The researcher’s dilemma: copyright and data protection

When anonymity and publicity clash

Liisa Söderlund

“In 2004, I had a long period of alcoholism, I was living in the woods and I was totally out of it. Now I’m standing at the opening of my own exhibition, holding a rose.”

In October 2010, we celebrated the launch of an exhibition by nine people who had experienced homelessness at Kiasma. A year later, we opened the second exhibition from the photography project at the Finnish Museum of Photography.

During the project, participants thought about their experience of homelessness and created personal photographic works. They found the photography interesting and it offered a change from their ordinary lives. The most important thing, which was also the culmination of the entire project, was the exhibitions. Their aim was to increase public awareness of homelessness and arouse a debate about this social problem. The pictures of places where people were sleeping on the street and in parks told the story of participants’ lives.

“It was a good decision to photograph the places, quite a unique decision. [...] The places that were important to us. The places that meant quite a lot, where we ended up spending the night and spending time. It wasn’t a question of us as people as such but about the places where a homeless person ends up. Where they find somewhere to sleep at night, where they find their food.”

The stories of life on the streets, survival and the moments that gave life meaning were expressed in the photographs and the texts and made the participants and their lives as homeless people visible. Interviews in the press and the positive feedback brought participants confidence about their success and they saw the exhibitions having an impact on social debate. It boosted their self-confidence.

“When we met people we knew, we found quite a lot of people had been offered a place to stay thanks to the exhibitions. It definitely started something anyway.”

The pictures and texts in the exhibition were named in accordance with the wishes of the participants – two of them wanted their surnames removed, others wanted to be shown under their own names. As a photographer, I thought respecting copyright went without saying.

When producing the exhibition for Kiasma, I started my PhD research, which evaluated photography as a participatory method. Because my research material comprised photographs collected for an exhibition that had been on public display, I agreed that the participants would also appear in the research under their own names in conjunction with the pictures.

My noticing the problem in research led to thinking about the ethics, which also created greater clarity regarding the research.

When writing my dissertation, however, I encountered a problem: the publicity attained as a result of the exhibitions and the agreements I had made meant abandoning an important principle of research ethics, that of anonymity. Respecting privacy is one of the most important norms of research ethics and to ensure this it is customary to remove directly identifying data from material that is to be published, anonymising it. My noticing the problem in research led to thinking about the ethics, which also created greater clarity regarding the research. In naming the authors of the pictures in my dissertation, I am respecting them. To avoid their being identified, giving rise to unfortunate consequences, I carefully consider which matters to write about in an identifying manner and how to write about them.

Liisa Söderlund, PhD researcher, Aalto University School of Arts, Design and Architecture, Department of Media

The sole right of the author to decide whether to be named

Maria Rehbinder

The Berne Convention protects copyright as a sole right of the author. Article 6bis of the Berne Convention sets out a legal provision according to which the sole rights of the author include, as part of the author’s moral rights, the right to be credited as the author of their work. The author has the right to claim authorship of the work independently of the author’s economic rights and even after the transfer of such economic rights. The Berne Convention is to be observed in interpreting European Union law. The European Union is to comply with Articles 1–21 of the Berne Convention by virtue of the WIPO Copyright Treaty, which the European Union has ratified.

The provisions of the Berne Convention, which is binding upon Finland, are incorporated into Finnish law by the Finnish Copyright Act. Section 3, paragraph 1 of the Finnish Copyright Act contains provisions on the name of the author. When an author decides to publish their photograph or other work, they decide how their name is to be stated in conjunction with the work. The author is always a natural person and they may decide to publish their work under an assumed name, under a pen name, anonymously or under their own name. The name of the author must be stated in a manner required by proper usage when the work is replicated or the work is published, for example in an exhibition, on a website, in an article or in a book. Under the Finnish Copyright Act, the issue at stake is protecting the right to be acknowledged as creator with the name of the author and the author’s sole right to decide whether to be named.

The name of the author should be stated in the form requested by the author. In its ruling 2005:92, the Finnish Supreme Court stated that the importance of the will of the author is also demonstrated by the fact that the name of the author in the work may not be removed against the author’s wishes without infringing the right of the author as set out in Section 3, paragraph 1 of the Copyright Act.

A person’s name as personal data

Personal data is defined in Article 4(1) of the European Union’s General Data Protection Regulation (GDPR), under which personal data means any information relating to an identified or identifiable natural person. A person’s name is personal data and a person whose name is processed is a data subject. The processing of personal data must be in accordance with the GDPR. According to Article 6(1) of the GDPR, processing of personal data is lawful if at least one of the grounds listed as a legal basis for processing in Article 6(1) of the GDPR applies. There are six possible grounds for processing, several of which could apply to this case. There is at least one legal basis for processing personal data under the GDPR in Liisa Söderlund’s PhD research.

Personal data means any information relating to an identified or identifiable natural person.

One legal basis for processing could be the data subject (the photographer) giving consent to the processing of his or her personal data for one or more specific purposes, GDPR Article 6(1)(a), where the specific purpose is a dissertation and the PhD candidate’s scientific research.

In this PhD work, the photographer/data subject entered into an agreement on the use of the work with the author of the dissertation. Under GDPR Article 6(1)(b), personal data may be processed if the processing is necessary for the performance of a contract to which the data subject is party. As far as Liisa Söderlund’s dissertation is concerned, it can be considered that the legal basis for processing personal data under the GDPR is a contract regarding stating the names of the authors and the fact that the use of the names in the dissertation is necessary for the performance of the contract.

Because it is necessary to state the name of the author under Section 3, paragraph 1 of the Finnish Copyright Act in order to realise the right to be acknowledged as creator, it can be considered that processing is necessary in order to comply with a legal obligation of the data controller.

As far as scientific research is concerned, a commonly applicable legal basis for processing is Article 6(1)(e), whereby processing is necessary for the performance of a task carried out in the public interest. Member States may introduce more specific provisions to adapt the rules reinforced in the GDPR to processing that takes place by virtue of Article 6(1)(e). Such more specific provisions are includes in  HE 99/2018  Data Protection Act, that is being discussed in the  Parliament of Finland. According to the proposed Data Protection Act, Section 3, personal data may be processed for scientific or historical research and statistical purposes if the processing is necessary and proportionate to the public interest objective pursued. Liisa Söderlund’s PhD is scientific research and processing the names of the authors of the photographic work, i.e. of non-registered personal data, can be seen as necessary and proportionate to the public interest objective pursued. If the national provision on scientific research and clarifying the legal basis for processing becomes law, it will make it easier to interpret the provision in the GDPR regarding scientific research as a legal basis for processing personal data.

In addition to the names of the authors, the PhD research highlighted the fact that the photographers of the photographic works were people who had experienced homelessness. Article 9(1) of the GDPR regulates the processing of special categories of personal data. Experiencing homelessness or a criterion applicable to homelessness are not mentioned in the article in question and nor is Article 9 applied to such data. Because in evaluating the use of personal data the GDPR emphasises a risk-based evaluation of the risks to the data subject, it should be borne in mind that, from the data subject’s point of view, experience of homelessness may be considered such a circumstance as to increase the risks associated with processing personal data for the data subject. Thus, special care should be taken when processing the personal data of the data subject, and  Liisa Söderlund  has demonstrated that this was done.

If the research also addresses special categories of personal data, such as the health of data subjects, the requirements for such processing should be examined. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic or biometric data for the purpose of unambiguously identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation is primarily prohibited. However, this kind of data may be processed under Article 9(2)(a) of the GDPR if the data subject has given explicit consent to the processing of those personal data for one or more specific purposes, or under Article 9(2)(e) if processing relates to personal data which are manifestly made public by the data subject, or under Article 9(2)(j) if processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law.

The name of the author of the photographic work and the fact that the authors of the photographic works are people who have experienced homelessness are manifestly made public by the authors of the photographic works/data subjects by their participation in the photography exhibition organised at Kiasma and their giving interviews to the public relating to the exhibition.

Name of the author

In the case in question, Liisa Söderlund’s PhD replicated works that were published in the photography exhibitions and published in exhibition catalogues and press articles with the consent of the authors and stating the names of the authors. The authors of the published photographic works had given their consent to their photographs and their names being published in the exhibition and the catalogue and for the works to be published and the names of the authors to be stated in the dissertation.

This case involves stating the names of authors, regarding which the authors of the photographic works exercise their sole right under the Finnish Copyright Act to decide on the stating of the author’s name. On the other hand, it also involves processing personal data under the GDPR. The GDPR does not prevent stating the author of the work, as stating the name of the author has a legal basis for processing in the GDPR.

The GDPR is general legislation which concerns all personal data. A person’s name may also be the name of an author as referred to in the Bern Convention and Finnish Copyright Act.  Legislation concerning the name in the context of paternity right could be considered considered special legislation, that should take preference, according t the interpretation rule lex specialis derogate legi generali, if there were a conflict of laws

In addition to legislation, one must always observe guidelines on research ethics which are founded on respect for research subjects and avoiding harm to them.

Copyright and personal data protection as fundamental rights

The fourth recital to the GDPR states that the right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. These other fundamental rights now to be examined are freedom of art and research and freedom of expression.

The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality.

Fundamental rights are safeguarded by the Charter of Fundamental Rights of the European Union. According to Article 17(2) of the Charter of Fundamental Rights, intellectual property shall be protected as a fundamental right. According to Article 13 of the Charter of Fundamental Rights, the arts and scientific research shall be free of constraint as a fundamental right. The freedom of the arts and scientific research is also protected by freedom of expression under Article 11. According to Article 8(1) of the Charter of Fundamental Rights of the European Union, everyone has the right to the protection of personal data concerning him or her.

Article 85 of GDPR also states, that member states should legislate national laws that reconcile the right to the protection of personal data with purposes of academic expression. The proposed Data Protection Act includes provisions that would protect Liisa Söderlund´s right to use personal data for purposes of academic expression.

The Member State is to enact exemptions and derogations for these purposes. As far as processing for scientific research purposes , derogations from the rights of data subjects may be provided  in the national law by virtue of Article 89 of the GDPR.  This national law,  HE 9/2018 Data Protection Act,  is still being discussed in the Parliament at the time  of writing.

Maria Rehbinder, Art University Copyright Advice, copyright attorney

_{Further information:}

_{Berne Convention for the Protection of Literary and Artistic Works: http://www.wipo.int/wipolex/en/treaties/text.jsp?file_id=283693
Copyright Act: https://www.finlex.fi/en/laki/kaannokset/1961/en19610404
General Data Protection Regulation: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
Charter of Fundamental Rights of the European Union: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12012P/TXT
Lex specialis derogat legi generali rule of interpretation, see Silvia Sorzetto: The Lex Specialis Principle and its Uses in Legal Argumentation, Eunomia No. 3, September 2012 – February 2013 pp. 61–87 (http://eunomia.tirant.com/?p=1164)
UK Data Archive: http://www.data-archive.ac.uk/create-manage/copyright/copyright-ownership}