Anonymity, confidentiality and privacy
Conditions of anonymity, confidentiality and privacy are included in every informed consent form. Their presence is widely thought essential to protect subjects from harm, specifically with regard to preventing the dis- semination of sensitive, attributable information. This chapter examines the soundness of reasons for the inclusion of these conditions in systems of research ethics, but also urges researchers critically to consider the particular meanings and purposes of the concepts as they are applied in a range of research contexts. As a general norm, confidentiality, for example, is at odds with the idea that research is to be disseminated and generalised. Neverthe- less, there are situations where confidentiality is required, for instance in focus group work, or in health-care situations and in consultancy contexts.
Anonymity and identification are important issues, particularly in qualita- tive work, where ‘rich’ data or ‘thick’ description is necessary in order to make the research meaningful to the reader. Yet these matters, with implica- tions for contextualisation and identification of individuals, are not simply to be set in the context of the individual researcher toiling away conscien- tiously. Almost all human participant/subject research takes place in some institutional context. Institutions provide the organisational base for research (including the researcher, the laboratory, leisure centre, sports club or hos- pital) and provide arenas in which research participants may be approached, recruited, observed and studied. Institutions too have responsibility for activities carried out in their name and obligations towards those who use their services and facilities. Institutions may thus have a corporate liability for the activities of researchers and the consequences of their actions. Some research carries genuine hazards and all human subject research entails some cost. These institutions therefore have an obligation to ensure that there are appropriate governance arrangements in place to protect the interests of all concerned. As part of that process, institutions are obliged to comply with the requirements of data protection legislation. As with all relationships between practitioners and institutions, this gives rise to certain tensions. It is the aim of this chapter to explore both the individual and institutional dimensions of the need to consider anonymity, confidentiality and privacy in the manifold aspects of the research process.
What’s mine is mine: what ought respecting privacy to entail?
Confidentiality and anonymity may appear to some to be an obsession with Research Ethics Committees (RECs) and more generally in society.
The UK popular press is full of stories about the Beckhams and Blairs and the revelations from nannies, au pairs and even art teachers in public schools. Some countries, for example France, have privacy laws, and campaigners have pressed for similar legislation in the UK, so far without success. Since 1970 Article 9 of the French Civil Code has provided that
‘everyone has the right to respect for his or her private life’. A person’s private life includes:
his or her love life, friendships, family circumstances, leisure activities, political opinions, trade union or religious affiliation and state of health.
In general, the right to privacy entitles anyone, irrespective of rank, birth, fortune or present or future office, to oppose the dissemination of his or her picture – an attribute of personality – without the express permission of the person concerned.
(Embassy of France in the US, 2005) While the French laws seek to protect the privacy of individuals, other coun- tries have enacted legislation that significantly reduces the rights of the indi- vidual to privacy, as for example in the USA, where the so-called Patriot Act greatly increased the ability of government, among other things, to monitor private communications between individuals, through telephone tapping and electronic intercepts. In the UK the Data Protection Act was introduced to provide some regulation over the processing of personal information but its misapplication has been blamed for serious failures in police intelli- gence, which may have contributed to the deaths of two young children (Batty, 2003). At a more trivial level, it seems to be impossible to speak to any organisation about one’s own affairs without first having to recite one’s address, phone number, date of birth and mother’s maiden name, all in the name of (supposedly) complying with the Act. In the context of research ethics, no researcher intending to collect personal data of any sort can ignore the issues of anonymity, confidentiality and privacy.
Application forms for RECs/IRBs invariably include sections concerning these issues; information sheets for participants will be expected to cover the question of anonymity and confidentiality, and consent forms will fre- quently seek explicit consent from participants for the handling of personal information and its disclosure to others involved in the research. Yet this norm stands in sharp relief, for example, with the position stated in a recent Editorial of the British Medical Journal:
Some of the criticism of research ethics committees has focused on
issues for which they can bear no responsibility, such as the interpretation of the Data Protection Act.
(Ashcroft et al., 2005: 557) It is worth asking what, for many, will be taken for granted: precisely why is there such sensitivity toward personal data? To understand what is behind concerns about anonymity and confidentiality we must first explore the rela- tionship between personal information, its value and impact, and the integrity of the self, as this relates to the concept of privacy. The ability to retain the right to choose what information to divulge or disclose to others, and what to retain to ourselves as privileged is an essential element of selfhood or personhood. Discovery of the ability not to reveal information, and even to lie, is a crucial stage in a child’s development, as it marks the beginning of the development of the individual, private self. The ability to construct bound- aries around our selves plays an important part in defining the difference between ourselves and others. Imagine, for example, that others had, as in a science fiction scenario, the ability to see inside our heads and read our minds. The result would be severely to destabilise the sense of self, and the belief that others can read our thoughts and manipulate our minds is a type of psychosis.
The removal of privacy, as happens in imprisonment, is seen as a punish- ment. In the eighteenth century the English utilitarian philosopher Bentham designed the Panopticon as a model prison in which ‘the more constantly the persons to be inspected are under the eyes of the persons who should inspect them, the more perfectly will the purpose of the establishment have been attained’. This would be the case:
No matter how different, or even opposite the purpose: whether it be that of punishing the incorrigible, guarding the insane, reforming the vicious, confining the suspected, employing the idle, maintaining the helpless, curing the sick, instructing the willing in any branch of industry, or training the rising race in the path of education: in a word, whether it be applied to the purposes of perpetual prisons in the room of death, or prisons for confinement before trial, or penitentiary-houses, or houses of correction, or work-houses, or manufactories, or mad-houses, or hospitals, or schools.
(Bentham, 1995) Foucault argues that ‘the major effect of the Panopticon [is] to induce in the inmate a state of conscious and permanent visibility that assures the automatic functioning of power’ (1995). In the context of health care, Girard (1988) talks about the elicitation of private information without sound justification as a form of sadism and an ontological assault. Thus invasion of privacy or the removal of privacy is no trivial matter, but may have a significant impact on the well-being of the person in question.
Can we be more specific than this? Parent (1983: 271–5) offers a critique of three conceptions of privacy that exist in ethical and jurisprudential writing:
1 privacy as being let alone;
2 privacy as autonomy;
3 Privacy as limitation on access to the self.
Each of these three conceptions has much to recommend it. Parent (1983) points out that were one to suffer innumerable blows to the head or be insulted from night to noon, the correct appeal would not simply be an appeal to privacy, but rather stronger, to concepts like force, harm or vio- lence. Simply being let alone, then, does not capture what privacy depicts and, in the contexts of research, the notion of consent being denied seems to do the work that rights to privacy might entail. Second, although it is com- monly the case that we think of privacy as control over significant personal matters, this conception fails to account for the person who divulges all sorts of intimate data about themselves; here the issue is one of a person who relinquishes their privacy while retaining control. And nothing seems wrong with this: indeed, often research with consent does not respect privacy in this sense of controlling when and who gets access to our privacy. There is some- thing contradictory, then, about this conception. Closer, for our purposes, to understanding privacy as applied to research is the idea of limiting access to the self. But in this case we are left wondering precisely what limitations are intended; it might be thought that this implies some spatial characteristic like proximity. A paradigm of such a case would be when people seek court orders against stalkers. Can this really apply meaningfully to research situations where privacy of a different kind is in mind? What then is this privacy, and why is it thought to be so important?
Parent’s positive account is this:
Privacy is the condition of not having undocumented personal know- ledge about one possessed by others [and that] . . . personal information consists of facts which most persons in a given society chose not to reveal about themselves . . . or of facts about which a particular indi- vidual is acutely sensitive and which he [sic] therefore does not choose to reveal about himself, even though most people do not care if these same facts are widely known about themselves.
(Parent, 1983: 269–70) Essentially, then, privacy refers to the ability to keep to ourselves informa- tion about ourselves that we choose not to disclose to others. This may relate to thoughts, opinions and feelings about anything, such as one’s sexual pref- erences, the state of one’s bank balance, or one’s voting intentions. It is not just bad manners to pry into people’s affairs, it may actually threaten a person’s sense of self and security to feel that others have access to such
information, regardless of the purposes for which they seek the information.
A person’s privacy is diminished exactly to the degree that others possess this kind of knowledge about him. The ability of others to obtain private information about us may also give them power over us, to do us harm, as for example in the case of Winston’s experience with rats in Room 101 in George Orwell’s Nineteen Eighty-four (2000 [1949]), or more recently, Cayce Pollard’s phobia about the Michelin Man in William Gibson’sPattern Recog- nition (2003). The latter is a particularly telling example as the information was obtained from records stolen from the office of Pollard’s psychotherapist. It is a warning, especially to those who work with sensitive data.
In an elite sporting context it is easy to imagine how information about a mental or physical frailty of an athlete or sportsman might give an advantage to a rival. Imagine how a sports psychologist working with batsmen in baseball or cricket, might give one access to their particular problems with a certain type of pitch or delivery. Or consider information about an elite distance runner who hated to run in the pack and ran best when heading the race with no-one around them. What about a dependency on prescription analgesics which were not performance enhancing but were enough to sully the reputa- tion of a football player? One might expect that such information should not be leaked, not merely to other competitors but to anyone, even when the consultancy had ended.
In addition to the privacy of information in the more typical sense, con- temporary society generally places value on the privacy of the body. This is perhaps more of a social construct than a deep-seated feature of our self- identity, because there have been times, and there are societies today, where the body and its functions were and are more public. Elias (1978), for example, describes how, since the eleventh century, the body has been ‘privatised’ and many of its functions made taboo.
The point about private information is not that no-one else may ever have access to it (although for some people, for some information, this may be true), but that the person to whom it is private retains control over its dis- closure. One may choose (or be compelled) to disclose certain things to certain people in whom one places trust. In a personal relationship one may share personal information because this in some way strengthens the rela- tionship. You share your deepest emotions with your lover because, given that our individual personal privacy is what keeps us separate and differenti- ated from others, you wish to be closer to your lover, to reduce or remove the barriers or boundaries that separate you, to unite you in your relationship.
Members of the Catholic religion may confess what they would describe as their sins in order to maintain their relationship with the Church and their God. With friends or colleagues one may share hopes, fears, ambitions and so on, in the interest of strengthening the bonds of friendship or creating a better team.
Or, more instrumentally or prudentially, one may disclose intimate and personal information to a doctor, a solicitor, a bank manager or an accountant,
because they cannot work effectively on one’s behalf unless this is done. But whereas in the context of a love affair we may disclose completely, absolutely, as proof of the strength of our love for and trust in the other, in professional and service relationships we disclose within a structure of rules, and these rules are set by the context. So, to take an example from Weinberg, it is possible to be nude in front of others without embarrassment as long as we adhere to the rules appropriately in the context. Being naked in a nudist camp is acceptable, but walking in the nude from Land’s End to John O’Groats (i.e. the length of the UK) apparently is not (see BBC, 2004).
The story of Stephen Gough, who set out to challenge the attitude of society to the human body, also illustrates the point that disclosure is not always welcomed by others. Revealing that which society prefers to keep concealed can provoke censure and sanctions: Gough took seven months to complete his trek from Cornwall to Scotland, in part because of the number of times he was arrested and imprisoned following complaints from mem- bers of the public. Being naked in the changing rooms and the showers at the sports facility, or sharing a bath with someone of the same sex is common- place after a rugby match. But it is less likely that two members of the same rugby team sharing a hotel room on tour would be happy to share a bath in their hotel bathroom, even if they regularly shared an ice bath after the match. And just as public nudity is bound by rules in context, we disclose personal information to the doctor or solicitor in a context that is also informed by rules, explicit or implicit.
One of the possible consequences of unwanted disclosure of personal information, whether about our thoughts, feelings, actions or the appearance of our bodies, is embarrassment or shame. Privacy is about not disclosing to people certain information about ourselves, and being obliged to give infor- mation that we would not otherwise wish to disclose reveals something about us that we would prefer to remain hidden. As Sartre (2003) suggests, when we are caught performing a disreputable act – he suggests peeping through a keyhole or making a rude gesture – we feel shame not because of the act itself but because we have revealed to the person who catches us, something about the kind of person we really are.
If someone seeks legal representation because they have been caught steal- ing they will typically reveal to the solicitor that they are a dishonest person, and that, at least for most people, is shameful. A visit to the sexually trans- mitted disease clinic to investigate a urethral discharge reveals to the staff that the patient has had sex with someone who has gonorrhoea or some such. Because of they way the body has become privatised, as Elias argues, even admitting the existence of a problem with bladder or bowel functions may cause feelings of embarrassment or shame, even though concealing symptoms may increase the probability of serious illness or even death from bowel cancer, for example. In discussing our bodily functions we are revealed as the kind of person who cannot manage their body in the way that society expects.
We disclose these embarrassing circumstances to our doctors or lawyers on the assumption that, in their professional roles, they will be non- judgemental. We do not expect to be given a lecture on morality by these people, although some professional advice about my future conduct may well be expected. But we properly expect our doctor to pronounce on the condition of our health without offering a critique of our character. We give an extended discussion of privacy as it relates to qualitative research in Chapter 7.
Research participants/subjects disclose personal information in these pro- fessional circumstances and rule-limited settings with two provisos: that they give their consent and that they are assured of confidentiality. Despite the lengthy treatment of informed consent in Chapter 4 it may be worth rehears- ing a few salient points here in the context of anonymity, confidentiality and privacy, for they are clearly supposed to be linked.
The contemporary view of consent in this context means that disclosure is voluntary, where the option of not disclosing is present. Of course, we may feel that in reality we have little choice. If we withhold essential information from a professional we jeopardise our chances of success in the enterprise for which we have consulted them, while in our personal relationships to be less than frank and open with lovers or friends exposes us to the risk that the relationship will fail.
Our access or entry to certain events or situations may be conditional on our consent to a certain level of disclosure as, for example, when we submit to a drug-testing regime as a requirement for competing in athletics. But we have the existential choice, nevertheless, as to whether we disclose or not.
How far ought researchers to go to keep confidences confidential?
Confidentiality provides what might be thought of as an extension of the boundaries of the self. Research participants or subjects are typically prepared to disclose some information, even of a personal nature, but only on the basis that they can rely on the confidence of researchers to hold the informa- tion in trust and in that confidence, not to further disclose without their permission and agreement. Thus participants or subjects retain control over access to personal information even though they have disclosed it. It will be useful to consider some realistic though hypothetical examples to illustrate these points.
A researcher began collecting longitudinal data (collected over a period over five years) on the lifestyles of elite sportspersons with respect to casual drug habits. The data were kept in locked files in a locked office to which few people had access. A few years into the research a politically conservative chief executive officer (CEO) of the sports governing body was appointed.
A request was made to the CEO by a local police detective who suspected that the researcher’s files might help him track down potential drug dealers.