Privacy & Confidentiality By Joan Sieber California State University, Hayward

People want to control…  The time and place where they give information.  The nature of the information they give.  The nature of the experiences that are given to them.  Who receives and can use the information.

Example of a Personal Privacy Issue in Research: A hidden video camera denies subjects the control of access to themselves. They should be warned!

Privacy Privacy refers to persons and to their interest in controlling access of others to themselves. (Confidentiality refers to data.)

Researchers should respect people’s privacy But – What is Private?

The IRB’s Dilemma The Federal Regulations do not Define Privacy. The Guidebook from the Office for Human Research Protections (OHRP) says: “Decide whether there is an invasion of privacy. There are no criteria. Base your decision on your own sense of propriety. “

Judging privacy by one’s own sense of propriety sets an ethnocentric, capricious, and inconsistent standard for judging privacy.

Besides, what’s private to you here, today, differs from….  Last year  Tomorrow  When you are elsewhere  When you were a child

Ability to regulate access of others to oneself (privacy) varies with:  Status  Role  Verbal skill  Stage of development  Context  Culture  Technology used in the research

What is Private Also Varies with:  Gender  Ethnicity  Age  Socio-economic class  Education  Ability level  Social/verbal skill  Health status  Legal status  Nationality  Intelligence  Personality  Relationship to researcher

A young child would want a parent present at a session with a researcher. A teenager has different issues of personal privacy, and would want and would want the parent absent. the parent absent.

Another perspective on privacy: Is the information sought any of the researcher’s business? The subject’s answer depends on: Factors in the subject’s background, beliefs and context. Who is sponsoring the research. The purpose of the research. The questions being asked – are they sensitive, relevant to the ostensible purpose of the research. Whether the subject likes the researcher (interviewer).

Some factors determining liking of the researcher:  Method of recruitment  Researcher’s body language and rapport  Convenience of the research time and place  Ethnicity, gender, apparent social class of the researcher in relation to the subject  Eye contact, speech patterns, posture  Cultural sensitivity

Ways to Learn about Privacy Interests of Research Population  Ethnography  Networks of professionals, gatekeepers, leaders who work with the population.  Focus groups  Community consultation  “Native” research associates  What else?

WAYS TO RESPECT PRIVACY IN RESEARCH  Informed consent – if effectively done!  Knowledge of subject’s culture.  Rapport and sensitivity to individuals.  Research associates from that culture.  Extensive consultation with appropriate professionals & peers of subjects.  Analyze the research context & technology.

What is Confidentiality?  Confidentiality is about data (not people), and about agreements and procedures for limiting the access of others to data.  There are ever-increasing methods of assuring confidentiality, along with ever increasing high-tech methods of breaching confidentiality.

THE COMMON RULE DOES NOT DEFINE CONFIDENTIALITY

Suggested Definition Confidentiality is an extension of the concept of privacy; it refers to data (identifiable information about a person) and to agreements about how data are to be handled in keeping are to be handled in keeping with subjects’ interest in controlling the access with subjects’ interest in controlling the access of others to information about themselves.

Implication  Craft the kind of promise of confidentiality that is appropriate to the research context and to the needs of subjects.  Be specific about the confidentiality agreement in the informed consent process.  Whatever you promise, make sure you can keep your promise.  Be mindful of threats to confidentiality.

The IRB Guidebook Advises... At least one IRB member should be aware should be aware of mechanisms for assuring confidentiality. of mechanisms for assuring confidentiality.

M ost research methods courses do not teach confidentiality methods.

In short,...  The regs are no help.  The OHRP guidebook is naïve.  Research training is inadequate.

It is hard to find the many techniques for protecting confidentiality:  Inter-file linkage  Error inoculation  Statistical strategies  Top coding  Restricted public use data  Restricted access, enclaves, archives  Certificates of Confidentiality  Ethical editing of qualitative descriptions  Data brokering

And no one tells you where to find these techniques... …which are scattered in various obscure applied research literatures. various obscure applied research literatures. But the good news is …

They’re in your handout!!!!

Quick Review of Handout  Procedures that eliminate linkage of data to unique identifiers  Intersystem linkage (alias; broker, etc.)  Statistical strategies: top coding or raw data or descriptive statistics  Contractual Agreements or Licensing: Data sharing, secondary analysis, or audit of data  Legal protections – Certificate of Confidentiality  Descriptive statistics and raw data releases – disclosure review to prevent re-identification

The Privacy & Confidentiality Test  Privacy test: Does the subject think the information sought is any of the researcher’s business? Is the subject comfortable in the research setting?  Confidentiality test: Is the subject satisfied with the methods that will be used to control who can have access to the data?

Small Group Problem Solving  Referring to the 3 vignettes & 2 protocols: Identify privacy issues Identify privacy issues What kinds of confidentiality agreement should be made? What kinds of confidentiality agreement should be made? What are some possible threats to confidentiality? What are some possible threats to confidentiality? What confidentiality assuring techniques should be considered (refer to handout). What confidentiality assuring techniques should be considered (refer to handout). Whose privacy and confidentiality is at issue: are there group, as well as individual, considerations? Whose privacy and confidentiality is at issue: are there group, as well as individual, considerations?