A researcher leaves a research file in her car while she attends a concert and her car is stolen. The file contains charts of aggregated numerical data from a research study with human subjects, but no other documents. The consent form said that no identifying information would be retained, and the researcher adhered to that component. Which statement best characterizes what occurred?

A researcher leaves a research file in her car while she attends a concert and her car is stolen. The file contains charts of aggregated numerical data from a research study with human subjects, but no other documents. The consent form said that no identifying information would be retained, and the researcher adhered to that component. Which statement best characterizes what occurred?

• A. There was a breach of privacy and confidentiality.
• B. There was a breach of privacy only.
• C. There was a breach of confidentiality only.
• D. There was neither a violation of privacy nor a breach of confidentiality.

Answer: (D)

The key idea is how privacy and confidentiality apply when data are de-identified. Privacy concerns whether information about a person could identify or reveal something about them. Confidentiality is the obligation to protect information that could link to a person and to keep it from disclosure. Here, the file contains aggregated numerical data with no identifying information, and the consent form stated no identifying information would be retained. Because there’s no way to trace the data back to any individual, sharing or losing the file does not disclose private details about a person. Likewise, there’s no information that could identify a participant, so there’s no breach of confidentiality. The theft itself is a security issue, but it doesn’t violate privacy or confidentiality given the data are de-identified and cannot be linked to individuals. If identifiers or linkable data were present, or if re-identification were possible, then privacy or confidentiality concerns could arise.

The key idea is how privacy and confidentiality apply when data are de-identified. Privacy concerns whether information about a person could identify or reveal something about them. Confidentiality is the obligation to protect information that could link to a person and to keep it from disclosure.

Here, the file contains aggregated numerical data with no identifying information, and the consent form stated no identifying information would be retained. Because there’s no way to trace the data back to any individual, sharing or losing the file does not disclose private details about a person. Likewise, there’s no information that could identify a participant, so there’s no breach of confidentiality. The theft itself is a security issue, but it doesn’t violate privacy or confidentiality given the data are de-identified and cannot be linked to individuals. If identifiers or linkable data were present, or if re-identification were possible, then privacy or confidentiality concerns could arise.