Best Practices for Sensitive Research and A/C Privilege

Raw text

Transcribed text as recorded, including headers and formatting fragments.

Best Practices for Sensitive Research and A/C Privilege Reality Labs UXR November 10, 2021 Elaine Dai &, Reality Labs-UXR Legal "We have an industry-leading research program so that we can identify the important issues and work on them. It's disheartening to see ... work taken out of context and used to construct a false narrative .... we're going to keep doing research because it's the right thing to do." - Mark Zuckerberg 01 Confidentiality Confidentiality Confidentiality and user studies "Confidential" means all non-public business information. It's critically important to maintain the confidentiality of all user studies: • To protect the privacy of all individuals who volunteer to participate in our studies • To maintain ethical standards and integrity of the research process 02 Sensitive research Sensitive research What makes research sensitive? Sensitive means research that may have comms, policy, or legal risks Sensitive Populations • U13 (under 13) children • U18 (under 18) teens • specific race/ethnicity • political/economic group • health or disability traits • sexual orientation, gender identity Sensitive Topics • elections • alcohol / drugs / tobacco • privacy settings • accessibility • health and safety • integrity (e.g. online abuse, suicide, harassment, bullying, mental health, trafficking, CEI) Sensitive Data Types • biometric data, face recognition, voice recognition • geolocation data • employee data • third party data • off-platform tracking • user-generated content (UGC) • WhatsApp data Sensitive research For sensitive research, we can mitigate the risk in two ways: • Be mindful about how we structure the research and communicate the findings • Conduct highly-sensitive research under attorney-client privilege 03 Attorney-client privilege Attorney-client privilege What is Attorney-Client Privilege (A/C Priv)? A/C Priv protects communications between a client and their counsel from adverse parties in order to allow clients to speak more freely to their counsel for obtaining effective legal advice. In order to be considered A/C privileged, it must be: 1. a communication 2. between an attorney and client 3. made in confidence; and 4. for the purpose of seeking or providing legal advice In practice, your attorney will make the determination as to whether a/c priv applies to communications and/or research. [Cartoon: two men in suits at a lawyer's desk. Caption: "The intricacies of attorney-client privilege are funny. But not "ha-ha" funny. More "psych, you're not protected" funny."] Attorney-client privilege Limits of A/C Privilege? • May be waived by disclosing too broadly – to third parties or even internally beyond "need-to-know" basis • Does not apply retroactively • Does not apply to underlying facts (i.e. if the facts can be obtained from another non-privileged source) [Image: meme captioned "ATTORNEY-CLIENT PRIVILEGE" / "I DO NOT THINK THAT MEANS WHAT YOU THINK IT MEANS."] Privilege How do we preserve A/C Privilege? 1. UX Research Counsel must be included in all communications related to the a/c priv study 2. Use email to circulate sensitive materials for XFN review, incl. Research Briefs or Plans instead of attaching in SRT 3. Label all materials with "Attorney-Client Privileged; For Internal Use Only" 4. Ensure Legal review before sharing out and posting research findings 5. Restrict circulation on a "need-to-know" basis 04 Best practices for framing and sharing research Framing Research When framing sensitive research findings, DO: Do's: Use precise language Examples: Instead of "women liked this button," use more precise phrases like "few," "some," "most," "the majority of," or "88% of participants" responding for accuracy; Use quotations when quoting research participants; Clearly differentiate between actual Meta practices vs. inaccurate participant perceptions of Meta practices Do's: Distinguish internal research from external research Examples: Make clear when you're citing from external research (include source link or citation) Do's: Be careful when reaching conclusions Examples: Provide context and stick to the facts Framing Research When framing sensitive research findings, DON'T: Don'ts: Avoid vague terms or overgeneralizing research results Examples: Terms like "people" or "users", which suggests that everyone globally holds the same view; Absolutes and hyperbole, like "always" or "never" can be misrepresentative Don'ts: Avoid use of legal terminology or making legal conclusions Examples: Terms like "not compliant", "illegal" or "violates" a specific law, as that's a legal determination to make; when in doubt, consult Legal Don'ts: Avoid clickbait or sensationalized statements or claims Examples: Be mindful of buzzwords or triggering phrases; Stick to the objective facts Sharing Research Sharing your findings • Share on a "need-to-know" basis only • Risk: Sensitivity of topic + type of audience • Do not share externally without Legal approval • Restrict permissions and access on documentation (e.g. Google Docs) or Workplace Groups and Chats [Diagram: nested circles - Non-Sensitive (outer), Sensitive (middle), A/C Priv (inner) - mapped against audience risk tiers:] high-risk audience: Research Insights and Discussions Open Groups medium-risk audience: Closed Groups low-risk audience: Live in-person, VC, closed small team meetings UXR Legal Resources • Dedicated UXR Legal team (separate and distinct from Product Legal & Privacy Legal) • Legal Intake Form • Email • Chat • Tag us in posts • Comms from Legal ◦ UXR Workplace Groups ◦ Email Updates to Managers ◦ Team Meetings - invite us, pretty please! • Legal Contacts per this post Thank you