The GDPR is a new headache for social scientists

I am guessing the authors of this article had no say in the crafting of the headline. The problems identified are not really about the GDPR and the research-focused exemptions, but the ways in which the French system has been designed and implemented in response. The bland generic reference to the issues "already spreading beyond [France's] borders" does not change this. As someone who is not only very involved in the ethics policies and processes at the same institution as Professor Emeritus Dingwall, but also as someone who has researched and published on Europeanisation policy processes in the EUs multilevel governance context, it strikes me that whilst the GDPR, merely as a piece of legislation, is not perfect (how many pieces of legislation are?) its fundamentals are sound; in my extensive experience its implementation through the research exemptions can be designed to be practical and effective; and that it is not at all uncommon to see problems arise not at the level of the EU legislation but at the national level through variations in implementation practice. In policy science there is a well-known potential for a gap to appear between policy-as-designed and policy-as-implemented. Claiming issues with implementation in France are because of the design of the policy looks to me like a serious case of misdiagnosis. Given that the problems identified lie fundamentally in how the GDPR is being implemented in France, attention should be given to how that implementation does, or does not, fit with French research culture. Maybe the approach to implementation of the GDPR as described in this article aligns closely with the broader context within which it is operating. If that is the case, then the issue lies in French research culture, not the GDPR. If there is not alignment there, then attention needs to be focused on realigning GDPR implementation in France with broader French research culture. Nothing here says that the problems are fundamentally those relating to the GDPR itself.