Participatory research in Mesoamerica and data protection in Europe (and elsewhere)

This essay examines the tensions between participatory ethnographic research methods and newly emerging legal regimes of data protection and privacy. Drawing on the example of recent grant-funded research in Mexico, the essay charts how the European Union’s General Data Protection Regulation impedes the practices and ethos of participatory research in signiﬁcant ways. In particular, new legal requirements about data collection, access and storage, and “the right to be forgot-ten,” effectively preclude integrating community members into research planning or data collection. As coun- tries around the world move toward more robust and comprehensive data protection and privacy laws, the issues raised in this essay are likely to become more pressing in many different research contexts in the future. [Mexico, data protection, participatory research, privacy laws].


P a r t i c i p a t o r y R e s e a r c h i n M e s o a m e r i c a a n d D a t a P r o t e c t i o n i n E u r o p e ( a n d E l s e w h e r e )
This essay examines the tensions between participatory ethnographic research methods and newly emerging legal regimes of data protection and privacy. Drawing on the example of recent grant-funded research in Mexico, the essay charts how the European Union's General Data Protection Regulation impedes the practices and ethos of participatory research in significant ways. In particular, new legal requirements about data collection, access and storage, and "the right to be forgotten," effectively preclude integrating community members into research planning or data collection. As countries around the world move toward more robust and comprehensive data protection and privacy laws, the issues raised in this essay are likely to become more pressing in many different research contexts in the future. [Mexico, data protection, participatory research, privacy laws].

I n t r o d u c t i o n S
ince at least the 1990s, developing participatory research methods have offered anthropologists an avenue through which the power hierarchies inherent in traditional ethnographic research may be destabilized. As many of the contributors to this collection show, by inviting research participants to take an active role in the development of research questions, activities and outcomes, participatory research has enabled anthropology to expand its practice, both conceptually and ethically. In addition to these disciplinary achievements, participatory research also aims to enable marginalized people to transform the conditions of their lives and communities by giving them research skills that they can use to work toward their own goals (Park 1993;Hurtig 2008). As Little and Rees (this issue) suggest in the introduction, participatory research is not only a methodology, it is also a political stance that seeks to place community members on equal footing with the researcher and their institution's interests and agendas.
On the ground, participatory research spans a spectrum of practices. These may be primarily community-focused, such as formal skill-building at local levels through workshops and training sessions (Batallan, Dente, and Ritta 2017). Researchers may also make themselves useful to the people with whom they work by contributing their time and expertise to community-led projects during the research period (Taylor this issue; see Simmons 2010). Other practices are more concerned with bringing participants into the research process itself. This may include involving participants in the development of research questions and data-collecting activities, including interviews and filmmaking, and collaborating with them during the writing and publication process (Lebrato, this issue, Whittaker, this issue; see also Behrman 2011;Contreras and Griffith 2011;Field 1998;Hurtig 2008). More recently, the return of data collected during ethnographic research to the communities involved has also emerged as an ethical commitment within participatory research practice (Rees, this issue;Cooper 2009). Although such reflective and reflexive approaches have been successfully used in many fields of the social sciences, the emergence of new data protection regimes in Europe (and elsewhere) is making the central tenets and activities of participatory research effectively impossible. I will describe the scope of these new regulatory regimes before briefly turning to my own research in Mexico as an example.

R e g u l a t o r y R e g i m e s
On the May 25, 2018, the General Data Protection Regulation (GDPR) came into force in Europe (including-for now, at least-the United Kingdom). Its primary objective, from the point of view of European Union (EU) regulators, is to allow people to have more control over their personal data. The spirit of this regulation is motivated by laudable intentions to increase transparency in how corporations store and use the personal data of their customers, and to increase people's rights over their own data. In particular, the regulation seeks to ensure individuals' "right to be forgotten" (European Commission n.d.). Although these regulations are specific to European Economic Area member countries, many nations around the world are passing more comprehensive data protection laws, such as Canada's Personal Information Protection and Electronic Documents Act and the Swiss Data Protection Act (Bundesgesetz über den Datenschutz). Currently, there is no comprehensive federal law in the United States regulating the use of personal data, although each congressional term brings new proposals to standardize the patchwork of federal, state, and industrial regulations and guidelines (Jolly 2018).
Although the individuals whose personal data are protected by such laws are primarily addressed as consumers and citizens interacting with corporations and government agencies, the regulations have significant implications for researchers. This is not an unintended consequence: the increasing complicity between social, medical, and technolog-ical research; product development; social media; and online marketing (as became evident in the Cambridge Analytica scandal, for example) is what led directly to the development of this legislation. 1 Although networks and professional organizations have protested the impact of these changes on anthropologists' ability to do research, calls for amendments to the act-which would exempt the social sciences and humanities from some of these requirements-have not been addressed (ASA et al. 2018;Pels et al. 2018).
All organizations based in the EU that collect and process personal data must abide by the GDPR, regardless of where those data are collected. This means that all researchers working at European institutions must follow GDPR regulations, as well as any privacy legislation of the countries where they conduct research. My latest research project in Mexico was funded by the European Commission's Horizon 2020 program. 2 Although the GDPR had not yet come into effect when I conducted my fieldwork in 2017, all of its data protection and privacy requirements were incorporated into the ethics and data management clauses of the contractual grant agreement between myself, my university, and the European Commission.

I m p a c t s o f R e g u l a t i o n o n E t h n o g r a p h i c R e s e a r c h
My research investigates the intersections of local Catholicism and heritage conservation in a small community in Oaxaca, Mexico, where a private cultural foundation is restoring a ruined 16th century monastery. The methods that I used were fairly standard for ethnographic research: participant observation in events and activities in the community and church, as well as open-ended and structured interviews with various community members and heritage professionals, supplemented with library and archival research. None of these are readily described as participatory research. Yet, there are aspects of my work that could have been enhanced by some of the practices I described above. For example, including members of the church committee in my interviews with older community members could have been interesting and informative for them, and almost certainly would have opened up topics and themes that I could not have anticipated. However, I was aware that such activities would not be compatible with the restrictions imposed on my research by the ethics and data management processes described in my grant agreement. In addition to the "informed consent" procedures that we are increasingly accustomed to, I had to guarantee that r I would not work with children under the age of 16; r I would not conduct research on any topic that was not covered by the original proposal; r I would protect my research participants' personal data by using pseudonyms in publications and all raw research data (i.e., field notes), and that each set of pseudonyms would be different; r only university personnel who are strictly necessary for implementing the grant would be able to access identifying or personal data (and I had to enumerate the ways that data would be physically and digitally "secured" in the field); r I would abide by the regulations for at least two years after the end of the project or until all identifying data are destroyed, whichever is longer.
Some of these restrictions, such as not working at all with children under the age of 16 or not researching any topic not covered by the original proposal, are difficult with respect to all forms of ethnographic research. However, it is the data management aspects of my grant agreement-those that replicate GDPR legislation-that are particularly problematic for participatory practices. Under GDPR, "personal data" are not just personalized data, such as a name, telephone number, or credit card details. It includes any information that can be linked to an identifiable person, including seemingly mundane information, subjective opinions, judgments, or beliefs. Higher levels of protection are given to what are considered "sensitive personal data," including religious beliefs and ethnic identity-both features of my research (GDPR.EU 2019a). 3 As such, all information gathered during my interviews is protected under GDPR. Because of this, I was prevented from including members of the church committee or the community more broadly in my interviews as part of my research process, since gathering data is considered a type of "data processing," and everyone present in an interview is able to identify the interviewee. Indeed, as the point above states, "only university personnel strictly nec-essary for implementing the grant" are allowed to access personal data. This also means that other participatory research practices, such as collaborating with participants in writing and publication, and returning data to research communities, are also rendered near impossible under GDPR, at least without prior anonymization that not only changes participants' names but also ensures that no one can be identified within the data at all (see Chibnik this issue). 4

C o n c l u s i o n s
What are the consequences of such regulatory regimes for participatory and ethnographic research more broadly? Although some of my colleagues advise taking a pragmatic perspective on the new laws by giving lip service on paper to the requirements while going about our business as usual in the field, others have worried whether anthropology is now even legal under GDPR (Humphris 2018 . As a more uniform and stricter legal regime, GDPR incorporates significantly greater penalties for violations, including extremely large fines (GDPR.EU 2019b). Universities are likely to be the true enforcers of the new laws, as they can be held legally and financially accountable for their employees' activities. A colleague recently told me of her institution's GDPR online training course, which she was required to complete at the beginning of the last academic year. One recommendation provided by the training was: if in doubt, do less research. This is not exactly a sentiment compatible with the exploratory, creative, and ultimately emancipatory goals of participatory research.

N o t e s
1. Cambridge Analytica was a political consultancy firm that sold access to personal data of up to 50 million Facebook users, which had been collected under the guise of academic research. It was used by right-wing political campaigns in a number of national elections and referenda in countries such as Canada, India, Mexico, the United