Navigating the GDPR with Innovative Educational Materials

‘Privacy in Research: Asking the Right Questions’ is an engaging and innovative response to the challenges faced by researchers working with sensitive data. Commended as best practice by the Council of Europe, the project team has developed a portfolio of modular and interactive educational materials designed to help researchers and students navigate the maze of privacy concerns when embarking on research involving personal data covered by the General Data Protection Regulation (GDPR). 

The e-learning material, which includes an online course, a film, case studies and a role-playing exercise, can be used in educational and research settings to teach and explore good practices for responsible research. Participants learn to consider privacy issues from different perspectives and learn to successfully design, implement and embed responsible research methodology in multi- and interdisciplinary research. 

The project is important in the context of open science and the FAIR principles, as it facilitates the responsible sharing and reuse of data that is relevant for a range of research areas, as well as clinical applications to artificial intelligence (AI) and education more widely. It also supports one of the United Nations’ Sustainable Development Goals (SDGs) that CLARIN has identified as key to its mission. 

The brainchild of Esther Hoorn, lawyer and member of the CLARIN Legal and Ethics Issues Committee, the e-learning material was developed with a wider team in order to offer researchers a tool to explore the possibilities of using or sharing personal data in their work. 

Hoorn’s initial idea of developing an interactive role-playing game to simulate the varying viewpoints of different stakeholders during a Data Protection Impact Assessment (DPIA) took concrete shape when she heard about the real-life challenges Henk van den Heuvel was experiencing as a result of his work with pathological speech, and the difficulty of storing and sharing such sensitive audio and video material in a way that is GDPR-compliant. 

The next key moment was a DELAD (Database Enterprise for Language And speech Disorders) workshop on corpora of speech with communication disorders in 2021, which brought together several relevant and connected parties, including the CLARIN Knowledge Centre for Atypical Communication Expertise Centre (ACE) and the Language Archive at the Max Planck Institute for Psycholinguistics, which is a CLARIN B-centre. The work during the workshop led to a video simulating the set-up of a basic DPIA for sharing sensitive patient research data with restricted access conditions. 

The video shows a meeting of different stakeholders developing a DPIA in order to determine if and under which conditions a dataset with atypical speech samples can be made available for a specific research project in light of the GDPR. The stakeholders present in the role play include representatives of the dataset, a legal expert, an ethics committee member, a language archive, and researchers, illustrating the different perspectives in the process that need to be taken into account. 

Hoorn says: ‘What we want to show is that within the GDPR, there is room for research. But you need to be responsible, and you need to be in line with ethics. Looking at a specific scenario helps to see what kind of measures are good for your scenario. […] It’s obvious now that you need collaboration and a way to harmonise best practices. The GDPR itself will not do that, only communities of researchers can do this themselves.’ 

GDPR can be a particular challenge in the context of open science and reuse. Hoorn says: ‘Researchers are sometimes risk-averse, or think they can no longer conduct research. They need to trust that there is a method to make a careful assessment on the impact of your research. You can make a reference report, and in the long run, you can perhaps make a code of conduct for your discipline, writing down what you’ve thought about. I think this will grow in the coming years.’ 

The video formed the basis for what has become a fully developed educational package. The role-playing exercise has been supplemented by a set of role cards and concept cards (in both English and Dutch) which can be used in the classroom, as well as a teacher roadmap. Students are encouraged to create a DPIA report at the end of the exercise.

The response to the e-learning material has been overwhelmingly positive. The method is already being used for several courses at Groningen University, for instance for the Master in Science Voice Technology (Campus Fryslân). In addition, the team has received interest from abroad, notably from the Open University (UK) for training their PhD students on ethics and data protection. 

The role plays will also continue to be used within the context of DELAD and the ACE Knowledge Centre, with plans to continue the work in the specific context of language and speech pathology. All materials, including guidelines for storage and consent, are available under guidelines at the DELAD website.

Hoorn says: ‘The emphasis is on others being able to use the material independently. In principle, it’s a method. And once you understand how you can use it, you can adapt it to your own environment. Specifically for atypical speech, we now have a recording of real stakeholders doing a scenario, and we have a scenario with role cards and an introduction, and all the material on the website that teachers can use with students.’

The Privacy in Research project was commended as a best practice in promoting academic integrity by the Council of Europe. Hoorn says: ‘I think I received this recognition because of the project’s positive, hands-on approach. In my application, I explained that although universities want this positive approach, it can be difficult to find the fun in such things in a university climate, to see that it can be fun to discuss hard cases. It was this can-do approach that made the project stand out.’