TL;DR Dropbox collaborated w/ university researchers to study scientists' collaboration patterns using "project-folder-related data." Potential interesting case study re: research ethics for industry/academic partnerships. [Thread] (h/t/ @shionguha!) hbr.org/2018/07/a-stud…
Similar to the Facebook emotional contagion study, the authors are a Dropbox employee as well as university researchers. They have a fairly clear statement about the type of data that was used, stating that no one had access to personally identifiable information. 
This statement does give me pause: "Dropbox gave us access to project-folder-related data, which WE aggregated and anonymized..." (emphasis added). Does this suggest it wasn't anonymized when the data (e.g., folder names) was provided to third-party researchers?
Dropbox's privacy policy does not mention research (either internal or external) as a possible use of data. It does have a vague reference to tasks in "the public interest," and maintains a specific list of "trusted third parties" for sharing data; universities aren't on it.
To be clear, I don't see the potential for harm to Dropbox users who were studied, IF there were no actual privacy violations. I also see the scientific value. That said, it looks like private data was used in outside research without their consent. I'm curious what others think!
Responses here and on Facebook regarding the potential ethical/privacy issues in this Dropbox study have been overwhelmingly negative. I'm hoping to get some more clarification rather than just speculating, so I've emailed Dropbox.
Realizing that, like most platforms, Dropbox has probably changed their privacy policy for GDPR, I had a look at their policy from 2015 (which was the start date for collected data). There was no mention at that time of "public interest," just "others working for Dropbox."
I want to make sure folks reading this thread see this update about the data that was provided to researchers:
Dropbox claims that they "permanently anonymized the data by rendering any identifying user information unreadable, including individual emails and shared folder IDs" which "prevented [the researchers] from seeing any personal information" zdnet.com/article/dropbo…
