Data access versus data protection: getting the balance right

Data Protection Day is something close to our hearts here in the Library given the huge amount of personal data we hold on the health and sexual lives of living people in our collection of films, audio recordings, artworks, photographs and text-based archives.

To celebrate, let’s run an experiment to gauge your attitude towards personal data. Think about your level of tolerance towards these two scenarios:

First, imagine someone has taken a snap that makes you look silly but having fun: something like this photo of the eminent haematologist Robert Race working hard at a Mexico City conference in 1946. Imagine that this image gets circulated online without your prior knowledge. How would you feel?

Robert Race in Mexico City, 1946. Wellcome Library reference: SA/BGU/B.1/3/1.

Next, imagine that several years ago you wrote an explicit letter to a relationship guru asking for advice on your personal life, and it ends up in a library as part of their personal archive. So something like the archived letters sent to the birth control campaigner Marie Stopes into the late 1950s, in response to her book Married Love. Would you be happy for this letter to be openly accessible to researchers?

My best guess is that most of you wouldn’t mind scenario one but nearly all of you would be worried by scenario two. We are too, and to make sure we protect the rights of people whose personal data appears in our collections, we have recently updated our data access policy in consultation with the UK Information Commissioner’s Office.

The policy helps us make consistent, fair assessments on whether researchers can have access to specific data. Sometimes assessing sensitivity is straightforward, as with this 1984 photo of Adrian Walton, a 14-year-old post-operative heart transplant recipient at Harefield Hospital:

Adrian Walton, a heart transplant recipient at Harefield Hospital, with his parents. Photograph by Associated Newspapers, 1984. Wellcome Library reference: 794694i .

This image counts as sensitive personal data under the 1998 Data Protection Act as it identifies a living individual and concerns his physical health. But the photo was taken by press photographers for publicity material on the transplant procedure, and a note with the image show that Adrian expected it to be made public:

“I enjoy being a star says ‘cheeky’ Adrian the heart swop boy… as cameras clicked and television microphones were pushed towards him. Thirteen days after his operation the plucky 14 year old faced the press.”

This allows us to conclude that the image has been made public as a result of steps deliberately taken by Adrian, and so we make it openly accessible to researchers.

At the opposite end of the spectrum is the 1930 film Rabies, which includes a case study of a 9-year-old boy suffering from rabies. This boy is being filmed dying – he died 6 hours after the film was made. As he is no longer alive the Data Protection Act doesn’t apply to the film, but our policy also helps us assess material from a wider, ethical perspective.

In this case we have restricted access to medical professionals and students who are authorised to view the film via JISC Mediahub. Not only do we feel that it is unethical to make footage of a person dying generally accessible, but we also feel that we must consider the potential distress that open access might cause any siblings of this dying child who may still be alive.

For those of you who love reading policy documents, good news, this certainly won’t be the last edition! Forthcoming changes to the EU Data Protection landscape will keep us on our toes. But in a shifting environment, our new policy is a concrete expression of our desire to be accountable to anyone with a stake in our collections, whether you are a researcher, someone considering donating research material to us, or a person mentioned in our data.

Author: Helen Wakely is Archive Project Manager at the Wellcome Library.