July 2, 2018 Carpenter v. United States, 585 U.S. ___ (2018) (Roberts, C.J.). Response by Margot E. Kaminski Geo. Wash. L. Rev. On the Docket (Oct. Term 2017) Slip Opinion | SCOTUSblog Carpenter v. United States: Big Data Is Different A central truism of U.S. privacy law is that if you share information, you do not... Read More

Simultaneously with their growing online presence, companies and individuals become increasingly susceptible to cyber-security attacks. Most organizations

Why key escrow and other "extraordinary access" dealios don't work and never can.

EXEMPLARY patron-privacy policy.

“Cybersecurity will be the most pressing challenge of the next decade, and IoT will play a critical role in it.” Internet Society 2017 Global Internet Report Introduction The open nature of the Internet creates the ability to connect devices, applications and services on a scale that transforms the way we interact with our environment and […]

Why the watchdogs that stood up to the NSA won’t stand up to Mark Zuckerberg.

The recent revelations of Facebook’s sharing of user data with Cambridge Analytica is just the latest in a long line…

In lawsuits about data breaches, the issue of harm has confounded courts. Harm is central to whether plaintiffs have standing to sue in federal court and whethe

The main goal of our Cyber Initiative is to build a more capable cyber policy field that works with the private sector, as well as government, to solve pressing challenges. As we reached the midpoint of our initial five-year funding commitment, we thought it was time to look at how we’re doing. With that in ...

Rather than a comprehensive legal protection for personal data, the United States has only a patchwork of sector-specific laws that fail to adequately protect data. Congress should create a single data-protection mandate to protect individuals' privacy.

New regulations offer EU citizens sweeping new powers over how their data can be collected, used and stored.

There is a wide and growing interest in promoting Research Data Management (RDM) and Research Data Sharing (RDS) from many stakeholders in the research enterprise. Funders are under pressure from activists, from government, and from the wider public agenda towards greater transparency and access to encourage, require, and deliver improved data practices from the researchers they fund.   Funders are responding to this, and to their own interest in improved practice, by developing and implementing policies on RDM and RDS. In this review we examine the state of funder policies, the process of implementation and available guidance to identify the challenges and opportunities for funders in developing policy and delivering on the aspirations for improved community practice, greater transparency and engagement, and enhanced impact.   The review is divided into three parts. The first two components are based on desk research: a survey of existing policy statements drawing in part on existing surveys and a brief review of available guidance on policy development for funders. The third part addresses the experience of policy implementation through interviews with funders, policy developers, and infrastructure providers.   In our review we identify, in common with other surveys, that RDM and RDS policies are increasingly common. The most developed are found amongst funders in the United States, United Kingdom, Australia, and European Union. However many other funders and nations have aspirational statements or are developing policy. There is a broad pattern of policy development moving from aspiration, to recommendations, to requirements, and finally reporting and auditing of data management practice.   There are strong similarities across policies: a requirement for data management planning, often in grant submissions, expectations that data supporting published articles will be made available, and in many cases requirements for data archiving and availability over extended periods beyond grants. However there are also important differences in implementation.   There is essentially no information available on the uptake and success of different policies in terms of compliance rates, or degrees of data availability. Many policies require a Data Management Plan as part of grant submission. This requirement can be enforced but there is disagreement on the value of this. One view is that requirements such as DMPs are the only way to force researchers to pay attention to these issues. The other is that such requirements lead to a culture of compliance in which the minimal effort is made and planning is seen as a “tick-box” exercise that has no further value. In this view requirements such as DMPs may actually be damaging the effort to effect culture change towards improved community practice.   One way to bring these two views together is to see DMPs as living documents that form the basis of collaboration between researchers, funders, and data managers throughout the life of a research project. This approach is reflected in guidance on policy development that emphasises the importance of clarifying responsibilities of various stakeholders and ensuring that researchers are both recognised for good practice and see tangible benefits.   More broadly this points to the need for the program of improving RDM and RDS to be shared project with the incentives for funders and researchers aligned as far as is possible. In the interviews successful policy implementation was often seen to be dependent on funders providing the required support, both in the form of infrastructure and resourcing, and via the provision of internal expertise amongst program managers. Where resources are limited, leveraging other support, especially from institutional sources, was seen as important as was ensuring the scope of policy requirements were commensurate with the support available and readiness of research communities.   Throughout the desk research and the interviews a consistent theme is the desire for cultural change, where data management and sharing practices are embedded within the norms of behaviour for research communities. There is general agreement that progress from aspirational policies to achieving compliance is challenging and that broad cultural change, with the exception of specific communities, is a long way off. It is interesting to note that discussion of cultural change is largely externalised. There is little engagement with the concept of culture as an issue to consider or work with and very little engagement with models of how cultural change could be enabled. The disagreement over the value of DMPs is one example of how a lack of active engagement with culture and how it changes is leading to problems.        Key Findings      Policies on RDM and RDS are being developed by a number of agencies, primarily in the Global North. These policies are broadly consistent in aspiration and outlines but differ significantly in details of implementation.   Policies generally develop along a path starting with aspirational statements, followed by recommendations, then requirements, and finally auditing and compliance measures.   Measurement of policy adoption and compliance in terms of the over goals of increased availability and re-use of data is not tracked and is likely unmeasurable currently.   Data Management Plans are a central requirement for many policies, in part because they can be made compulsory and act as a general focus for raising awareness.   There are significant differences in the views of stakeholders on the value of Data Management Planning in its current form.   Some stakeholders regard them as successful in raising awareness albeit with some limitations.   Some regard them as actively damaging progress towards real change in practice by making RDM appear as one administrative activity among the many required for grant submission   Successful policy implementation is coupled with funder support for infrastructure and training. Seeing RDM as an area for collaboration between funders and researchers may be valuable   Internal expertise and support within a funder is often a gap which becomes a problem with monitoring and implementation   DMPs can be a helpful part of process but it will be important to make them useful documents throughout and beyond the project   If the object of RDM and RDS policy is cultural change in research communities then direct engagement with understanding the various cultures of researcher and other stakeholder communities, alongside frameworks of how they change is an important area for future focus.

A pilot project worked with seven existing projects funded by the International Development Research Center of Canada (IDRC) to investigate the implementation of data management and sharing requirements within development research projects. The seven projects, which were selected to achieve a diversity of project types, locations, host institutions and subject areas, demonstrated a broad range of existing capacities to work with data and access to technical expertise and infrastructures. The pilot project provided an introduction to data management and sharing concepts, helped projects develop a Data Management Plan, and then observed the implementation of that plan.   In examining the uptake of Data Management and Sharing practice amongst these seven groups the project came to question the underlying goals of funders in introducing data management and sharing requirements. It was established that the ultimate goal was a change in culture amongst grantees. The project therefore looked for evidence of how funder interventions might promote or hinder such cultural change.   The project had two core findings. First that the shift from an aim of changing behaviour, to changing culture, has both subtle and profound implications for policy design and implementation. A particular finding is that the single point of contact that many data management and sharing policies create where a Data Management Plan is required at grant submission but then not further utilised is at best neutral and likely counter productive in supporting change in researcher culture.   As expected, there are significant bottlenecks within research institutions and for grantees in effectively sharing data including a lack of resources and expertise. However, a core finding is that many of the bottlenecks for change relate to structural issues at the funder level. Specifically, the expectation that policy initiatives are implemented, monitored, and evaluated by Program Officers who are the main point of contact for projects. The single most productive act to enhance policy implementation may be to empower and support Program Officers. This could be achieved through training and support of individual POs, through the creation of a group of internal experts who can support others, or via provision of external support, for instance by expanding the services provided by the pilot project into an ongoing support mechanism for both internal staff and grantees.   Other significant findings include: the importance of language barriers and the way in which assumptions of English language in materials, resources, services and systems permeate the entire system; that data infrastructures are poorly served by current funding arrangements and tools, particularly where they are obliged to seek continuing funding through project grants. There are also fundamental questions raised by the status of digital objects as "data". The concept of data is part of a western scientific discourse which may be both incompatible with other cultures, particularly indigenous knowledge systems. More importantly that discourse may be incompatible with values-based approaches that seek to respect indigenous knowledge through a commitment to retaining context.   With the possible exception of the last finding, none of these issues are exclusive to development research. The Development Research context surfaces them more strongly through its greater diversity of goals and contexts. In many ways this project illustrates not that Development Research has particular special needs, but that it is a site that surfaces issues in policy design and implementation deserving of more consideration across the research enterprise.