Lack of protections for vulnerable groups in big data research

24. Mai 2022

In this commentary the issue of (lack of) protections for vulnerable groups in big data research is addressed. Although the risk of physical harm is reduced with such research, the distance between researchers and participants raises new issues, as illustrated by the case of one study of Facebook users, some of whom were children or suffering from depression.

Introduction

It is a well-known cliche that just because scientists can do something does not mean they should do it. Unfortunately, science often advances at such a speed that ethical considerations are an afterthought or at least lag behind. And just as ethics often struggles to keep up with scientific innovation, so research ethics systems struggle to adapt to new ways of doing research. In this commentary, I revisit the issues of informed consent, the transparency asymmetry between companies and individuals, and discrimination against certain groups, discussed respectively in Elger’s, Christen’s, and Loi’s main articles of this white paper to explore the lack of protections for vulnerable groups in big data research.

In the decades since the Second World War, humans participating in scientific research have become subject to a series of protections designed to protect them from harm and ensure that their autonomy is respected. Institutional review boards (IRBs) and research ethics committees (RECs) are the governance structures that evaluate research proposals to ensure that participants are provided with sufficient protection. Until fairly recently, however, the principles and mechanisms of research ethics were geared solely towards biomedical research, in which experiments of one sort or another are conducted on human beings. The classic example is the clinical trial, in which a new drug is tested on healthy volunteers or people who are sick. When reviewing research projects, IRBs and RECs pay particular attention to the potential exploitation of vulnerable groups—a catch-all term that can include children, elderly people, pregnant women, ethnic minorities, people with mental health issues, or anyone who lacks the capacity to consent to participation in research.

As the development of new ways of doing research has expanded human involvement beyond clinical trials, corresponding ethical governance methods have, belatedly, emerged. Many universities now have committees that evaluate psychology research, sociology research, and even survey research, where the risk of harm might seem low but still exists. Committees also seek to check that participants’ time is not being wasted on pointless research. But another type of research challenges ethical oversight mechanisms to an even greater extent: big data research and, specifically, internet-mediated research (IMR). IMR can be conducted ethically but also raises several issues that do not occur in more traditional clinical or sociological research.

The challenges of big data research

The classic example of big data IMR is social media research. Facebook, Instagram, WhatsApp, and Twitter are only four examples of online spaces in which billions of people share information about their lives every day. Such websites are very popular because they enable people to stay in touch very easily and share their stories with their friends without having to be in the same place as them. Thus, many of us can now stay in touch with friends on multiple continents, some of whom we may never have met in person.

Yet the ease with which information can be shared with people all over our planet also hints at the types of problems that can affect social media and research employing this medium. If it is easy to share your data, then it is easy for other people to access your data. And if you want to share your data to the maximal extent, you will set your privacy settings—which give you some control over who can view your posts—to public.

Now, that might not seem to be a problem. After all, people know what they sign up to when they start using Facebook or other social media, and they can control who sees their posts. However, the previous sentence has two errors in it. First, many people simply tick the box at the bottom of the terms and conditions for social media software and apps without reading the text itself, so they do not know what they are signing up for. Of course, that could be seen as their problem, but one of the concerning issues with the social media giants is that one must accept all of their terms to access their services; one cannot opt out of the bits one dislikes. So, if you want to use Facebook, you have no choice but to accept the terms—a possible reason why people don’t bother to read the agreement properly. Second, while it is true that on Facebook one’s privacy settings can be chosen so that no one, or only friends, or only friends of friends, or absolutely anyone can see your posts, the terms and conditions also state that Facebook may use your data for its own research. So, anyone signing up to Facebook gives their consent to being a research participant, even if they haven’t realised that.

The fact that consent to research can be given at the point of initial access to social media is highly problematic. Normally participants are informed about a specific research project and the associated potential harms before deciding whether to consent to their involvement. An agreement to participate in research obtained from someone who doesn’t know what is involved in the research amounts to exceptionally broad consent—all the more so if the person consenting did not realise what they were agreeing to. In such cases, any consent gained may be legally valid but nonetheless is ethically worthless.

At the other end of the ethical spectrum, the use of social media data by researchers raises a different issue: the participants are remote from the researchers in time and space and thus are less known or knowable than typical research participants. Their social media accounts may contain a great deal of data, but the data are not necessarily reliable; people can say whatever they want about themselves online. And even if the data are reliable, it is still impossible for researchers to apply the usual safeguards, such as verifying that a person is competent to give consent or is not a member of a vulnerable group.

Vulnerable groups and big data research

The ethical issues discussed above apply all the more to vulnerable groups such as children, but there are additional potential problems. Children and people with mental health issues are perhaps less likely to care about the contents of the terms and conditions when signing up for a service they want to access. This is particularly true of children who sign up for accounts despite being below the minimum age for doing so. Even if such children do read the conditions of use, they are likely to disregard them because they want to use the service. It might be assumed that social media companies valued at billions of dollars have age verification features in place, but this is normally not the case. Anyone with an e-mail address can set up accounts on Facebook and many other services (Schneble et al. 2021). Some social media platforms do have age verification components, but the evidence suggests that many parents are happy to help their children circumvent such protections—in effect, endorsing their underage use of social media. Indeed, parents are often Facebook friends of their children, despite the latter not being old enough to use Facebook in line with the terms and conditions of the platform.

The implications for researchers of children who are too young to be permitted to use social media should now be obvious: if many Facebook users are underage children, that means that any research using Facebook data is likely to involve children who are too young to use the service and very probably too young to consent to their participation in research, depending on the jurisdiction. (Given that Facebook is a global company, the legal context will vary.) In the UK, 30% of 5 to 7-year-olds and 44% of 8 to 11-year-olds had a social media account in 2020, indicating the scope of the problem (Ofcom, 2020).

The fact that children and people with mental health problems use social media would not be a research ethics problem if researchers were always sensitive to ethical issues. But there have been two massive scandals involving Facebook’s use of social media data for research. Many people have heard of the (mis)use of Facebook data by Cambridge Analytica (Schneble et al. 2018). But long before that scandal broke, an even worse incident occurred that highlights the dangers of big data Internet research to vulnerable groups.

In the Emotional Contagion study, which was conducted in 2014, almost 700,000 Facebook users were subjected to an experiment without their consent. The study investigated the effects of changing the proportion of positive and negative stories appearing on their News Feeds (the main channel for seeing what one’s Facebook friends have been doing). Some friends’ positive stories were removed from the feeds of half of the Facebook users included in the study; some negative stories were removed from the feeds of the other half of the users included. This censoring might seem relatively unimportant, but it means that hundreds of thousands of people experienced either more positive or less positive News Feeds for a week. And the behaviour of those in the different groups changed: users who saw more positive stories were more likely to post positive stories themselves. The opposite was true of those who saw more negative stories. This suggests that the emotions of participants were affected by their participation—participation that they did not consent to and did not even know about.

What are the implications of the Emotional Contagion experiment for vulnerable groups? Besides the presence of children on Facebook, including those too young to legitimately access the service, many Facebook users can be assumed to suffer from depression or other mental health issues. This means that the researchers conducting the Emotional Contagion experiment not only included non-consenting adults but also non-consenting children and people suffering from depression and manipulated their emotions. The effects of this are unknown, but given that the study did seem to make some people feel better and others feel worse, it is highly likely that young children had their mood altered negatively by this study; the same goes for depressed people. Some of those included may have been both children and depressed.

This might seem like arbitrary speculation, but we can make these concerns more concrete by working out how many people in each of these vulnerable groups were probably included in the study, as I did in an article analysing the experiment (Shaw 2016). Extrapolating Facebook user statistics as well as research suggesting that at least 5% of people are suffering from depression at any given time, I calculated that “15% or more than 100,000 participants were children” and “at least 30,000 people with depression were included in the study” (Shaw 2016). If we apply the same numbers to the Cambridge Analytica scandal, in which the data of 87 million people were used inappropriately, 13 million children and over 4 million people with depression may have had their data used without consent.

How did the contagion study ever get approved? In fact, it was never approved by a REC or IRB. Social media research is often unregulated by RECs or IRBs because it is conducted by researchers at institutions where no committee exists that reviews such research or because they work not at universities but at social media companies or private companies such as Cambridge Analytica; this applies not only to social media research but to a great deal of IMR (Schneble et al. 2018). This fact further compounds the dangers posed to vulnerable groups by big data research. Not only can researchers involve participants, including vulnerable participants, without informing them of a specific project or obtaining their consent but also ethical oversight is missing in action at the very point where an ethics committee or IRB is most needed. In fact, an IRB did have the opportunity to review this study as one of the researchers was affiliated with Cornell University. But the university’s IRB decided that “he was not engaged directly in human research” because he “had access only to results—and not to any individual, identifiable data at any time” and Facebook had conducted the study independently (Cornell University 2014). This conclusion is questionable at best, given that he was the lead researcher on a project that manipulated people’s emotions. Furthermore, it is wrong to assume that this research only concerned American citizens, as Cornell seems to have done. Emotional Contagion was an international study as any Facebook users with English as their chosen language were eligible for inclusion. Therefore, any REC reviewing the study should at least have considered whether ethics review in countries such as Canada, the UK and Australia might be necessary (even then, English speakers in any country could have been included).

It emerged after the scandal surrounding the Emotional Contagion study that Facebook’s terms and conditions did not mention the possibility of user data being employed for research. In the years since, Facebook has made the role of research clearer in its terms and conditions, stating that “We engage in research to develop, test, and improve our products.” This is still a very broad statement, even assuming that users bother to read it. While we can hope that researchers would not make the same mistakes again, history suggests that such scandals tend to recur.

Conclusion

The fact that big data research is often conducted using the Internet and social media can make it seem like a safer way of doing research. There are no physical interventions, and thus no risk of direct physical harm. But in fact, the removal of the necessity for physical proximity between researchers and research participants vastly increases the potential for unethical research to be conducted, particularly when combined with a relative lack of ethical oversight. These risk factors are multi- plied even further when we consider the lack of protections for vulnerable groups in online spaces. Any researchers using the Internet or big data must remain extremely vigilant to the possibility that the people whose data they are using for the research might belong to vulnerable groups, particularly when the nature of the study means that participants’ identities are unknown or unclear. Just because research using social media can be done easily doesn’t mean that it should be done. Similarly, users of social media and the Internet would do well to remember that just because they can participate in research and share their data on social media doesn’t mean that they should.

Recommendations

Researchers using the internet to conduct studies should be alert to the possibility that participants may belong to a vulnerable group. Users of social media should read Terms and Conditions closely and be aware that their data may be used for research.

References

Cornell University Media Relations Office. 2014. Media statement on Cornell University’s role in Facebook “emotional contagion” research.

Ofcom. 28 April 2021. Children and parents: Media use and attitudes report 2020/21.
→ https://www.ofcom.org.uk/ data/assets/pdf_file/0025/217825/children-and-parents- media-use-and-attitudes-report-2020-21.pdf.

Schneble, C.O., B.S. Elger, and D.M. Shaw. 2018. The Cambridge Analytica affair and Internet-mediated research. EMBO Reports 19 (8):e46579. doi:10.15252/embr.201846579.

Schneble, C.O., M. Favaretto, Elger B.S., and D. Shaw. 2021.
Social media terms and conditions and informed consent from children: Ethical analysis.
JMIR Pediatrics and Parenting 4 (2):e22281.

Shaw, D.M. 2016 Facebook’s flawed emotion experiment: Antisocial research on social network users. Research Ethics, 12 (1): 29-34. doi:10.1177/1747016115579535.