Princeton researcher apologizes for GDPR/CCPA email study
Claiming that this study was &quot;human research&quot; is straight-up insane. There&#x27;s as much &quot;human research&quot; going on there as there is when statisticians acquire data by going to a human who possesses it and asking for it (e.g. they want to study baseball, so they go to the Head Excel Overlord of the MLB and ask for their data) - that is, <i>exactly none</i>.<p>Analyzing data that was given to you by a human does not automatically make your research project &quot;human research&quot;, full stop.<p>The research question here is &quot;How do <i>organizations</i> fulfill their legal requirements due to the GDPR and CCPA?&quot; and has <i>nothing</i> to do with individuals. The researchers didn&#x27;t want any data about the humans, they didn&#x27;t ask for it, they weren&#x27;t studying reaction time, psychological response, brain activity, or <i>anything</i> else about any humans at all.<p>If the answer to the question &quot;Could you replace a human in experiment with an automated process and still perform a meaningful experiment with conceptually identical results?&quot; is &quot;yes&quot;, then there <i>is no human research going on</i>. Test: Stanford Prison Experiment: answer &quot;no&quot; (because the students were actually the ones being studied), turns out to be human research. Test: studying the properties of a crystal in a lab, and one of the machines is operated by a human grad student, answer is &quot;yes&quot;, not human research. (note also that this test just proves that human research isn&#x27;t being done - if you replace the baseball players in the above example with robotic batters, the answer the above question is &quot;no&quot;, but clearly human experimentation isn&#x27;t happening)<p>Similarly, if each of the individuals who were contacted were replaced with a Perl script scanning for keywords that automatically replied with the organization&#x27;s GDPR and CCPA policies, the results from the experiment would be. Exactly. The. Same.<p>In fact, let&#x27;s go and look up the definition of &quot;human subjects research&quot;:<p>According to 45 CFR 46, a human subject is &quot;a living individual about whom an investigator (whether professional or student) conducting research:<p>Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or
Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.&quot;<p>...from the NIH at <a href="https:&#x2F;&#x2F;grants.nih.gov&#x2F;policy&#x2F;humansubjects&#x2F;research.htm" rel="nofollow">https:&#x2F;&#x2F;grants.nih.gov&#x2F;policy&#x2F;humansubjects&#x2F;research.htm</a>, and <i>clearly</i> does not describe what&#x27;s going here.<p>Let me repeat again: the fact that humans responded to the emails about GDPR+CCPA compliance of an <i>organization owning the email</i> is <i>completely irrelevant</i>. The experimenters didn&#x27;t <i>care</i> about whether their request was serviced by a human or a computer, and in fact would have <i>preferred</i> computerized responses (instant response, more standardized formats, no possibility of human error).<p>Claiming that this is &quot;human experimentation&quot; is disingenuous to the point of malice.