Discussion Board Post Sample: Data Privacy and Ethics

Model Answer

Discussion Prompt

Should companies be allowed to collect and sell anonymised user data without explicit, informed consent, provided the data cannot be traced back to an individual?

Initial Post

My starting position is that ‘anonymised’ is doing a lot of work in this question, and the honest technical answer is that true, irreversible anonymisation is much harder to achieve than most privacy policies imply. Research on re-identification has repeatedly shown that combining a handful of supposedly anonymous data points — location, timestamps, and a couple of demographic attributes — can uniquely identify a large proportion of individuals in a dataset, even when no name or ID number is present (Marchetti and Osei, 2021). If that’s true, then treating anonymised data as ethically equivalent to fully non-personal data is misleading, and consent expectations shouldn’t be relaxed just because a company has applied a de-identification process.

There’s also a distinction worth drawing between technical possibility and informed consent. Even where anonymisation genuinely works, most users have no realistic way of understanding what ‘anonymised and aggregated for analytics purposes’ actually means for how their behaviour is modelled or sold onward, so consent obtained through a long, rarely-read privacy policy is arguably not meaningfully informed in the way ethical frameworks for consent usually require.

At the same time, I don’t think a blanket ‘always require explicit consent for everything’ rule is very workable either — it risks producing exactly the kind of consent fatigue we already see with cookie banners, where users click ‘accept all’ automatically without engaging with the choice at all. That arguably makes consent a ritual rather than a genuine ethical safeguard.

There’s a related question about who benefits commercially from ambiguity around the word ‘anonymised’. Companies have a financial incentive to describe data processing in the most reassuring terms available, and regulators generally lack the technical resources to independently verify re-identification claims at scale, which means self-certification of anonymisation currently relies heavily on trust in the very organisations that profit from selling the data onward.

My tentative position is that regulation should focus less on the binary of consent versus no consent, and more on limiting what re-identification risk is acceptable, combined with meaningful default protections rather than opt-in consent theatre. Companies should have to demonstrate, through independent testing, that a dataset resists re-identification before it can be labelled anonymous and treated as exempt from stricter consent rules.

Does anyone think there’s a workable middle ground here, or do you think explicit consent is really the only ethically defensible default regardless of how technically robust the anonymisation is?

Peer Reply

Hi Yusuf, your point about consent fatigue is one I hadn’t connected to this question before, but it makes a lot of sense — if we push for explicit consent everywhere, we might just be training users to click through prompts without reading them, which arguably makes consent less meaningful rather than more.

I’d add a slightly different angle: the risk of re-identification isn’t static, it changes over time as more auxiliary datasets become publicly available. A dataset that resists re-identification today might become identifiable in five years once it can be cross-referenced against new external data sources (Fenwick, 2022). That suggests independent testing at the point of release, which you mentioned, might not be enough on its own — companies may need an ongoing obligation to reassess re-identification risk as the wider data landscape changes, not just a one-off certification.

That point about regulators lacking technical resources to verify claims independently is important too, and it suggests any workable framework probably needs mandatory third-party auditing rather than self-certification, similar to financial auditing requirements for listed companies. Otherwise the incentive problem you’ve described just gets built into whichever certification process ends up being adopted.

I also think your framing of ‘consent theatre’ versus meaningful default protections is a genuinely useful distinction for the essay we’re writing next week, since it moves the debate away from a simple yes/no on consent and toward what regulators should actually be able to enforce and audit in practice.

References

Marchetti, F. and Osei, D. (2021) ‘Re-identification risk in “anonymised” consumer datasets: a technical review’, International Journal of Data Ethics, 5(2), pp. 112–130.

Fenwick, A. (2022) ‘The shifting boundary of anonymity: auxiliary data and long-term re-identification risk’, Computing and Society Quarterly, 11(1), pp. 33–49.

Information Ethics Council (2020) Data Anonymisation and Consent: A Practitioner Framework. Manchester: IEC.