This essay examines issues involving personal privacy and informed consent that arise at the intersection of information and communication technology and population genomics research. I begin by briefly examining the ethical, legal, and social implications program requirements that were established to guide researchers working on the Human Genome Project. Next I consider a case illustration involving deCODE Genetics, a privately owned genetics company in Iceland, which raises some ethical concerns that are not clearly addressed in the current ELSI guidelines. The (...) deCODE case also illustrates some ways in which an ICT technique known as data mining has both aided and posed special challenges for researchers working in the field of population genomics. On the one hand, data-mining tools have greatly assisted researchers in mapping the human genome and in identifying certain “disease genes” common in specific populations. On the other hand, this technology has significantly threatened the privacy of research subjects participating in population genomics studies, who may, unwittingly, contribute to the construction of new groups that put those subjects at risk for discrimination and stigmatization. In the final section of this paper I examine some ways in which the use of data mining in the context of population genomics research poses a critical challenge for the principle of informed consent, which traditionally has played a central role in protecting the privacy interests of research subjects participating in epidemiological studies. (shrink)

This essay critically examines some classic philosophical and legal theories of privacy, organized into four categories: the nonintrusion, seclusion, limitation, and control theories of privacy. Although each theory includes one or more important insights regarding the concept of privacy, I argue that each falls short of providing an adequate account of privacy. I then examine and defend a theory of privacy that incorporates elements of the classic theories into one unified theory: the Restricted Access/Limited Control (RALC) theory of privacy. Using (...) an example involving data-mining technology on the Internet, I show how RALC can help us to frame an online privacy policy that is sufficiently comprehensive in scope to address a wide range of privacy concerns that arise in connection with computers and information technology. (shrink)

Recent scholarship in philosophy, law, and information systems suggests that respecting privacy entails understanding the implicit privacy norms about what, why, and to whom information is shared within specific relationships. These social contracts are important to understand if firms are to adequately manage the privacy expectations of stakeholders. This paper explores a social contract approach to developing, acknowledging, and protecting privacy norms within specific contexts. While privacy as a social contract—a mutually beneficial agreement within a community about sharing and using (...) information—has been introduced theoretically and empirically, the full impact on firms of an alternative framework to respecting the privacy expectations of stakeholders has not been examined. The goal of this paper is to examine how privacy norms develop through social contract’s narrative, to redescribe privacy violations given the social contract approach, and to critically examine the role of business as a contractor in developing privacy norms. A social contract narrative dealing specifically with issues of privacy is an important next step in exploring a social contract approach to privacy. Here, the narrative is used to explain to analyze the dynamic process of privacy norm generation within particular communities. Based on this narrative, individuals within a given community discriminately share information with a particular set of obligations in mind as to who has access to the information and how it will be used. Rather than giving away privacy, individuals discriminately share information within a particular community and with norms governing the use of their information. Similar to contractual business ethics’ impact on global commerce in explaining how and why norms vary across global contexts, the social contract approach to privacy explains how and why norms vary across communities of actors. Focusing on agreements around privacy expectations shifts the responsibility of firms from adequate notification to the responsibility of firms as contractors to maintain a mutually beneficial and sustainable solution. (shrink)

The cluster of concerns usually identified asmatters of privacy can be adequately accountedfor by unpacking our natural rights to life,liberty, and property. Privacy as derived fromfundamental natural rights to life, liberty,and property encompasses the advantages of thecontrol and restricted access theories withouttheir attendant difficulties.

The primary theme of this paper is the normative case against ownership of one's genetic information along with the source of that information (usually human tissues samples). The argument presented here against such “upstream” property rights is based primarily on utilitarian grounds. This issue has new salience thanks to the Human Genome Project and “bio-prospecting” initiatives based on the aggregation of genetic information, such as the one being managed by deCODE Genetics in Iceland. The rationale for ownership is twofold: ownership (...) will protect the basic human rights of privacy and autonomy and it will enable the data subjects to share in the tangible benefits of the genetic research. Proponents of this viewpoint often cite the principle of genetic exceptionalism, which asserts that genetic information needs a higher level of protection than other kinds of personal information such as financial data. We argue, however, that the recognition of such ownership rights would lead to inefficiency along with the disutility of genetic discoveries. Biomedical research will be hampered if property rights in genes and genetic material are too extensive. We contend that other mechanisms such as informed consent and strict confidentiality rules can accomplish the same result as a property right without the liabilities of an exclusive entitlement. (shrink)

A growing body of theory has focused on privacy as being contextually defined, where individuals have highly particularized judgments about the appropriateness of what, why, how, and to whom information flows within a specific context. Such a social contract understanding of privacy could produce more practical guidance for organizations and managers who have employees, users, and future customers all with possibly different conceptions of privacy across contexts. However, this theoretical suggestion, while intuitively appealing, has not been empirically examined. This study (...) validates a social contract approach to privacy by examining whether and how privacy norms vary across communities and contractors. The findings from this theoretical examination support the use of contractual business ethics to understand privacy in research and in practice. As predicted, insiders to a community had significantly different understandings of privacy norms as compared to outsiders. In addition, all respondents held different privacy norms across hypothetical contexts, thereby suggesting privacy norms are contextually understood within a particular community of individuals. The findings support two conclusions. First, individuals hold different privacy norms without necessarily having diminished expectations of privacy. Individuals differed on the factors they considered important in calculating privacy expectations, yet all groups had robust privacy expectations across contexts. Second, outsiders have difficulty in understanding the privacy norms of a particular community. For managers and scholars, this renders privacy expectations more difficult to identify at a distance or in deductive research. The findings speak directly to the needs of organizations to manage a diverse set of privacy issues across stakeholder groups. (shrink)