Privacy Protection in the Era of Open Science

Given the many benefits of sharing data, an increasing number of psychological researchers publicly share the data underlying their research via online repositories. While undoubtedly a positive scientific development that enables greater verification and data re-use, it is important to protect the interests and confidentiality of research participants while doing so. This is particularly relevant when studying sensitive topics, for example related to health, religion, politics, and sexual behaviors. We systematically assessed the risk of identification of individual participants in 2,169 psychological datasets shared alongside articles published in Psychological Science from 2014 - 2019, Judgment and Decision Making from 2011 - 2014, and PLOS ONE from 2013 - 2015. Results show that individuals could be readily identified by names, IP addresses, web identifiers (email, MTurk Worker ID), birth dates, or ZIP codes and initials combined with other demographic variables in 114 (5.3%) of the datasets. An additional 94 datasets (4.3%) included (often unnecessary) demographic information that posed some re-identification risk. Moreover, of these datasets with identifying or potentially identifying data, 110 (53%) also contained data considered sensitive according to the GDPR. The majority of cases presenting privacy risks could have been prevented through simple procedures to de-identify datasets without sacrificing valuable information or transparency. We offer practical guidance to improve privacy protections in this transitional period towards greater data openness.