Outreach 1/5: ethics, data protection, and mail-policy checks (gate before sending)

[larnsce]

Why this gates everything

Emailing ~153 researchers individually is ordinary scholarly communication, but two things can turn it into something that needs formal clearance: studying the responses (e.g. publishing compliance rates for "available on request" statements — a classic meta-research design, and plausibly where this project is heading given #38/#39), and processing scraped personal data (names + email addresses harvested from journal pages) at scale from an ETH system.

No email goes out until the checklist below is resolved.

Follow-up tasks for @larnsce

• ETH Ethics Commission (EK): clarify whether approval or a waiver is needed. Key framing question: are we only requesting data for reuse (no approval expected), or will response behaviour be recorded and analysed for publication (likely needs EK submission)? Get the answer in writing before the first batch.
• Decide now, in writing, what we will do with responses — publish response/compliance rates, or only use the data we receive? This decision determines the EK answer and must precede sending, because consent can't be bolted on afterwards.
• ETH data protection: confirm the GDPR/FADP basis for processing the scraped author emails (presumably legitimate interest — addresses were published by the authors themselves as correspondence addresses). Check whether ETH requires a record-of-processing entry. Contact: ETH Data Protection Officer.
• ETH mail policy: confirm that ~150 individual, personalised, manually-reviewed emails sent in small batches over days from a personal ETH mailbox is within acceptable use (it should be — this is not bulk mail — but a two-line note to ETH IT avoids surprises).
• Retention: decide where replies and received datasets live, and for how long.

Decisions to record in this issue

• Opt-out handling: template includes a no-follow-up sentence; opt-outs are marked exclude in the contact list and never contacted again.
• Reminder policy interacts with ethics: a single polite reminder is normal practice, but decide it here, not ad hoc (see the tracking sub-issue).

Refs #41