Commentary: Data Protection and the Promotion of Health Research

Abstract

The paper by Valerie Steeves provides a well-presented series of arguments concerning research access to personal health information. Her perspective is clear, and her voice often challenges some of the stereotypic attitudes and values she attributes to the perspective of research interests when confronted with privacy protection policies and practices. To those of us who encounter the consequences of health information privacy legislation in our scientific work in population health, health services or clinical research, Dr. Steeves’s perspective will seem provocative. Her objective is constructive. It is her view that privacy protection legislation enables research by constructing trust in research practices and contributing to the accuracy of personal health information. She presents and discusses six misconceptions about the relationship between privacy, health research and the law. In her view, the perspective of health researchers concerning privacy protection legislation can be represented in six stereotypic statements: Misconception 1 Data protection laws restrict research Misconception 2 Health research is an unencumbered public good, free of any private interests Misconception 3 Privacy is an individual right and so must give way to research as a social good Misconception 4 Observational research data collected without the patient’s knowledge and consent will lead to unbiased data Misconception 5 Privacy is a roadblock to better health Misconception 6 De-identified health information does not pose a risk of harm to the patient Dr. Steeves’s paper is primarily informed by the perspective of legal scholarship. The paper is therefore flavoured by some characteristics of this field: (1) strongly voiced perspectives in the tradition of rhetorical argument, (2) the use of cases (single instances) as evidence and (3) a general disregard for the argument that might be offered from the opposite position. In addition, the “opposite position” (the perspective of researchers concerning privacy) is often stereotyped and overdrawn. The paper presents an original set of perspectives on the social value of privacy. Many of these arguments very nicely extend the rights-based perspective on individual privacy to elaborate on how individual rights to privacy protection have social value. These contributions are a real strength of this paper. On the other hand, the strongly voiced perspective of the author is not well anchored in evidence concerning the prevalence or frequency of research/privacy conflicts and the consequences of these conflicts to both research and privacy. As noted above, the paper makes selective use of “cases” to build an argument. For example, the study by Tu and colleagues (2004) is important for a host of reasons. One value is that it provides the best documented evidence of the scale of the trade-off in external validity that arises when consent is required. Dr. Steeves glosses over this evidence of the negative consequence of rigidly applying the consent principle to make a (less important) point about premises. In the case of the evidence documented by Dr. Tu, the requirement to obtain informed consent did emphatically result in a biased research sample, with significant limitations on the value of the study sample for deriving inferences. Ironically, the reference to the paper by Tu et al. is an excellent example not of a misconception, but of the real threat to the validity of observational research if consent requirements are rigidly applied. Over the past decade in Canada, many provinces have established or clarified the legislative basis for the protection of personal health information. The great majority of health researchers would agree with Dr. Steeves that the improved clarity of rights and responsibilities contained in this legislation will strengthen personal privacy rights and will also strengthen appropriate access to health information for reseach purposes. While Dr. Steeves has produced a helpful analysis of some points of tension between the objectives of research and the objectives of privacy protection legislation, what is needed at present are careful empirical studies of the frequency of research/privacy conflicts and their consequences for both research and privacy. What will be helpful in the years ahead is greater clarity in the recognition of potential risks to personal privacy and the potential risks to high-quality evidence arising from health research in the inappropriate application of health information privacy legislation.