The fact that we are leaking all sorts of PII is precisely why I think generalised privacy laws are vital. I blogged about this here http://lockstep.com.au/blog/2013/02/12/the-beginning-of-privacy and here http://lockstep.com.au/blog/2012/10/29/not-too-late-for-privacy. A lot of the leakage is accidental; most people just don’t know what is revealed about them as they surf the net, nor how companies absorb and re-purpose personal information provided during the course of business transactions. I don’t think people should be punished for their carelessness or naivety. There should be limits to what can be done with PII regardless of how a third party has come across it.

Ken makes a good point, that PII used in a re-identification has to come from somewhere, and the corresponding data custodian could try and restrict its use. In the case of Yaniv’s work, P came from public genealogical databases. I have not chased down the Ts&Cs for those databases — but I bet the lawyers are!

But there’s another thing: In many jurisdictions, data protection or information privacy laws *do* put obligations on R2 despite the fact they have no relationship with S. This is actually the point of such laws — to protect consumers. Companies and governments in Europe, Australia, New Zealand and many Asian nations are subject to legal Collection Limitation and Use Limitation principles.

In the US there is famously no such cross-sector generalised privacy law. So what to do in America? Should researchers stick to the letter of the law, or should they adopt for themselves a higher duty of care, and refrain from collecting and using PII without consent if it is not really needed?

I believe that many technologists and informaticians are simply unaware that across the world, re-identification is a form of indirect collection of PII, and as such may breach privacy laws. Once they understand this, they might ask themselves if an act that is unlawful in many parts of the world is, by extension, unethical in the USA?

I’m skeptical, however, that the case law supports the alternative way that you propose courts might reasonably construe an asserted fetal pain interest like Arizona’s: namely, “that, although preventing pain is not compelling on its own, it becomes so when combined with the state’s interest in preserving fetal life before viability.”

The Supreme Court has never, to my knowledge, suggested that multiple and mutually reinforcing state interests, if not compelling themselves, could be “combined” to count as a compelling one. But the Court has several times declined to endorse this aggregated-interest approach, most recently, I believe, in the First Amendment context. See California Democratic Party v. Jones, 530 U.S. 567, 582-85 (2000). In the Fourteenth Amendment context too, Justice Thomas (in a separate opinion), explicitly rejected the aggregation approach, writing that “the combination of . . . ‘three essential elements’” said to comprise a “compelling interest,” “does not,” if “[n]one of these elements is [itself] compelling,” thereby “produce an interest any more compelling than that represented by each element independently.” Parents Involved in Community Schools v. Seattle School District No. 1, 551 U.S. 701, 759-60 (2007) (Thomas, J., concurring).

I’d be interested to learn of any doctrinal (or normative) reasons why non-compelling interests could (or should), under particular circumstances, or ever, be taken to add up or otherwise “combined” to constitute the canonical kind that the Court designates as “compelling.”

Now imagine that we add another variable to the equation, P (for Personal Identifiable Information, PII). R2 presumable has to get P from somewhere to re-identify the DNA sample. If that “somewhere” is, for example, a website, then the entity hosting the information could presumably put legal restriction on the use of its data. In other words, the entity could create a contract and legal cause of action against R2 if he (I always assume bad actors are males) uses P inconsistent with the Terms of Use. More specifically, the Terms of Use could prohibit the use of the information for purposes other than those allowed by the service and could specifically call out re-identification as a prohibited use.

Thoughts?

But we’re not talking about dementia, and we’re not talking about car accidents. We’re talking about psychosis and a grisly murder. Yes, those with HD, like those with dementia, can be belligerent and even physically aggressive — for instance, using their cane to whack their caretaker on the head. But it is not “polite” to point out that neither those with HD nor those with dementia are at all likely to commit murder — it is accurate.

Since you seem to think that personal experience is a prerequisite to commenting on an issue, I’ll share that in addition to my experience with dementia, and much more to the point, I’ve known people with HD. Do you tend to see many patients with HD in your ophthalmology practice?