Adherence to data protection measures such as pseudonymization or anonymization is critical in human subjects research because it has a direct impact on the confidentiality of participants' sensitive information, trust in research practices, and compliance with ethical and legal standards. Regulations such as the General Data Protection Regulation (GDPR) and guarantees made by researchers in informed consent forms mandate strict protocols for data security. However, compliance with these is not always straightforward. To gain qualitative insights into data protection practices in the field of Usable Security and Privacy (USP), we conducted interviews with 22 practitioners (five professors, eight researchers, nine data protection officers) and one focus group with five researchers. Overall, our results show a high awareness of ethical and legal responsibilities but highlight many practical and procedural issues. Based on these, we make concrete recommendations on how to improve the protection of personal data in research.

For decades, law enforcement and privacy advocates have struggled to find common ground regarding surveillance and privacy, resulting in the so-called Crypto Wars. When Apple announced it was planning to implement client-side scanning (CSS) in 2021 as a privacy-preserving compromise to detect known child sexual abuse material (CSAM), it received such intense pushback, especially from IT experts, that it dropped the plans within weeks. However, a study of the European population by ECPAT [1] and another of the German population by Geierhaas et al. [2] showed that despite concerns, the majority stated that they supported CSS for the detection of CSAM. This highlights a potential mismatch between “the majority” and “the experts.” To examine the different attitudes toward CSS further, we extend the work by Geierhaas in two ways. First, we conducted qualitative interviews with 19 IT security and privacy researchers at two major IT security conferences: the Symposium on Usable Privacy and Security (SOUPS) and the USENIX Security Symposium. In our second study, we replicated the German survey with a representative sample (age, gender, and state) from the USA. This was done both to examine possible cultural differences between Germany and the U.S. and to have a U.S. view to compare to our interview study. In this paper, we discuss key similarities and differences between the U.S. and German samples and contrast these with the researchers' views on the matter.