A fair number of PLOS One articles have statements like the following:

Data Availability: Data cannot be made publicly available as the dataset contains sensitive and identifying information. The authors confirm that the data will be made available upon request. Requests may be sent to the corresponding author.

My question is, what effect does the EU General Data Protection Regulation (GDPR) that recently came into effect have on such statements? Does it render such statements void (i.e., the authors cannot share the data any longer), or does it not apply to this situation (but perhaps some authors will blindly cite GDPR so as to not share their data)?

  • This seems to be both a legal and opinion-based question (and not just legal opinion). We have not idea what various authors may or may not do. They may just get better at learning how to strip personal information out of their databases to make copies that could be made available.
    – Jon Custer
    Jul 5 '18 at 15:57
  • What does GDPR stand for?
    – Emilie
    Jul 5 '18 at 16:38
  • Added link to website with explanation of GDPR and spelled out the acronym. Jul 5 '18 at 16:56

This is a very broad topic, and specific guidance should come from lawyers and the requisite PIs, but in general terms:

  • there are a lot of reasons a given data set may be too sensitive to share, and containing PII- the domain of GDPR- is only one of them, but when PII is involved, it absolutely applies, and academic research is one of the many domains specifically identified in GDPR language, and is granted more privilege than other domains
  • when it comes to PII, GDPR does not prevent the storage, sharing or processing of data for legitimate purposes, it just prescribes lifecycle protocols that those who participate in storage, sharing or processing have to follow
  • those lifecycle protocols are intended to allow for the enforcement of the rights provided by GDPR to the humans whose data is legitimately shared, stored, and processed- to have their data removed, to have processing explained to them, etc.
  • those who participate in the sharing, storage or processing of data are either "controllers" or "processors" and different responsibilities are attributed to each. Controllers generally are responsible for the acts of their processors, and processors have to do their work in accordance with their controllers
  • a data sharing agreement has to define those roles and responsibilities for the parties involved, and ensure the sharing protocol fulfills the requirements of GDPR

A granular review of the issue in the context of research is here:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.