6.2 Privacy, confidentiality, security, and ethics

These concepts overlap but are not interchangeable.

Privacy concerns appropriate treatment of information about people. Confidentiality concerns the duty to prevent unauthorized disclosure. Security concerns the controls used to protect information, such as permissions, encryption, approved storage, and secure transfer. Ethics asks whether the use is fair, responsible, and consistent with the interests of affected people, even when the use is technically permitted.

For example, a dataset may be stored securely but used for a purpose that participants did not reasonably expect. Alternatively, an analysis may have a legitimate purpose but be disclosed through a chart that reveals a small or distinctive group. Responsible practice requires attention to all four areas.