Do Scientists Actually Protect Our Data? What Swedish Research Can Tell Us

Data protection is important – even in science.

Would you like it if everyone was able to access your personal data? Sensitive information like religious and political belief, health data, your personal sex life and sexual orientation, your legal information and genetic data or even biometric data that can be used to identify you? This data must be protected, and this is not just a popular opinion but also regulated by law. The European Union’s General Data Protection Regulation, for instance, defines this as sensitive information forbidden to be revealed under most circumstances.

Researchers often collect such data. This is necessary to answer various questions like “Can that specific gene mutation cause cancer?” or “Do religious people have better or worse mental health than atheists?”. Sweden has a law (the Swedish Ethical Review Act) to protect humans and their dignity in research. It states that a national ethical review authority must decide if a study may include this sensitive data of study participants.

This process can be faulty. Ethical review across different countries and by different institutions can lead to very different outcomes and has been nicknamed “ethics review roulette”, but having it is much better than just letting researchers do whatever they want with participants’ personal data. It is important that studies disclose that they went through this ethical review, and ideally also their registration number. That ensures transparency.

So, on paper, everything is reasonably well regulated. But how does this look in practice?

A Swedish study investigated how well these data protection laws are followed.
Kjell Asplund and Kerstin Hulter Åsberg examined if Swedish studies went through ethical review and properly disclosed it. They looked at 600 articles across two databases; the Science Citation Index Expanded, which covers natural and applied sciences like medicine, biology, and engineering, and the Social Citation Index, which contains social science studies, covering areas like psychology, political science and sociology.

They only looked at Swedish studies from health science and social science that contained said sensitive data (defined by the General Data Protection Regulation law) about living people which were not completely anonymized. That means these studies were obligated to undergo ethical review, otherwise they would actually break the law.

But they didn’t only check if the studies reported having undergone ethical review. They examined if they could find differences across studies. Do health science studies handle sensitive data better or worse than social science studies? What about different sub-disciplines? Does it make any difference how many researchers work together or which institution they belong to? And finally, does it make a difference in which journal a study was published – do prestigious journals control for lawful handling of sensitive data more strictly than others?

To answer these questions, they sorted each of the 600 articles by their main field of study and noted down publishing journal, number of authors and their institutions. This allowed them to make comparisons.

Indeed, sensitive information was not protected equally well by different kinds of studies.

Out of the 600 articles, 87 (so, about 15%) did not mention going through any kind of ethical review. Out of these 87 articles, six even claimed there was no need for this, which was false. A couple of articles stated they were approved by local committees or claimed to follow some ethical guidelines – this still breaks the law of the Swedish Ethics Review Act of data protection requiring national ethical review.

The 600 investigated studies were composed of 200 health studies with somatic focus (that is research concerning the body, surgeries, and similar), 200 health studies with non-somatic focus (not concerning the body itself but other health areas like the mind or nursing practices) and 200 social science studies. Out of these three categories, social science research performed much worse than the others. Over one in four social science studies lacked information on proper ethics approval. In health science with somatic and non-somatic focus, about one in ten articles didn’t include information on ethical review. There was some difference between the two categories, but this is not statistically significant. That means that the study didn’t look at enough articles to make sure that this finding was reliable. Out of the studies that did report going through ethical review as required by the law, 20-30% did not disclose their registration number, making the ethical review process untraceable.

Among social science studies, there were big differences across sub-disciplines. For example, every single study of research on the elderly reported undergoing ethical review. The sub-group containing research like political science, economics and similar areas failed to do so in 61% of studies. It isn’t possible to compare these sub-disciplines more closely because to get reliable results, one would, again, need to compare even more articles.

But there is more: Studies in which participants were merely observed, so-called observational studies, had 3 times as much issues with ethical review reporting as interventional studies. Is partially because most interventional studies were somatic – concerning the body, for example medical or surgical trials – so, not from social sciences. But in cross-sectional studies (which is a type of observational study that analyses data from a certain population or a representative sample) social science studies also performed worse than health science studies with almost three times more failure to disclose ethical review information.

What does this mean? Do social sciences just not care about protecting sensitive personal information? In medical sciences, ethical approval is very strictly required, but it has been questioned and criticized in the social sciences. An alternative explanation could be that social sciences, especially disciplines like political studies or economics don’t handle sensitive information as often. Therefore, the researchers may not be well-trained in research ethics and might not even know about this law.

Further research revealed that when there were only one or two authors to a study, there was four times as much lack of ethical review reporting than in studies by three or more authors. This might be because in larger teams, it is more likely that someone knows that it is necessary to undergo the ethical review process. It also turned out that authors from universities without a medical school failed to do this more often, maybe because their institutions handle sensitive data less regularly and therefore fail to educate their researchers on how to do this.

Finally, the researchers investigated if articles published in journals with a high impact factor, which is a number that indicates how much attention a journal gets, performed any better. While they found that health science articles were generally published in more prestigious journals than social science articles, looking at studies within these categories revealed that publications in prestigious journals did not report ethical review more reliably than others.
This study has strengths, but also some limitations.

Altogether, this study revealed interesting information of how well sensitive data is handled by different kinds of studies and offers some possible explanations. About every tenth health science and every fourth social sciences study doesn’t disclose if they went through the required ethical review. Especially in social sciences, a lack of knowledge may play a role – this would also explain why studies with more authors perform better (the chance of someone knowing increases) and why authors from institutions without medical schools perform worse (they aren’t properly educated about this). Also, prestigious publishers don’t control if their studies adhere to the law any more strictly.

Since this study only examined Swedish research, that limits the interpretability of the findings. To understand what this means for the rest of the world, the authors compare their findings to similar studies in other countries. They couldn’t compare their findings about social studies, because there was no other data on this, but they do report that other countries have similar regulations, and that in health science, Sweden is one of the countries that follow the law comparatively strictly. So, the situation may generally be even worse elsewhere.

Still, it would be important to examine this and to conduct larger studies. Since this one only examined 87 studies that didn’t report ethical review, there wasn’t enough data to reliably examine smaller sub-categories of science.
There was also some subjectivity involved – when an article didn’t clearly belong to one sub-group, the researchers decided what they thought the main focus of the article was and classified it accordingly. Therefore, analysis by a different team might lead to slight variations in findings.

What can be done now?

Bigger analyses and studies for different countries can clarify further questions, but most importantly, we must act to change what is going wrong. To improve the ethical handling of sensitive data, these findings can be useful, for example by showing inspectors where to look more closely. The study also shows that all publishers, no matter their prestige, can help make sure that their authors don’t infringe on our data protection rights. Because in the end, it only matters which laws we have to protect us if they are actually followed.