Selling your soul while negotiating the conditions: from notice and consent to data control by design

Original Paper

DOI: 10.1007/s12553-017-0185-3

Cite this article as:
Belli, L., Schwartz, M. & Louzada, L. Health Technol. (2017). doi:10.1007/s12553-017-0185-3
Part of the following topical collections:
  1. Privacy and Security of Medical Information

Abstract

This article claims that the Notice and Consent (N&C) approach is not efficient to protect the privacy of personal data. On the contrary, N&C could be seen as a license to freely exploit the individual’s personal data. For this reason, legislators and regulators around the world have been advocating for different and more efficient safeguards, notably through the implementation of the Privacy by Design (PbD) concept, which is predicated on the assumption that privacy cannot be assured solely by compliance with regulatory frameworks. In this sense, PbD affirms that privacy should become a key concern for developers and organisations alike, thus permeating new products and services as well as the organisational modi operandi. Through this paper, we aim at uncovering evidences of the inefficiency of the N&C approach, as well as the possibility to further enhance PbD, in order to provide the individual with increased control on her personal data. The paper aims at shifting the focus of the discussion from “take it or leave it” contracts to concrete solutions aimed at empowering individuals. As such, we are putting forth the Data Control by Design (DCD) concept, which we see as an essential complement to N&C and PbD approaches advocated by data-protection regulators. The technical mechanisms that would enable DCD are currently available (for example, User Managed Access (UMA) v1.0.1 Core Protocol). We, therefore, argue that data protection frameworks should foster the adoption of DCD mechanisms in conjunction with PbD approaches, and privacy protections should be designed in a way that allows every individual to utilise interoperable DCD tools to efficiently manage the privacy of her personal data. After having scrutinised the N&C, PbD and DCD approaches we discuss the specificities of health and genetic data, and the role of DCD in this context, stressing that the sensitivity of genetic and health data requires special scrutiny from regulators and developers alike. In conclusion, we argue that concrete solutions allowing for DCD already exist and that policy makers should join efforts together with other stakeholders to foster the concrete adoption of the DCD approach.

Keywords

Notice and consent Privacy by design Data control by design Data protection Health data 

Copyright information

© IUPESM and Springer-Verlag Berlin Heidelberg 2017

Authors and Affiliations

  1. 1.Center for Technology & SocietyFundação Getulio Vargas (FGV)Rio de JaneiroBrazil
  2. 2.University of MalmöMalmöSweden
  3. 3.Universidade do Estado do Rio de JaneiroRio de JaneiroBrazil

Personalised recommendations