394
customer’s billing data (but allow release of aggregated deidentified billing data,
which minimizes risk and still allows substantial utility). Data utility underpins
need-to-know.
A closely corollary data ethics principle is that of Informed Consent, which is
written explicit consent granted by a private party to allow public release of private
data or its use for a specifically defined purpose. Informed consent requires that the
private party is reasonably capable of being informed and of granting consent based
on a description of the intended data use and its risks and benefits and that the consenting party is under no compulsion to do so. As a result, informed consent cannot
be granted in most cases by prisoners, citizens of autocracies and dictatorships,
children, and so on. Informed consent guarantees that the object of the study understands and agrees with the data ethics of those doing the data collection. Ethical
researchers are required to obtain informed consent before collecting new human
subjects (objects) data in most cases. Private businesses usually insist, by the habit
of legal counsel, that their customers grant informed consent to the use of all private
customer data as a precondition of doing business. As a result, large private businesses like McDonalds, Wal-Mart, or Aldi possess a great deal of precise customerlevel data about individuals’ food consumption, and this data is effectively the
property of the private business instead of the originating individual. Public energy
and water utilities have historically neglected to obtain informed consent, and are
therefore unable to release utility customer data.
Personally Identifiable Information (PII) is a distinct data protection categorization identifying some types of an individual person’s data as being explicitly covered by data privacy and data protection law. In the USA, HIPAA (health data) and
FERPA (student data) laws, along with utility customer billing data privacy laws,
are good examples of PII categorization. Utility customer data concerns an individual’s potable water, sewerage, natural gas, heating oil, or electricity usage. Safe
Harbor is a legal data protection against release of specifically named PII data, and
safe harbor principles apply unless a qualified expert determination is made that a
narrowly defined scope of data release does not create a significant risk of identification and/or harm to the person(s) involved in this specific context and application
of the data based on the data protection methods employed. Expert Determination
usually requires careful de-identification of PII data to remove the risk that an individual’s identity will be disclosed publicly, while simultaneously maintaining the
utility of the data for the specifically proposed application.
If you want to access private data such as a customer’s or business’s food consumption or water or energy usage, you need to ask the private party for informed
content and release of that data. If you want to access categorized public data such
as health records, student records, precise infrastructure data, or utility customer
billing data for energy or water usage, you will need to apply and satisfy the authorities’ ethical and legal concerns regarding your need-to-know and your expert determination that your methods of data collection and use favorably balance risk against
benefit to the objects of the data (and then additionally you must overcome the
security through obscurity). If you want to access classified data, you need to enter
B. L. Ruddell
customer’s billing data (but allow release of aggregated deidentified billing data,
which minimizes risk and still allows substantial utility). Data utility underpins
need-to-know.
A closely corollary data ethics principle is that of Informed Consent, which is
written explicit consent granted by a private party to allow public release of private
data or its use for a specifically defined purpose. Informed consent requires that the
private party is reasonably capable of being informed and of granting consent based
on a description of the intended data use and its risks and benefits and that the consenting party is under no compulsion to do so. As a result, informed consent cannot
be granted in most cases by prisoners, citizens of autocracies and dictatorships,
children, and so on. Informed consent guarantees that the object of the study understands and agrees with the data ethics of those doing the data collection. Ethical
researchers are required to obtain informed consent before collecting new human
subjects (objects) data in most cases. Private businesses usually insist, by the habit
of legal counsel, that their customers grant informed consent to the use of all private
customer data as a precondition of doing business. As a result, large private businesses like McDonalds, Wal-Mart, or Aldi possess a great deal of precise customerlevel data about individuals’ food consumption, and this data is effectively the
property of the private business instead of the originating individual. Public energy
and water utilities have historically neglected to obtain informed consent, and are
therefore unable to release utility customer data.
Personally Identifiable Information (PII) is a distinct data protection categorization identifying some types of an individual person’s data as being explicitly covered by data privacy and data protection law. In the USA, HIPAA (health data) and
FERPA (student data) laws, along with utility customer billing data privacy laws,
are good examples of PII categorization. Utility customer data concerns an individual’s potable water, sewerage, natural gas, heating oil, or electricity usage. Safe
Harbor is a legal data protection against release of specifically named PII data, and
safe harbor principles apply unless a qualified expert determination is made that a
narrowly defined scope of data release does not create a significant risk of identification and/or harm to the person(s) involved in this specific context and application
of the data based on the data protection methods employed. Expert Determination
usually requires careful de-identification of PII data to remove the risk that an individual’s identity will be disclosed publicly, while simultaneously maintaining the
utility of the data for the specifically proposed application.
If you want to access private data such as a customer’s or business’s food consumption or water or energy usage, you need to ask the private party for informed
content and release of that data. If you want to access categorized public data such
as health records, student records, precise infrastructure data, or utility customer
billing data for energy or water usage, you will need to apply and satisfy the authorities’ ethical and legal concerns regarding your need-to-know and your expert determination that your methods of data collection and use favorably balance risk against
benefit to the objects of the data (and then additionally you must overcome the
security through obscurity). If you want to access classified data, you need to enter
B. L. Ruddell