Mumsnet Corpus

[TokyoBouncyBall]

Not a TAAT, but a bit of googling as a result of a now deleted thread has led me to this:

https://fold.aston.ac.uk/handle/123456789/18

I note it says that the License is uncertain. Can you confirm that you have given permission for posts to be used in this way, or is there something that Aston might like to look into?

I note it says Users who wish to access this dataset must make a detailed application to FoLD and the researcher, as well as potentially gain additional agreement from an external organisation before they can be approved for access.

Given one of the uses it is being put to, I think it is a bit dubious to say the least.

It’s interesting that the first thing he said was that MN should ask Aston to immediately shut down the illegally scraped and stolen dataset and prevent any access to it while the matter is under discussion, which is something I haven’t seen mentioned here.

It's been said several times over the 400+ posts here and in the 1300+ posts in other threads on the topic but bears repeating as a reasonable request. I gather than Aston is disputing that the scraping violates fair use. There may even be a 'grandfather' argument.

Apparently, Aston will answer all of our questions. I'm looking forward to that.

I agree.

A PoMo addled 20 something who can’t see the difference between Mummies Saying No and Hate Crimes pales into insignificance beside the scraped data/lack of consent/ copyright issues.

Aston is using 16 years worth of data belonging to a Ltd company, taken without permission, as a selling point to solicit funders and recruit students.

If Aston are so confident they haven’t broken the law, why did they remove the Mumsnet page from the FoLD index so quickly?

As far as I can see the link was deleted several days before Aston replied to Justine’s first attempt at contact, which was made while the link was still live.

Yes, I've had to do several GDPR training courses and this is a key element of the legislation - you can only use data for it's intended purpose (which is whatever is in MN T&Cs, as long as they are legal). Not for any other random thing you think. You have to gain additional consent for that. Doesn't say a lot for the quality of Aston academics that they don't know this basic fact.

In my work I've had to explain to people putting forward other people for an award that they actually do still need to get consent (IME no one ever says no, they're usually very flattered) if they're submitting data, before doing so. There are situations I could think of where someone might say no though, where the work in question related to a very vulnerable group of people for example.

Oh and once I had to talk to our GDPR officer to confirm that even if the data is anonymised (as someone once suggested to me) then that's still not ok - you still need consent to use that data for a different purpose than originally intended. Even if all data that could identify individuals is removed.

DH also said that lots of people just don’t get that they have to specify the use of the dataset and that it can’t be used for anything else if the permission wasn’t given up front - it’s something he has to battle with regularly - especially with managers from overseas and/or those who figure they can quiz an existing dataset to get an answer quickly and who don’t want to jump through the admin hoops they need to, to get permission each time. They seem him as being deliberately obstructive rather than realising that he is saving their asses from big fines and legal bills if they get caught doing the wrong stuff.

I didn't know this for sure, but my mind has been wondering about the relationship of specific uses and permissions on a resource that may contain enough identifying material (whether technically anonymised from some angles or not), to the principles that bind the role of a data controller in relation to the people whose data is being scrutinised (usually a university in the scenarios I am most familiar with). In this case, would it be the university or (and/or?) Mumsnet?

@JustineMumsnet didn't say Aston were disputing the scraping violated fair use, she said they believed they were using the data legitimately.

She also didn't specifically say Aston would answer 'our', we the users, questions, she said they would answer our questions, reasonably expected to the questions from @mnhq . But one would hope given the excellence of some posters on this thread, they would be considering info from here to build into their discussions.

It's indicative that they are taking it seriously that a call with the VC was set up so swiftly. Whether this is a GDPR issue, Ts and Cs issue or other will be for the lawyers to resolve. It won't get sorted out quickly. Don't expect quick replies.

And if you want to wonder what data is worth... if you can't visualise the mind boggling sums Google pay Reddit, think about how you earn Tesco Clubcard vouchers, or Nectar Points or frankly every other "loyalty" scheme. Data has huge commercial value.

Is anyone else slightly creeped out that this Aston bunch did research on fertility threads from MN (without consent for scraping the data) whilst also doing forensic linguistics within their department and accepting US money.

In the US those threads (and the miscarriage etc threads on here) could potentially be used to try and identify and prosecute individual women in several states now.

I really hope Justine is coming down on Aston hard. This space is so valuable for women - but we do need to be informed about the extent to which our data is used and protected from illegal data scraping with clear legal remedies when this occurs.

I'm perfectly fine with all my data being used to market school uniform, toasters or a particular grocery store to me... but not with Aston even holding my data.

They do seem to have shut down the database - certainly it has disappeared from their online library descriptions, something that happened within hours on Friday. Links - and screenshots of the original descriptions - are right at the top of the thread.

Mumsnet have also said that they are reviewing the threads and taking on board the research done here. I do occasionally report a post to bring it to their attention, and if you see a good point which you think they need to see, I would suggest doing that too.

Yes

Extremely creeped out.

There was a Caroline Criado Perez podcast which talked about data from health apps being bought (quite cheaply) in the US and how it was used to out a Catholic priest as gay. I think location data played a part here too, which is particularly horrible. The data is also used for screening potential employment candidates.

Yes, same response to an approach in the university (not Aston) where I was working.

In the US those threads (and the miscarriage etc threads on here) could potentially be used to try and identify and prosecute individual women in several states now.

Yes I also made this point, and even if the info wasn't on MN this type of scraping might make jigsaw information much easier.

Aston needs to list everytime the dataset has been used. Whether it has been given to a third party. What the third party has used it for. Whether the dataset is stored in full or in part anywhere else. Whether the third party has given info to anyone else. This includes America and why it was used.

Sorry Eresh - I have committed the cardinal MN sin of NOT RTFT. Hands up, my fault!

Not a bad thing to say twice, though, because it is quite worrying.

Maybe you need to suggest to Aston you could be a consultant on appropriate use of MN data. I'd suggest a daily rate of at least £500 (plus expenses, to include Tunnocks) to reflect your extensive experience.

And I think it might be a good idea to let MNHQ know too

I said this upthread:
Data protection law in the uk is that you can only use that data for a very narrow explicit reason. You can't say 'research purposes' for example because that's too vague. You have to state research of x, on every single occasion. This is precisely to prevent situations like this and people feeling misled about what they have given consent to.

People don't seem to understand this well, but talk to the ICO and I bet they will confirm my point.

DH's specialist area is data protection and security. I've been battered by him stressing this over and over again for years when people don't do this. His expertise on this comes from getting a lot of very direct and respected legal advice on this.

It's good to see at least two posters confirming I'm not a bloody nut job and I'm not talking out my arse.

DH's experience has been it's remarkable just which companies and institutions are light years behind in their understanding of the law on this.

It's another area of the law not being understood by people who spout a lot of hot air. We need to stand up to it and enforce rights. Once again.

£200 an hour pl0x for an online consultation.

Ah, sorry, I wasn't very clear (plus when I started talking to dh about this there were only about 150 posts on the thread and it has grown massively since then!) - most of the posts that had mentioned shutting down the use of the illegal dataset seemed to be more along the lines of the aim of the discussion between MN and Aston were to get the dataset shut down rather getting it shut down and then having the discussion.

I know that Aston think that they have the right to use an illegal scraping of a website but while it's all under discussion and they don't have any proof that they have the rights or permission to use it, they shouldn't be able to carry on using it as if nothing had happened. What happens afterwards - well that depends on what the lawyers battle out. But right now - in the interim - there should definitely be a break in the use of the illegal dataset while the issue is being discussed. By continuing to use the dataset it feels like Aston are kicking MN in the face and showing what they think of the value of themselves vs MN and all the Mnetters.

Would also be interesting to know which other websites they have scraped to use in their 'sandbox' and whether or not they asked for (and got) permission...

Not a bad thing to say twice, though, because it is quite worrying.

100% agree!

RTFT

Has anyone suggested they run their doxathon3000 on Tattle as an alternative source for language analysis?

I'm wondering now if this research and this event also used MN data?

https://twitter.com/lucia__busso/status/1765017857543352799

I would expect a forensic linguistics institute to be right on top of data protection law, conventions, ethics, and regulations. I mean handling data is their actual raisonne d'etre, isn't it?

I don't think they can claim ignorance as a defense.

There is a question I think under GDPR whether MN can in fact give permission for our data to be used in the way Aston are using it. They can't if they haven't indicated this use upfront in T&Cs which they've confirmed doesn't cover this use. This is particularly true for sensitive data. Consent needs to be quite specific, in my experience.

Even if you 'own' data, that's only for specific named purposes. If the purpose changes, new consent is required.

So if MN doesn't push this then I think we, as users, could reasonably crowdfund for a court case on breach of GDPR. If there were enough of us we could maybe do a class action (or the UK equivalent)? We might have to agree to be named although maybe a class action could provide some anonymity.

I hope someone like Sarah Phillimore could advise - I know @ ing people is frowned upon but if anyone knows her username off the top of their head it might be worth it in this case?

'A further area which requires considerable development is in thinking through
the ethics of forensic authorship analysis. The starting point has to be that nearly
all authorship analyses constitute an intrusion into the privacy of an individual
and that this requires justification. This is true whether that individual is a
novelist writing under a pseudonym, such as Eleanor Ferrante or Robert
Galbraith, or whether the analysis is of a username of an individual on a dark
web site set up to exchange indecent images of children. Authorship analysis is neither morally neutral nor inherently constrained in its application. It can be used as a necessary and proportionate method to protect individuals and society from a variety of harms, or it might be used to identify and potentially do harm to whistle-blowers or political activists of one persuasion or another'
...
' intrusion against an anonymous abuser is still intrusion, but
the responsibility for that intrusion is theirs, created by the actions and harms of
their cause. The responsibility for the intrusion done to a pseudonymous
novelist, against whom there is no issue of liability, thus lies squarely with the
authorship analyst. Clearly there needs to be considerably more thinking with
regard to the issues of authorship analysis as an intrusion and where and how it
might be justified'

Tim Grant, The Idea of Progress in Forensic Authorship Analysis

He's written a whole book on it, and this is the bulk of a really brief section on ethics. (I've pasted 2 out of 3 paragraphs).