A socio-legal analysis of the divergent approaches of the EU Data Protection Directive and individuals’ attitudes towards novel uses of administrative data in social science research

Governments around the world are encouraging social science research using administrative data to support policy development. These initiatives depend on wide-scale public acceptance to succeed and are often supported by a legal basis. The care.data initiative in the UK, which sought to open up routinely collected health data to researchers, is an example where societal expectations of privacy diverged from legally permissible data processing practices. This discord led to the closing down of the project. The factors influencing societal expectations and causing these divergences are currently under-theorised, and little understood, particularly in the field of administrative data. The thesis argues that data processing utilising innovative technologies challenge current constructions of privacy and the notion of the public interest in data processing. As a result, the approaches of the EU Data Protection Directive and individuals’ attitudes towards these practices diverge. In developing this argument, the contested nature of the interests of privacy and the public interest in data processing, which are interests present in the objectives of the Directive are explored. The thesis suggests that different values underpin the construction of these interests and further proposes that these different values are a potential source of the divergences between the Directive and individuals’ attitudes. This claim is tested by examining the Directive and the empirical findings from two focus groups to identify potential divergences. The analysis suggests the Directive constructs privacy by reference to its value to society and perceives research as a data processing activity in the public interest. The qualitative findings, however, suggest individuals ascribe less value to research as an activity in the public interest. Due to individuals’ uncertainty as to the risks generated by novel practices, they adopted a more individualistic construction of privacy, enabling greater control over their data. Considering these divergences, possible legal responses are explored, including the suitability of the law aligning with individuals’ expectations, the ability of the law to guide societal expectations, and the possibility of the law fostering deliberative dialogues between the actors involved in data processing.