[Air-L] New CDT Report on Independent Researchers' Access to Data & Risks of Law Enforcement Surveillance

[Dhanaraj Thakur]

Hi everyone,


I’m writing to share a new report by the Center for Democracy & 
Technology, Defending Data: Privacy Protection, Independent Researchers, 
and Access to Social Media Data in the US and EU 
<https://cdt.org/insights/report-defending-data-privacy-protection-independent-researchers-and-access-to-social-media-data-in-the-us-and-eu/>. 
The report examines the risks that laws requiring social media companies 
to provide data to independent researchers could make it easier for law 
enforcement to gain unjustified access to users’ data, and how to 
mitigate those risks. The main author is Caitlin Vogus (Deputy Director 
of Free Expression at CDT).


The report first examines existing legal protections for stored social 
media data in the United States and European Union and how they might be 
impacted by mandatory researcher access to social media data. We find 
that in the US, there is a significant risk that disclosure of social 
media data to independent researchers may make it easier, as a matter of 
law, for law enforcement personnel to access that data and surveil 
social media users. In contrast, in the EU disclosure of social media 
data to independent researchers likely will not impact the legal 
requirements governing the disclosure of data to law enforcement. 
However, there remains a risk that, in practice, law enforcement 
personnel may find it easier to access social media data from 
researchers, regardless of legal protections.


The report then makes recommendations for how to mitigate the risks of 
increased law enforcement access to data intended for independent 
researchers. Although our recommendations are aimed at policymakers, 
they’re also relevant to anyone thinking about how to approach new or 
proposed requirements to share data with researchers, like Digital 
Services Act Article 40 or bills in the US, or even companies’ voluntary 
data sharing efforts.


Some of the recommendations to mitigate the risks to users’ privacy include:


  *

    In both the US and EU, precluding law enforcement agencies from
    qualifying as “vetted researchers” and taking steps to make it
    technically impossible or difficult for independent researchers to
    disclose data to researchers.

  *

    In the US, addressing gaps in the Stored Communications Act and
    Fourth Amendment that may permit unjustified law enforcement access
    to social media data held by independent researchers.

  *

    In the EU, provisions for data sharing agreements and transparency
    obligations for social media platforms and independent researchers.


I hope you’ll find the report useful and feel free to share.

take care,

Dhanaraj


-- 

*Dhanaraj Thakur* (he/him) | Research Director
Center for Democracy & Technology |*cdt.org <https://cdt.org/>*
*E:* dthakur at cdt.org | *P:* +1 202 407 8849 | @thakurdhanaraj