Introduction

In its mission to protect the personal data of European Union (EU) citizens, the reach of the General Data Protection Regulation (GDPR) extends into the research activities traditionally supervised and approved by university institutional review and ethics boards. This article discusses how transnational research for an online support intervention for family carers of people with dementia was obstructed by a particularly restrictive interpretation of the 2018 GDPR. Contested issues discussed include privacy, consent, the balance between risks and benefits, and the rights of family carers.

Background

Dementias are chronic illnesses that can have a lengthy life course. Consequently, caring for persons with dementia who remain in the home carries significant financial, psychological, social and physical burdens. There are an estimated 391,000 ‘family carers’ in the Republic of Ireland, representing approximately one in ten of the adult population (Care Alliance Ireland, 2019). Across 20 European states, there is an estimated carer prevalence range of 8 per cent (people who provide at least 11 hours of unpaid care per week) to 34 per cent (people who provide any level of unpaid care per week) (Verbakel et al, 2017). Taken together, carers’ work represents a significant economic benefit to society, offsetting the enormous cost of institutional care. Reduction in carer burden must therefore be a societal priority.

The authors of this article believe that social media platforms like Facebook (FB) have the potential to partly address this societal priority and to deliver impactful and cost-effective online family carer support. Social media’s potential derives from its low cost and ease of access, as well as the reduction of logistical barriers to support, such as travel. However, it also has limitations, with a primary limitation being the prevalence of ‘lurking’ (reading the postings in an Internet forum without actively contributing) and the small number of actual content contributors (Nielson, 2006). For instance, one study found that only 1 per cent of individuals actively participated in social media forums designed to provide peer support for alcohol misuse, anxiety, depression and smoking cessation (Van Mierlo, 2014). This limits the diversity of contributions, as well as the quantity and speed of answers to informational or emotional support questions posted to forums. These response patterns are also observed in dementia caregiver social support forums (Wilkerson et al, 2018), which indicates that practitioners need to tailor their approach with caregivers to address this issue.

From prior research (O’Sullivan, 2008) and from experience working in the carer support sector, the authors are aware that the majority of family carers, and particularly male carers, do not participate in face-to-face carer support groups. With upwards of 2 billion monthly active users, FB is an obvious example of a medium through which there is potential to deliver an intensive peer support intervention for family carers. This is important in the context of efforts to address the widely observed heightened risk of isolation, anxiety, depression and other health conditions associated with intensive family caring, and with dementia caring in particular (Ho et al, 2009; Osaki et al, 2016; CPI and FCI, 2019).

The GDPR came into force in all EU countries on 25 May 2018, placing a responsibility on anyone who processes personal data to ensure that individuals’ private health data is kept securely. The maximum penalty for breaching these regulations is a fine of up to US$22 million (€20 million) or 4 per cent of global turnover, whichever is the greater.

Online interventions for family carers

Following discussions with researchers at a US university about their pilot study of an online intervention that leveraged social media to support the family carers of people with Alzheimer’s, and following the securing of specific funding, a formal collaboration began in early 2019 between the US university researchers and two Irish non-profit organisations (Care Alliance Ireland and the Alzheimer Society of Ireland). The aim was to undertake transnational research involving 80 Irish family carers of people with dementia by delivering an online peer support intervention and investigating its effects on family carer burden and perceived stress. The research was approved by the university researchers’ institutional review board.

The plan was to deliver an intervention using FB that included two methods for engaging peer support. The first used a traditional, closed FB group with facilities to provide peer support to the family carers of people with dementia. The second used an innovative web app to push informational or emotional support questions to the FB ‘friends’ of these family carers. The questions were developed by the family carers in the closed group, with the FB ‘friends’ of these family carers invited to suggest answers relevant to caring that might usefully be discussed by the closed carer support group. Combining the two methods, a closed group of ten family carers could be expanded to include literally hundreds of FB friends/supporters. The activity of joining the small closed group to seek answers from the larger FB friends groups is known as ‘social micro-volunteering’. The researchers hypothesised that some FB ‘friends’ and those in their social media network would also be current and/or former carers (though this might not be known to the participants prior to this exchange and engagement). The opportunity for new awareness and engagement had the potential to be experienced as supportive by current family carers.

Data protection issues

In addition to obtaining institutional review board approval, the transnational research team undertook a Data Protection Impact Assessment (DPIA). This is a means of identifying and mitigating data protection risks associated with a given project. Such assessments are required (under the 2018 GDPR) for data processing that is likely to result in a high risk to the rights of individuals, and are an increasingly common phenomenon in health and social care research in EU member states. The team felt that conducting the intervention through the FB platform presented a risk (the platform is currently the subject of multiple investigations by the Irish Data Protection Commission [IDPC] for alleged data breaches) but was an important aspect of the research.

In preparing the DPIA, the research team needed to consider who was a ‘data subject’. The family carer was undoubtedly a data subject; however, there was less consensus in the team about whether or not the (cared-for) person with dementia was also a data subject, and the researchers’ institutional review board did not consider them to be a data subject.

In July 2019, the research team sought a review of the DPIA by the Irish Data Protection Commissioner. The opinion of the Irish Data Protection Commissioner was that, as proposed, the project was not compliant with data protection law and that the project had insufficiently identified and mitigated the risks to data subjects. The IDPC considered the person with dementia being cared for to be a data subject and believed that the project did not provide a legal basis for processing special category data as explicit consent could not be secured from all data subjects whose special category personal data would be processed. The IDPC also raised questions about the processing of research data by an online software company outside the EU. As a result of this opinion, the project is now ‘on hold’.

The research team has reflected on the IDPC’s interpretation of the DPIA. We have concerns about proportionality and risk (in respect of potential data breaches), and feel that an overly restrictive interpretation of the definition of data subjects could have a wider negative impact on the delivery of innovative online family carer support initiatives.

Discussion

We consider the IDPC’s interpretation of who is a data subject to be problematic, and take issue with the proposition that the rights of a person with dementia to absolute privacy exist in isolation from the rights of a family carer to access support. We feel that the risk of harm to a person with dementia from a potential ‘data breach’ should be balanced against the rights of a family carer to seek and benefit from peer support (irrespective of the platform and medium through which these are secured). Even if the person with dementia is to be considered a data subject, risks to their privacy should be balanced against the potential benefits derived by their carer and the potential of this to enhance and sustain the quality of care that they receive from the family carer.

Furthermore, the thrust of good practice in Ireland (and beyond) regarding consent by persons with dementia is that such consent is both assumed and continuously reviewed and assessed. The IDPC’s view that people with dementia are incapable of providing consent because the proposed support infrastructure to enable this to happen has yet to be put in place in Ireland is therefore problematic.

Institutional review boards charged with ensuring that researchers adhere to the ethical obligations applicable in research on human subjects look closely at the risk–reward ratio – the likelihood of harm and the severity and/or impact of such harm. It seems that proportionality has not been centre stage in the IDPC’s interpretation of the GDPR.

Conclusion

The IDPC interpretation of the proposed online research project has had the effect of subjugating the right of family carers to seek and participate in online carer support interventions, and of obstructing research into a piloted intervention that sought to harness social media for the social good of family carers by improving their well-being. The importance of this issue of restrictive interpretation and its effect on interventions for family carers derives from two factors:

• the economic value of caring, arising from family carers’ success in enabling persons with dementia to live in their communities for longer and to postpone institutional placement; and

• the contribution of family caring to slowing disease progression (Gitlin et al, 2015).

The quantum and inputted economic value of unpaid dementia care provided by family carers is significant and growing. In 2016, the value in the US was estimated at US$230.1 billion (Alzheimer’s Association, 2016). In 2011, the value in Ireland was (conservatively) estimated at between US$2.3 billion and US$5.4 billion (€2.1 billion–€5.5 billion).

A greater burden of family caring falls on women (Hanly and Sheerin, 2017), while it is also known that dementia family carers suffer from higher rates of stress and medical and psychiatric illness than the general population (Lewis, 2014). As countries within the EU seek to implement and interpret the 2018 GDPR, it seems that countries outside the EU would be well advised to pay close attention to the potential for such legislation to have unintended consequences that may not be in the best interests of wider society.

Funding

This work was supported by the Department of Employment Affairs and Social Protection (Ireland, Dormant Accounts Funds; no grant number), as well as by internal funding.

Acknowledgements

The authors acknowledge the support of the Department of Employment Affairs and Social Protection (Ireland), their respective institutional core funders, and their colleagues.

Conflict of interest

The authors declare that there is no conflict of interest.