Protection of Privacy of Information Rights among Young Adults with Developmental Disabilities

Protection of privacy of information for young adults with developmental disabilities and their families is essential to promote quality of life, well-being, empowerment, and inclusion. Despite this, the young adults’ information privacy rights are increasingly at risk. This paper provides a scoping review, applying Arksey and O’Malley’s (2005) approach, of all published peer-reviewed journal articles and gray literature to examine the barriers and facilitators in utilization of legislation that protects the collection, use, disclosure, and access of personal information in Canada. The scoping review process was further expanded with a rigorous reliability method and applied a socio-ecological framework to the final 47 studies. National and international policy and legislation (macro level), organization-based factors (meso), young adults and community interactions (exo), and individual disability related factors (micro) are examined. The review identifies the barriers and highlights the importance of facilitators for acting on personal privacy rights.

YADD Privacy Project was developed (Khanlou, et al., 2017b). As part of the project, a methodologically rigorous scoping review was conducted to address this gap by synthesizing evidence on information privacy rights for YADD in Canada. The goals of this comprehensive scoping review of both published peer-reviewed articles and online gray literature were to: (1) examine the range, depth and nature of both the scholarly and gray literature related to access to privacy of information rights and utilization of legislation in Canada for the provision of services to young adults with developmental disabilities (PIPEDA, 2000or PHIPA, 2004, (2) apply a socio-ecological framework (Bronfenbrenner & Ceci, 1994) to the findings to illustrate the barriers and facilitators of information privacy rights for young adults with developmental disabilities, and (3) to contribute to the development of future strategies and solutions enhancing information privacy rights with evidence-based recommendations.

Methods
Our protocol was developed using the scoping review methodology proposed by Arksey and O'Malley (2005), which has a five-step process for conducting scoping reviews. This method entails (1) identification of the research question, (2) identification of relevant studies, (3) study selection, (4) charting the data, and (5) synthesizing and reporting of the results. In addition, we refined the scoping review process to increase methodological rigor, by including three more components as suggested by Tricco et al. (2016) and Colquhoun et al. (2014) and their colleagues, including establishing a protocol, utilizing at least two reviewers and calculation of reliability, a reporting checklist, and conducting a consultation exercise to ensure our results are useful to advancing the field.
Step 1 We identified the research question as follows, BWhat does the scholarly and grey literature on information privacy in relation to PIPEDA or PHIPA inform us about the barriers and facilitators young adults with developmental disabilities encounter when accessing and utilizing their privacy rights?Ŝ tep 2 Next, relevant peer-reviewed studies were identified by searching electronic databases: ProQuest, JSTOR, Scholars Portal, EBSCO, Web of Science, PubMed, PsychINFO, Scopus, and CANLII (for legal cases and briefs), using specific search terms: PIPEDA OR PHIPA OR information privacy AND developmental disabilities AND Canada. The gray literature search was conducted using the Google search engine, and keywords/phrases were either (a) barriers to PIPEDA for young adults with developmental disabilities in Canada or (b) barriers to PHIPA for young adults with developmental disabilities in Canada. The database searchers were not limited by language or type of publication, but location for keywords was restricted to Canada. Specifically, we searched Google Search and websites of agencies that service YADD. The electronic searches retrieved 9299 articles (Fig. 1), and 25 articles through hand searching. Ten duplicates were removed. Search and keyword strategy were developed by research team members and approved by the study Principle Investigator and the health sciences librarian.
Step 3 Abstracts of identified articles were reviewed to assess if they met the inclusion and exclusion criteria. Articles were eligible if they were written in a peer-reviewed journal or published online, including policy documents, websites, and commentary, between January of 2000 and November of 2017. All titles and abstracts were individually examined by the reviewers AM and AK. We excluded any articles or gray literature that was aimed at the general population or cited the legislation without detailed explanation or information on application in servicing YADD. Articles not pertaining to access to or utilization of privacy legislation were excluded. Abstracts were included if they described issues related to PIPEDA or PHIPA and legislation with young adults with developmental disabilities. We included articles based on other populations (e.g. physical disability, and mental illness) and countries (EU) and USA) only if their findings were also relevant to To ensure comprehensiveness in the evidence base, we also supplemented our list of included articles with academic literature that discussed information privacy with similarly vulnerable populations (e.g., those with mental health or decision-making capacity issues). We included studies conducted outside of Canada when findings were informative for barriers and facilitators of privacy legislation. Forty-seven articles (24 peer-reviewed and 23 gray literature) fulfilled the eligibility criteria for the scoping review.
Step 4 Information was captured on Excel 2011. To ensure reliability between reviewers, a series of training exercises were conducted and inter-rater agreement for both the study inclusion and data charting phases. Changes were made based on feedback until there was consensus regarding the face validity of the tool by the two reviewers. A total of 10 randomly selected articles were evaluated by two reviewers, and 5 by three reviewers, to assess the level of agreement across all categories for each article. Reliability for level of agreement on items on the abstraction form ranged from 61 to 96%. Given the high degree of variability among the published and gray literature, the mean level of agreement obtained (79.5%) was deemed to be sufficient. All changes were verified by reviewers to ensure data accuracy.

Results
All analyzed articles described legislation focused on information privacy rights, in relation to collection, use, disclosure or sharing and correction, or access for checking. Eighty percent of the articles (peer-reviewed published and gray literature) also addressed confidentiality and/or autonomy while only 6 articles (12%) reviewed ethical issues related to accountability on the part of the service organization. Full-length manuscripts, case studies, legislative acts, policy reports, professional practice guidelines, service provider resources as well as literature and policy reviews were obtained for all abstracts identified for inclusion by both reviewers.

Location
Fifty-one percent of the 47 articles included for full text review and synthesis represented peer-reviewed published articles and 48% represented documents selected through the gray literature search. Of the published articles, five were based in the USA and three in the EU.

Population
While 39 articles were related to young adults with developmental disability, 8 articles from the published and gray literature did not discuss young adults or developmental disability, but to consumers of technology (n = 4), genetic researchers (n = 1), and patients with mental health diagnoses (n = 3).

Legal and Ethical Themes
Within the whole sample (n = 47), all articles discussed relevant legal and ethical issues but through a variety of sub-themes. Fifty-five percent of articles discussed collection of personal information, while 42 to 45% focused on use disclosure of personal information and 25% discussed the legal and ethical issues related to correction or access to personal information that is kept within the organization. With respect to ethical principles related to the privacy of information rights, 83% focused on confidentiality, 38% on the need for autonomy, and 13% discussed accountability on the part of the organization collecting the personal information.

Types of Articles
Articles from both the peer-reviewed published and gray literature included a variety of formats, from commentary to policy/legislation and literature reviews to empirical studies utilizing qualitative and/or quantitative data, and professional or organization-based guidelines. Policy and legislation reviews or discussions accounted for 22% of the total articles, while 17% represented the empirical research studies and 32% were based on reviews of the literature (please see Table 1). Fifty-six percent of articles representing the gray literature were published as guidelines, either to be used as a general resource to consumers of the organization (n = 15), or to support health professional practice (n = 5), or to communicate the organization's policy and procedures (n = 6). Of the five articles published as professional practice guidelines specifically addressing privacy rights for use by health professionals (e.g., Occupational Therapists, Speech/Language Pathologists, Personal Support Workers), none discussed relevant parts of the legislation, or potential strategies to help the professional protect information privacy rights of those they are supporting. Rather, they referred the reader to read the PIPEDA. The remaining 46% of published gray literature included websites, information sheets, press releases, reports to the Canadian parliament, dissertation, relevant legislation, and a document of meeting minutes (please see Table 2).

Discussion
Despite legislation that provides standards on how to collect, use, and disseminate personal information to protect privacy, this review identifies specific factors as barriers and facilitators to access and use of information privacy rights for YADD and their families. These findings were classified according to Bronfenbrenner's socio-ecological framework (Bronfenbrenner & Ceci, 1994) of classifying macro level (policy, legislation, attitudes), meso level (organization), exo level (community interactions), and micro level (individual, family), to more fully understand influences on access and utilization of privacy rights for young adults with developmental disabilities (please see Fig. 2).

Macro Level: Policy and Legislation (National and International)
At the macro level, this review suggests that aspects of policy and legislation, both in Canada and internationally, are identified as barriers to YADD exercising their privacy rights. The main factors shown to act as barriers can be categorized as relating to presentation of policy, gaps in legislation, and rise of corporate interests. Poorly written policy that is unclear (Dyke,  Mills et al., 2003;Rule, 2004;Wappel, 2007), and a lack of integration of technology into policy (Mills, et al., 2003) were cited often. The lack of international agreements and compliance with provincial and federal legislation in Canada, including respect for local norms around disability and privacy rights, was stated by several authors as problematic (Dyke, et al., 2016;Geist, 2016;Mills, et al., 2003;Siegel et al., 2009). Increasing levels of corporate lobbying interests and associated pressure to lower standards (Geist, 2016;Peekhaus, 2008) and exploitation of personal information (Peekhaus, 2008;Rule, 2004) were also cited as barriers.

Exo Level: YADD and Community Interactions
At the exo level for adults with developmental disabilities, an interesting pattern of barriers and facilitators was evident consistently across articles. This related to access issues based in the interactions between YADD and their community and service providers. Barriers included insufficient knowledge leading to limited use of the existing legislation (Keith, 2004;Mental Health Commission of Canada (MHCC), 2015;Mills, et al., 2003;Repetto, et al., 2008;Rule, 2004;Simcoe York Dual Diagnosis Education Committee (SYDDEC), 2015;Wellington North, 2015), fear of reprisal for making a complaint (Joffe, 2010), lack of transparency regarding online social media platforms (Siegel et al., 2009;Rule, 2004), and use of overly Fig. 2 Conceptual framework: determinants of privacy of personal information rights for YADD complex language and presentation of rules (Siegel et al., 2009;Yalon-Chamovitz, 2009). Most noteworthy was the observation of a failure among organizations to provide appropriate accommodations to better support consent for collection and use of personal information and advocacy (Dyke et al., 2016;Joffe, 2010;Lafky & Horan, 2011;Larivie're-Bastien & Racine, 2011;Mills et al., 2003;Wolbring, & Leopatra, 2013;Yalon-Chamovitz, 2009). Facilitators identified at the exo level included increasing the use of advocacy supports by YADD and family caregivers (Joffe, 2010;Lafky & Horan, 2011;Mills et al., 2003), provision of technology for YADD to facilitate communication and comprehension (CACL, 2011;Larivie're-Bastien & Racine, 2011), and most importantly, the inclusion of family members to support decision-making (Chan, & O'Brien, 2011;Desai, 2013;LCO, 2017a, b;MHCC, 2015;Peekhaus, 2008). Finally, the addition of specific instructions, in professional practice and organizational guidelines, on how to support young adults with developmental disabilities to exercise their privacy rights was cited in all articles discussing interactions with YADD in the community (Kitchener Downtown Community Health Centre, 2012;Law Commission of Ontario, 2017a, b;Legislative Assembly of Ontario, 2008;Repetto et al., 2008;Wellington North, 2015).

Meso Level: Organization-Based Factors
Factors related to organizations and their processes, specifically to staff relations that act either as barriers or facilitators of access and utilization of privacy of information rights, were identified at the meso level. Barriers included a persistent lack of willingness on the part of organizations to share their information databases in order to ease the stress on YADD and their families (Clement, & Obar, 2016;Desai, 2013;Dyke et al., 2016;Gagnon et al., 2016;Larivie're-Bastien, & Racine, 2011;Peekhaus, 2008;Mills, et al., 2003;Ministry of Health and Long-Term care (MHLTC), 2006;Lacobucci, 2014;Urowitz et al., 2008) and lack of commitment to use of technological advances to protect information privacy rights (Mills, et al., 2003;Siegel et al., 2009;Urowitz et al., 2008). Throughout the review, YADD needs were found to be unrepresented in organizational processes (Austin, 2006;CACL, 2011;Clement, & Obar, 2016;Siegel et al., 2009).
Identified solutions that acted as facilitators at the meso level focused on the provision of greater levels of experience, training, and practice opportunities for staff to better facilitate privacy rights for YADD (Dyke, et al., 2016;Gagnon et al., 2016;Lafky & Horan, 2011;Legislative Assembly of Ontario, 2008;Wellington North, 2015;Yalon-Chamovitz, 2009). As well, implementation of assessment of YADD needs for electronic health records and patient portals (Dyke et al., 2016;Urowitz et al., 2008) and enforcement of compliance among organizations in providing service that is consistent with existing privacy legislation and legislation governing the provision of individualized accommodations particularly for communication and comprehension (Austin, 2006;CACL, 2011;Dyke et al., 2016;Geist, 2016;Ontario Law, 2008).

Micro Level: Individual Disability-Related Factors
A few characteristics that stem from the individual's disability were identified as barriers at the micro level. However, it is important to note that existing legislation already provides direction to avoid these barriers but is often overlooked due to lack of compliance with privacy legislation and community-based care (Beardwood, 2015;Davidson et al., 2016;Dyke et al., 2016;Geist, 2016;Joffe, 2010;). For instance, the failure to provide individualized accommodations YADD need to exercise their rights and receive support for their decisionmaking due to low literacy as well as communication, comprehension, and visual difficulties surfaced consistently through this review (CACL, 2011;Joffe, 2010;Larivie're-Bastien, & Racine, 2011;Repetto et al., 2008;Yalon-Chamovitz, 2009). Similarly, a lack of support to better prepare YADD during this transition period was identified as a major vehicle for YADD to become more empowered in exercising their information privacy rights (Davidson et al., 2016;Joffe, 2010;Larivie're-Bastien, & Racine, 2011;Repetto et al., 2008). Finally, socioeconomic issues were cited as barriers to utilization of privacy rights, in that fees make it difficult for YADD and their families to make corrections to their personal information files (CACL, 2011;Laverie-Bastien, & Racine, 2011;Urowitz et al., 2008).
In connection with the findings reviewed, we recommend the following three areas that need to be addressed by privacy commissioners and organizations supporting young adults with developmental disabilities. First, and foremost, awareness, knowledge, and skills need to be raised among organizational staff, families, and YADD. In this way, self-advocacy will occur more frequently, and families will be included in the YADD's core support and privacy rights education in their high school curriculum. Second, promotion of information privacy legislation through education for organizational staff is required. In particular, implementation of manuals with specific guidelines instructing staff with strategies to use the privacy legislation is suggested. Finally, targeted translation of existing legislation that will allow more YADD and their families to exercise their privacy of information rights is recommended.

Limitations
This review has some limitations. Our literature search was limited to articles focusing on privacy legislation and developmental disabilities, and this search strategy may have contributed to excessively narrow range of articles included. Several exceptions for inclusion were established to capture relevant articles and to make it possible to broaden the capture of relevant barriers and facilitators also relevant to YADD. The articles differed not only in their objectives and methodology or type of article, but also showed great heterogeneity in approach to considering the issue of privacy of information rights. While quality was consistently high (such as representative samples, standardized tools, in depth policy discussion), the total number of empirical studies was very few (n = 6). It is important that future studies examine public understanding of privacy rights and pathways to accessing tools to exercise privacy rights. Finally, the presentation of our findings in Fig. 2 (Conceptual Framework: Determinants of Privacy of Personal Information Rights for YADD) presents a systems perspective. Our interpretation of our findings is influenced by this perspective.

Conclusion
In this scoping review, 24 peer-reviewed articles and 23 articles from the gray literature were identified which examined the barriers and facilitators for access and utilization of information privacy rights in relation to the needs of young adults with developmental disabilities and their families. A basic requirement in protecting individual privacy rights is informing people of their rights so they know when a violation has occurred and how it can be remedied. This becomes a challenge to organizations trying to support families and their YADD as communication and information sharing can be complicated, often requiring accommodations or supports for the decision-making. The implications of the challenges typically experienced by YADD are tremendous, especially for providing support for provision of consent and decision-making to ensure ensuring confidentiality and autonomy throughout the protection of personal information privacy (Joffe, 2010). Although some parallels can be made with elderly citizens or persons with physical disabilities, important and distinct differences exist for YADD whose chronological age indicate adult, but who may not have sufficient decision-making capacity, and, more often than not, may be restricted as a result of their mode of communication or literacy level. By the time the potential privacy breach is voiced, or even recognized, young adults with developmental disabilities may have already lost some of their privacy rights in the process. For this reason, and because existing privacy legislation exists, the present review suggests that increasing awareness, education, and knowledge translation tools for all involved, especially YADD, family caregivers, and service providers, will help to combat the disadvantage in exercising information privacy rights by young adults with developmental disabilities.