The keys to the kingdom. Overcoming GDPR-concerns to unlock access to platform data for independent researchers

Independent researchers have requested access to a wide variety of platform data in order to scrutinize the actors and methods responsible for the spreading of disinformation, as well as to assess the effectiveness and impact of the self-regulatory measures platforms have taken to counter disinformation. Over the past two years the European Union has increasingly supported these requests, including by facilitating the adoption of the EU Code of Practice on Disinformation, in which platforms committed themselves to provide such access through a variety of mechanisms. However, both European decision makers and researchers have consistently criticized the insufficiency of these mechanisms. On a number of occasions platforms have invoked their obligations under the EU’s General Data Protection Regulation (GDPR) as rationale for failing to make certain data sets available. This paper aims to assess those claims in order to clarify to which extent, if any, GDPR concerns prevent the disclosure of (sensitive) personal data by platforms to independent researchers. The paper will argue that the GDPR currently allows the sharing of personal data for such purposes in a number of ways, but recommends the adoption of a binding legal obligation for platforms to hand over data and a Code of Conduct on Access To Platform Data under Article 40 of the GDPR as necessary measures to provide more legal certainty about the specific roles and responsibilities of both platforms and independent researchers.