14 - iassist quarterly

Issues of Privacy

and Access

represent a threat to the survival of the data

organizations - and to a certain extent even of

quantitative social research.

Consequently, in August of 1978, IFDO
sponsored an International Conference on

Emerging Data Protection and the Social

Sciences' Need for Access to Data . At this

conference, which was hosted by the most

experienced and biggest European Data Archive,

the Zentralarchiv in Cologne, comparative

national status reports were presented from 10

coimtries. The national reports were sent to the

organizers who collected them in a volume of

proceedings that was a tangible point of

departure for the discussions at the 3-day

conference.

by Per Nielsen'

Early academic reactions to privacy and access

regulations

The IFDO resolutions, August 1978

For a few years in the mid-seventies, members
of the international social science community

could study the Hessian and the Swedish data

legislation practices whilst preparing the

viewpoints for which they foimd it necessary to

fight on their national home groimd before the

enactment of similar privacy legislation. To
member institutions of the newly established

International Federation of Data Organizations

(IFDO), the issues of privacy and access were

of central importance, not just as an academic

field of study, but as central issues that might

The participants invited to the Cologne

Conference unanimously adopted three IFDO
Resolutions which served the purpose of

drawing attention to as many aspects and

consequences of data legislation as possible.

The IFDO Resolutions are appended to this

note as one of the first, outspoken, academic

reactions to privacy and access regulations.

They are included in the same form as that in

which they were presented to the Danish public

in the Danish Data Archives (DDA)
newsletter^

The Bellagio Principles, 1977

One year prior to the IFDO Conference, a

group of social scientists and senior

administrators at national statistical biu'eaux had

discussed access to statistical data in Bellagio,

Italy. From this event, 18 so-called Bellagio

Principles were circulated in the social science

community. These principles were considered

important because they represented a first

compromise between social scientists on the one

hand and senior statistics administrators on the

other.

'Presented at lASSIST/IFDO International

Conference May 1985. Amsterdam. DDA-nyt 9:12-14, December 1978.

Spring 1986



iassist quarterly 15

In an explicit statement, the IFDO Conference

endorsed the Bellagio Principles, which are

reproduced below - again in the same form as

that in which they were presented to the

Danish pubhc in the DDA newsletter^.

The European Science Foundation statement,

1979-1980

In 1979, a working group of invited specialists

in the social sciences, the medical sciences, and

administrators from data inspection authorities,

tried to reach agreement on a statement which

was going to be subject to approval by the

assembly of the ESF. Dtmng the working

group meetings, I felt a peculiar distrust

between each group and the other two. The

medical experts asserted that their data-handling

procedures were safe and felt that it was in the

interests of patients (i.e. the public) to supply

necessary information to their doctors - without

too much interference from the data inspection

authority; on the other hand, the medical

experts were sceptical about some of the data

collection and handUng procedures applied by

social scientists! The experts with a social

science background tended to hold that their

own rationale for data collection, as well as

their appHed data handling routines, were less

dangerous to the public than most of the data

collection ventures within medical science. And
the data inspection authorities felt that both

medical and social science projects involving

confidential data should be rather rigidly

controlled.

In addition to these disciplinary variations in

attitudes, the national differences were more
outspoken in the ESF working group than they

had been in either Bellagio (where Canada, US,

UK, West Germany and Sweden were

represented by scientists and statisticians) or in

Cologne in which about a dozen countries were

involved. Furthermore, it took more than a

year to reach agreement on the wording of the

DDA-nyt 9:14-16, December 1978.

final texL After reworking the text as adopted

at the conference, a slightly rephrased version

was accepted by the ESF Assembly. It is this

revised (official) version of the ESF Statement

which is appended to this paper.

Reasons behind the diversification in attitudes

I think it is fair to say that three or four major

factors caused the change in attitudes to the

issues of privacy and access during the last half

decade of the seventies - from consensus to a

more diversified set of attitudes. First, the

various groups of agents became more aware of

their group interests in the course of the data

legislation process as the latter proceeded in

more and more countries. Second, the

discussions moved from a level of soft

statements towards one of juridical phraseology

in sections and subsections. Third, the

difTerences in existing legal conditions between

countries (e.g. in such areas as freedom of

information) as well as practical set-up (e.g. a

tradition for codes of ethics) implied associated

difTerences in the new legislation and in its

actual implementation.

This indicates that there is still a lot of research

to be done in terms of comparing the conditions

for quantitative research between countries as

well as following the trend over time within a

single country - as practices are defined and

acts are amended.

As can be expected, substantial interest is

devoted to this issue among social science data

"pushers" and "addicts". Since 1977, there has

hardly been a conference of any size or

generality which has not had issues of privacy

and access on its agenda.

Concluding remarks and recommendations

As a convenor of the IFDO/IASSIST 1985

Conference session on Issues of Privacy and

Access, 1 thought that it might be useful to

reprint some of these early deliberations, in

Spring 1986



16 - iassist quarterly

order to facilitate discussion along the following

lines: what new issues (if any) have entered the

debate in recent years, and what is the

present-day situation, compared to expectations

5 or 10 years ago.

Finally, I should very much like to see a

repetition of the 1978 IFDO conference. Now
that most coimtries have actually been living

with enacted privacy bills, a new systematic

comparison across countries would prove useful.

IFDO

International conference on emerging data

protection and the social sciences' need for

access to data

Resolutions

In a plenary session the conference unanimously

adopted the following three statements.

Social scientists' experiences with data

protection.

On the basis of evaluation of developments in

data protection within eleven coimtries, and

taking account of the general tendency for

legislative measures to have unintended

consequences, the conference expresses grave

concern about some of the negative impact of

data protection laws, regulations, and practices

on the social sciences. While we recognize that

it is essential to protect the privacy (integrity)

of the individual, there is also a need to know
and a need to secure the channels through

which, under proper safeguards, a reliable and

comprehensive understanding of the life

situation of individuals and groups of individuals

may be obtained.

In the opinion of the conference the need to

know and the need to secure a free flow of

information constitute the other side of the issue

of protecting the privacy of individuals. To a

large extent this other side of the privacy issue

has not been given due consideration in the

process of enacting and implementing data

legislation. The conference would like to draw

attention to the fact that such legislation can

and has become a vehicle for the protection of

the vested interests of particulariy resourceful

groups and organizations, thus contributing

toward an infringement of the fundamental

rights of other parts of society. It is recognized

that the results of significant social research

might jeopardize the interests of some of the

groups or individuals about whom data are

collected. However, it seems important to be

sensitive to the possibility that because of this

situation data protection measures can be

utilized as a shield behind which socially

significant issues are excluded from research.

Furthermore, developments in the field of

information processing have resulted in very

powerful instruments to control individuals and

society. In most of the countries represented at

the conference data protection laws are used by

bureaucracies to monopolize the information

necessary for the open discussion of public

policies. The data fiow among government

agencies has increased considerably during the

last few years, although data protection has in

some cases placed restrictions on this flow.

However, researchers often find themselves

excluded from the information necessary to

enable them to contribute to public discussion

by presenting independent opinions. This is

especially dangerous in a situation where

government policies are based increasingly on

large data bases, including microdata.

The conference is of the opinion that these

issues have significant political implications and

are associated with broad and general notions of

the free and unrestricted flow of information in

society. They should be given thorough political

Spring 1986



iassist quarterly - 17

consideration in the future development of data

legislation and practices.

The conference has learned that with respect to

data protection there are significant differences

in the situations of the different countries.

There are nations that have found an acceptable

balance between data protection and access to

data for research purposes. On the other hand,

there are countries where data flow for research

has come nearly to a standstill.

In this situation it is necessary to develop

guidelines for a general information policy. A
fundamental aim of a modem information

policy is to make information gathered by

public (and private) institutions more transparent

and visible in order to improve democratic

control. Within this broader framework, social

research must be considered not only as a

matter of interest to social scientists, but as part

of that system of democratic control.

A first important recognition of these problems

at the international level came in 1977, when a

group of social scientists and senior

administrators of national statistical bureaus

discussed the issue and drafted a set of

recommendations, which are now known in the

international social scientific community as the

Bellagio Principles. We endorse these principles.

We also hope that the pattern set by the

Bellagio conference of joint discussion of

common problems between social scientists and

governmental officers at all levels will be

continued.

In the perspective, the distinction between

statistical and administrative data should not be

used to make the latter less accessible to

researchers. Access to administrative data for

scientific purposes should be regulated according

to the principle or functional separation of

research and administrative data incorporated

also in the Bellagio Principles.

The conference wishes to point to the high

value placed on freedom of the press. The
social science community might be in a better

position to improve its services to society if its

freedom and rights to do research were secured

through similar principles, including the

obligation to protect the source of informatioa

Preservation and accessibility

In addition to these general principles the

conference recognized other points of interest

for the international development of social

research. In particular it recommended:

• that the data relevant to scientific

investigations on human affairs should be

preserved in readily usable forms;

that with the sole limits of protection of

privacy and confidentiality recognized in

the first part of this statement, research

data should be openly accessible to social

researchers and the general public of all

nations;

that govenmients should work to

eliminate barriers to general access to

research data and should take appropriate

action to facilitate their use under the

principles established by the United

Nations charter and incorporated in

UNESCO.

Codes of conduct

Finally the conference supported the following

recommendations toward the adoption of codes

of conduct by social researchers:

Social scientists collect information from

and about individuals for research

purposes. In doing so they have

traditionally followed certain standards of

behaviour: social research is conducted at

all times so that no harm should come to

Spring 1986



18 - iassisl quarterly

individuals while being subjects of

research.

The current concern to beuer protect the

privacy of individuals makes it necessary

to increase awareness of difTerences

between administrative and research uses

of information.

To make this point better understood by

the public, governments and researchers,

it is recommended that in addition to the

existing codes of ethics in various

disciplines, codes of conduct should be

developed for each research methodology.

These can make explicit the rules that are

already respected by the professional

researcher. Thus, by common practice in

survey research, the anonymity of

respondents, their right to be informed

about the purpose of a study, their right

to refuse cooperation at each stage of an

investigation, and their right to know the

identity of the researchers have been

respected.

The practical ground rules for the

responsible research use of personal data

will differ with the research method.

Each professional specialty should be

asked to make its practitioners fully aware

of the range of alternative techniques

available to implement codes of conduct

For survey research, as an example, such

alternatives include randomized response

methods, insulated data banks, and

appropriate levels of aggregation.

Codes of conduct should have sanctions

so that the public can be assured that

such codes of conduct are more than

mere declarations.

The Bellagio Principles

Excerpted from David H. Flaherty's report*.

1 National statistical offices should provide

researchers both inside and outside

government with the broadest practicable

access to information within the bounds of

accepted notions of privacy and legal

requirements to preserve confidentiality.

2 Legal and social constraints on the

dissemination of microdata are appropriate

when they reflect the interests of respondents

and the general public in an equitable

manner. These constraints should be

re-examined when they result in the

protection of vested interests, or the failure

to disseminate information for statistical and

research purposes (i.e., without direct

consequences for a specific individual).

3 All copies of government data collected or

used for statistical purposes should be

rendered immune from compulsory legal

process by statute.

4 In making data available to researchers

national statistical offices should provide

some means to ensure that decisions on

selective access are subject to independent

review and appeals.

5 The distinction between a research file, in

the sense of a statistical record (as defined

in the 1977 report of the U.S. Privacy

Protection Study Commission), and other

micro files is fundamental in duscussions of

privacy and dissemination of microdata. All

dissemination of government microdata

" David H. Flaherty. Final repon of the

Bellaggio conference on privacy, confidentiality,

and the use of government microdata for

research and statistical purposes. Statistical

reporter 78-8:274-279, May 1978.

Spring 1986



iassist quarterly - 19

discussed in connection with the Bellagio

Principles is assumed to be a transfer of data

to research files for use exclusively for

research and statistical purposes.

6 There are valid and socially significant fields

of research for which access to microdata is

indispensible. Statistical agencies are one of

the prime sources of govenmient microdata.

7 Public use samples of anonymized individual

data are one of the most useful ways of

disseminating microdata for research and

statistical purposes.

8 Techniques now exist that permit preparation

of public use samples of value for research

purposes within the constraints imposed by

the need for confidentiality. Countries with

strict statutes on confidentiality have

prepared public use samples.

9 There are legitimate research purposes

requiring the use of individual data for

which public use samples are inadequate.

10 There are legitimate research uses which

require the utilization of identifiable data

within the framework of concern for

confidentiality.

11 Other techniques of extending to approved

research the same rights and obligations of

access enjoyed by officers of the government

agency need to be considered in terms of

better access.

12 There is considerable potential for

development of more economical and

responsive customized-user services, such as:

1) record linkage under the protection of the

statistical office, 2) special tabulations, 3)

public use sample for special purposes. Such

services must often involve some form of

cost recovery.

13 Some research and statistical activities require

the linking of individual data for research

and statistical purposes. The methods that

have been developed to permit record

linkage without violating law or social custom

regarding privacy should be used whenever

possible.

14 Professional or national organizations should

have codes of ethics for their disciplines

concerning the utilization of individual data

for research and statistical purposes. Such

ethical codes should furnish mutually

agreeable standards of behaviour governing

relations between providers and users of

governmental data.

15 Users of microdata should be required to

sign written undertakings for the protection

of confidentiality.

16 Considerable efforts should be made to

explain to the general public the procedures

in force for the protection of the

confidentiality of microdata collected and

disseminated for research and statistical

purposes.

17 The right of privacy is evolving rather than

static, and closely related to how statistics

and research are perceived. Therefore,

statisticians and researchers have a

responsibility to contribute to policy and

legal definitions of privacy.

18 Public concern about privacy and

confidentiality in the collection and utilization

of individual data can be addressed in part

as follows:

a. voluntary data collection, whenever

practicable,

b. advanced general notice to respondents

and informed consent, whenever

practicable,

c. provisions for public knowledge of data

Spring 1986



20 iassist quarterly

public education on the distinction

between administrative and research uses

of information.

EFS's statement on 'privacy'

Statement concerning the protection of privacy

and the use of personal data for research

(adopted by the Assembly of the ESF on 12

November 1980) '

Preamble

The necessity of safeguarding the individual

against misuse of his personal data has been

repeatedly emphasized, in the last few years, at

both the national and the international level.

This has been particularly the case in the

countries with organizations which are affiliated

to the ESF. In Austria. Portugal and Spain data

protection is explicitly referred to in the

constitution. Specific legislation already exists in

Austria, Denmark, France, the Federal Republic

of Germany. Norway and Sweden. Draft laws

are under consideration in Belgium, the

Netherlands and Switzerland, while an official

report on the issue has been prepared in the

United Kingdom.

There has also been considerable concern v/ith

these matters at the international level. The
Council of Europe has recently elaborated a

Convention for the Protection of Individuals

with Regards to Automatic Processing of

Personal Data , while the OECD has prepared a

series of guidelines concerning the protection of

privacy and the movement of personal data

across frontiers. Mention should also be made
of the discussions going on within the

Commission of the European Communities

about a possible directive and of the enquiry

carried out by the European Parliament which

led to a resolution calling for immediate action.

However, the implementation of data protection

laws has led. in an increasing number of cases,

to serious restrictions on access to personal data

for research purposes. For example, problems

connected with the collection and evaluation of

information by means of questiormaires, access

to information held by public authorities,

particularly statistical offices, and the destruction

of personal data by such authorities once the

purposes for which they were collected have

been fulfilled, have been creating considerable

concern amongst the scientific community. This

led to the drawing up of the Bellagio Principles

in August 1977' and to an international

conference on emerging data protection and the

social sciences' need for access to data which

was held in Cologne in August 1978. sponsored

by the International Federation of Data

Organizations (IFDO). These problems were

also discussed at the 10th Colloquy on European

Law organized by the Council of Europe at

Uege in September 1980.

The ESF fully endorses the necessity of

protecting the privacy of the individual. It

feels, however, that the attention of the

legislators and international bodies conemed
should drawn be to the researchers' case for

special conditions for the use of personal data.

These should ensure, under proper controls,

DDA-nyt 18:9-13, sommer 1981.

'Contained in the Final Report of the Bellagio

Conference on Privacy, Confidentiality, and the

use of Government Microdata for Research and
Statistical Purposes, which was a meeting of
representatives of the central statistical agencies
of Canada, the Federal Republic of Germany,
Sweden, the United Kingdom and the United
States held at the Rockfeller Foimdation
Bellagio Study and Conference Center in Italy,

16-20 August 1977.

Spring 1986



iassist quarterly - 21

access to such data when it is needed for

specific research purposes. Accordingly, a group

of experts under the chairmanship of Professor

S. Simitis, Professor of Civil and Labor Law at

the University of Frankfurt and Data Protection

Commissioner of the State of Hesse in the

Federal Republic of Germany, was set up to

draft such a statement After full discussion

and revision within the ESF the following

principles and guidelines were adopted by the

ESF Assembly at its meeting in November 1980.

They are put forward to ensure both the

protection of personaal data and the necessary

access to such data for research purposes.

J. Goormaghtigh

Secretary General

Strasbourg

13 November 1980

Basic principles

'Personal data' are, in the context of this

document and in accordance with the

definition to be found in the Coimcil of

Europe's Convention for the Protection of

Individuals with Regard to Automatic

Processing of Personal Data and also

adopted by the OECD. any information

relating to an identified or identifiable

individual.

Data protection legislation must, in order

to fulfill its task, which is to guarantee

the respect of privacy, cover all uses of

personal data and therefore include its

use for research purposes.

Professional codes of ethics are a

complement to legislative measures

safeguarding the respect of privacy. The
scientific communities concerned should

encourage the development of such codes,

within the fram.ework of the rules

established by the legislator, in order to

take into account the specific needs of the

different disciplines.

Freedom of research presupposes the

broadest possible access to information.

Legislation should, therefore, besides

specifying the conditions tmder which

personal data may be used for research,

ensure access to the information needed.

In order to ensure the respect of privacy,

research should, wherever possible, be

undertaken with anonymized data,

following already accepted practices.

Scientific and professional organizations,

together with pubUc authorities, should

promote further development of

techniques and procedures to secure

anonymity. Anonymity should be

considered as given, whenever the

individual can only be identified with an

imreasonable amoimt of time, cost and

manpower {de facto anonymity).

Guidelines

Any use of personal data for research

purposes, irrespective of the aims for

which they were or are to be collected,

presupposes either the explicit permission

of the legislator or informed consent

unless the individuals concerned are not

identifiable by the receivers.

There is informed consent when the

individuals concerned have been clearly

informed:

a. that the provision of data is volimtary

and that a refusal to comply will have no
adverse consequences on them;

b. of the purposes and nature of the

research project;

c. by and for whom the data are being

Spring 1986



22 - iassist quarterly

collected;

d. thai the data collected will not be used

for any other purpose than research.

With the approval of the data protection

authority, or its equivalent, informed

consent is not required in cases where the

nature of the research project is such

that:

a. the informed consent of the individual

would invalidate important objectives of

research;

b. informed consent could cause mental or

physical distress to the individual

concerned.

For the sole purpose of selecting samples

for research involving population-based

surveys, legislation or other legally

acknowledged procedures should permit

the use of data concerning name, address,

date of birth, sex and the occupation of

individuals collected by state agencies for

non-research purposes.

Personal data obtained for research should

not be used for any other purpose but

research.

In particular, personal data obtained for

research purposes should not be used to

make any decision or take any action

directly affecting the individual except

within the context of research or with the

specific authorization of the individual

concerned.

confirmation whether or not data

pertaining to him are maintained, to

challenge data relating to him and to

have data erased, rectified, completed or

amended should be limited to other

research projects where it is intended that

the data be used in an identifiable form.

The leaders of research projects using

personal data should be responsible for

ensuring that the necessary technical and

organizational measures are taken in order

to guarantee the confidentiality and

security of the data and for keeping these

measures imder review in accordance with

the latest scientific and technical

developments.

Once the specific research purpose for

which personal data have been collected

has been achieved, these data should be

depersonalized and the necessary measures

(e.g. the deposit of identifying code

numbers with a central research data

archive) should be taken for their secure

storage.

The decision to destroy personal data held

by public authorities should only be taken

after consideration of their possible future

use for research and after consultation

with the central data archive or a similar

organization.

Whenever personal data are used for

research, they should not be published in

identifiable form unless the individuals

concerned have given their consent

In the case of personal data used for

research, the individual's right to obtain

Spring 1986