Does the GDPR cover reviewer blacklists, and if so, how? [closed]

Question

I've served as an area chair for several conferences. Following the review period, the program chairs asked the area chairs to submit to them an annotated list of problematic reviewers. Mostly these were reviewers who failed to submit a review at all, despite repeated reminders, but we were also asked to identify reviewers who submitted exceptionally low-quality reviews, such as reviews that were so short/vague as to be useless, and reviews whose factual errors were so glaring that it was obvious that the reviewer either lacked even the bare minimum subject-matter knowledge, or else didn't bother reading the paper at all. The purpose of collecting these lists was to construct or to supplement a blacklist for use with future program committee invitations. That is, people on these blacklists would not be invited to review for future conferences operated by the same scholarly society.

I am wondering whether the coming into force of the EU/EEA General Data Protection Regulation has any implications for these blacklists. In particular, is the blacklist itself considered "personal information", and is it even lawful to compile such a list? Can the reviewers mentioned on this list use the provisions of the GDPR to force its maintainers to disclose their presence on the list or even to remove them from the list? How about the area chair comments used to construct the list—are these something that blacklisted reviewers can force the conference organizers to turn over to them?

I realize that this is a question about legal principles and practice, and so might be also (or maybe even better) appropriate for the Law Stack Exchange or a lawyer. But since the question treats a uniquely academic scenario, I'm hoping that someone here might belong to a scholarly society that has already looked into the matter, and can therefore provide a brief summary for the present academic audience.

Answer 1

The GDPR of course doesn't cover all possible scenarios. However, it's fairly logical. You're not allowed to have and use personal information, unless you meet at least 1 of 6 specific reasons. "Consent" is the best-known, because we've all been asked hundreds of times in the last year. But obviously that's not going to fly for a blacklist.

No, the reason which can justify a blacklist is (6e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Academic publishing is probably not done "in the exercise of official authority", but it definitely is "a task carried out in the public interest".

Having established that there's a reason, most of the other GDPR requirements become technical. There's a right to ask for factual corrections, but if the facts are in dispute you only need to record the objection. You are not forced to decide.

Now the biggy is of course the "right to be forgotten"/right to erasure. This is not an unconditional right. The person invoking this right must state a reason, and this must hold. "Withdrawing consent" is a reason, but it only applies when consent was originally necessary, which is not the case for the blacklist. "No longer necessary" might make sense if someone retires entirely, but we know that in academia retirement is often not a black&white matter.

The good thing here is that you can reason about actual removal requests if and when they arrive. There is not much preparation required other than the general GDPR rules for good recordkeeping.

Answer 2

You cannot force editors to use de facto bad reviewers if they know about them.

However, the actual problem with today's ease of data collection is that you can easily accumulate lots of (possibly low-quality and unvetted) data; a blacklist being sent around can constitute slander (or whatever you call it in your jurisdiction), even independently of GDPR. IANAL, but in my understanding, GDPR might be used by a person suspecting blacklisting to force the organisers to reveal its existence and one's presence on it, even if its transfer from one years' organiser to next years' organiser could be justified under its rules. With a cascade of further legal consequences in its wake which are not just limited to removal from the list.

I do not know if they can have a look at the blacklisting comments, but if the comments are sent around with the blacklist between year committees, I estimate that they fall under GDPR.

Having some basic rules of data hygiene (and I consider GDPR as such) is not an entirely bad thing. Best is, leave yourself extra time to get additional reviews if reviews are not up to scratch and don't send blacklists around.

TL;DR GDPR, as I understand it (IANAL), permits people to ask their presence on a blacklist to be revealed, especially if it is institutional (i.e. sent around between organisation committees, not just for individual use of the particular editor).