing on medication consumption by professionals subject to high-performance pressure, namely, nurses, journalists, and police officers¹. The fieldwork is based on a mixed-methods model: focus groups, questionnaire surveys, and semi-directive interviews. In this article, we will focus exclusively on the quantitative component of the research, emphasising the obstacles, challenges, and solutions adopted that had an impact on three particular stages of the work: the stage of access to participants, the stage of applying the questionnaires, and the stage of managing the implemented alternatives.

Therefore, based on this reference, we will develop a critical narrative that sheds light on the choices taken in the context of greater regulatory bureaucratisation while assessing its practical implications for the research. From its conception up to the later development, the research had to incorporate and manage not only the demands resulting from the current regulatory landscape but also the effects of the implementation of the GDPR by the time of the effective start of the project (i.e. after its methodological conception and scientific approval). In doing so, we focus not so much on results as on research processes and practices (Duke, 2002), which provides an opportunity to reflect on the constraints and dilemmas posed by regulatory restrictions on the conduct of research.

In the critical discussion, we highlight how this example illustrates the difficulty of balancing the scientific rigour intrinsic to sociological research and the pragmatic need for adaptation and (re)invention to accommodate new mechanisms of ethical scrutiny and regulatory practices that affect the study design and methodological options available. Due to their bureaucratic and restrictive nature, these constraints can result in multiple procedural compromises that may distort the research process’s fundamentals. Finally, we try to draw some relevant conclusions to discuss the practical implications of the GDPR for research in sociology. The current ethical norms that guarantee the anonymity, or protection, of the participants (assuming them as intrinsically vulnerable) can at times be ill-adjusted to at least some forms of research – in particular, those whose methodological strategies cannot be divorced (without loss) from the non-aprioristic character of research stages or even from interpersonal relationships and trust built in situ between researchers and participants.

GDPR – between the old and the new

Despite the recent implementation of this new legal provision, concerns about the procedures for processing personal data collected in several spheres of public life are not new. These concerns stem from broad social transformations related to a new era that Castells (1996) called Information Era and that, more recently, Andrew and Baker (2019) have called Vigilant Capitalism. The advancement of computer science and technological surveillance (strongly anchored in the analysis of large amounts of data [Big Data] coming from the personal use of social media) highlighted the need to protect every person’s right to a space of freedom and security, and more specifically, his or her right to privacy.

To this extent, and regardless of the fact that many legal efforts have focused on commercial and business contexts, as areas where most possibilities for the misuse of personal data can become more relevant (Andrew and Baker, 2019; Vanberg, 2020; Vestoso, 2018), the legitimacy of scientific research has also been questioned with regard to the protection of the personal data of the research participants and their guarantees of privacy.

Strictly speaking, this theme matches a long-standing concern over the relationship between empirical research and social regulation (Vanberg, 2020; Vestoso, 2018). Still, its relevance has now increased. This explains the growing debate regarding the implications of data protection, especially those concerning the collection, treatment, and dissemination of data on research participants.

This debate is also concerned with some of the new challenges of the digital society. In addition to the individual’s active presence on the Internet, there is a need to regulate his or her passive presence, specifically when he or she is sought to participate in scientific research activities. A set of technological innovations that came to be associated with scientific research greatly contributes to this new reality, and it implies the adjustment of the interpersonal relationship between researchers and research participants towards a more complex relationship mediated by information technologies (Hennel et al., 2020).

As a result of this mediation, privacy and the protection of personal data become increasingly pressing issues. Information technologies provide an endless array of tools for the collection, processing and dissemination of personal data, whose boundaries are dangerously permeable to attacks and subversions. Technical innovation results in a much wider source of data, but also in new risks. Thus, in addition to the ethical commitment between researcher and participant, it is now necessary to regulate a whole new set of responsibilities, among which is the protection of personal data, especially in a digital environment.

It is in this context that the preparation of a data management plan is reinforced. In fact, within the scope of the GDPR compliance exercise, more than the contribution of technology as a tool at the service of the respondents’ privacy protection, the need for meticulous planning of all stages of the research process becomes clear. This plan specifies in detail the different aspects of data creation, storage, backups, documentation, and description, archiving, and preservation, as well as who will be able to access them, how to reuse them, and where they will be stored and preserved. That is, although the mediation of technology may occur in each of the specific moments of the research process, from the planning of the project to the presentation of the final results, the truth is that the management of the control over the whole process remains more human than ever. GDPR, more than regulating the use of technology in the service of research, has assigned responsibilities, not only institutional but also individual, on its proper use.

Guided by the principles of respect for the rights, freedoms, and guarantees of all individuals, the GDPR establishes a set of ethical commitments which, strictly speaking, were already imperative in any research plan. What the GDPR really reinforces, in a more systematic and legally binding way, is the need for expressed consent from the investigated participants. This means that the person whom the data are collected from should know how it will be treated, for what purpose, by whom, and what will its destination be in terms of storage and future use. The formal requirements of the informed consent establish that the data may not be processed in a manner that is incompatible with the purposes for which the data have been collected (GDPR, Art. 5 (1) b; Art. 6 (4)).

What the law, thus, attempts to ensure is that secondary uses of personal data collected, which were not foreseen at the time when consent was given, are prohibited. This poses increased challenges in the construction of informed consents, in that it is now required that the information provided can reflect the compatibility of future uses of the data collected with the initial purposes. This means that subjects should be able to give their consent (if they so understand and agree) not only for a particular research project, but more broadly for certain areas of scientific research, provided that these possibilities are not only contemplated but also properly backed by ethical standards (Lauber-Rönsberg, 2018).

In this sense, the possibility that data may be kept for their potential public, historical, or scientific interest turns out to be a beneficial aspect of this legal framework, which seems to be in line with several practical solutions that have recently been worked out, particularly in areas of clinical research, especially those that foresee the development of investigations with a long-term time horizon. In such cases, the figure of a temporally extended consent arising from an informed and voluntary action of the subjects may ensure the future management of the collected data and, thus, the dynamism of scientific research, even if the participants do not get to directly benefit from the results of the research to which they contributed (Krutzinna et al., 2019).

Potential impacts on scientific research

The implications of implementing the GDPR in the context of scientific research are diverse and raise relevant questions in terms of the execution of a research plan. In this regard, the EU has requested the production of monitoring reports to supervise the implementation of this legal norm. In 2019, the European Parliament’s Science and Technology Options Assessment produced a report evaluating the impact of the GDPR on scientific research in a European context, from a multi-methodological approach (European Parliament, 2019). The goal was to understand not only the risks and benefits of its implementation, based on the published scientific production, but also the doctrinal analysis of the related legal literature, as well as the social perception surrounding the application of the GDPR, based on the analysis of the media. This report reveals diverse, multifaceted, and complex impacts. Within the context of the EU, where the heterogeneity of the countries is unavoidable, the wide range of application contributes to these impacts, as well as the variations according to the scientific domain in question and the type of scientific activity under analysis. The aforementioned complexity is greatly amplified by the recent nature of the GDPR’s implementation, which makes it difficult to objectively assess its true impact.

Regarding the benefits of applying GDPR to scientific research, the study signals three main aspects: transferability, security, and trust. In the first case, the implementation of the GDPR allowed a harmonisation of data protection systems, facilitating international research collaborations. In the second case, the tightening of privacy and security measures in the elaboration of research plans is expected to clearly reduce data processing failures. Finally, the guarantee of security and the increased control over personal data by the research participants may result in an increase in public trust and a greater propensity to participate in scientific research projects, given the commitment to scientific integrity and research credibility.

As for the risks associated with the GDPR, three aspects are also identified: bureaucratic, ethical, and non-transferability. The first one, and the most noticeable and transversal, is that the GDPR imposes an exaggerated bureaucratic burden on researchers and research participants, particularly with the plethora of procedures to be carried out throughout all phases of scientific research, which are subject to approval by ethics committees. This excessive standardisation of all the rules and practices during the research process promotes less investment in innovation and creativity, which are intrinsic characteristics of scientific research. Second, ethical constraints may arise, particularly with regard to the informed consent process, which, from a dynamic and continuous perspective, may not be applicable (Wiles et al., 2007). It is possible that the participants, particularly in the field of health, give their informed consent, but as the investigation progresses, they cease to respond to the notifications, jeopardising the research work (Timmers et al., 2019). Finally, there are the negative consequences stemming from the ambiguity associated with the pseudonymisation of data. This particular risk is amplified by the fact that differences in terms of national regulations may prevent the transferability of data between countries whose regulations are not equivalent. There is also the ambiguity placed on how data were accessed in the period before the transnational implementation of the GDPR.

The potential impacts of GDPR on scientific research reflect the dual nature of its creation, since it was intended to facilitate the flow of availability of personal data without, at the same time, jeopardising its preservation (Chassang, 2017). To that extent, the risks and benefits associated with its implementation echo a set of challenges that needs to be reflected upon in the pursuit of any scientific research programme.

It is thus clear that the implementation of this regulation carries with it a set of new challenges. Any scientific research programme will need to make a clear assessment of the limits and possibilities of the investigation under the GDPR. This will be addressed in the following section, for the case of the ongoing research project previously mentioned.

The implications of GDPR for an ongoing research project – stages of a critical narrative

To illustrate the impact of the GDPR framework on an ongoing research project, we will present a sociological study in the field of health, taking place in Portugal since June 2018. The focus will be the identification of the changes and challenges that the process of implementing the framework²caused during the research, as well as of the practical choices adopted to make the project viable. In more operational terms, this presentation will be achieved through the critical evaluation of what were the three main stages of the research (access to participants, application of the questionnaires, and management of the alternatives implemented), since in each one of them we can assess the nature of the adaptations assumed. As a response to the new requirements regarding the protection of subjects, all the adaptations in question were evaluated to safeguard their compatibility with the rationale and methodological options of the research.

The idea of proceeding with what we have called a critical narrative stems from the assumption that a critical reflection on the vicissitudes of a study is an excellent opportunity to ponder the limits and possibilities of the scientific enterprise, in a context characterised by new dynamics, rationales, and requirements. It is an opportunity not only to locate the main constraints to the production of scientific knowledge, but also to evaluate the nature of the methodological foundations of scientific research and its operationalisation in the field – in particular, when the ‘real world’ of research requires flexible adaptations that are not always easily compatible with the prescriptive and codified logic of the protocols of ethical regulation (White and Fitzgerald, 2010).

This narrative is in line with the argument that research projects end up being, in varying degrees, what some authors call ‘messy areas’. Procedures (as well as the experiences they trigger) can be beset by hesitations, setbacks, dilemmas, or adaptations of various kinds, and resolution might be difficult or time-consuming (Cook, 1998, 2009; Humble, 2012; Law, 2004). It is true that the idea of ‘mess’ does not fit well with the traditional academic ideals of ‘well-ordered’ research (Cook, 2009: 279; Humble, 2012: 285), but to include ‘mess’ in research narratives is essential to recognise the ‘connections and complexities involved in research’ (Cook, 2009: 278). When honest and transparent reports contribute to make the ‘mess’ visible (Thomas-Hughes, 2018), researchers are better equipped to criticise, change, and eventually integrate research practices under development with the construction of new research knowledge. But above all, they are more aware of the conditions that really justify safeguarding the consistency and rigour intrinsic to the research processes (Cook, 2009: 290).

In the present case, as we shall see, the procedural fluctuations during the progress of the study are rooted in constraints that are diverse and mostly unavoidable. This sociological research ends up illustrating what is relatively clear today: there is a tendency to reinforce the formalisation and bureaucratisation of ethical regulation in scientific research and, consequently, a pressure for greater normalisation that does often not agree with the disciplinary characteristics of the Social Sciences (Hoeyer et al., 2005; Kent et al., 2002; Reed, 2007).

To this extent, it can be argued that the implementation of the GDPR only accentuated the constraints currently imposed on the multiple modalities of development of scientific knowledge. Although it was not the case for the present research, it is thus clear that the imperious requirement for privacy and data protection becomes an unequivocal normative burden, whose effects can limit scientific freedom, namely, but not only, the choice of themes, methodologies, or populations that, if not attuned to the regulatory framework, can be considered as ‘sensitive’, ‘maladjusted’, or ‘vulnerable’ in view of the codified rules (Hilário and Augusto, 2020; Van den Hoonaard, 2020; Vieira et al., 2020; Wiles et al., 2007).

The stage of access to participants – from planning to execution

The first stage of this critical narrative refers to the access to research participants. This was undoubtedly an important moment as it marked the beginning of the quantitative component of our empirical research. This stage was focused on the need to recruit participants from the three professional groups under study, for which collaboration protocols were planned, and subsequently signed, with the trade unions of the respective groups. Due to their independence from employers, it was considered that the trade unions could work as privileged gatekeepers in access to the professionals. On the one hand, they could convey the necessary trust to ensure the professionals’ participation in the study, and on the other, as a result of that trust, the responses should not be constrained and conditioned by unequal power relationships in work context. The main purpose of this plan was to have a more immediate and transparent access to the participants via the member’s databases of the different trade unions, with the aim of encouraging participation in the study.

This access was fully in accordance with the ethical requirements regarding the guarantees of anonymity of the participants, following the usual protocols of scientific rigour to which researchers are bound by their professional ethical framework, and also the institutional commitments that resulted from the project approval process by the financing entity and by the appraisal of the Ethics Committee of the proposing institution.

However, with the implementation of the GDPR, at a stage when the project had already started, the most immediate effect was preventing the project team from having direct access to the professionals’ contacts, forcing the researchers to look for alternatives to the original plan. This occurred as protocols were no longer sufficient for us to have access to professionals’ contact details. With the implementation of the GDPR, individuals are now required to give their express consent to be contacted by researchers (in line with the provisions of Art. 4, no. 11, which defines consent as a free, specific, informed, and explicit expression of will, by which the data subject accepts, through a declaration or unequivocal positive act, that the data concerning him or her will be processed). By giving such consent, there is then lawfulness in the processing of the data in accordance with the provisions of Articles 6(1)(a) and 7 of the GDPR.

Keeping the collaboration with the trade unions as planned, an additional step was needed. The solution found was to create a form on an online questionnaire application platform, to collect contacts of possible respondents to the questionnaire through an invitation to participate in the study, which the unions divulged to their members. If they agreed to participate, the individuals would insert, in a voluntary and informed way, their email address in the form. As for those who chose not to participate, their data were never made available to the team. Basically, the invitation itself met the requirements for informed consent at this stage of the research.

Concerning the importance of ensuring informed consent at various stages of the project (which may imply adaptations whenever necessary), and not just at the initial moment, Sin (2005) presents a case with some parallels with the study here reported, in the sense that the initial plan for the fieldwork met an impediment of access to the participants for reasons that could not be anticipated, resulting in the need to find new recruitment strategies through institutional intermediaries.

With the new rules imposed by the GDPR, members of the research team did not have access to the trade unions’ contact databases. The solution adopted was the creation of a new database managed by the researchers and for exclusive use in this research, through the online recruitment of participants, and with the trade unions as intermediaries. It was a fallback solution, one that has generated a growing reflection in the specialised literature, since it has been found that the resulting participation rates are relatively low compared to other methods, such as personal recruitment (Dodge and Chapman, 2018; Poynton et al., 2019; Sappleton and Lourenço, 2016).

The stage of applying the questionnaires – the challenges of participation

Given the realisation that the original planning had to be adapted to the above-mentioned contingencies, the focus shifted to a mediated online recruitment, in the sense that we became dependent on the trade unions to make an appeal for participation on our behalf.

According to the information provided by the trade unions on the total number of invitations sent to their members, the return on the participation rate was around 7.2%. This means that the return of the first round of invitations did not reach the number of participants foreseen in the sample design of our project (n = 750)³. While this is not entirely unexpected, given the increasing number of studies with multiple attempts to attract individuals, it indeed confirms a trend of decreasing willingness to participate in academic research (Sappleton and Lourenço, 2016; Van Mol, 2017; Vercruyssen et al., 2014; Vieira et al., 2020).

Given the limitations in recruiting participants online, it was necessary to enter a new phase, namely, sending reminders to try to increase the number of participants in the survey, response rates in studies, concluding, in line with other research findings (Fan and Yan, 2010; Sheehan, 2001), that they have a positive result.

Given the increasing bureaucratisation of the procedures necessary to reach participants in a mediated way, the length of the process was the first practical implication of this contingency. Indeed, although the sampling process was not yet completed in this initial period, it became necessary to begin the application of the questionnaire to individuals who gave their consent to participate in the study. This means that the questionnaire application stage took place simultaneously with the ongoing collection of contacts for our participants’ database. At this point, the procedure was sending the questionnaire as soon as consent to participate in the study was given. However, for participants contacted earlier, the gap between the moment of showing interest in participating and the effective application of the questionnaire may have had negative effects in terms of the response rate.

The questionnaires were sent by the research team without the mediation of the trade unions, to maintain the level of control essential for the integrity of the project. This heightened concern with control is based on the awareness that confidentiality and anonymity need to be guaranteed and, therefore, protected from any extemporaneous external interference.

An account on a web platform was used to create and send the questionnaires, associated with one of the proposing institutions, to ensure an institutional base. However, the use of a digital format raised an additional concern regarding the anonymity of the participants. The existence of a contact list of participants implies the possible identification of these same people. Even though many of the email addresses presented some kind of pseudonymisation, several others – especially those with institutional links – made it easy to identify their users by name, which is a kind of information that would not be available if surveys were conducted on paper, or in person, and that requires greater care in the archiving of data to preserve the anonymity of participants. It was decided that only one researcher on the project team would be responsible for managing these contacts. This same person organised the lists of each group and sent the questionnaires keeping with the rules to ensure the confidentiality of the answers, making sure that the software used had an anonymity function that automatically created an autonomous database where the answers were not linked to the email of the person who responded.

The stage of managing the implemented alternatives – a critical assessment of the implications

Another stage worth mentioning in the critical narrative under discussion concerns the practical assessment of the alternative solutions that have been implemented, especially in terms of their effectiveness to ensure the enrolment of research participants. Once the route of sending invitations and reminders by the trade unions was exhausted, there was a need to diversify the procedures, as the necessary number of participants had not yet been reached. The final stage was then the use of the snowball sampling method, by requesting some participants of the focus groups and the pre-test stages to forward the invitation to their colleagues. The anonymity was still ensured, since only our intermediaries knew the identity of the people to whom the invitation was sent. The team only received contacts that were voluntarily submitted by the new participants.

The snowball method was thus employed as a ‘support measure’ to reinforce the sample and access new participants when the previous routes were exhausted (Noy, 2008). However, the results continued to be unsatisfactory, which led to the need to extend the network to the personal contacts of the members of the research team. In this context, some contacts were collected, not through the access link in the invitation request, but in rather more informal situations in which the researchers themselves inquired, within their personal networks, about the existence of individuals matching one of the required profiles. These attempts sometimes extended to ‘friends of friends’ and contacts arrived, for example, via SMS or email. In other words, instead of new contacts tapering ‘vertically’ within the groups concerned, the solution was to take a more ‘horizontal’ approach, with researchers exploring their own social networks in a wider way (Geddes et al., 2018).

It should be noted that despite all the adaptations and attempts to overcome unforeseen constraints, their impact was not innocuous. The strategies adopted, particularly the expansion of the sample through the snowball method, have not been able to reverse the issue of low participation rates effectively, and the whole process has proved, according to the literature on this subject, to be very intensive and time-consuming. (Dodge and Chapman, 2018; Lozar Manfreda et al., 2008; Marcus et al., 2007; Poynton et al., 2019; Sappleton and Lourenço, 2016; Van Mol, 2017).

After 16 months of fieldwork (much longer than what was originally anticipated), we were able to collect 1046 willing participants, to whom we have sent the questionnaire. In return, we received a total of 539 responses (51.5%), a number which, irrespective of the objectives we set ourselves at the start of the research, was considered sufficiently robust to enable the analysis of the results.

Another constraint was, of course, the delay in the execution of the project, with implications at the stage of conducting the interviews, especially regarding the respondents’ adherence. The increased length of time between different moments of contact, and the resulting gaps, can be harmful to the motivation for involvement and participation in the study. This stage, which will follow the questionnaire application stage, depends on the contacts obtained through that route, since we asked participants to give us their personal contacts if they wanted to be interviewed in a later phase of the project. This means that, in some cases, we may contact individuals who, despite having answered the questionnaire and expressed their interest in being interviewed several months ago, may now not maintain their availability.

In this study, we can, in short, consider that although there were no restrictions on the freedom of the research, there was, however, a greater volume of bureaucratic constraints. The greatest constraint was the ‘forced’ procedural concessions imposed by the will to protect the participants. This resulted in several operational consequences, both in terms of a decreased control in access to research participants, with the delay inherent to these adjustments, and a reduced efficiency in terms of adherence to the questionnaire. In other words, these concessions reflect a challenging act of balance between fidelity to the methodological assumptions of sociological research and the pragmatic need to give up some operational options, to avoid compromising the viability of the research itself. The practical difficulties encountered (especially in access to participants) made it necessary to take several ‘precautions’ to respond to the complexity of bureaucratic requirements. These did not, however, completely eradicate the implications, which were also manifest in the application of the questionnaire. While not distorting the fundamental theoretical and methodological options, the nature of the constraints restricted the courses of action available, and implied that the research team had to manage the difficulties related to the prolonged time of application of the questionnaires, the relatively low number of responses during the time span of the process, and also the effects of the time gap between the response to the questionnaire and the availability of respondents for the stage of the interviews.

Final considerations

It is fair to acknowledge that the implementation of the GDPR has brought with it some positive aspects. Notably, greater clarification of the nature and sensitivity of personal data and a more significant legal commitment to the rights and guarantees of individuals in terms of the control they take over the use of their data. In the case of scientific research, the need for expressed consent from the investigated participants is reinforced in a more systematic and legally binding way.

We argue that the critical discussion is certainly not about the critical goal of protecting the individuals but about the potential blind implications that new regulatory requirements may have for the development of scientific research, which is already firmly bound to ethical principles committed to privacy and anonymity of participants. Therefore, what results from this is a new balance between the demands of privacy and the requirements of scientific freedom in terms of the operational possibilities for research development.

In the specific case of the critical narrative developed here regarding a sociological health research, we have chosen to develop a discussion centred on the vicissitudes of the research process itself, as these illustrate well the practical implications that the GDPR can trigger in the operationalisation of research. We believe that this critical narrative allowed us to develop some reflexive explorations of the research process itself, which is essential to understand better the dilemmas that are too often absent or lost in other methodological descriptions (Duke, 2002).

Considering the main practical implications that emerged throughout the stages of the quantitative component of the research, we can see that they all stemmed from the imperatives established by the GDPR concerning the protection of personal data. At each stage (access to participants, application of questionnaires and management of the alternatives implemented), new challenges arose. Each was managed to ensure the best balance between compliance with the new rules and legal requirements and fidelity to the scientific and methodological assumptions of the research. However, they were all consequential in their implications, which means that the procedural concessions assumed did not prove innocuous. As previously shown, it resulted in the more complex management of access to participants (because depending on unforeseen forms of mediation); a more time-consuming process in terms of participants’ adherence (because it implied the adoption of more alternatives and more intensive efforts for implementation); and operationalisation of this research component with time discrepancies between the different recruitment phases.

From the critical narrative here presented, we think that it becomes clear that the current strengthening of regulatory scrutiny accentuates the bureaucratic constraints in terms of research ethics, even if this does not necessarily imply the strengthening of ethical guarantees. With the approval of the GDPR, there is an increase of requirements and restrictions that tend to materialise in operational difficulties for the research, especially in epistemological and disciplinary traditions distant from the framework of clinical and biomedical fields – in other words, from the model that serves as a reference to many of the rules of institutional ethics that currently frame research.

While conducting research with ethical concerns is, to a large extent, a truism (Monaghan et al., 2013), it is clear that the increasing bureaucratisation of ethical regulation of scientific research generates paradoxical effects – in particular, when the intensification and normalisation of regulatory scrutiny may lead the scientific investigations to become, in fact, unethical. That is, when the detailed prescriptions and proscriptions lead the researchers to blindly follow the rules to conform to the norms and institutional demands and relinquish a truly ethical reflection in face of the concrete dilemmas of their study, according to the references of their own disciplinary traditions (Hammersley, 2010; Vermeylen and Clark, 2017) and the premises of their research cultures (Hoeyer et al., 2005). This is a trend that, particularly in the Social Sciences, is always potentially harmful, given that the ‘risk(s) of standardising procedures (are) contrary to the exercise of theoretical-methodological reflexivity to be observed in each new process of knowledge production’ (Vieira et al., 2020: 37).

With the increasing requirements for privacy and data protection arising from the GDPR, we consider it becomes pertinent (based on the sharing of research experiences grounded on critical and reflexive narratives, such as this one) to consider the virtues of other possibilities that may obviate the constraints of ethical scrutiny that is restrictive, bureaucratic and, above all, based on a single regulatory framework, indifferent to disciplinary specificities. This assessment is even more significant considering the tendency of institutionalised normative references to colonise the distinct traditions of scientific research and the consequent uniformity of the ethical and methodological questioning processes themselves (Raposo, 2020; Van den Scott, 2020; White and Fitzgerald, 2010). Therefore, and although they are useful and necessary, formal processes of bureaucratic review based on strict observance of the prescriptions should be just one part of the regulatory dynamic, which will be all the more virtuous the broader and more differentiated it is. That is, bound to the plural nature (in disciplinary terms) of scientific research.

This, however, requires a broader and more plural understanding of ethics itself, which involves assuming the ethical credibility of the professional codes governing the different disciplinary areas, as well as the diversity of the standards that guide its practices (Emmerich, 2016). As such, and in counterpoint to a ‘uniform’ and merely procedural ethics (Truman, 2003; Vermeylen and Clark, 2017), a major challenge becomes the transformation of ethical regulation from a bureaucratic moment to an open process of critical discussion within the research community (White and Fitzgerald, 2010), safeguarding that increased ethical scrutiny cannot imply the total capitulation of researchers’ authority and scientific freedom.

Footnotes

Funding

The author(s) disclosed receipt of the following financial support for the research, authorship, and/or publication of this article: This work was supported by the Portuguese Foundation for Science and Technology (FCT) (grant number: PTDC/SOC/30734/2017).

ORCID iDs

Hélder Raposo

Sara Melo

Catarina Egreja

Notes

Author biographies

Hélder Raposo is Assistant Professor of Sociology at the Lisbon School of Health Technology – Polytechnic Institute of Lisbon (ESTeSL-IPL) and a Researcher at the Centre for Research and Studies in Sociology at the Iscte – University Institute of Lisbon (CIES-Iscte), and at The Health & Technology Research Center (H&TRC) of Lisbon School of Health Technology – Polytechnic Institute of Lisbon. His research areas are in sociology of health, medical sociology, health professions, and therapeutic consumptions.

Sara Melo is Assistant Professor at the Higher Institute of Social Work of Oporto and is also a Researcher at the Institute of Sociology, University of Oporto. Her research areas are in social gerontology, social intervention by art, and research methodologies.

Catarina Egreja is a Researcher at CiiEM – Multidisciplinary Research Center of Egas Moniz. Her research areas are in higher education, migrations, and health.

References

Andrew

Baker

(2019) The General Data Protection Regulation in the age of surveillance capitalism. Journal of Business Ethics 168: 565–578.

Castells

(1996) The Rise of the Network Society. Malden, MA: Blackwell Publishers.

Chassang

(2017) The impact of the EU general data protection regulation on scientific research. eCancer 11: 709.

Cook

(1998) The importance of mess in action research. Educational Action Research 6: 93–109.

Cook

(2009) The purpose of mess in action research: Building rigour though a messy turn. Educational Action Research 17: 277–291.

Derbyshire

(2008) The ethical dilemma of ethical committees. Sociology Compass 2(5): 1506–1522.

Dodge

Chapman

(2018) Investigating recruitment and completion mode biases in online and door to door electronic surveys. International Journal of Social Research Methodology 21(2): 149–163.

Duke

(2002) Getting beyond the ‘Official Line’: Reflections on dilemmas of access, knowledge and power in researching policy networks. Journal of Social Policy 31: 39–59.

Emmerich

(2016) Reframing research ethics: Towards a professional ethics for the social sciences. Sociological Research Online 21(4): 16–29.

10.

EU General Data Protection Regulation. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46. Official Journal of the European Union of 4 May 2016, L 119/1.

11.

European Parliament, Directorate-General for Parliamentary Research Services (2019) How the general data protection regulation changes the rules for scientific research, Publications Office.

12.

Fan

Yan

(2010) Factors affecting response rates of the web survey: A systematic review. Computers in Human Behavior 26: 132–139.

13.

Geddes

Parker

Scott

(2018) When the snowball fails to roll and the use of ‘horizontal’ networking in qualitative social research. International Journal of Social Research Methodology 21(3): 347–358.

14.

Hammersley

(2010) Creeping ethical regulation and the strangling of research. Sociological Research Online 15(4): 123–125.

15.

Hennel

Limmer

Piacentini

(2020) Ethical dilemmas using social media in qualitative social research: A case study of online participant observation. Sociological Research Online 25(3): 473–489.

16.

Hilário

Augusto

(eds) (2020) Practical and Ethical Dilemmas in Researching Sensitive Topics with Populations Considered Vulnerable. Cham: MDPI.

17.

Hoeyer

Dahlager

Lynöe

(2005) Conflicting notions of research ethics? The mutually challenging traditions of social scientists and medical researchers. Social Science & Medicine 61: 1741–1749.

18.

Humble

(2012) ‘This isn’t getting easier’: Valuing emotion in development research. Emotion, Space and Society 5: 78–85.

19.

Iphofen

(2020) Regulating research. Governance and ethics across the spectrum. In: Iphofen

(ed.) Handbook of Research Ethics and Scientific Integrity. Cham: Springer, pp. 17–32.

20.

Kent

Williamson

Goodenough

, et al. (2002) Social science gets the ethics treatment: Research governance and ethical review. Sociological Research Online 7(4): 1–15.

21.

Krutzinna

Taddeo

Floridi

(2019) Enabling posthumous medical data donation: A plea for the ethical utilisation of personal health data. In: Krutzinna

Floridi

(eds) The Ethics of Medical Data Donation (Philosophical Studies Series), vol. 137. Springer: Cham, pp. 163–180.

22.

Lauber-Rönsberg

(2018) Data Protection Laws, Research Ethics and Social Sciences. In: Dobrick

Fischer

Hagen

(eds) Research Ethics in the Digital Age. Wiesbaden: Springer VS, pp. 29–44.

23.

Law

(2004) After Method: Mess in Social Science Research. London: Routledge.

24.

Lozar Manfreda

Bosnjak

Berzelak

, et al. (2008) Web surveys versus other survey modes – A meta-analysis comparing response rates. International Journal of Market Research 50(1): 79–104.

25.

Marcus

Bosnjak

Lindner

, et al. (2007) Compensating for low topic interest and long surveys: A field experiment on nonresponse in web surveys. Social Science Computer Review 25(3): 372–383.

26.

Monaghan

O’Dwyer

Gabe

(2013) Seeking university Research Ethic Committee approval: The emotional vicissitudes of a ‘rationalised’ process. International Journal of Social Research Methodology 16(1): 65–80.

27.

Noy

(2008) Sampling knowledge: The hermeneutics of snowball sampling in qualitative research. International Journal of Social Research Methodology 11: 327–344.

28.

Orfali

DeVries

(2010) A sociologial gaze on bioethics. In: Cockerham

(ed.) The New Blackwell Companion to Medical Sociology. London: Wiley-Blackwell, pp. 487–510.

29.

Poynton

DeFoouw

Morizio

(2019) A systematic review of online response rates in four counseling journals. Journal of Counseling & Development 97(1): 33–42.

30.

Raposo

(2020) Tensões e desafios da eticidade da investigação científica em saúde: uma reflexão em aberto. Saúde & Tecnologia 23: 19–26.

31.

Reed

(2007) Bureaucracy and beyond: The impact of ethics and governance procedures on health research in the social sciences. Sociological Research Online 12(5): 80–84.

32.

Sappleton

Lourenço

(2016) Email subject lines and response rates to invitations to participate in a web survey and a face-to-face interview: The sound of silence. International Journal of Social Research Methodology 19(5): 611–622.

33.

Sheehan

(2001) E-mail survey response rates: A review. Journal of Computer-Mediated Communication 6(2): 00117.

34.

Sin

(2005) Seeking informed consent: Reflections on research practice. Sociology – The Journal of the British Sociological Association 39(2): 277–294.

35.

Thomas-Hughes

(2018) Ethical ‘mess’ in co-produced research: Reflections from a U.K.-based case study. International Journal of Social Research Methodology 21(2): 231–242.

36.

Timmers

Van Veen

Maas

, et al. (2019) Will the EU data protection regulation 2016/679 inhibit critical care research? Medical Law Review 27(1): 59–78.

37.

Truman

(2003) Ethics and the ruling relations of research production. Sociological Research Online 8(1): 70–80.

38.

Van den Hoonaard

(2020) «Vulnerability» as a Concept Captive in its own prison. In: Iphofen

(ed.) Handbook of Research Ethics and Scientific Integrity. Cham: Springer, pp. 577–588.

39.

Van den Scott

LJK

(2020) Sociology and Ethics. Doing the right thing. In: Iphofen

(ed.) Handbook of Research Ethics and Scientific Integrity. Cham: Springer, pp. 769–782.

40.

Van Mol

(2017) Improving web survey efficiency: The impact of an extra reminder and reminder content on web survey response. International Journal of Social Research Methodology 20(4): 317–327.

41.

Vanberg

(2020) Informational privacy post GDPR – End of the road or the start of a long journey? The International Journal of Human Rights 25(1): 52–78.

42.

Vercruyssen

Roose

Carton

, et al. (2014) The effect of busyness on survey participation: Being too busy or feeling too busy to cooperate? International Journal of Social Research Methodology 17(4): 357–371.

43.

Vermeylen

Clark

(2017) An alternative ethics for research: Levinas and the unheard voices and unseen faces. International Journal of Social Research Methodology 20(5): 499–512.

44.

Vestoso

(2018) The GDPR beyond privacy: Data-driven challenges for social scientists, legislators and policy-makers. Future Internet 10: 62.

45.

Vieira

Diogo

Marques

(2020) Ética e Deontologia no exercício da Sociologia. Novos desafios. Sociologia Online 23: 31–50.

46.

White

Fitzgerald

(2010) Researcher tales and research ethics: The spaces in which we find ourselves. International Journal of Research & Method in Education 33(3): 273–285.

47.

Wiles

Crow

Charles

, et al. (2007) Informed consent and the research process: Following rules or striking balances? Sociological Research Online 12(2): 99–110.