Social Media Research

Abstract

The use of the social media by people around the globe is widespread. This chapter discusses the contribution which social media research can offer to pharmacovigilance and medicinal product risk communication research. While the use of the social media itself and the development of social media strategies are important topics for research, this chapter focusses on the methods of social media listening and crowdsourcing of information, and provides examples of their utility. It highlights opportunities, limitations, challenges as well as ethical and legal aspects that need to be addressed for future research.

Appendices

Appendix 11.1: Legal Aspects Relevant to Internet-Based and Social Media Research

Researchers making use of data from the internet and the social media need to consider legal aspects. The applicable law will vary depending on where relevant actors, e.g. internet and social media users and researchers, are located. The relevant rules are usually those of the country where researchers are based. The European Union (EU) data protection rules, found in General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), can have “extra-territorial effect”—that is they bind researchers outside the EU when they target those within the EU.

1.1 Types of Law to Consider

In addition to adhereing to legislation on personal data protection, confidentiality and privacy, other legal aspect may be of relevance to the research project. Other legal concerns include contracts (e.g. with data vendors), intellectual property (e.g. onwership of digital content, reproduction and transfer rights, ownership of algortihms developed), sector-specific regulation (e.g. medical product marketers), as well as civil and criminal law (e.g. stalking, bullying, etc.).

1.2 Personal Data Protection Law

Personal data protection law—discussed here in more detail as the most relevant law to consider for internet-based and social media research related to health matters—does in general not prohibit the processing of data, but it lays down conditions for when, on what basis and how the processing of personal data should take place, and it gives enforceable rights to persons who are data subjects. Reference is made here to the EU GDPR, which is recognised by many—consumer organisations notably too—as a global standard. There, personal data are defined as any information relating to an identified or identifiable natural person. Researchers will often work with data that have been pseudo-anonymised by the data provider. That means that the data subject is not identified but there can still be a risk of possibly identifying the person through combining data or using additional information. This is particularly a risk when a patient has a rare disease. Where however information is truly anonymous, i.e. where the information does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable, data protection legislation is not necessary to be applied. Statistics on the number and the length of visits of people on a website, stratified by country, age and sex, are examples of data likely to be anonymous data.

1.3 Grounds for Processing of Personal Data Relevant to Health Research

The EU GDPR specifies the grounds on which personal data may be processed—consent, performance of a contract, performance of a legal obligation, protecting the vital interests of the data subject, necessary for the performance of a task in the public interest, and the legitimate interests of the processor (subject to fundamental interests of the data subject). The EU GDPR also specifies strict rules as to what consent means. The EU GDPR prohibits the processing for special categories of personal data, including ethnic data, genetic and biometric data for the purpose of uniquely identifying a natural person, as well as data concerning health, sex life and sexual orientation. Such data are however allowed to be processed on defined exempting grounds, which include:

• explicit consent by the data subject has been given; or

• the personal data have manifestly been made public by the data subject; or

• the data processing is necessary for the purposes of preventive or occupational medicine and provision of care, whether for an individual or populations; or

• processing is necessary for reasons of public health, including ensuring high quality and safety of healthcare, medicinal products or medical devices.

These exemptions can be given for medicinal product risk communication research making use of data from the internet and the social media for understanding, planning, evaluating or improving communication. For example, patients may have identified themselves in comments on websites or publically accessible social media posts, or patients of a closed social media group may have given consent for their data to be used for the purpose of such research, to, e.g. identify their risk perceptions or questions for the safe use of medicines. Where patients publish their information under a pseudonym, researchers should not make attempts to identify that person through combining data, but may attempt to contact them if needed for a specific research project.

1.4 Principles for the Processing of Personal Data

Where the processing of personal data is allowed, the EU GDPR requires the data processing (i.e. collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction) to be:

• lawful, fair and transparent in relation to the data subject (principle of lawfulness, fairness and transparency);

• for the specified purpose only (principle of purpose limitation);

• adequate, relevant and limited to what is needed (principle of data minimisation);

• based on accurate data (principle of accuracy);

• performed in a way that permits identification of data subjects for no longer than is necessary (principle of storage limitation);

• secure, which includes that the data should be protected against unauthorised or unlawful processing and accidental loss, destruction or damage (principle of integrity and confidentiality).

1.5 Rights of Data Subjects

As mentioned before, data protection law gives enforceable rights to persons who are data subjects towards the data controller. When planning research, the protocol needs to guarantee the following rights of data subjects, either because locally applicable legislation requires this or because it can be considered ethical good research practice:

• right of access to the data subject’s data and information on the conditions of data processing;

• right to rectification in order to correct or complete data;

• right to erasure of data, i.e. the right to be forgotten;

• right to restriction of processing;

• right to data portability, i.e. to obtain the data in a readable format and to transfer them to another data controller; and

• right to object to data processing at any time.

The rights of data subjects—here the users of social media—may be limited in respect of processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. This will be specified by each EU member state (which could mean that the position will be different across member states) and must be subject to safeguards—again these will be specified by each member state.

1.6 Concluding Remarks

Researchers making use of data from the internet and the social media need to consider various types of law applicable in the given jurisdictions of all actors involved. Researchers need to in particular adhere to personal data protection, confidentiality and privacy legislation and are accountable in this respect towards data subjects. In jurisdictions where such legislation does not exist, the principles presented here can be considered good research practice. Research protocols and data processing need to be designed accordingly (Woods 2017). Regularly updated guidance on the EU GPRD is provided by the European Data Protection Board (EDPB) (European Data Protection Board (EDPB) 2018).

Appendix 11.1

• European Data Protection Board (EDPB) (2018) [guidance documents published on website]. Brussels: EDPB; Accessible at: https://edpb.europa.eu/edpb_en.

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Official Journal of the European Union; 4 May 2016: L 119/1-88.

• Woods LM (2017) Legal considerations relevant to social media and health [lecture]. Pharmacovigilance and social media [training course on 15 October 2017]. Liverpool: 17th Annual Meeting of the International Society of Pharmacovigilance; 15-18 October 2017.