A Guide to Internet Research Ethics

Foreword

This guide has been prepared by the National Committee for Research Ethics in the Social Sciences and the Humanities (NESH). The work was initiated by the previous committee (2014–2017) and completed by the current committee 2018–2021, listed below).[1]

The guide supplements and refers to the Ethical guidelines for research in the social sciences, humanities, law and theology (2016) published by NESH, and is based on NESH’s Guidelines for Internet research ethics (2003).[2] The objective of this guide is to assist with ethical reflection on real dilemmas, and to promote responsible and ethically justifiable practices among researchers and research institutions.

Rapid technological advances produce new challenges for research ethics. This guide is therefore a ‘living document’ and will be updated as an online resource. NESH welcomes suggestions for revisions and updates. NESH can also provide advice and guidance regarding specific projects and may, on request, address individual cases that involve matters of principle.

Oslo, May 2019

NESH (2018–2021)
Elisabeth Staksrud (chair of the committee), Kirsten Johanne Bang, Lene Bomann-Larsen, Kjetil Fretheim, Rakel Christina Granaas, Kristian Berg Harpviken, Heidi Østbø Haugen, Kjetil Ansgar Jakobsen, Roar Johnsen, Ivar Kolstad, Markus Hoel Lie, Hadi Strømmen Lile, Anne Nevøy, Tove Klæboe Nilsen, May-Len Skilbrei, and Vidar Enebakk (director of the secretariat).

Research Ethics

The same ethical considerations apply to Internet research as to other areas, as defined in NESH’s guidelines and elsewhere. It is thus essential to adhere to and focus on the fundamental norms of and prominent guidelines for research ethics to assist the researcher in developing sound judgement and to promote good scientific practices. In other words, Internet research alone does not raise completely new issues, nor does it invalidate recognised norms and values of research ethics. Even though the object of study is of a special nature, the ethical basis of research relating to it is of a universal nature.[3] As in all other research in the social sciences and the humanities involving humans, the crucial matter is to ensure the dignity and integrity of the participants.[4]

Research ethics is based on respect for human dignity and builds on general ethics and fundamental human rights. Each individual possesses their own interests and integrity that cannot be disregarded in the performance of research: ‘Researchers must protect personal integrity, preserve individual freedom and self-determination, respect privacy and family life, and safeguard against harm and unreasonable strain’ (NESH 2016: B.5). Recognised norms and values in Internet research include, for example, dignity, freedom, autonomy, solidarity, equality, democracy and trust.[5] Four factors are especially relevant in an assessment of Internet research ethics: the accessibility in the public sphere, the sensitivity of the  information, the vulnerability of the participants, and the interaction with the participants. Four further aspects are more specific to communication on or via the Internet: the information is stored, it is searchable, it can be copied, and the nature of the audience is often unclear.[6] This guide describes these different factors and aspects in more detail with regard to five areas: 1) The distinction between private and public; 2) The concern for children and vulnerable groups; 3) The responsibility to inform and obtain consent; 4) The responsibility for confidentiality and anonymisation; and 5) Sharing of data, open data and Big Data.

However, Internet research gives rise to some particular challenges, especially with regard to data protection and the sanctity of private life. In this context, NESH refers to the concept of reasonable expectations of publicity, meaning that the information will not necessarily be public, even though it might be openly available.[7] Moreover, the form of the communication and the design of the technology might be relevant to a broader ethical reflection on the distinction between private and public matters. In this context, NESH refers to the concept of contextual integrity, which implies that legal concerns for privacy must be seen in a wider context of research ethics.[8]

This guide contains no rules or checklists for Internet research but is intended as a guide for reflection on research ethics considering general norms and real dilemmas, and thus aims to promote responsible and ethically justifiable practices among researchers and research institutions.

Delimitations

The purpose of this guide is to introduce students, researchers and the research community to recognised norms of and guidelines for research ethics. The guide is intended to aid in the development of sound judgement and reflection on issues pertaining to research ethics, resolutions of ethical dilemmas, and promotion of good research practices. It can be an aid in planning a research project or in the publication of findings and results. The research ethics guidelines and this guide are advisory and supplement the legislation in this area.[9]

Ethical considerations in Internet research may be complex as well as counterintuitive. The object of study is not always obvious: Is it a study of the technology in itself? Is it about the way in which people use technology to communicate? Or are the privacy and personality of the users so closely interwoven with the technology and communication that its boundaries with individual identity and integrity have become blurred?

Technological development is advancing rapidly, and this raises new challenges for research ethics. Since NESH launched its guidelines for Internet research in 2003, technological development has come a long way. Internetbased social networks such as Facebook became widespread around 2005, and in all the sharing of information it is sometimes unclear what is public and what is private. Smartphones and mobile Internet connections (3G, 4G, Wifi) appeared around 2008, with various apps that register data on health and location, raising issues pertaining to data storage and surveillance. Furthermore, since 2010, development in the areas of digitalisation and automatisation has led to production, dissemination and storage of huge amounts of data at an increasing pace, often in real time. As a result of this rapid development, the criteria for what constitutes good and justifiable research are not always obvious.[10]

In this guide, the concept of ‘Internet research’ is used in a technology neutral manner. The concept includes the Internet (in the definite form), a technological infrastructure based on the Internet protocol (IP addresses), but also other communication networks (GSM, 4G, WLAN etc.) and other technologies such as mobile telephone systems, location systems, biometrics, sensors and data storage.

This guide primarily focuses on research on people in their encounter with digital networks. The guide is primarily intended for research in the humanities and social sciences on those who disseminate information, communicate and interact in some form or other via the Internet. NESH recognises that Internet research also raises several other issues, including within other disciplines and in public debate. This version of the guide will only provide a very limited description of the challenges associated with Big Data, Artificial Intelligence (AI) and the Internet of Things.[11]

Researchers are personally responsible for ensuring that the protection of the interests and rights of individuals, based on the respect for human dignity and the requirement to protect privacy, are protected. NESH emphasises that research ethics goes beyond the statutory protection of personal data. The new Norwegian Personal Data Act, which incorporates the EU’s General Data Protection Regulation (GDPR), regulates only the processing of personal data, whereas research ethics takes a broader view of privacy linked to the protection of individual integrity and the sanctity of private life.[12] In other words, research ethics seeks to protect the people involved, not solely ensuring compliance with the legalities regarding use and storage of personal information. NESH’s guidelines for research ethics are recognised internationally because they combine individualist and relational perspectives on human life, which is especially relevant for distinguishing between private and public matters on the Internet.[13]

Below we will look in more detail at norms and values of research ethics that are especially relevant for Internet research with reference to NESH’s guidelines, in particular Part B on the concern for individuals. 

Ethical Considerations

1) Distinction between public and private

NESH’s guidelines state as a main rule that researchers are responsible for informing research participants (NESH 2016: B.7), and if sensitive personal information is used, that they obtain consent (NESH 2016: B.8). The guidelines also refer to a number of exceptions to this rule, for example, for observations in open arenas, such as public streets and squares (NESH 2016: B.7). Other exemptions from the requirement for consent apply to research on public figures (NESH 2016: B.7) and on private businesses and organisations (NESH 2016: B.19). When online research is undertaken, both the main rule and the exemptions need to be specified. This section discusses the distinction between public and private with regard to what exemptions exist concerning the requirement for consent and the right to be informed. When can a statement made online be considered as public? What rules apply to public figures? When can research be considered to be in the public interest?[14]

In Internet research, drawing a distinction between public and private may be difficult, but in principle, this distinction is identical to the one that applies to all forms of research: the researcher cannot indiscriminately register private information even though it may be openly available, for example in the form of intimate confidences shared in a café or confidential exchanges between children in the schoolyard. The same applies to Internet research. In other words, not all information openly available online is public, and thereby be made an object of research without informing and obtaining consent from those concerned. Nor can all information that is of a public nature be indiscriminately used for research purposes, since some groups are entitled to special protection, and some also need to be protected against themselves. This may apply even after consent has been given.

It is crucial here to distinguish between accessibility in the public sphere and the sensitivity of the information. The statement might have been made in public or in private, and the content can be of a personal or general nature. There is thus a continuum that ranges from particularly sensitive information revealed in closed online forums to general information published in a public arena targeting a broad audience. In terms of research ethics, the grey zone often involves sensitive information and statements published in open Internet forums where it may be less obvious whether this is a public arena or not.

NESH states that in this context, it will be expedient to apply the concept of reasonable expectation of publicity. This concept delineates research that does not violate the informant’s understanding or expectation that the information and communication are public (for example political debate in open forums intended for a general audience). The concept relates to research where it is unclear whether the informants understand and expect that their actions and statements are in fact public, and that this information may be used for purposes other than those they had initially intended. However, this involves a great number of nuances and concerns. Researchers must actively balance these different concerns, and take a personal responsibility for assessing the appropriate criteria for reasonable expectations of publicity.

Moreover, the form of communication and the design of the technology may be relevant for on research ethics reflections. NESH believes that it is relevant here to refer to contextual integrity. The context in which the information exchange or communication takes place is also crucial in distinguishing between what is public or private. This applies to the use of blogs and social media in particular, where the expectations of publicity, privacy settings and awareness of the publication of location data vary between users. Relevant questions may include: How accessible is the service? What is the form of its technical settings? Does it have an age limit or restrictions on access? How many users have access? To what extent is this group or website referred to in traditional media? These are elements that may be included in reflections on the research ethics pertaining to the context and setting in which the information is provided and communication takes place.

Some Internet forums use passwords and other restrictions on access. Information provided here is not always of an obviously private or public nature, and obtaining consent may thus be required before the information can be used for research purposes. As a main rule, researchers ought to proceed with greater caution the stronger the restrictions on access. On the other hand, the purpose of technical restrictions on access and ‘private’ groups may be to protect statements that in principle are public. For example, Facebook-groups with thousands of members could be regarded as public, despite any technical settings indicating that the group is ‘private’ or only for ‘friends’. The larger the group, the more public the information.

What about the information in online media? As a main rule, researchers should be able to freely use information on issues reported in edited media [15] Persons who are interviewed and/or referred to in such media, must take into account that the published information might be used for research purposes (NESH 2016: B.7). In other contexts, the distinction may be more vague, such as in blogs and unedited discussion groups. Here it may be relevant to draw on the reflections above on reasonable expectations of publicity: people who publish information in unedited discussion groups may have an understanding that the information is private, even though technically speaking it is openly available. Others may be aware that the information in blogs is public, but still object to the use of this information for research purposes. On one specific website, different participants may have differing views of what is private or public, and their communication and patterns of activity are thus affected by this understanding.

What about research which is in the public interest, but cannot practically be undertaken if prior consent must be obtained, such as undercover participant observation? This may involve research necessary to reveal and criticise injustices and abuses of power, which is relevant in a number of disciplines in the social sciences and humanities.[16]

Other examples include, but are not limited to, research on criminal activities such as abuse, violence in personal relationships, discrimination, corruption and planning of terrorist acts. Here, the freedom and social responsibility of research permit potential exemptions, including from the requirement for consent.[17]

In all cases the researcher must balance what technically or legally speaking is of a public nature in light of what people actually consider to be public or private. NESH emphasizes that even if information appears to be of a public nature, researchers may nevertheless be obligated by research ethics to inform those concerned or request consent for the research project.

2) Concerns for children and other vulnerable groups

In addition to assessments of the sensitivity of the information and its accessibility in the public sphere, it may be necessary to assess the vulnerability of the participants and the interaction with the participants. This applies in particular to protection of children and adolescents (NESH 2016: B.14), vulnerable or exposed groups (NESH 2016: B.21) and information provided by third parties (NESH 2016: B.13). One example of this could be confidential exchange of personal experiences or those of others regarding health and illness in closed online communities.[18]

Children and adolescents who participate in research are entitled to special protection (NESH 2016: B.14).[19] So are other weak and vulnerable groups, such as the elderly or patients. Internet research involving children and adolescents gives rise to special challenges, because some of their activities occasionally evade adult control, and because the boundaries between the child’s world and the adult world may be blurred. This does not weaken the requirements for obtaining parental consent for children’s participation in research, even though this may be difficult in practice. In this context it is also crucial to verify the real, biological age of the respondents. In addition, children must provide their own informed consent to participate in the research. In some cases, it might be easier to comply with the children’s need for protection by collecting information with the aid of established methods rather than online.[20]

Researchers must also show respect for the values and opinions of the research participants, especially if the opinions and values deviate from those of society at large. Examples of such participants may include religious groups, ethnic minorities, youth groups and political sub-cultures (NESH 2016: B.16). Research on and within other cultures entails special requirements for dialogue with representatives of the culture being studied (NESH 2016: B.23). But there are also limits to such cultural recognition, for example, if linked to discrimination, culturally based forms of abuse and other violations of fundamental values and universal human rights (NESH 2016: B.24). In certain situations, the researcher’s duty to protect must yield to the duty to avert (in case of suspected criminal offences) and the duty to inform (in case of suspected child abuse) (NESH 2016: B.9). This also applies to Internet research.[21]

Various forms of interaction online may cause a researcher directly or indirectly to collect information on persons who have not provided consent to participate in the research project. Researchers must assess and consider possible consequences for persons who come to be involved in the research indirectly (NESH 2016: B.13). For example, studies of online interaction in social media may gain access to information about persons who are closely linked to the primary informants, for instance in the form of pictures or videos, or through interaction and comments. This information may also be of a sensitive nature and must be treated as such. If other, previously unknown individuals become objects of research, researchers ought to consider obtaining consent ex post.

3) Responsibility to inform and obtain consent

The ethical assessment of the accessibility in the public sphere, the sensitivity of the information, the vulnerability of the participants and the interaction with the participants should form the basis of the assessment of the researcher’s ethical responsibility for informing the research subjects and obtaining their consent (NESH 2016: B.7). In other words, this does not refer to the statutory requirement for consent to the processing of special categories of personal data or the statutory entitlement to information and transparency (NESH 2016: B.8), but to the ethical responsibility that invariably rests with the researcher, irrespective of whether personal data are involved or not, or whether the information is sensitive or not. Variations in the nature of the research, its source material and source data may give rise to different questions and dilemmas concerning research ethics.

For example, it is insufficient for the researcher to refer to the general consent which is provided when people sign up to an Internet forum such as Facebook. If needed, consent to the use of personal information in research must be reobtained, and the purpose must be specified before research can start. In other words, researchers must consider both legal and ethical issues involved to decide whether informing or obtaining consent is required or not.[22]

In many cases it will be a simple matter to inform or obtain consent from various online communities, directly from the participants or via a moderator. On the other hand, there are numerous challenges involved in providing information or obtaining consent for Internet research. The participation by individuals in online communities may be of a fleeting nature, but the information that the researcher wishes to use may have been stored and is thus available. In such cases, providing information and obtaining consent ex post may prove to be difficult. In other cases, the number of persons involved may be so large that it is impossible to obtain consent from all those involved. In cases where obtaining consent is required, such practical issues place demands on the planning of the research effort.

In Internet research, obtaining consent often requires a greater effort to ensure the quality of the consent. First, a person pretending to be someone else (e.g., through a fake profile) thus makes it difficult for the researcher to ensure that the consent is real. Second, the person concerned may not have sufficient capacity to consent. Here, the vulnerability of those concerned is a key factor. This requires comprehensive precautions to ensure that no children or vulnerable persons are recruited into studies intended for adults who do have the capacity to consent. Third, it might be a challenge to ensure that the participants have sufficient and correct information concerning the research project and the background to the request for consent if these are communicated only in writing online.

In some cases, when the information is especially sensitive and the informants are vulnerable, these problems of obtaining and securing consent may indicate that the researcher ought to abstain from studies of that particular online community. In other cases, it might suffice to provide information on the project in an open forum and subsequently obtain consent from those selected informants who will be included in the final data material and/or analysis.

Research interaction is also a relevant factor in this context. There is a significant difference between researchers who only collect information and those who actively participate in the exchange of opinion or information. As a main rule, researchers should present themselves as researchers when actively participating in or collecting information from an online community with restricted access. This should be done before the research project starts. Researchers must pay due attention to ethical norms and any rules of behaviour that may apply in the online community. In this context, the researcher is responsible for declaring any limitations, expectations and requirements inherent in the role of researcher (NESH 2016: B.18). In research processes where the contact between the researchers and participants extends over time, contact that has initially been established by analogue means may be transferred to Internet-based platforms or take place in both analogue and digital forms. If information published on digital platforms will be included in the data material, the informed consent from the research participants must also encompass digital communication. If digital communication is not encompassed by the initial consent, the researcher must obtain a new consent after providing information stating that the digital communication will be made subject to research. In such cases, it might be relevant to consider the possibility of a broad consent.[23]

Whenever possible, the researcher should also inform participants in, and owners of, open forums of the systematic collection or use of information. The rules of the forum may provide some indication of the user’s reasonable expectations of publicity, i.e. the extent to which the users expect that the information published in the forum will be public or only shared between members.

4) Responsibility for confidentiality and anonymity

In many cases, the researcher’s interaction with vulnerable persons and groups, and his or her active collection of sensitive information will be restricted by a vow of confidentiality. The credibility of the researcher and the trust of the participants depend on confidential processing of the information in accordance with the terms defined by the consent form (NESH 2016: B.9). However, there are also some exceptions. For example, those concerned may choose to consent to be identified in research that obviously will entail significant personal burdens.[24]

In Internet research, anonymisation may in many cases be hard to achieve. This is related to the technical preconditions and assessment of accessibility in the public sphere. Online information and statements are stored digitally, often permitting identification of participants and informants in searches. In some cases, it will be possible to re-identify individuals, even when all information in principle is de-identified. Nor is the use of ‘nicknames’ or pseudonyms a guarantee that the individuals remain anonymous, since such nicknames can often be traced across different communities and settings. This imposes great demands on the researcher, and it also limits the kind of confidentiality that researchers are actually able to guarantee the  participants. When informing and obtaining consent, the researcher ought to seek to explain these potential limitations for confidentiality in as much detail as possible wherever relevant.

Internet research is often based on interaction in transient digital forums, and this impermanent form may give rise to the expectation that the information communicated to the researcher is private and confidential. Some individuals may also reveal personal and sensitive information in open online forums, without thereby accepting that their statements can be shared or made subject to research. The researcher must exercise due care and assume personal responsibility for safeguarding the integrity and interests of the individual, including the respect for privacy and family life (NESH 2016: B.15). Researchers are in all cases obligated to provide information on the statutory limitations to confidentiality and professional secrecy.[25]

5) Sharing of data, open data and Big Data

Sharing of data is important for verification and re-use of research material. Transparency is also a precondition for maintaining society’s confidence in research (NESH 2016: D.29). However, sharing of data also raises a number of issues pertaining to data protection, privacy and confidentiality. Research ethics therefore emphasizes that such re-use will necessarily be of a limited nature (NESH 2016: B.10). The researcher must make an independent judgement of what is ethically appropriate. This is especially difficult for Internet research, where there might be, for example, ambiguity with regard to the accessibility in the public sphere, the sensitivity of the information and the vulnerability of the participants.[26] In some cases, it might be necessary to rethink some fundamental issues: Can data be distinguished from personal information? Is the information public or private? When is obtaining consent required? Can anonymity and confidentiality be guaranteed?[27]

Sharing of data may also give rise to questions about ownership and publication rights. It is therefore important to clarify, at an early stage of the project, who may publish what with respect to co-authorship (NESH 2016: D.25) or good reference practices (NESH 2016: D.26). Researchers who use data or information provided by others have an independent responsibility for checking the quality and validity of this information.

Ethical principles regarding the sharing of data are currently supplemented by a number of research policy guidelines pertaining to open data and open science. One key instrument in this regard is sharing of research data and making them generally available. Here, transparency and sharing must be balanced against other concerns such as data protection, security and commercial interests. The fundamental principle is that the access to data should be as open as possible and as restricted as necessary.[28] On the other hand, this development is associated with profiling and a risk of re identification.[29] A linking of Big Data, location data and IP addresses may enable tracing of the informants’ identity, even when the data in principle have been de-identified. Moreover, collation of data that are not sensitive in themselves may produce new and sensitive information. A researcher may thus have difficulty ensuring that the processing of data is anonymous or that that all personal data are deleted once the project has ended. The researcher nevertheless remains responsible for this and should, as far as possible, advise potential informants of these challenges and the potential consequences that the research could imply. This applies in particular when the research links information together, and new, sensitive information about identifiable individuals is generated.[30]

Technological development in data-driven research is also linked to Big Data, Artificial Intelligence and the Internet of Things. Individuals who use various online services may leave behind large amounts of digital information which can be sold and linked in ways about which we have not been informed or to which we have not consented. This development raises a number of new and more interdisciplinary challenges that NESH, in collaboration with other committees for research ethics nationally and internationally, will seek to address.

In terms of research ethics, the key issue is that the researcher always has an independent responsibility for safeguarding the integrity of informants, irrespective of the methods used to collect or retrieve the data. The researcher is also responsible for informing subjects about the objectives of the research project and the purposes for which the results will be used. Furthermore, the researcher is responsible for reflecting and judging what is appropriate in terms of research ethics.

References

British Academy and The Royal Society (2017). Data management and use: Governance in the 21th century.

Buchanan, E. A. (2011). «Internet Research Ethics: Past, Present, Future». In Ess and Consalvo (eds.), The Handbook of Internet Studies, pp. 83–108. Oxford: Blackwell Publishing Ltd.

Datatilsynet (2013). Big Data. Personvernprinsipper under press.

De nasjonale forskningsetiske komiteene (2018). «Ny lovgivning om personopplysninger - hva betyr det for forskning?».

Den nasjonale forskningsetiske komite for samfunnsvitenskap og humaniora (2003). Etiske retningslinjer for forskning på Internett.

Den nasjonale forskningsetiske komite for samfunnsvitenskap og humaniora ([1993] 2016). Forskningsetiske retningslinjer for samfunnsvitenskap, humaniora, juss og teologi.

Economic and Social Research Council (2015). Research Ethics Framework.

Elgesem, D. (2015). «Consent and information - ethical consideration when conducting research on social media». In Fossheim and Ingierd (eds.), pp. 14–34.

Enebakk, V., H. Ingierd and N. O. Refsdal (eds.) (2016). De berørte etter 22. juli. Forskningsetiske perspektiver. Oslo: Cappelen Damm Akademisk and De nasjonale forskningsetiske komiteene.

Ess, C. (2002). «Ethical decision-making and Internet research». AoIR ethics working committee.

Ess, C. (2015). «New selves, new research ethics?». In Fossheim and Ingierd (red.), pp. 48–76.

Ess, C. (2017). «Grounding Internet Research Ethics 3.0: A view from (the) AoIR». In Zimmer og Kinder-Kurlanda (eds.), Internet Research Ethics for the Social Age: New Challenges, Cases, and Contexts, pp. iv-xv. New York: Peter Lang.

European Data Protection Supervisor (2018). Towards a Digital Ethics. Ethics Advisory Group.

Forskningsrådet (2017). Policy for tilgjengeliggjøring av forskningsdata.

Fossheim, H. and H. Ingierd (eds.) (2015). Internet Research Ethics. Oslo: Cappelen Damm Akademisk and De nasjonale forskningsetiske komiteene.

Kunnskapsdepartementet (2017). Nasjonal strategi for tilgjengeliggjøring og deling av forskningsdata.

Larsson, A. O. (2015). «Studying Big Data - ethical and methodological considerations». In Fossheim and Ingierd (eds.), pp. 141–156.

Markham, A. N. and E. A. Buchanan (2012). «Ethical Decision-Making and Internet Research». Recommendations from the AoIR Ethics Working Committee (Version 2.0). Association of Internet Researchers.

Prabhu, R. (2015). «Big Data - big trouble? Meanderings in an uncharted ethical landscape». In Fossheim and Ingierd (eds.), pp. 157–172.

Segadal, K. U. (2015). «Possibilities and limitations of internet research: A legal framework». In Fossheim and Ingierd (eds.), pp. 35–47.

Staksrud, E. (2015). «Counting children. On research methodology, ethics and policy development». In Fossheim and Ingierd (eds.), pp. 99–121.

Steen-Johansen, K. and B. Enjolras (2015). «Social research and Big Data - the tension between opportunities and realities». In Fossheim and Ingierd (eds.), pp. 122–140.

Notes

[1] In particular, NESH wants to acknowledge the support of professor Charles Ess and the inspiration of the Association of Internet Researchers (AoIR).

[2] References to the various guidelines are made in the text, for example (NESH 2016: B.5). See also the various contributions in Fossheim and Ingierd (eds.) (2015), referred to in this guide.

[3] Markham og Buchanan (2012).

[4] Ess (2015), in Fossheim og Ingierd (red.), pp. 48–76.

[5] European Data Protection Supervisor (2018), pp. 16–21.

[6] For a discussion of these four factors and aspects, see Elgesem (2015), in Fossheim and Ingierd (eds.), pp. 14–34.

[7] Read more about reasonable expectations of publicity in Elgesem (2015), pp. 23 ff.

[8] Read more about contextual integrity in Ess (2015), pp. 64 ff.

[9] Forskningsetikkloven [Research Ethics Act] (2017);  Personopplysningsloven [Personal Data Act] (2018).

[10] Read more about the development in this area in Buchanan (2011) and Ess (2017).

[11] NESH has proposed that the National Committees for Research Ethics (FEK) examine these aspects as a shared and interdisciplinary topic in research ethics.

[12] For more information on GDPR in research, see the National Committees for Research Ethics (2018).

[13] For more about individualist versus relational perspectives, see Ess (2015).

[14] The notion of what is considered to be public or publicised is also crucial in a legal perspective, since Article 9, litera e) of the GDPR, which regulates processing of special categories of personal information, permits processing of ‘personal data which are manifestly made public by the data subject’ without consent, cf. Section 9 of the Personal Data Act

[15] Here, edited media implies adherence to a professional editorial code, such as the Norwegian Rights and duties of the editor.

[16] Economic and Social Research Council (2015), p. 28; Tri-Council Policy Statement (2005), p. i.7.

[17] Section 9 of the Personal Data Act permits research on special categories of personal data without consent, provided that the research is in the public interest and its benefits clearly exceed the inconveniences to those concerned. Of relevance to this is also Article 85 of the GDPR, which permits exemption from most data protection provisions for ‘academic expression’, with reference to freedom of information and expression.

[18] Elgesem (2015), pp. 24 ff.; NESH statement 2015/21.

[19] Staksrud (2015), in Fossheim and Ingierd (eds.), pp. 98–121.

[20] NESH statement 2015/323.

[21] NESHs statement 2015/295

[22] Segadal (2015), in Fossheim and Ingierd (eds.), pp. 35–47

[23] Personal Data Act, GDPR preamble item 33. The criterion here is that the research is ‘in keeping with recognised ethical standards for scientific research’.

[24] Enebakk, Ingierd and Refsdal (2016).

[25] Confidentiality may conflict with the duty to report if reprehensible or illegal matters are detected: the duty of confidentiality must yield to the duty to avert (Section 196 of the General Penal Code) in case of criminal offences and to the duty to inform (Section 6–4 of the Child Protection Act) if suspicions of child abuse or neglect arise.

[26] NESHs statement 2017/277.

[27] British Academy og The Royal Society (2017); Ethics Advisory Group (2018).

[28] Kunnskapsdepartementet (2017); Forskningsrådet (2017).

[29] Datatilsynet (2013)

[30] Steen-Johansen and Enjolras (2015), in Fossheim and Ingierd (eds.), pp. 122–140; Larsson (2015), in Fossheim and Ingierd (eds.), pp. 141–156; Prabhu (2015), in Fossheim and Ingierd (eds.), pp. 157–172.