"Why does consent even need to be assumed?"

Because the government knows full well that express consent would rarely be given, so it uses the oxymoron of "assumed consent".

Newsflash: if it's assumed, it isn't consent.

If you want access to my medical data, pay my practice manager to ASK my permission to join your medical experiment. Then pay me to participate.

Icon as a reward to you and as a metaphor for why you can not assume consent.

Absolutely this.

Anyone working with datasets knows that anonymised data can easily be de-anonymised. The higher the level of detail in a dataset, the easier it is to find unique points that can trace back to individuals.

I can accept that certain treatments will vary and have different effects depending on the approximate age, sex* and race of the patient, together with other existing health conditions. I simply do not believe that there are such large differences between people that treatments need to be targeted more individually than that.

*I advisedly use 'sex', of which there are only 2 as opposed to 'gender', since I highly doubt that gender has any relevance to different outcomes of treatments / medications etc

>Anyone working with datasets knows that anonymised data can easily be de-anonymised. The higher the level of detail in a dataset, the easier it is to find unique points that can trace back to individuals.

This. And the fact that datasets can be combined and once they are, what appeared "securely" anonymous in only one of them may not remain so after the data is combined.

Assumed consent is only achievable if you have trust. Governments and society rarely have those at a sufficient level for this to work.

The bigger point here though, I think, is that assumed consent is a short term measure anyway.

The way data is handled is going to change radically over the next 5-10yrs.

I found this article fascinating: https://www.theregister.com/2021/10/04/column_data_privacy/

It points the way to the future of consent.

I trust the current government in only one specific area: I trust them to act purely in their own interest with flagrant disregard for the needs of wider society beyond doing just enough to get themselves re-elected.

Trust is a major issue here and many governments of differing hues and nationalities have repeatedly abused the trust of their people. The juxtaposition of the opening of this debate with the reporting of the warning from England's Data Guardian on wider police access to NHS data was incredible [almost smacks of editorial mischief].

The repeated violations of peoples data privacy is compounded by a lack of meaningful "holding to account" of offenders. Too often it seems that it is a case of publishing a "privacy is our highest priority" statement before returning to business as usual.

The medical business does have a long-established ethics infra-structure but it is not perfect and cannot ensure absolute integrity - individuals/companies can violate ethical rules as easily as they violate other laws. What sanctions there are can punish those found guilty - but cannot make good all the harm that has been done.

That should mean we should carefully consider the harm that could be done by sharing data vs the benefits that can be gained, and who is going to suffer that harm vs who is going to benefit. It will be a trade-off between individual rights and societal benefits - but it needs to be an equitable trade-off. It would be interesting to hear from various ethics bodies on the subject of ethical sharing of medical data.

Information and Data Technology are rapidly changing the privacy landscape, some consider that personal privacy will be totally lost. Many [the majority?] seem either ignorant or blasé about it.

I don't think medical privacy should be spear-heading this change, but it seems perverse to deny potential benefits to society by holding onto a concept of privacy that might no longer exist. How many, on receiving bad news from their GP would be Googling for information - so who now has what information.

I don't welcome it, but I am not sure the medical profession, researchers or even pharmaceutical companies are the worst here [individual cases excepted].

Insatiated big pharma industry will corrupt any government to get access to data.

The problem is that big pharma wants patients to be dependent on their drugs, in their interest is to have people take as much expensive meds as they possibly fit in their mouth every few hours.

They don't have any incentives to create a cure.

It's not just big pharma - many industries shift to subscription models where you have to pay for the product every month in order to use it.

Big pharma wants you to take their pills in order to live.

They need this data to see what demographics they can exploit and which illnesses could yield the most profit.

Please DO NOT change the headline used for each part of the debate because that just adds confusion, the more so as the original subject is not visible in this post until after you've voted For or Against.

Ideally the first three lines on each of the four propositions would be:

PROPOSITION BEING DEBATED - This exact same wording appears in all four parts

Headline for the next debater's argument

Debater's name

and the main proposition should be repeated at the top of the 'vote now' box.

" Claims that prior informed consent is just “too difficult” or “too burdensome” self-interestedly disregard people’s lawful rights to dissent or opt out. "

Entirely correct. This is another example of a clearly prevalent mind set that advocates abandoning data subject rights in general in order to support (in the words of a recent DCMS request for comments) ' driving growth and unlocking innovation '. It sits very well alongside the current government proposal to repeal Article 22 of the GDPR, which provides for a data subject to require explanation and review of entirely automated decisions that have a material effect on their rights or freedoms. The result would be "computer says no" enshrined in law, with no route for redress.

It's become perfectly clear that 'digital progress' is more important than the people it's supposed to serve, quite possibly because it's a big bucks business that promises to make a few very rich people even richer. So it's being rushed ahead regardless of possible consequences. However, as I said in my submission to the RFC referred to above " Where lives and livelihoods are at stake, even in the name of progress the public can not legitimately be considered an involuntary test bed for systems development ".

While I largely agree with the arguments put here, I take issue with the phrase "mutant algorithm". It's meaningless rhetoric to use the word mutant there, and it originated from an attempt last year by the UK government to put the blame for their decisions on some "algorithm" as if it was beyond their control or that of the programmers who wrote it. The algorithm in question was not some uninterrogable machine learning model, but quite simply a choice to take teachers of small classes (private schools) at their word for predicted grades while thresholding results for large classes (state schools) at those of previous years. Talking about a mutant algorithm suggested some unforeseeable and incomprehensible consequence of computer programming beyond the government's control, when these were actually the entirely predictable consequences of fairly simple rules.

The phrases we unquestioningly adopt shape our thinking, and this is one to be rejected. Whatever the algorithm in question, it hasn't crawled out of the sea in some 50's B movie.

Health-related personal data is some of the most sensitive personal data there is and, in the majority of cases, unlike a leaked phone number or bank account details, it is data that cannot be changed.

Some of the risks to personal data include:

- anonymisation of data is hard to perform correctly, especially in a health context where for example certain medical conditions might be 'rare' enough to defeat any anonymisation attempts. Also some (much?) medical research cannot work with anonymous data and rather requires pseudonymised data. So you are relying on the competence and willingness of organisations to anonymise or pseudonymise personal data correctly, especially in the case of pseudonymisation where the org in question may not understand the 'trackability' of particular items of personal data and so leave them present/unaltered in any 'pseudonymised' data they create.

- even if organisations implement proper data security (which is in of itself questionable) there still remains the risk of data breaches

- once personal data is shared there is a loss of control over that data (at least by the data subject themselves, if not by other orgs) from that point onwards. If the recipient org(s) later decide to change what they do with the personal data then its realistically too late (for the individual) to do anything about it. The same applies in the case of anonymised data (which is *not* personal data) - if, for sake of argument, I don't agree with animal testing and an org who receives my anonymised data stated at the time they do not test on animals I may be happy for my data to be used to create their anonymous dataset but if that org later decides to start animal testing there is nothing I can do. Any Privacy Notices or other policy documents reflect a particular point in time and do not reflect on any future intentions.

- inadequate enforcement of data protection law which means that many organisations do not take the laws seriously (or even consider them at all) as the risk of being "caught" is low, the risk of enforcement action is lower, and the risk of a substantial fine or action taken against individuals is even lower.

So as someone who has worked in 'enterprise'/largescale IT for his whole career "I've seen things you people wouldn't believe" (https://en.wikipedia.org/wiki/Tears_in_rain_monologue) and so I am reluctant for my most sensitive personal data to be at risk of either accidential or purposeful misuse, a risk that increases greatly as more organisations have access to it.

With this mind I do not agree with opt-out scenarios for health data - I have already suffered from unlawful processing of my health data in the past due to this: healthcare systems were launched where allegedly letters where sent out notifying of a cut-off date for opting out and I never received the letters and so was unable to opt-out in time to prevent my health data being shared against my wishes (and also in breach of data protection law).