Protection of Privacy and Confidentiality in Research

: : Identifiable Personal Information
: : Privacy
: : Confidentiality
: : Anonymity
: : Limits

The TCPS defines personal identifiable information as "information relating to a reasonably identifiable person who has a reasonable expectation of privacy, including information about personal characteristics such as culture, age, religion and social status, as well as their life experience and educational, medical or employment histories" (p. 3.2).

No single item (except possibly one's Social Insurance Number, which by law cannot be used except for very specific circumstances) can be relied upon to identify an individual with certainty. Names, addresses or telephone numbers may more directly identify an individual than postal codes, date of birth, age, occupation, initials, hospital or student number, ethnic group or religion. Although individual items may not by themselves permit identification of an individual, taken together in a given context and with a certain amount of effort and use of other sources, a combination of items may allow an individual to be identified. This means that all items of information relating to an individual may have the potential to identify that individual.

Researchers have a duty to respect the privacy of prospective subjects. That is, the researcher allows the research subject to determine when, how, and to what extent information about him or her is communicated to others. Researchers usually protect an individual's right to privacy by obtaining free and informed consent before collecting personal information about him or her. The act of contacting potential subjects to seek free and informed consent to access private information may constitute a breach of privacy if the investigator does not have access to such individuals in the course of his or her usual professional activities. In general, someone the research subject would think has a reason to know why he or she might participate in the study should be the first to approach the research subject.

Researchers have a duty to respect the confidentiality of personal information collected during research. Research projects vary substantially in the sensitivity of the information involved, the possibility of identifying particular individuals, and the magnitude and probability of harms that may result from identification of research subjects. Breaches in confidentiality may also have a negative impact on family and friends or the group to which the research subject belongs.

The researcher has a duty to protect research subjects from harm through unauthorized release of identifiable personal information. Confidentiality safeguards include assigning each research subject a code number and using that number on all data about the subject, and the use of locked rooms and filing cabinets for storage of data.

When information collected through research is disseminated, research subjects normally are anonymous, unless identification has been agreed to or requested by the research subject. Often, data are presented in aggregate form which also reduces the potential to link specific responses to individuals.

In some instances, research results may be disclosed to the government, government agencies, the research sponsor, the REB, or a regulatory agency. Provincial statutes may require reporting of child abuse, sexually transmitted diseases, intent to murder, or suicidal thoughts. Additionally, in the cases of well-known individuals, those with very rare conditions, or research that requires presentation of photographs or videotapes, it may be impossible to present the data without identifying the research subject. Research subjects need to be aware of any limitations to anonymity in these situations.

In other cases, research records may be liable to subpoena in judicial and administrative proceedings, and data may be vulnerable to search warrants. Because researchers have a duty to protect the confidentiality undertaken in the free and informed process to the extent possible within the law, it is legitimate for the researcher and the institution to argue the issue in court. In fact, this may be the only legal option open to a researcher to protect the confidentiality of research data.

>> Introduction to Section 3: Privacy and Confidentiality