Young adults with developmental disabilities (YADD) and their families are at risk of exploitation in terms of privacy and protection of their personal information (Joffe, 2010). Their increasing dependency on multiple community-based and private agencies creates a scenario where a wide range of personal information is retained and shared through the course of servicing these individuals and their families over time. YADD are vulnerable not only because they are in a sensitive period transitioning into adulthood but also as they have complex developmental needs and may experience difficulties making their own decisions (Dyke et al., 2016). They may also have concurrent health and mental health needs which require support, and even as adults may frequently depend on secondary decision makers to protect their privacy of information rights (Geist, 2016).

Developmental disabilities (DDs), which include intellectual disability, autism, down syndrome, fragile x syndrome, cerebral palsy, and developmental delays, are lifelong and affect multiple aspects of psychosocial development, physical functioning, and participation in daily activities (Developmental Services Ontario (DSO), 2016; Roebuck et al., 2008). Individuals with DDs may have deficits in their cognitive, decision-making, comprehension, and communication capacity (Roebuck et al., 2008) that increases their exposure to human rights violations related to privacy of information (Fogden et al., 2016). They or their family caregivers and service providers often do not have the necessary resources to defend their privacy rights to personal information.

While legislation in Canada is well developed and in place to guide the protection of personal information (e.g., Personal Information Protection and Electronic Documents Act (PIPEDA), 2000), and health information for individuals (e.g., Personal Health Information Protection Act (PHIPA), 2004), the translation of relevant legislation as required for individuals at-risk of understanding or communicating their rights is not. This impression is informed by our findings from our recent and on-going research studies on families of children and young adults with developmental disabilities (Khanlou et al., 2017a; Khanlou et al., 2017c; Khanlou, 2018). During the data collection phase of these projects, family caregivers, service providers, and YADD frequently reported concerns they faced with the collection and use of their personal information. Specifically, they relayed concerns about the extensive paper work, dispersed services, navigation across multiple service sectors with repetition of requests for personal information, financial difficulties, social isolation, and stigma. Immigrant family caregivers of YADD faced additional information privacy concerns specific to language fluency, lack of social networks, and new knowledge required post-migration of service delivery systems and their rights, which were reported to affect their access to and utilization of health and social services (Khanlou et al., 2017a; Khanlou et al., 2017b; Khanlou et al., 2017c; Khanlou, 2018). Their concerns and these factors influence the privacy rights of YADD in a challenging manner. Many YADD and their parents continue to remain uncertain as to who is accountable for the protection of their privacy rights given the complexity and persistence of developmental challenges of the young adults.

In Ontario, Canada, persons with DDs are permitted to remain in their secondary school until they reach 21 years of age. Thus, even though they are adults as of 18 years of age, their privacy and confidentiality rights are largely protected by the adherence to privacy laws within their school environment. However, following completion of school, the young adults with developmental disabilities can take different pathways ranging from partial employment, volunteer work, vocational training, day programs, or to no involvement in activities outside the home. Once these young adults leave the protection of their school settings, they are increasingly dependent on both private and public agencies from within both the social and health sectors. This dependency on multiple organizations to provide needed services, supervision, care, employment, or education— commercially based or not—increases dramatically as the young adults transition into adulthood.

Given the significant gap between application of relevant legislation or information privacy evidence and the needs of young adults with developmental disabilities, the YADD Privacy Project was developed (Khanlou, et al., 2017b). As part of the project, a methodologically rigorous scoping review was conducted to address this gap by synthesizing evidence on information privacy rights for YADD in Canada. The goals of this comprehensive scoping review of both published peer-reviewed articles and online gray literature were to: (1) examine the range, depth and nature of both the scholarly and gray literature related to access to privacy of information rights and utilization of legislation in Canada for the provision of services to young adults with developmental disabilities (PIPEDA, 2000 or PHIPA, 2004), (2) apply a socio-ecological framework (Bronfenbrenner & Ceci, 1994) to the findings to illustrate the barriers and facilitators of information privacy rights for young adults with developmental disabilities, and (3) to contribute to the development of future strategies and solutions enhancing information privacy rights with evidence-based recommendations.

Methods

Our protocol was developed using the scoping review methodology proposed by Arksey and O’Malley (2005), which has a five-step process for conducting scoping reviews. This method entails (1) identification of the research question, (2) identification of relevant studies, (3) study selection, (4) charting the data, and (5) synthesizing and reporting of the results. In addition, we refined the scoping review process to increase methodological rigor, by including three more components as suggested by Tricco et al. (2016) and Colquhoun et al. (2014) and their colleagues, including establishing a protocol, utilizing at least two reviewers and calculation of reliability, a reporting checklist, and conducting a consultation exercise to ensure our results are useful to advancing the field.

  • Step 1 We identified the research question as follows, “What does the scholarly and grey literature on information privacy in relation to PIPEDA or PHIPA inform us about the barriers and facilitators young adults with developmental disabilities encounter when accessing and utilizing their privacy rights?”

  • Step 2 Next, relevant peer-reviewed studies were identified by searching electronic databases: ProQuest, JSTOR, Scholars Portal, EBSCO, Web of Science, PubMed, PsychINFO, Scopus, and CANLII (for legal cases and briefs), using specific search terms: PIPEDA OR PHIPA OR information privacy AND developmental disabilities AND Canada. The gray literature search was conducted using the Google search engine, and keywords/phrases were either (a) barriers to PIPEDA for young adults with developmental disabilities in Canada or (b) barriers to PHIPA for young adults with developmental disabilities in Canada. The database searchers were not limited by language or type of publication, but location for keywords was restricted to Canada. Specifically, we searched Google Search and websites of agencies that service YADD. The electronic searches retrieved 9299 articles (Fig. 1), and 25 articles through hand searching. Ten duplicates were removed. Search and keyword strategy were developed by research team members and approved by the study Principle Investigator and the health sciences librarian.

  • Step 3 Abstracts of identified articles were reviewed to assess if they met the inclusion and exclusion criteria. Articles were eligible if they were written in a peer-reviewed journal or published online, including policy documents, websites, and commentary, between January of 2000 and November of 2017. All titles and abstracts were individually examined by the reviewers AM and AK. We excluded any articles or gray literature that was aimed at the general population or cited the legislation without detailed explanation or information on application in servicing YADD. Articles not pertaining to access to or utilization of privacy legislation were excluded. Abstracts were included if they described issues related to PIPEDA or PHIPA and legislation with young adults with developmental disabilities. We included articles based on other populations (e.g. physical disability, and mental illness) and countries (EU) and USA) only if their findings were also relevant to the developmental disability community. Articles discussing children and youth under the age of 16 were not included, and studies of adults were only included if a large portion of the reported sample in the study included young adults under 28 years of age. To ensure comprehensiveness in the evidence base, we also supplemented our list of included articles with academic literature that discussed information privacy with similarly vulnerable populations (e.g., those with mental health or decision-making capacity issues). We included studies conducted outside of Canada when findings were informative for barriers and facilitators of privacy legislation. Forty-seven articles (24 peer-reviewed and 23 gray literature) fulfilled the eligibility criteria for the scoping review.

  • Step 4 Information was captured on Excel 2011. To ensure reliability between reviewers, a series of training exercises were conducted and inter-rater agreement for both the study inclusion and data charting phases. Changes were made based on feedback until there was consensus regarding the face validity of the tool by the two reviewers. A total of 10 randomly selected articles were evaluated by two reviewers, and 5 by three reviewers, to assess the level of agreement across all categories for each article. Reliability for level of agreement on items on the abstraction form ranged from 61 to 96%. Given the high degree of variability among the published and gray literature, the mean level of agreement obtained (79.5%) was deemed to be sufficient. All changes were verified by reviewers to ensure data accuracy.

Fig. 1
figure 1

Information privacy rights PRISMA diagram

Full size image

Results

All analyzed articles described legislation focused on information privacy rights, in relation to collection, use, disclosure or sharing and correction, or access for checking. Eighty percent of the articles (peer-reviewed published and gray literature) also addressed confidentiality and/or autonomy while only 6 articles (12%) reviewed ethical issues related to accountability on the part of the service organization. Full-length manuscripts, case studies, legislative acts, policy reports, professional practice guidelines, service provider resources as well as literature and policy reviews were obtained for all abstracts identified for inclusion by both reviewers.

Location

Fifty-one percent of the 47 articles included for full text review and synthesis represented peer-reviewed published articles and 48% represented documents selected through the gray literature search. Of the published articles, five were based in the USA and three in the EU.

Population

While 39 articles were related to young adults with developmental disability, 8 articles from the published and gray literature did not discuss young adults or developmental disability, but to consumers of technology (n = 4), genetic researchers (n = 1), and patients with mental health diagnoses (n = 3).

Legal and Ethical Themes

Within the whole sample (n = 47), all articles discussed relevant legal and ethical issues but through a variety of sub-themes. Fifty-five percent of articles discussed collection of personal information, while 42 to 45% focused on use disclosure of personal information and 25% discussed the legal and ethical issues related to correction or access to personal information that is kept within the organization. With respect to ethical principles related to the privacy of information rights, 83% focused on confidentiality, 38% on the need for autonomy, and 13% discussed accountability on the part of the organization collecting the personal information.

Types of Articles

Articles from both the peer-reviewed published and gray literature included a variety of formats, from commentary to policy/legislation and literature reviews to empirical studies utilizing qualitative and/or quantitative data, and professional or organization-based guidelines. Policy and legislation reviews or discussions accounted for 22% of the total articles, while 17% represented the empirical research studies and 32% were based on reviews of the literature (please see Table 1). Fifty-six percent of articles representing the gray literature were published as guidelines, either to be used as a general resource to consumers of the organization (n = 15), or to support health professional practice (n = 5), or to communicate the organization’s policy and procedures (n = 6). Of the five articles published as professional practice guidelines specifically addressing privacy rights for use by health professionals (e.g., Occupational Therapists, Speech/Language Pathologists, Personal Support Workers), none discussed relevant parts of the legislation, or potential strategies to help the professional protect information privacy rights of those they are supporting. Rather, they referred the reader to read the PIPEDA. The remaining 46% of published gray literature included websites, information sheets, press releases, reports to the Canadian parliament, dissertation, relevant legislation, and a document of meeting minutes (please see Table 2).

Table 1 Studies on privacy of personal information: study characteristics (N = 24)
Full size table
Table 2 Gray literature on privacy of personal information: study characteristics (N = 23)
Full size table

Discussion

Despite legislation that provides standards on how to collect, use, and disseminate personal information to protect privacy, this review identifies specific factors as barriers and facilitators to access and use of information privacy rights for YADD and their families. These findings were classified according to Bronfenbrenner’s socio-ecological framework (Bronfenbrenner & Ceci, 1994) of classifying macro level (policy, legislation, attitudes), meso level (organization), exo level (community interactions), and micro level (individual, family), to more fully understand influences on access and utilization of privacy rights for young adults with developmental disabilities (please see Fig. 2).

Fig. 2
figure 2

Conceptual framework: determinants of privacy of personal information rights for YADD

Full size image

Macro Level: Policy and Legislation (National and International)

At the macro level, this review suggests that aspects of policy and legislation, both in Canada and internationally, are identified as barriers to YADD exercising their privacy rights. The main factors shown to act as barriers can be categorized as relating to presentation of policy, gaps in legislation, and rise of corporate interests. Poorly written policy that is unclear (Dyke, et al., 2016; Keith, 2004; Law Commission of Ontario (LCO) 2017a; Mills et al., 2003; Rule, 2004; Wappel, 2007), and a lack of integration of technology into policy (Mills, et al., 2003) were cited often. The lack of international agreements and compliance with provincial and federal legislation in Canada, including respect for local norms around disability and privacy rights, was stated by several authors as problematic (Dyke, et al., 2016; Geist, 2016; Mills, et al., 2003; Siegel et al., 2009). Increasing levels of corporate lobbying interests and associated pressure to lower standards (Geist, 2016; Peekhaus, 2008) and exploitation of personal information (Peekhaus, 2008; Rule, 2004) were also cited as barriers.

On the other hand, facilitators of information privacy rights were also supported in the articles, primarily, the need for penalties to enforce accountability (Bearwood, 2015; Desai, 2013; Dyke, et al., 2016; Geist, 2016; Joffe, 2010; Keith, 2004; LCO, 2017a; Wedge, 2014), but also increased acknowledgement and respect for disability (Canadian Association of Community Living (CACL), 2011; Community Living Huntsville, 2012; Central East Local Health Integrated Network (LHIN), 2009; Repetto et al., 2008), community, socioeconomic, and technology support (CACL, 2011; Joffe, 2010; LCO, 2017b), and higher standards for security of personal information (Community Living Huntsville, 2012; Peekhaus, 2008).

Exo Level: YADD and Community Interactions

At the exo level for adults with developmental disabilities, an interesting pattern of barriers and facilitators was evident consistently across articles. This related to access issues based in the interactions between YADD and their community and service providers. Barriers included insufficient knowledge leading to limited use of the existing legislation (Keith, 2004; Mental Health Commission of Canada (MHCC), 2015; Mills, et al., 2003; Repetto, et al., 2008; Rule, 2004; Simcoe York Dual Diagnosis Education Committee (SYDDEC), 2015; Wellington North, 2015), fear of reprisal for making a complaint (Joffe, 2010), lack of transparency regarding online social media platforms (Siegel et al., 2009; Rule, 2004), and use of overly complex language and presentation of rules (Siegel et al., 2009; Yalon-Chamovitz, 2009). Most noteworthy was the observation of a failure among organizations to provide appropriate accommodations to better support consent for collection and use of personal information and advocacy (Dyke et al., 2016; Joffe, 2010; Lafky & Horan, 2011; Larivie’re-Bastien & Racine, 2011; Mills et al., 2003; Wolbring, & Leopatra, 2013; Yalon-Chamovitz, 2009).

Facilitators identified at the exo level included increasing the use of advocacy supports by YADD and family caregivers (Joffe, 2010; Lafky & Horan, 2011; Mills et al., 2003), provision of technology for YADD to facilitate communication and comprehension (CACL, 2011; Larivie’re-Bastien & Racine, 2011), and most importantly, the inclusion of family members to support decision-making (Chan, & O’Brien, 2011; Desai, 2013; LCO, 2017a, b; MHCC, 2015; Peekhaus, 2008). Finally, the addition of specific instructions, in professional practice and organizational guidelines, on how to support young adults with developmental disabilities to exercise their privacy rights was cited in all articles discussing interactions with YADD in the community (Kitchener Downtown Community Health Centre, 2012; Law Commission of Ontario, 2017a, b; Legislative Assembly of Ontario, 2008; Repetto et al., 2008; Wellington North, 2015).

Meso Level: Organization-Based Factors

Factors related to organizations and their processes, specifically to staff relations that act either as barriers or facilitators of access and utilization of privacy of information rights, were identified at the meso level. Barriers included a persistent lack of willingness on the part of organizations to share their information databases in order to ease the stress on YADD and their families (Clement, & Obar, 2016; Desai, 2013; Dyke et al., 2016; Gagnon et al., 2016; Larivie’re-Bastien, & Racine, 2011; Peekhaus, 2008; Mills, et al., 2003; Ministry of Health and Long-Term care (MHLTC), 2006; Lacobucci, 2014; Urowitz et al., 2008) and lack of commitment to use of technological advances to protect information privacy rights (Mills, et al., 2003; Siegel et al., 2009; Urowitz et al., 2008). Throughout the review, YADD needs were found to be unrepresented in organizational processes (Austin, 2006; CACL, 2011; Clement, & Obar, 2016; Siegel et al., 2009).

Identified solutions that acted as facilitators at the meso level focused on the provision of greater levels of experience, training, and practice opportunities for staff to better facilitate privacy rights for YADD (Dyke, et al., 2016; Gagnon et al., 2016; Lafky & Horan, 2011; Legislative Assembly of Ontario, 2008; Wellington North, 2015; Yalon-Chamovitz, 2009). As well, implementation of assessment of YADD needs for electronic health records and patient portals (Dyke et al., 2016; Urowitz et al., 2008) and enforcement of compliance among organizations in providing service that is consistent with existing privacy legislation and legislation governing the provision of individualized accommodations particularly for communication and comprehension (Austin, 2006; CACL, 2011; Dyke et al., 2016; Geist, 2016; Ontario Law, 2008).

Micro Level: Individual Disability-Related Factors

A few characteristics that stem from the individual’s disability were identified as barriers at the micro level. However, it is important to note that existing legislation already provides direction to avoid these barriers but is often overlooked due to lack of compliance with privacy legislation and community-based care (Beardwood, 2015; Davidson et al., 2016; Dyke et al., 2016; Geist, 2016; Joffe, 2010;). For instance, the failure to provide individualized accommodations YADD need to exercise their rights and receive support for their decision-making due to low literacy as well as communication, comprehension, and visual difficulties surfaced consistently through this review (CACL, 2011; Joffe, 2010; Larivie’re-Bastien, & Racine, 2011; Repetto et al., 2008; Yalon-Chamovitz, 2009). Similarly, a lack of support to better prepare YADD during this transition period was identified as a major vehicle for YADD to become more empowered in exercising their information privacy rights (Davidson et al., 2016; Joffe, 2010; Larivie’re-Bastien, & Racine, 2011; Repetto et al., 2008). Finally, socioeconomic issues were cited as barriers to utilization of privacy rights, in that fees make it difficult for YADD and their families to make corrections to their personal information files (CACL, 2011; Laverie-Bastien, & Racine, 2011; Urowitz et al., 2008).

To better facilitate access and utilization of privacy rights for YADD, provision of support in two main areas were identified: (1) provision of training to improve computer literacy and self-advocacy skills specific to information privacy rights (CACL, 2011; Joffe, 2010; Repetto et al., 2008; Urowitz et al., 2008), and (2) provision of supported decision-making through greater engagement of family members in the consent process and utilization of privacy rights (CACL, 2011; Central East LHIN, 2009; Chan & O’Brien, 2011; Davidson et al., 2016; Lafky & Horan, 2011; LCO, 2017a, b; Joffe, 2010; Repetto et al., 2008).

Recommendations

The findings and discussions of these articles show that the gap between the existing legislation and access to, or utilization of, information privacy rights among YADD and their families results from three factors: (1) a lack of knowledge among YADD and their family supporters (Gagnon et al., 2016; Joffe, 2010; Lacobucci, 2014; Lafky & Horan, 2011; Repetto et al., 2008; Yalon-Chamovitz, 2009), (2) a tendency of organizations to interpret or adhere to privacy laws inconsistently (Clement & Obar, 2016; Desai, 2013; Dyke et al., 2016; Geist, 2016; Peekhaus, 2008; Wolbring & Leopatra, 2013; Urowitz et al., 2008), and (3) a lack of access to the tools needed to support YADD exercising their information privacy rights (Davidson et al., 2016; Joffe, 2010; Larivie’re-Bastien & Racine, 2011; Mills et al., 2003; Repetto et al., 2008; Skouge et al., 2007; Urowitz, et al., 2008; Yalon-Chamovitz, 2009).

In connection with the findings reviewed, we recommend the following three areas that need to be addressed by privacy commissioners and organizations supporting young adults with developmental disabilities. First, and foremost, awareness, knowledge, and skills need to be raised among organizational staff, families, and YADD. In this way, self-advocacy will occur more frequently, and families will be included in the YADD’s core support and privacy rights education in their high school curriculum. Second, promotion of information privacy legislation through education for organizational staff is required. In particular, implementation of manuals with specific guidelines instructing staff with strategies to use the privacy legislation is suggested. Finally, targeted translation of existing legislation that will allow more YADD and their families to exercise their privacy of information rights is recommended.

Limitations

This review has some limitations. Our literature search was limited to articles focusing on privacy legislation and developmental disabilities, and this search strategy may have contributed to excessively narrow range of articles included. Several exceptions for inclusion were established to capture relevant articles and to make it possible to broaden the capture of relevant barriers and facilitators also relevant to YADD. The articles differed not only in their objectives and methodology or type of article, but also showed great heterogeneity in approach to considering the issue of privacy of information rights. While quality was consistently high (such as representative samples, standardized tools, in depth policy discussion), the total number of empirical studies was very few (n = 6). It is important that future studies examine public understanding of privacy rights and pathways to accessing tools to exercise privacy rights. Finally, the presentation of our findings in Fig. 2 (Conceptual Framework: Determinants of Privacy of Personal Information Rights for YADD) presents a systems perspective. Our interpretation of our findings is influenced by this perspective.

Conclusion

In this scoping review, 24 peer-reviewed articles and 23 articles from the gray literature were identified which examined the barriers and facilitators for access and utilization of information privacy rights in relation to the needs of young adults with developmental disabilities and their families. A basic requirement in protecting individual privacy rights is informing people of their rights so they know when a violation has occurred and how it can be remedied. This becomes a challenge to organizations trying to support families and their YADD as communication and information sharing can be complicated, often requiring accommodations or supports for the decision-making. The implications of the challenges typically experienced by YADD are tremendous, especially for providing support for provision of consent and decision-making to ensure ensuring confidentiality and autonomy throughout the protection of personal information privacy (Joffe, 2010). Although some parallels can be made with elderly citizens or persons with physical disabilities, important and distinct differences exist for YADD whose chronological age indicate adult, but who may not have sufficient decision-making capacity, and, more often than not, may be restricted as a result of their mode of communication or literacy level. By the time the potential privacy breach is voiced, or even recognized, young adults with developmental disabilities may have already lost some of their privacy rights in the process. For this reason, and because existing privacy legislation exists, the present review suggests that increasing awareness, education, and knowledge translation tools for all involved, especially YADD, family caregivers, and service providers, will help to combat the disadvantage in exercising information privacy rights by young adults with developmental disabilities.