Privacy, Confidentiality and Identifiability

Overview

Privacy concerns a person’s control over access to themselves, their information and aspects of their life. Confidentiality concerns how researchers protect information entrusted to them. Identifiability concerns whether an individual can reasonably be recognised directly or indirectly from data, alone or in combination with other information.[1,2]

Modern health research makes simple labels such as “anonymous” increasingly unreliable. Linkage keys, rare diagnoses, exact dates, free text, genomic data, precise geography and externally available datasets can permit re-identification even when names and identity numbers have been removed.

Why this matters

Privacy breaches can cause stigma, discrimination, financial harm, relationship harm or loss of trust. They can also make communities reluctant to participate in future research. Yet excessive data restriction can undermine scientific verification and responsible reuse. Responsible reuse is supported by modern data-sharing policy and FAIR principles when access conditions are defined proportionately.[3,4] Ethical governance therefore aims for appropriate access, not maximal secrecy or unrestricted openness.

Core principles

Direct identifiers include items such as names or identity numbers. Indirect or quasi-identifiers may identify someone when combined—for example age, location, dates and rare characteristics. Coding/pseudonymisation replaces direct identifiers with a code while retaining a linkage mechanism. De-identification reduces identifiability but does not always reduce risk to zero. True anonymisation is difficult when rich data remain useful.[1–3]

Controls should be layered: collect only necessary data; separate identifiers; restrict permissions; encrypt transfer and storage; log access; govern exports; review free text; define retention; and use controlled repositories or data-use agreements when open release is unsafe.

Data minimisation and purpose limitation

Collecting fewer unnecessary identifiers is usually safer than collecting everything and hoping to secure it later. Each sensitive field should have a research purpose, retention period and authorised user group. This discipline also improves data quality and reduces accidental disclosure.

Linkage, coding and separation of functions

When re-identification is needed for follow-up or linkage, a coded design can separate the research dataset from the identifying key. Access to the key can be more restricted than access to analysis data. The protocol should state who can reconnect codes to identities and under what circumstances.

Digital, geographic and genomic data

Device identifiers, IP addresses, location traces, audio/video, faces, voice, free-text clinical notes and genomic data can remain identifying even after conventional fields are removed. Rich longitudinal combinations create additional risk. The safest sharing model may therefore involve a controlled access environment rather than public download. Clinical-trial data systems also require access controls and data integrity safeguards proportionate to risk.[5]

Limits of confidentiality

Researchers should not promise absolute confidentiality if legal, clinical or safeguarding duties may require disclosure. Consent materials should explain foreseeable limits in plain language—for example, circumstances involving immediate safety or mandatory reporting where applicable. Exact duties vary by jurisdiction and study setting and must be verified.

Privacy by design

Privacy decisions should be made before data collection. The research team should map data flows from recruitment to archive: what is collected, where it travels, where identifiers are stored, who has access, which exports are permitted, what third parties process data and how breaches are detected and managed. Part 13 provides the operational data-security foundation for this governance layer.

Identifiability is a continuum

Research datasets are better placed on a continuum than divided into “identified” and “anonymous”. Contemporary data-sharing guidance emphasises both responsible scientific reuse and participant privacy, while FAIR principles support governed accessibility rather than unrestricted release.[3,4] At one end are datasets with direct identifiers and easy linkage. In the middle are coded or pseudonymised datasets with varying numbers of quasi-identifiers. At the other end are data transformed so extensively that re-identification is not reasonably likely in the intended environment. Moving along this continuum often reduces analytic utility, which is why governance must balance data minimisation with scientific value.

The relevant environment matters. A table of age, sex and district may pose little risk in a national survey but high risk in a rare-disease clinic with five patients. A dataset that was effectively anonymous twenty years ago may become more identifiable when public databases and computational linkage improve. Researchers should avoid permanent promises about risk that technology can change.

Free text deserves special attention

Clinical notes, interview transcripts and open-ended survey responses can contain names, addresses, workplaces, family relationships or unusual events. Automated scrubbing can help but is imperfect. Qualitative data may also lose meaning if every contextual detail is removed. Sharing plans should therefore consider redaction, paraphrasing, synthetic excerpts, controlled access or quotation consent depending on the research purpose.

Audio and video are intrinsically more identifying than transcripts because voices and faces can identify participants. If future sharing is contemplated, the consent and governance plan should distinguish between derived transcripts and original recordings.

Linkage creates both value and risk

Linkage to registries, laboratory systems or administrative records can reduce participant burden and improve outcome ascertainment. It also creates a pathway through which identities are necessarily handled. The protocol should specify which organisation performs linkage, what identifiers are transferred, whether a trusted third party is used, how linkage files are destroyed or archived, and whether the combined dataset introduces new identifiability.

Where feasible, the analysis team may receive only a coded linked dataset rather than direct identifiers. Separation of duties reduces the number of people who need access to identity information.

Access controls should follow least privilege

Not every member of a research team needs the same data. Recruiters may need contact details, data managers may need linkage identifiers, analysts may need coded outcomes, and external collaborators may need a restricted extract. Role-based permissions based on least privilege reduce the impact of accidental or malicious disclosure.

Permissions should also be reviewed when staff change roles or leave. Shared accounts, emailed spreadsheets and local copies can undermine otherwise strong server security. Governance is only as effective as the actual workflow.

Privacy risk should be communicated proportionately

Consent forms should avoid both false reassurance and alarm. Saying “your information is completely confidential” is rarely accurate. Saying “there is a risk that anyone could find your information” may be unnecessarily frightening when robust controls exist. A balanced explanation describes the safeguards, residual possibility of unauthorised disclosure and relevant limits such as required safety reporting.

For studies using broad future data sharing, participants should understand whether data may be accessed by researchers outside the institution, whether commercial researchers can apply, and whether individual permission will be sought for each future project. The answer depends on the governance model rather than one universal rule.

Breach response belongs in the protocol

Teams should know what happens if identifiable data are sent to the wrong person, a device is lost or unauthorised access is detected. A response plan usually includes containment, preservation of logs, risk assessment, institutional notification and any participant or authority notification required by policy or law. The exact legal timelines are jurisdiction-specific and should not be invented in a general lecture. Big-data ethics guidance similarly stresses data protection and responsible governance when health datasets are reused.[6]

Building a privacy threat model

A privacy threat model asks who might access the data, by what route, and with what consequence. Threats include accidental email, lost devices, excessive permissions, malicious insiders, compromised accounts, insecure third-party platforms, public re-identification and authorised users who exceed the approved purpose. Thinking through plausible pathways is more useful than declaring a system “secure”.

The threat model should include the participant-facing workflow. Recruitment lists printed at a clinic desk, names displayed on research appointment boards, video calls conducted in shared spaces and reminder messages shown on a family phone can reveal participation even if the research database is perfectly encrypted. Privacy therefore begins before data entry.

Data exports deserve particular controls because they create new copies outside the central system. Investigators should specify who can export, which variables can leave, how files are encrypted, where they may be stored and when local copies should be deleted. Analysts should not routinely receive direct identifiers simply because they are members of the project.

The protocol should also distinguish confidentiality of participation from confidentiality of individual responses. In sensitive research, merely being known to have joined a study can reveal information about diagnosis, behaviour or identity. Recruitment and contact methods should therefore avoid messages such as “HIV adherence study appointment” on shared devices when a neutral approved description can serve the same operational purpose.

Finally, privacy governance should be tested before live recruitment. A short tabletop exercise can trace one hypothetical participant from screening log to contact list, consent, research database, export, analysis and archive. At each step the team asks who can see the identity, whether access is necessary and what would happen if the record were misdirected. This often exposes gaps that policy documents alone miss.

Privacy considerations in publication and presentation

Confidentiality does not end at database lock. Tables with very small cells, maps of rare conditions, clinical photographs and detailed case narratives can identify participants even if the analytic dataset was well protected. Authors should review outputs for disclosure risk before manuscripts, conference slides or public dashboards are released.

Qualitative quotations are particularly important. Removing names may not be enough when a quotation contains a distinctive occupation, family event or location. Researchers can paraphrase non-essential identifying detail, combine contextual descriptors, obtain explicit quotation permission where appropriate, or restrict particularly revealing material. The analytical meaning should not be altered merely to disguise identity.

Public communication teams should also avoid using participant images or stories gathered for research as promotional content unless the relevant permission clearly covers that use. Consent to research participation is not automatically consent to publicity.

Reassessing privacy when the dataset changes

Privacy review should be repeated when new variables, linkages or sharing arrangements are added. A dataset that was low risk at initial approval can become more identifiable after linkage to geolocation, genomics or a rare-outcome registry. Amendments should therefore assess the combined dataset and new access environment, not merely note that each component had previously been approved. This is particularly important for long-lived registries and platform studies in which data accumulate over years.

Confidentiality responsibilities continue after staff leave

Offboarding procedures should remove system access, recover study devices and confirm the disposition of local files when staff, students or collaborators leave. Former team members should not retain identifiable research data merely because they contributed to collection. Longitudinal studies should periodically review permissions and shared folders so that access reflects current responsibilities rather than historical membership of the project.

Privacy training should use the real workflow

Generic annual privacy training is not enough for complex studies. Staff should practise the specific workflow they will use: how screening lists are handled, which system stores identifiers, which channels are approved for participant contact, how exports are requested, and whom to contact after a suspected breach. Scenario-based training makes confidentiality an operational competence rather than a policy statement and should be refreshed when systems or staff roles change.

Periodic privacy review

Longitudinal studies should schedule periodic review of identifying fields, access permissions, third-party processors and sharing plans. Privacy risk can change as new linkages are added, staff move roles or external datasets become available. A governance plan that was proportionate at study start may need strengthening later. Documenting these reviews helps demonstrate that confidentiality is actively maintained rather than assumed from the original approval.

Final disclosure-control check

Before data release or publication, a second person should review the proposed output for residual identifiers, small cells, unusual combinations and embedded metadata. This check is especially useful for spreadsheets, images, free-text extracts and geographic displays, where disclosure can occur outside the variables that analysts normally inspect. The review should consider the audience and access environment: a table suitable for a controlled collaborator may be unsuitable for a public website. Privacy protection therefore continues through dissemination, not merely through secure storage.

DECISION GUIDE

Choose an access model

• Does the research need direct identifiers after recruitment?
• Which combinations of indirect identifiers could permit re-identification?
• Can the dataset be safely shared openly, or is controlled access more appropriate?
• Who needs the linkage key and for how long?
• What limits of confidentiality must be disclosed to participants?

PROTOCOL CHECKLIST

Privacy and confidentiality plan

• List direct and important indirect identifiers.
• Justify collection of sensitive identifying fields.
• Describe coding, key separation and authorised re-identification.
• Specify role-based access, encryption, transfer and export controls.
• State retention, destruction or archiving arrangements.
• Describe breach response and limits of confidentiality.

APPRAISAL CHECKLIST

Appraise identifiability

• Could a participant be recognised through rare combinations even without a name?
• Are free text, images, audio, exact dates and location data handled appropriately?
• Does the proposed sharing environment match residual re-identification risk?
• Are third-party platforms and transfers included in the data-flow map?
• Are confidentiality promises accurate rather than absolute?

Worked example

WORKED EXAMPLE

Redesigning a rare-disease data release

The team replaces public release of row-level data with a controlled-access repository. Direct identifiers and unnecessary exact dates are removed; free text is reviewed and transformed; geographic resolution is reduced where analytically acceptable; and the linkage key remains at the originating institution.

External researchers submit a justified request, sign a data-use agreement and receive only variables needed for the approved analysis. The study team documents residual re-identification risk rather than calling the dataset anonymous.

Suggested protocol or governance wording

Common mistakes

Knowledge check

What is the difference between privacy and confidentiality?

Answer and reasoning

Privacy concerns access to the person and their information; confidentiality concerns how information entrusted to researchers is protected from inappropriate disclosure.

Is coded data anonymous?

Answer and reasoning

Not if a linkage key or other realistic re-identification route remains. Coding is a protection, not necessarily anonymisation.

Why are indirect identifiers important?

Answer and reasoning

Because combinations such as age, postcode, occupation and rare diagnosis can identify a person even without conventional direct identifiers.

Can controlled access be more ethical than open release?

Answer and reasoning

Yes. When useful data remain meaningfully identifiable, controlled access can support responsible reuse while reducing privacy risk.

Key take-home messages

SUMMARY

Key take-home messages

• Privacy, confidentiality and identifiability are related but distinct concepts.
• Re-identification risk depends on combinations of data and the access environment.
• Data minimisation and separation of identifiers should be designed prospectively.
• Rich digital, genomic and geographic data often require stronger governance.
• Confidentiality limits should be explained accurately rather than hidden or overstated.

References

1. World Medical Association. Declaration of Helsinki: ethical principles for medical research involving human participants. Ferney-Voltaire: WMA; 2024. https://www.wma.net/what-we-do/medical-ethics/declaration-of-helsinki/
2. Council for International Organizations of Medical Sciences. International ethical guidelines for health-related research involving humans. 4th ed. Geneva: CIOMS; 2016. https://cioms.ch/publications/product/international-ethical-guidelines-for-health-related-research-involving-humans/
3. National Institutes of Health. Data Management and Sharing Policy overview. Updated 2026. https://grants.nih.gov/policy-and-compliance/policy-topics/sharing-policies/dms/policy-overview
4. Wilkinson MD, Dumontier M, Aalbersberg IJJ, et al. The FAIR Guiding Principles for scientific data management and stewardship. Sci Data. 2016;3:160018. https://doi.org/10.1038/sdata.2016.18
5. International Council for Harmonisation. ICH E6(R3) guideline for good clinical practice: principles and Annex 1. Step 4. 2025. https://database.ich.org/sites/default/files/ICH_E6%28R3%29_Step4_FinalGuideline_2025_0106.pdf
6. UNESCO International Bioethics Committee. Report on big data and health. Paris: UNESCO; 2017. https://unesdoc.unesco.org/ark:/48223/pf0000248724