Friday, April 5, 2013
A quite useful article on privacy and secondary uses of information just came across on ssrn: Clark D. Asay, Consumer Information Privacy and the Problem(s) of Third-Party Disclosures, forthcoming in the Northwestern Journal of Technology and Intellectual Property. Asay nicely crystallizes language for two aspects of secondary uses of personally identifiable information. "Incognito" harm is that people may have absolutely no idea of the identities of the myriad entities that may possess information about them. "Downstream" harm is that people may have absolutely no idea or control about subsequent transfers of information. Asay's proposed solution is legislation to introduce a more robust notice and choice regime for personally identifiable information. While his discussion concerns commercial information generally, it is certainly relevant to health information, as such information roams widely in the non-HIPAA world (which includes the wealth of information once HIPAA-protected but then transferred to non-HIPAA covered entities).