GDPR, AI and ethics requirements for research

Scientific research must be done carefully and responsibly, with limited use of AI and respect for privacy regulations. This is especially true for applied computer science where researchers collect and analyse personal data. This article explains for which rules apply and how to implement them in practice.

GDPR requirements for scientific research

Scientific research often includes the processing of personal data. Think of a questionnaire where you want to collect data such as names, age, email addresses or more sensitive attributes like gender or private habits. When handling personal data, privacy regulations such as the GDPR, and principles ethical conduct must be taken into account throughout the data management process. However, it can be very challenging for researchers (and students) to follow the relevant procedures when designing and executing research tasks.

The GDPR is driven by a short number of principles that anyone processing personal data should apply. You should always  follow the principles of the GDPR since the GDPR was always intended as practical regulation, more like traffic rules than complicated trade law. The following principles are important:

• You should be transparent. So if you do a a survey or social experiment, make sure you explain the survey or experiment clearly. People should know who made the survey, whether it is related to a this project or other project, the name and main topic of the project and which university leads the research.
• You should not collect more information than necessary. This means that you should not ask irrelevant questions (e.g. in a study on automatic cars, avoid  asking age and gender, instead ask how many miles people drive or travel or how many years of driving experience they have). This also means that you only record audio and video when truly necessary and avoid asking personal stories or sensitive data such as medical history.
• You should only share data with reliable suppliers that your university has a data processing agreement with. In practice this means you should ask your lecturer or university colleagues which suppliers are approved and contracted by your university and avoid cloud based services for processing personal data. This is an interesting research topic in itself. If you are handling personal data, try to process it locally using libraries instead of relying on services
• Do not keep personal data longer than necessary. This is a challenging requirement since doing research requires you to keep your data for 10 years in case other researchers question your research. You should probably transcribe recorded interviews and delete the recordings and keep transcriptions. You should remove irrelevant personal details from the transcriptions or data files (anonymisation) or replace them with codes that are stored elsewhere (pseudonimisation).
• You should avoid collecting data about criminal background or activities, medical history, sexual preferences, ethnicity or religion in your computer science research. The GDPR described these characteristics as special and forbids the processing of special personal data except in some very specific cases and with additional measures in place. Please also take note that there are additional rules and guidelines for medical research that your professor probably does not know, such as the medical device regulation.

The key to good, ethical research is thus knowing your limitations, careful interview / experiment design, combined with good data management. You should therefore plan your research in a project proposal or plan. For larger research projects, it is often required to make a data management plan. Once you have a plan in place, follow your plan and pay attention to detail.

Responsible use of AI

A research article should be a real, authentic report containing the motivation, approach, results and lessons learned by the researcher, and should thus be written by the actual researcher. Therefore in the business track for VU university, for our computers and society research journal and for our advisory services,  we have strict limits on the use of AI. Our policy is in line with the VU policy on Generative AI in examinations, explains the risks of using chatbots in the following way: A chatbot operates using a comprehensive language model and generates responses (word by word) based on a probability model created from information on the internet. This data is often quite general in nature, not always accurate, and may also contain biases. Therefore, always be critical of the text generated by a chatbot.

We do not allow theuse AI for generating text. Any researcher must create the first version of any paragraph or sentence themselves, in their own words, based on what they want to say. They can use chatGPT or other models only for small improvements to already written sentences. This allowed use is explained in the VU policy as follows

• Example 1. Writing improvement (allowed in business track)
  You can ask generative-AI chatbots to detect language spelling and structure improvements for texts you have created yourself, similar to how ‘regular’ spelling and grammar tools work. Like a language assistant, in other words. If the teacher allows it, generative AI can also give you inspiration for writing a piece of text. It gives content ideas and structures how to build a text. Make sure that the use of these tools does not interfere with a good assessment by the teacher of your own knowledge and skills.
• Example 2. Searching for information (allowed in business track)
  Generative AI creates answers to questions you ask based on lots of existing data. This is somewhat similar to how you would search for information through, say, the University library catalogue, Google Scholar or through other methods (although it obviously works differently technically and the data sources are clear). Note that the chatbot may give different answers to the same question each time. After searching, you should always critically assess the value of this information, relate it to various other sources, process it yourself and justify your choices.

The following practical rules result from this policy:

1. You must carefully check each word that was suggested to you by AI. You must check whether each sentence is really needed in the text and whether you understand and would also use each word.
2. You must have read the PDF of each source you cite. So when citing you must copy the actual title, year and authors carefully, check if the conclusion of the source actually supports the sentence where you cite it. Note that it is therefore also forbidden to cite paywalled article that you do not have access to. Find the PDF or cite something else.
3.  In your thesis you must describe in full detail your research methods, including any tools used. So if chatGPT was used to create images or text as part of data collection, this should be described.

Research integrity

The GDPR and our AI policy are not the only rules relevant for scientific research. Anyone doing research in The Netherlands should also study and always follow the general principles of Honesty, Scrupulousness, Transparency, Independence and Responsibility determined in the Netherlands Code of Conduct for Research Integrity. This is applicable to all Dutch universities.

In practice, this means you should report your methods as accurately as possible, refrain from making unfounded or exaggerated claims, describe the limitations of your results and, importantly, never falsify data. Indeed, a major concern in research is plagiarism: presenting others creative work as yours. Always cite the study behind an idea or fact you read somewhere, this way, you demonstrate your knowledge on the topic and readers can find your sources. When using the original author’s words, always use the quotation marks with the reference (“To be or not to be, that is the question”, Shakespeare).

If generative AI is permitted and you fail to acknowledge its use correctly, this is regarded as plagiarism. To a trained eye, it is possible to sense when a text has been generated with AI with no editing.

This extends to figures and even how you format the references. Plagiarism can also be unintentional, especially when using generative AI tools such as looking for relevant papers and references – gen AI can make mistakes even when just reformatting citation styles. Similarly, take great care in describing clearly our research efforts. For instance, when manipulating data with generated code, you need to double-check what the vibe-script does (do not ‘fire and forget’).

Be clear when describing what you have and what you have done. How did you get the data? How did you achieve the results? In case parts of research or data have to be kept confidential (e.g., when signing an NDA) you should respect the confidentiality while still providing a motivation. Transparency is important also when using gen AI tools: clearly state upfront what and how gen AI tools have been used in your thesis or research, perhaps, with an AI statement.

In research, avoid non-scientific considerations, e.g., marketing-style or opinionated description of results. This connects to being responsible and to to think that you do not operate in isolation. For example, when carrying out surveys or interviews you should acknowledge that your actions can have consequences for the individuals that are involved in your research, such as the risk of publishing personal data or sharing it with gen AI tools without anonymizing it first.

Following these principles is not only a moral duty, but concrete standards to follow. Failing to follow them has concrete negative consequence in the form of sanctions. Indeed, the Code of Conduct lists clear standards on what to do and what not to do along the design, execution and reporting phases of a research project. In the event of misconduct, like plagiarism or sharing personal data, there are concrete sanctions. On top of a reputational damage – in serious cases of plagiarism – the examination committees can decide to dismiss or expel from the institution the person concerned.

Additional Surf guidelines

For researchers interested in data management and privacy, the SURF Privacy Expertise Center published a practical guideline for researchers in higher education to comply with the GDPR. The guideline is a roadmap on how to properly manage personal data during the entire research lifecycle. One of the main highlight in the guideline is that research at universities falls under the special regime of the GDPR and Dutch AP (Autoriteit Persoonsgegevens) whereby (sensitive) personal data may be used for scientific research on the legal ground of general public interest.

According to article 6 of the GDPR the legal bases for processing personal data are consent, performance of a contract, legal obligation, vital interests, public task and legitimate interest. Scientific research thus falls under public task assigned to universities by law (Higher Education and Research Act). This means that you do not need to ask for permission to process personal data in your research as long as the research meets certain conditions:

• 1) research performed under the direction of a professor or lecturer
• 2) the research does not serve a primary private purpose
• 3) the research meets the relevant methodological and ethical standards (approved by the ethics committee) and
• 4) appropriate safeguards are in place (see below).

These conditions are typically met at all Dutch research and applied universities. Note that the ‘ethical consent’ remains relevant. The ethical consent is about asking to participate in research and is often reviewed by the same ethics committee of a university. Universities often provide instructions and templates about ethical consent.

The ‘public interest’ basis may also apply to sensitive data (e.g., salary, health or political beliefs), but here you would need to contact you university privacy contact point (additional security measures may be necessary). Public interest in not applicable to special personal data (e.g., medical data or religious beliefs) for which exceptions and stringent safeguards would need to apply, such as informed consent and strict measures to mitigate the higher risks.

In case the public interest basis is not applicable, you should consider using the ‘consent’ basis where you ask the permission of the involved person. However, you will need to do this in the right way (consent must be free, clear, informed and specific to the task).

Source: cover photo by ODISSEI on Unsplash