Ok – Not at all sure this is right, but:
1. Ask a question: How effective are privacy regulations in protecting personal data?
This question can be examined through a few different lenses: the consumer/ private citizen, the government and business.
2. Pick a case: The EU Directive (Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data) could be a case in point. So – the research question would be “How effective has the EU Directive been in protecting personal data of citizens of the EU Member States?”
3. Describe what kind of case it would be, and discuss the types of data that should/ could be collected for analysis. One country within the EU – for example, the UK- could be examined with respect to pre- and post- implementation data concerning such issues as prevalence of theft of personal information (including identity theft, credit card and bank account hacking) by looking at claims and cases filed (including where filed – as a claim against the business/operation itself, or through legal process); public sentiment concerning how safe citizens feel their personal information is through, for example, polls, media (news and social media). Impact or effect on behaviors could also be examined in this way (i.e. have data sharing behaviors changed since the implementation of the EU directive? What changes in business operations have occurred since then?)
4. Types of analysis you should complete in order to assemble such a case study. As suggested above, there are a number of sources of information (both qualitative and quantitative) that should be analyzed when putting together a holistic picture of data protection effectiveness – if for no other reason than because there are a number of different stakeholder groups, and efficacy is measured relative to each of them (both subjectively in terms of their own specific feelings, but also objectively in terms of any specific goals achieved or milestones reached in terms of addressing specific concerns) and their specific interests as well as ‘overall’. These would include primarily written evidences, including document review of transcripts/ reports of interviews and/or focus groups that might have been conducted previously, as well as writings evidencing what might broadly be called “legislative intent” which can provide insight into what specific issues and concerns were discussed during the drafting of (in this case) the Regulation and whether (and how) these were in fact incorporated or addressed in the final Regulation.
5. Think briefly through how this would result in findings that are “different” from what they would be if you did a study on the same question but with more participants/sites/data sources and fewer data types.
a. More participants/sites. More sites/ participants in this context would mean looking at more countries in the EU (“Member States”). Since this particular directive is applicable in some 40+ countries, we would be better able to answer the research question set forth in #2 above the more Member States we analyze. The data sources would largely remain the same. That is to say, this would provide a very broad perspective on how effective the Directive has been across the entire body of EU Member States.
b. Fewer/ Different Data Types – In the examination of the UK above, for example, if we only looked at claims/ cases (and ignored media and other indicia of changes in behavior – whether personal or operational) – we would lose out on a segment of data that would highlight those concerns and/or incidents that perhaps didn’t rise to the level of the “victim” filing a claim or case – which are likely to be more prevalent than those that actually do rise to that level. Conversely, if we did away with claim/ case analysis and proceeded strictly based on polls and media, we’d lose evidence of how these arguably more serious incidents/ concerns are addressed in practice and what the thought processes and arguments are on both sides.