Data Protection Law Compliance for Cybercrime and Cyberterrorism Research

Data protection is perhaps the most important area in which legal requirements determine whether and how research into cybercrime and cyberterrorism may take place. Data protection laws apply whenever personal data are processed for the purposes of research. There are legal risks of non-compliance with data protection regimes emanating from strict legal frameworks and from rules on data security and data transfer. Researchers are strongly recommended to explore the possibilities of anonymisation as well as all obligations relating to notification and consent, which affect the legitimacy of data processing. The presentation of findings, with implications for research carried out in the area of cybercrime and cyberterrorism, begins with exploring definitions of data protection and privacy. We introduce the most relevant aspects of data protection for cybercrime and cyberterrorism research before an overview of the applicable legal and regulatory frameworks is presented. The way in which data protection interacts with other fundamental rights, namely freedom of speech, academic freedom and security, is considered in order to highlight important issues which may affect researchers. Another key feature of data protection law is the difference between countries in the way it is applied; member states have a degree of autonomy in this respect which is summarised and an overview provided. General conclusions are drawn from all findings and implications of the research undertaken for this chapter and key recommendations for those involved in research are presented.