I've served as an area chair for several conferences. Following the review period, the program chairs asked the area chairs to submit to them an annotated list of problematic reviewers. Mostly these were reviewers who failed to submit a review at all, despite repeated reminders, but we were also asked to identify reviewers who submitted exceptionally low-quality reviews, such as reviews that were so short/vague as to be useless, and reviews whose factual errors were so glaring that it was obvious that the reviewer either lacked even the bare minimum subject-matter knowledge, or else didn't bother reading the paper at all. The purpose of collecting these lists was to construct or to supplement a blacklist for use with future program committee invitations. That is, people on these blacklists would not be invited to review for future conferences operated by the same scholarly society.

I am wondering whether the coming into force of the EU/EEA General Data Protection Regulation has any implications for these blacklists. In particular, is the blacklist itself considered "personal information", and is it even lawful to compile such a list? Can the reviewers mentioned on this list use the provisions of the GDPR to force its maintainers to disclose their presence on the list or even to remove them from the list? How about the area chair comments used to construct the list—are these something that blacklisted reviewers can force the conference organizers to turn over to them?

I realize that this is a question about legal principles and practice, and so might be also (or maybe even better) appropriate for the Law Stack Exchange or a lawyer. But since the question treats a uniquely academic scenario, I'm hoping that someone here might belong to a scholarly society that has already looked into the matter, and can therefore provide a brief summary for the present academic audience.

  • 3
    You are right, this is a law question. Commented Oct 15, 2019 at 8:58
  • 6
    And yet we have a dedicated tag here for legal issues, so I figured I'd try posting here first. I'm not in urgent need of professional legal advice; I'm asking more out of curiosity and long-term planning (in case I ever decide to organize a conference myself).
    – Psychonaut
    Commented Oct 15, 2019 at 8:59
  • 2
    A question being about law does not make it more or less on topic.
    – Tommi
    Commented Oct 15, 2019 at 9:48
  • 5
    I think this is an awesome question. Let's hope we get good answers for it.
    – xLeitix
    Commented Oct 15, 2019 at 10:35
  • 2
    I have voted to close as off-topic in the hope that the question will be moved to law.sx where I expect that the probability to obtain good answers by someone who knows the legal intricacies is higher. In that case, we'd still have the link to that question here, so anyone searching for answers on academia will find it. Commented Oct 15, 2019 at 11:08

2 Answers 2


The GDPR of course doesn't cover all possible scenarios. However, it's fairly logical. You're not allowed to have and use personal information, unless you meet at least 1 of 6 specific reasons. "Consent" is the best-known, because we've all been asked hundreds of times in the last year. But obviously that's not going to fly for a blacklist.

No, the reason which can justify a blacklist is (6e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Academic publishing is probably not done "in the exercise of official authority", but it definitely is "a task carried out in the public interest".

Having established that there's a reason, most of the other GDPR requirements become technical. There's a right to ask for factual corrections, but if the facts are in dispute you only need to record the objection. You are not forced to decide.

Now the biggy is of course the "right to be forgotten"/right to erasure. This is not an unconditional right. The person invoking this right must state a reason, and this must hold. "Withdrawing consent" is a reason, but it only applies when consent was originally necessary, which is not the case for the blacklist. "No longer necessary" might make sense if someone retires entirely, but we know that in academia retirement is often not a black&white matter.

The good thing here is that you can reason about actual removal requests if and when they arrive. There is not much preparation required other than the general GDPR rules for good recordkeeping.

  • My guess would be that irrespective of whether their might be a case that could be argued in court, whoever carries the (financial) liability for a finding against the conference organizers, or just the cost of defending such a claim, would not want to even see the case be brought. Commented Oct 15, 2019 at 16:43
  • Am I right in assuming that GDPR also means that keeping such a list would mean having to inform people who are on the list? Commented Oct 15, 2019 at 17:25
  • @TobiasKildetoft AIUI, not proactively. But if a person on the list asked about the list, the organisation would have to tell them.
    – Flyto
    Commented Oct 15, 2019 at 17:46
  • @Flyto Ok. That is not my understanding of it, but I never did go into much detail. I know we send out letters with details of how we treat data to everyone who gets added to the system I work on (since I just had the task of automating that process). But I don't know if we are required to send out those or just do. Commented Oct 15, 2019 at 17:58
  • @TobiasKildetoft my understanding is that you're not required to send it out, but that information it must be available. But I'm not a lawyer or an expert on GDPR, so I may be wrong.
    – Flyto
    Commented Oct 15, 2019 at 18:01

You cannot force editors to use de facto bad reviewers if they know about them.

However, the actual problem with today's ease of data collection is that you can easily accumulate lots of (possibly low-quality and unvetted) data; a blacklist being sent around can constitute slander (or whatever you call it in your jurisdiction), even independently of GDPR. IANAL, but in my understanding, GDPR might be used by a person suspecting blacklisting to force the organisers to reveal its existence and one's presence on it, even if its transfer from one years' organiser to next years' organiser could be justified under its rules. With a cascade of further legal consequences in its wake which are not just limited to removal from the list.

I do not know if they can have a look at the blacklisting comments, but if the comments are sent around with the blacklist between year committees, I estimate that they fall under GDPR.

Having some basic rules of data hygiene (and I consider GDPR as such) is not an entirely bad thing. Best is, leave yourself extra time to get additional reviews if reviews are not up to scratch and don't send blacklists around.

TL;DR GDPR, as I understand it (IANAL), permits people to ask their presence on a blacklist to be revealed, especially if it is institutional (i.e. sent around between organisation committees, not just for individual use of the particular editor).

  • 3
    But a major additional question is whether keeping such a list is even allowed by GDPR, since it will (by necessity) contain information that can identify people. It might be allowed, since there is a reason for it, but that would still probably involve some serious thought to data security and who has access to the list. Commented Oct 15, 2019 at 11:55
  • @TobiasKildetoft Absolutely. If the list is leaked, the organisers could end up in very serious trouble (not because something is leaked that shouldn't be there, but because the list becomes visible to people who shouldn't be privy to it). Commented Oct 15, 2019 at 13:22
  • @TobiasKildetoft organisations can retain personal information so long as they have a "legitimate interest" in having it. One could argue that there is legitimate interest in having lists of bad reviewers when organising a conference. But it does have to be treated with the same care and thought as other personal data.
    – Flyto
    Commented Oct 15, 2019 at 17:45

Not the answer you're looking for? Browse other questions tagged .