In 2016, two Danish social science researchers used data scraping software developed by a third collaborator to amass and analyze a trove of public user data from approximately 68,000 user profiles on the online dating website OkCupid. The purported aim of the study was to analyze"the relationship of cognitive ability to religious beliefs and political interest/participation"among the users of the site.

However, when the researchers published their study in the open access online journalOpen DifferentialPsychology, they includedtheir entire dataset, without use of any deanonymizing or other privacy-preserving techniques to obscure the sensitive data. Even though the real namesand photographs ofthe site's users were not includedin the dataset, the publication ofusernames, bios, age, gender, sexual orientation, religion, personality traits, interests, and answers to popular dating survey questions was immediately recognized by other researchers as an acute privacy threat, since this sort of data is easily re-identifiable when combined with other publically available datasets.That is, the real-world identities of many of the users, even when not reflected in their chosen usernames, could easily be uncovered and relinked to the highly sensitive data in their profiles, using commonly available re-identification techniques. The responses to the survey questionswere especially sensitive, since they often included information about users' sexual habits anddesires, history ofrelationship fidelity and drug use, political views, and other extremely personal information. Notably, this information was public only to others logged onto the site as a user who had answered the same survey questions; that is, users expected that the only people who could see their answers would be other users ofOkCupid seeking a relationship. The researchers, of course, had logged on to the site and answered the survey questions for an entirely different purposeto gain access to the answers that thousands of others had given.

When immediately challenged upon release of the data and asked via social media if they had made any efforts to anonymize the dataset prior to publication, the lead study author EmilKirkegaard responded on Twitter as follows: "No. Data is already public." In follow-up media interviews later, he said:"We thought this was an obvious case of public data scraping so that it would not be a legal problem."17When asked if the site had given permission, Kirkegaard repliedbytweeting"Don'tknow,don'task.:)"18AspokespersonforOkCupid,whichtheresearchers had not asked for permission to scrape the site using automated software, later stated that the researchers had violated their Terms ofService and had been sent a take-down notice instructing them to remove the public dataset. The researchers eventually complied, but not before the dataset had already been accessible for two days.

Critics of the researchers argued that evenifthe informationhadbeen legally obtained, it was also a flagrantethicalviolation ofmany professional norms ofresearch ethics (including informed consent from data subjects, who never gave permission for their profiles to be used or published by the researchers). Aarhus University, where the lead researcher was a student, distanced itself from the study saying that it was an independent activity of the student and not funded by Aarhus, and that"We are sure that[Kirkegaard] has not learned his methods and ethical standards of research at our university, and he is clearly not representative of the about 38,000students at AU."

The authors did appear to anticipate that their actions might be ethically controversial. In the draftpaper, which was later removed from publication, the authors wrote that "Some may object to the ethics of gathering and releasing this data...However, all the data found in the dataset are or were already publicly available, so releasing this dataset merely presents it in a more useful form."

Question:

1.What specific, significant harms to members of the public did the researchers' actions risk? List as many types of harm as you can think of.

2.How should those potential harms have been evaluated alongside the prospectivebenefitsof the research claimed by the study's authors? Could the benefits hoped for by the authors have been significant enough to justify the risks of harm you identified above in 3.3?

3.List the variousstakeholdersinvolved in the OkCupid case, and for each type of stakeholder you listed, identify what wasat stakefor them in this episode. Be sure your list is as complete as you can make it, including all possible affected stakeholders.

4.The researchers' actions potentially affected tens of thousands of people. Would the members of the public whose data were exposed by the researchers be justified in feelingabused,violated, or otherwise unethically treated by the study's authors, even though they have never had a personal interaction with the authors? If those feelings are justified, does this show that the study's authors had an ethicalobligationto those members of the public that they failed to respect?

5.The lead author repeatedly defended the study on the grounds that the data was technically public (since it was made accessible by the data subjects to other OkCupid users). The author's implication here is that no individual OkCupid user could have reasonably objected to their data being viewed by any other individual OkCupid user, so, the authors might argue, how could they reasonably object to what the authors did with it? How would you evaluate that argument? Does it make an ethical difference that the authors accessed the data in a very different way, to a far greater extent, with highly specialized tools, and for a very different purpose than an 'ordinary' Ok Cupid user?

6.The authors clearly did anticipate some criticism of their conduct as unethical, and indeed they received an overwhelming amount of public criticism, quickly and widely. How meaningful is that public criticism? To what extent are big data practitionersanswerableto the public for their conduct, or can data practitioners justifiably ignore the public's critical response to what they do? Explain your answer.

7.As a follow up to Question 3.7, how meaningful is it that much of the criticism of the researchers' conduct came from a range of well-established data professionals and researchers, Including members of professional societies for social science research, the profession to which the study's authors presumably aspired? How should a data practitioner want to be judged by his or her peers or prospective professional colleagues? Should the evaluation of our conduct by our professional peers and colleagues hold special sway over us, and if so, why?

8.A Danish programmer, Oliver Nordbjerg, specifically designed the data scraping software for the study, though he was not a co-author of the study himself. What ethical obligations did he have in the case? Should he have agreed to design a tool for this study? To what extent, if any, does he share in the ethical responsibility for any harms to the public that resulted?

9.How do you think the OkCupid study likely impacted the reputations and professional prospects of the researchers, and of the designer of the scraping software?