English law is full of fantastical creatures. Pride of place goes to the Reasonable Man who is, by all accounts, an ordinary and prudent person, who is bowler-hatted and most commonly found on the Clapham omnibus.
He gets everywhere (he has cousins on the Bondi tram and the Shau Kei Wan tram). He is free from over-apprehension and from over-confidence. He provides a neutral standard that assists the bemused lawyer to assess whether or not any particular act is negligent.
Contract lawyers know the Officious Bystander well. He occasionally interrupts proceedings to suggest terms for inclusion in contracts which are so obvious that they can be implied and do not need to be stated.
There is the Informed User who is something more than a consumer, knowing a fair bit about the existing design corpus but who is most definitely not an expert in the field. He helps us to establish the boundaries of individual character in registered designs. Or there is his close friend from the world of patents, the Person Skilled In The Art (aka the Nerd With No Imagination). He is widely read in his field but has no imagination. If he wouldn’t have thought of it, an invention satisfies the requirement of novelty necessary for the grant of a patent.
Less impressive is the Moron In A Hurry. If two items are so different that they would not confuse even the Moron In A Hurry then there is no confusion and no passing off or trade mark infringement.
There is now another character to add to the fold: the Motivated Intruder.
The Information Commissioner’s Office highlighted his existence in November 2012, although some sightings date back to 2008. He (or quite possibly she) has been quietly permeating the vexed topic of effective anonymisation. This is more interesting than it sounds and currently matters a great deal to academic researchers although I predict it will soon matter just as much to insurance companies.
Under UK law, information about a living and identifiable person can only be processed in accordance with the terms of the Data Protection Act. To generalise, if you don’t have the individual’s consent (informed and freely given), you can’t use their data. This is an issue for researchers keen to use the huge repository of data collected by the National Health Service (NHS). The NHS holds a treasure trove of useful information but it was collected for clinical care purposes, not for research. Obtaining individual consent permitting personal data to be used for research purposes just isn’t practical. Cue much gnashing of academic teeth at the wasted opportunity. But there is hope. If the data is anonymous, it does not qualify as personal data and the restrictions of the Data Protection Act fall away.
Consent is not necessary in order to perform the act of anonymising personal data. However, the question that now looms is just how anonymous information has to be to ensure that it is no longer classed as personal data. The Data Protection Act is concerned with the likelihood of re-identification rather than with the possibility. It boils down to needing to know whether any given method of anonymisation renders the information so secure that it is not reasonably likely that individuals, even individuals with rare medical conditions living in sparsely populated regions, will be re-identified.
This character has no prior knowledge but wants to identify an individual from an anonymised dataset. The Motivated Intruder is competent, has access to resources such as the internet and public documents, and, will take all reasonable steps to try to re-identify an individual from the anonymised dataset. But the Motivated Intruder does not have specialist skills and will not break the law. He sits somewhere between the inexpert member of the public and the skilled specialist. If the statistical method used would defeat the Motivated Intruder then the data can be treated as anonymous and used with confidence by the researcher.
Unfortunately, the Motivated Intruder is still a youngster. There are few examples of his work. In some cases, it has been enough to defeat the Motivated Intruder to redact certain aspects of the dataset such as the dates and locations of medical incidents. In others the likelihood of identification was low enough that statistical information relating to same sex adoption and (in a separate case) to school entrance exams was effectively anonymised and could be released. In another case, the raw data from a clinical trial could not be effectively anonymised and therefore should not be released. There are questions that remain to be answered: just how hard will the Motivated Intruder try? What sort of information does the Motivated Intruder care most about? How much embarrassment or anxiety can the individual who is identified be expected to tolerate?
As time goes on and the Motivated Intruder is cited (sighted… geddit? Unfortunately, yes. Ed) more often so we will have a clearer picture and so researchers can proceed with greater confidence.
In fact, the Motivated Intruder has the potential to play a starring role in an information debate coming to your screens in the very near future. The care.data project has been put on ice because of growing public concern that anonymised health data could find its way into the hands of unscrupulous insurance companies who would promptly and easily re-identify it and use it to push our premiums up. Time to call for the Motivated Intruder to restore public confidence? Or is it too late for that? The Motivated Intruder focuses on the likelihood of re-identification. Public opinion might well be focussed on the possibility of re-identification.
PS IP Draughts is curious to know if there are any other fictional legal characters, not mentioned above, in readers’ jurisdictions. He wonders whether the woman on the Edinburgh tram could be a candidate. Please let us know via this blog’s comments.