1 Christopher Adam, Comment to What is the Meaning of ‘Barbarians at the Gate?’, Blurtit, http://references-definitions.blurtit.com/76895/what-is-the-meaning-of-barbarians-at-the-gate [https://perma.cc/4XWE-JE3E]

2 Id.

3 Michael, J. Madison, Commons at the Intersection of Peer Production, Citizen Science, and Big Data: Galaxy Zoo, in Governing Knowledge Commons 209, 215 (Brett, M. Frischmann et al. eds., 2014)Google Scholar.

4 Id. at 215, 228-29 (describing the success of Galaxy Zoo, which involved citizen volunteers in the effort of classifying galaxies).

5 Federal Policy for the Protection of Human Subjects, 80 Fed. Reg. 53,933, 53,938 (proposed Sept. 8, 2015) (characterizing a shift in research activities to include more informational studies that rely on data and biospecimens, in contrast to clinical studies).

6 Greenberg v. Miami Children's Hosp. Research Inst., 264 F. Supp.2d 1064, 1066-67 (S.D. Fla. 2003).

7 Federal Policy for the Protection of Human Subjects, 80 Fed. Reg. at 53,943.

8 Greenberg, 264 F. Supp. 2d at 1067.

9 Id. at 1068 (“Plaintiffs allege that at no time were they informed that Defendants intended to seek a patent on the research. Nor were they told of Defendants' intentions to commercialize the fruits of the research ….”).

10 See, e.g., Grayson Norquist, Patient-Driven Research Will Lead to Better Health, Health Aff. Blog (May 19, 2016), http://healthaffairs.org/blog/2016/05/19/patient-driven-research-will-lead-to-better-health/ [https://perma.cc/3DHS-CHMZ] (describing how the Patient-Centered Outcomes Research Institute (PCORI) has focused on research that is “patient-driven” and “patient-centered” by “involving patients, caregivers, clinicians, payers, industry, and other health care stakeholders throughout the research process”).

11 See, e.g., Patient-Centered Outcomes Research, PCORI (Nov. 7, 2013), http://www.pcori.org/research-results/patient-centered-outcomes-research [https://perma.cc/6TZ3-KK6B].

12 See, e.g., David, I. Shalowitz & Franklin, G. Miller, Disclosing Individual Results of Clinical Research: Implications of Respect for Participants, 294 JAMA 737, 737-40 (2005)Google Scholar(discussing the importance of returning individual research results to participants in clinical research).

13 See Mark, A. Hall & Kevin, A. Schulman, Ownership of Medical Information, 301 JAMA 1282, 1283–84 (2009)Google Scholar (discussing advantages of patient-controlled longitudinal health records and suggesting that one way to foster the development of such records would be to “give patients the rights to sell access to their records, rights that are superior to the property rights held by [entities that currently hold patients' data]”); see also Mark, A. Hall, Property, Privacy, and the Pursuit of Interconnected Electronic Medical Records, 95 Iowa L. Rev. 631, 651 (2010)Google Scholar [hereinafter Hall, Property] (“[I]f patients were given ownership of their complete medical treatment and health histories, they could license to compilers their rights to that information in a propertized form that could be more fully developed and commercialized.”); see also Eric, M. Meslin & Peter, H. Schwartz, How Bioethics Principles Can Aid Design of Electronic Health Records to Accommodate Patient Granular Control, 30 J. Gen. Internal Med. S3, S5-6 (2014)Google Scholar (discussing granular consent).

14 See discussion infra at note 43 and accompanying text.

15 See generally Frank Pasquale, The Black Box Society: The Secret Algorithms that Control Money and Information (2015) (discussing modern data-mining practices that generate health-related information about consumers). See also Panopticon, The Oxford Dictionary of English Etymology (1966) (“[Jeremy] Bentham's name for a circular prison in which warders could at all times observe their prisoners ….”).

16 Pasquale, supra note 15, at 28-32.

17 Effy Vayena & Urs Gasser, Between Openness and Privacy in Genomics, 13 PLOS Med. at 1 (Jan. 12, 2016).

18 Berris Charnley, People Powered Science, Constructing Sci. Communities (May 14, 2015), https://conscicom.org/2015/05/14/people-powered-science/ [https://perma.cc/SQS7-HCMP].

19 Nat'l Med. Device Evaluation Sys. Planning Bd., The National Evaluation System for Health Technology (NEST): Priorities for Effective Early Implementation 27 (2016), https://healthpolicy.duke.edu/sites/default/files/atoms/files/NEST%20Priorities%20for%20Effective%20Early%20Implementation%20September%202016_0.pdf [https://perma.cc/C52T-LKZ8].

20 See discussion infra Part 2.

21 See Lawrence O. Gostin, Public Health Law 4 (2d ed. 2008) (describing public health as including population-oriented (as opposed to patient-specific) efforts “to ensure the conditions for people to be healthy” and “to pursue the highest possible level of physical and mental health in the population, consistent with the values of social justice”); Paul J. Amoroso & John P. Middaugh, Research vs. Public Health Practice: When Does a Study Require IRB Review?, 36 Preventive Med. 250, 250 (2003) (offering, as examples public health activities, tracking communicable diseases, investigating disease outbreaks, and collecting personal data to protect public health).

22 See Advancing Regulatory Science: Moving Regulatory Science Into the 21^st Century, FDA (last updated May 24, 2016), http://www.fda.gov/ScienceResearch/SpecialTopics/RegulatoryScience/default.htm?utm_campaign=Goo [https://perma.cc/4JW9-E9JW].

23 The Precision Medicine Initiative, White House, https://www.whitehouse.gov/precision-medicine [https://perma.cc/NYH9-7GPV].

24 See BRAIN Initiative, White House (Sept. 30, 2014), https://www.whitehouse.gov/share/brain-initiative [https://perma.cc/JK2B-8HZP].

25 Press Release, White House Office of the Press Sec'y, Fact Sheet: Investing in the National Cancer Moonshot (Feb. 1, 2016), https://www.whitehouse.gov/the-press-office/2016/02/01/fact-sheet-investing-national-cancer-moonshot [https://perma.cc/Y4NY-6YSX].

26 See Public Workshop - Use of Databases for Establishing the Clinical Relevance of Human Genetic Variants, FDA (Nov. 13, 2015), http://www.fda.gov/medicaldevices/newsevents/workshopsconferences/ucm459450.htm [https://perma.cc/6UPG-RHQD]. See also Barbara J. Evans, Wylie Burke & Gail P. Jarvik, The FDA and Genomic Tests - Getting Regulation Right, 372 New Eng. J. Med. 2258, 2259 (2015).

27 Leighanne Olsen, Dara Aisner & J. Michael Mcginnis, Inst. of Med., The Learning Healthcare System: Workshop Summary (IOM Roundtable on Evidence-Based Medicine) 3, 6 (2007).

28 See generally Brian, H. Shirts et al., Large Numbers of Individuals Are Required to Classify and Define Risk for Rare Variants in Known Cancer Risk Genes, 16 Genetics in Med. 529 (2014)Google Scholar (discussing the size of data resources required to draw inferences about the clinical significance of rare genetic variants).

29 Press Release, White House Office of the Press Sec'y, Fact Sheet: Obama Administration Announces Key Actions to Accelerate Precision Medicine Initiative (Feb. 25, 2016), at https://www.whitehouse.gov/the-press-office/2ea016/02/25/fact-sheet-obama-administration-announces-key-actions-accelerate [https://perma.cc/ZBH3-D843].

30 Barbara, J. Evans, Much Ado About Data Ownership, 25 Harv. J.L. & Tech. 69, 90 (2011)Google Scholar.

31 Id.

32 Id. at 93-94. Note that while there are algorithms that can link incoming streams of data that lack identifiers, such linkages are probabilistic. The resulting longitudinal record for an individual may contain errors if incoming data have been erroneously inferred to belong to that individual.

33 See FTC, Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers 35–38 (Dec. 2010) (warning that the distinction between personally identifiable information and non-identifiable information is increasingly irrelevant in light of the potential for data to be re-identified); Paul, Ohm, Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization, 57 UCLA L. Rev. 1701, 1706 (2010)Google Scholar (discussing the risks to individual privacy if de-identified data were to be re-identified); Mark, A. Rothstein, Is Deidentification Sufficient to Protect Health Privacy in Research?, 10 Am. J. Bioethics 3, 5 (2010)Google Scholar (“Despite using various measures to deidentify health records, it is possible to reidentify them in a surprisingly large number of cases ….”).

34 See Ohm, supra note 33, at 1724-25; Rothstein, supra note 33, at 5-6.

35 Evans, supra note 30, at 95-96.

36 Id.

37 See generally David, Casarett et al., Bioethical Issues in Pharmacoepidemiologic Research, in Pharmacoepidemiology 587, 593-94 (Brian, L. Strom ed., 4th ed. 2005)Google Scholar; Comm. on Health Research & the Privacy of Health Info.: The HIPAA Privacy Rule, Inst. of Med., Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research 209-14 (Sharyl J. Nass et al. eds., 2009) [hereinafter IOM, Privacy Report] http://www.nap.edu/catalog/12458.html [https://perma.cc/2PJG-K7SP] (surveying studies of consent and selection bias); Brian Buckley et al., Selection Bias Resulting from the Requirement for Prior Consent in Observational Research: A Community Cohort of People with Ischaemic Heart Disease, 93 HEART 1116 (2007); Khaled, El Emam et al., A Globally Optimal k-Anonymity Method for the De-Identification of Health Data, 16 J. Am. Med. Informatics Ass'n 670, 670 (2009)Google Scholar; Steven, J. Jacobsen et al., Potential Effect of Authorization Bias on Medical Record Research, 74 Mayo Clinic Proc. 330 (1999)Google Scholar; Jack, V. Tu et al., Impracticability of Informed Consent in the Registry of the Canadian Stroke Network, 350 New Eng. J. Med. 1414 (2004)Google Scholar; Steven, H. Woolf et al., Selection Bias from Requiring Patients to Give Consent to Examine Data for Health Services Research, 9 Archives Fam. Med. 1111 (2000)Google Scholar.

38 Audio Recording: Toby Bloom, Deputy Director, Bioinformatics, N.Y. Genome Ctr., Next Generation Sequencing and Bioinformatics: A Researcher's Perspective, Remarks at the American Association of Law Schools Annual Conference, BioLaw Section (Jan. 8, 2016), https://soundcloud.com/aals-2/biolaw-co-sponsored-by-law-medicine-and-health-care/s-BDCUD [https://perma.cc/7GES-CSWC].

39 Id.

40 Id.

41 Protection of Human Subjects, 45 C.F.R. pt. 46 (2015). On January 19, 2017, HHS and other Common Rule agencies published a final rule revising the Common Rule. See Federal Policy for the Protection of Human Subjects, 82 Fed. Reg. 7149 (Jan. 19, 2017). These revisions, unless further altered or revised by the incoming Administration, are scheduled to become effective on January 19, 2018. These Common Rule revisions do not address, and in some cases will tend to amplify, the central concerns explored in this Article.

42 Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (2012) (codified as amended in scattered sections of 18, 26, 29 and 42 U.S.C.); see HIPAA Privacy Rule, 45 C.F.R. pts. 160, 164 (2015).

43 See Evans, supra note 30, at 82-86 (discussing nonconsensual access pathways under the Privacy Rule and the current Common Rule that will remain in effect through January 19, 2018). See also Protection of Human Subjects, 82 Fed. Reg. at 7150 (noting that the final Common Rule revisions slated to become effective in January 2018 did not adopt restrictive proposals that would have treated research with nonidentified biospecimens as subject to the Common Rule, requiring consent, nor did the final rule adopt the most restrictive proposals relating to consent for identifiable private information and identifiable biospecimens). The final rule will, however, prohibit IRBs from waiving informed consent if individuals have been asked for, and have declined to provide, broad consent to the storage and maintenance for secondary research use of their identifiable private information or identifiable biospecimens. See id. at 7226, 7267 (continuing to allow waivers for unconsented use of identifiable data and biospecimens, even under the revised Common Rule, if broad individual consent has not previously been sought and refused).

44 See IOM, Privacy Report, supra note 37, at 81-82 (discussing the results of a survey showing a “majority of respondents were not comfortable with their health information being provided for health research except with notice and express consent”).

45 See generally id. at 82; Leonard, J. Kish & Eric, J. Topol, Unpatients—Why Patients Should Own Their Medical Data, 33 Nature Biotechnology 921, 921-24 (2015)Google Scholar (discussing individuals' willingness to participate in research); Eric, J. Topol, The Big Medical Data Miss: Challenges in Establishing an Open Medical Resource, 16 Nature Revs. 253 (2015)Google Scholar (discussing individuals' willingness to participate in medical research as long as there are sufficient privacy safeguards); Health Data Exploration Project, Personal Health Data for the Public Good: New Opportunities to Enrich Understanding of Individual and Population Health (2014), http://hdexplore.calit2.net/wp-content/uploads/2015/08/hdx_final_report_small.pdf [https://perma.cc/229B-B3FB] (discussing the willingness of individuals to contribute non-traditional forms of PHD for use in research).

46 IOM, Privacy Report, supra note 37, at 82.

47 See supra notes 32-34 and accompanying text.

48 See generally Barbara, J. Evans, The First Amendment Right to Speak About the Human Genome, 16 U. Pa. J. Const. L. 549 (2014)Google Scholar (discussing and criticizing IRB-imposed restrictions on return of results from research),

49 Common Rule Waiver Provision, 45 C.F.R. § 46.116(d) (2015); HIPAA Waiver Provision, 45 C.F.R. § 164.512(i) (2015).

50 See Carl, H. Coleman, Rationalizing Risk Assessment in Human Subject Research, 46 Ariz. L. Rev. 1, 13–17 (2004)Google Scholar (discussing procedural informality of the Common Rule).

51 See Kish & Topol, supra note 45, at 923.

52 Id.

53 See, e.g., Hall, Property, supra note 13, at 651 (discussing such a scheme).

54 See, e.g., Marc, A. Rodwin, Patient Data: Property, Privacy & the Public Interest, 36 Am. J.L. & Med. 586, 593 (2010)Google Scholar (proposing such a scheme).

55 See discussion infra.

56 Health Data Exploration Project, supra note 45, at 12.

57 Id.

58 Kish & Topol, supra note 45, at 922.

59 See discussion infra.

60 Lily Hay Newman, Obama Says People Who Give Genetic Samples for Research Should Own the Data, Slate (Feb. 26, 2016), http://www.slate.com/blogs/future_tense/2016/02/26/at_precision_medicine_initiative_summit_obama_says_people_own_their_genetic.html [https://perma.cc/JG72-R7W9].

61 Id.

62 See, e.g., Elinor Ostrom, Governing the Commons: The Evolution of Institutions for Collective Action (1990) (examining natural resource commons); Carol Rose, The Comedy of the Commons: Custom, Commerce, and Inherently Public Property, 53 U. Chi. L. Rev. 711 (1986) (elaborating the role of commons in property theory more generally).

63 Cf. Brett M. Frischmann et al., Governing Knowledge Commons, in Governing Knowledge Commons, supra note 2, at 1-3 (describing a wide variety of commons arrangements and emphasizing that “commons does not denote the resources, the community, a place, or a thing”).

64 Id.

65 Ostrom, supra note 62, at 50-51.

66 See Charlotte, Hess & Elinor, Ostrom, Introduction: An Overview of the Knowledge Commons, in Understanding Knowledge as a Commons: Theory and Practice 3, 4-7 (Charlotte Hess & Elinor Ostrom, eds., 2011)Google Scholar.

67 See Frischmann et al., supra note 63, at 7-8 (contrasting the domain of proprietary rights and the public domain).

68 Hess & Ostrom, supra note 66, at 13.

69 Id. at 16-18.

70 Frischmann et al., supra note 63, at 3.

71 See Ostrom, supra note 62.

72 Hess & Ostrom, supra note 66.

73 Frischmann et al., supra note 63, at 2.

74 Id.

75 See id. at 3 (“Knowledge commons” refers to “the institutionalized community governance of the sharing and, in some cases, creation, of information, science, knowledge, data, and other types of intellectual and cultural resources.”).

76 Evans, supra note 30, at 102-03.

77 President's Council of Advisors on Sci. & Tech., Exec. Off. of the President, Report to the President Realizing the Full Potential of Health Information Technology to Improve Healthcare for Americans: The Path Forward 1, 27, 39 (2010).

78 Sonia, M. Suter, Disentangling Privacy from Property: Toward a Deeper Understanding of Genetic Privacy, 72 Geo. Wash. L. Rev. 737, 751 (2004)Google Scholar.

79 Samuel, D. Warren & Louis, D. Brandeis, The Right to Privacy, 4 Harv. L. Rev. 193, 193 (1890)Google Scholar.

80 Vera, Bergelson, It's Personal but Is It Mine? Toward Property Rights in Personal Information, 37 U.C. Davis L. Rev. 379, 401-02 (2003)Google Scholar; Daniel, J. Solove, Conceptualizing Privacy, 90 Cal. L. Rev. 1087, 1092-1126 (2002)Google Scholar.

81 Bergelson, supra note 80, at 401 (quoting Raymond T. Nimmer, The Law of Computer Technology, ¶ 16.02, at 16-5 (2001)).

82 Walter, W. Miller Jr. & Maureen, A. O'Rourke, Bankruptcy Law v. Privacy Rights: Which Holds the Trump Card?, 38 Hous. L. Rev. 777, 786-87 (2001)Google Scholar (discussing transaction-generated data gathered without consumers' knowledge using “cookies” and related technology).

83 Paul, M. Schwartz, Internet Privacy and the State, 32 Conn. L. Rev. 815, 820 (2000)Google Scholar.

84 Bergelson, supra note 80, at 401-02.

85 See, e.g., Patricia, Mell, Seeking Shade in a Land of Perpetual Sunlight: Privacy as Property in the Electronic Wilderness, 11 Berkeley Tech. L.J. 1, 26-41 (1996)Google Scholar.

86 Evans, supra note 30, at 77.

87 Suter, supra note 78, at 804 (citing Jessica Litman, Information Privacy/Information Property, 52 Stan. L. Rev. 1283, 1297-98 (2000)).

88 See Bergelson, supra note 80, at 438; Evans, supra note 30, at 77-82; Jacqueline, Lipton, Information Property: Rights and Responsibilities, 56 Fla. L. Rev. 135, 165-75 (2004)Google Scholar.

89 Lipton, supra note 88, at 165-75 (emphasis added).

90 Margaret, Jane Radin, Property and Personhood, 34 Stan. L. Rev. 957, 958 (1982)Google Scholar (emphasis added).

91 Edella, Schlager & Elinor, Ostrom, Property-Rights Regimes and Natural Resources: A Conceptual Analysis, 68 Land Econ. 249, 250 (1992)Google Scholar.

92 Evans, supra note 30, at 79.

93 John, F. Hart, Land Use Law in the Early Republic and the Original Meaning of the Takings Clause, 94 Nw. L. Rev. 1099, 1102, 1107 (2000)Google Scholar (discussing historical uses of the state's police power to require owners to confer positive externalities on the community).

94 Thomas, W. Merrill, The Economics of Public Use, 72 Cornell L. Rev. 61, 66 (1986)Google Scholar.

95 See Robin, Paul Malloy & James, Charles Smith, Private Property, Community Development, and Eminent Domain, in Private Property, Community Development, and Eminent Domain 1, 8 (Robin, Paul Malloy ed., 2008)Google Scholar (discussing the public use requirement).

96 See, e.g., Kelo v. City of New London, 545 U.S. 469 (2005) (holding that the city's taking of private property for resale and redevelopment as an office park did not violate the Takings Clause); Poletown Neighborhood Council v. City of Detroit, 410 Mich. 894 (1981) (holding that exercise of eminent domain for neighborhood redevelopment was justified because the action was for the public good, irrespective of incidental private gain).

97 See Abraham, Bell, Private Takings, 76 U. Chi. L. Rev. 517, 522 (2009)Google Scholar (noting, “public ownership of … property is not a necessary companion to just and efficient takings”).

98 U.S. Const. amend. V.

99 Evans, supra note 30, at 79, 85-86. See supra note 43 for a discussion of how recent revisions to the Common Rule, which are scheduled to become effective on January 18, 2018, will affect the Common Rule's waiver provisions, if these revisions are implemented by the new Administration.

100 Id. at 81.

101 Pamela, Samuelson, Privacy as Intellectual Property?, 52 Stan. L. Rev. 1125, 1138-39 (2000)Google Scholar.

102 Suter, supra note 78, at 737.

103 Id. at 799-803.

104 See Samuelson, supra note 101, at 1136-37 (citing Kenneth C. Laudon, Markets and Privacy, 39 Comm. Acm 92 (1996)). See also Litman, supra note 87, at 1297-98; Suter, supra note 78, at 804.

105 Lipton, supra note 88, at 141.

106 Id. at 141-42.

107 Kish & Topol, supra note 45, at 922.

108 Id. at 922-23.

109 Id. at 921-23.

110 See, e.g., Mell, supra note 85, at 76.

111 Eric, R. Claeys, Takings, Regulations, and Natural Property Rights, 88 Cornell L. Rev. 1549, 1575 (2003)Google Scholar.

112 Bell, supra note 97, at 540-42.

113 Evans, supra note 30, at 73.

114 See Seth Axelrad, Am. Soc. L. Med. & Ethics, State Statutes Declaring Genetic Information to be Personal Property, http://www.aslme.org/dna_04/reports/axelrad4.pdf [https://perma.cc/3DSY-NSX7] (listing statutes of Alaska, Colorado, Florida, and Georgia that recognize individual property rights in genetic information). See also Ala. Stat. Ann. § 18.13.010(a)(2) (West 2016); Colo. Rev. Stat. Ann. § 10-3-1104.7(1)(a) (West 2016); Fla. Stat. Ann. §760.40(2)(a) (West 2016); Ga. Code Ann. § 33-54-1(1) (West 2016).

115 See, e.g., H.B. 1260, 87th Leg. Assemb., Reg. Sess. (S.D. 2012); H.B. 1220, 84th Leg. Sess. (Tex. 2015); H.B. 2110, 82nd Leg. Sess. (Tex. 2011).

116 Jennifer K. Wagner & Dan Vorhaus, On Genetic Rights and States: A Look at South Dakota and Around the U.S., Genomics L. Rpt., (Mar. 20, 2012), http://www.genomicslawreport.com/index.php/2012/03/20/on-genetic-rights-and-states-a-look-at-south-dakota-and-around-the-u-s/ [https://perma.cc/JX9U-NJ97].

117 David, L. Silverman, Data Security Breaches: The State of Notification Laws, 19 Intell. Prop. & Tech. L.J. 5, 8 (2007)Google Scholar.

118 See Susan, E. Gindin, Lost and Found in Cyberspace: Informational Privacy in the Age of the Internet, 34 San Diego L. Rev. 1153, 1195 n. 231 (1997)Google Scholar (listing several cases where courts have recognized patients' ownership of medical records).

119 David, A. DeMarco, Understanding Consumer Information Privacy in the Realm of Internet Commerce: Personhood and Pragmatism, Pop-Tarts and Six-Packs, 84 Tex. L. Rev. 1013 (2006)Google Scholar.

120 Id. at 1035-36.

121 Dwyer v. Am. Express Co., 652 N.E.2d 1351 (Ill. App. Ct. 1995).

122 Bergelson, supra note 80, at 412.

123 Res Nullius, Bouvier's Law Dictionary (6th ed.1856).

124 Barbara, J. Evans, Mining the Human Genome after Association for Molecular Pathology v. Myriad Genetics, 16 Genetics in Med. 504, 505 (2014)Google Scholar.

125 Silverman, supra note 117, at 8.

126 See Paul, M. Schwartz, Property, Privacy, and Personal Data, 117 Harv. L. Rev. 2056, 2076-94 (2004)Google Scholar (discussing conceptual difficulties in applying a regime of property rights to information in databases).

127 Silverman, supra note 117, at 8.

128 Schwartz, supra note 126, at 2092-93.

129 Rodwin, supra note 54, at 593.

130 Id. at 590-93.

131 Scott, R. Peppet, Regulating the Internet of Things: First Steps Toward Managing Discrimination, Privacy, Security, and Consent, 93 Tex. L. Rev. 85, 145 (2014)Google Scholar.

132 Id.

133 Hall, Property, supra note 13, at 646.

134 Rodwin, supra note 54, at 588.

135 Hall, Property, supra note 13, at 647.

136 Schlager & Ostrom, supra note 91, at 250-51.

137 Id. at 250.

138 Id.

139 2 William Blackstone, Commentaries 3 (Wayne Morrison ed., 2001) (spelling conformed to modern conventions).

140 Hall, Property, supra note 13, at 647-48; Rodwin, supra note 54, at 606.

141 Rodwin, supra note 54, at 606.

142 See discussion infra at subsection B.

143 Evans, supra note 30, at 82-86.

144 See discussion supra at Part 3.

145 Evans, supra note 30, at 82.

146 See Jorge L. Contreras, Constructing the Genome Commons, in Governing Knowledge Commons 99, supra note 2, at 112-13 (providing examples of data-sharing policies that correspond to the concept that this Article refers to as incentivized consent alignment).

147 Id. (discussing funding agencies' data-sharing policies); Evans, Burke & Jarvik, supra note 26 (discussing NIH data-deposit policies).

148 See 45 C.F.R. § 46.102(f) (2016) (defining “human subject,” for purposes of the Common Rule, in a way that excludes a person whose data is received by an investigator in de-identified form from being a human subject that has a right of informed consent); 45 C.F.R. §164.502(d)(2) (2016) (providing that, for purposes of the HIPAA Privacy Rule, de-identified information is not protected health information that is subject to the Privacy Rule's provisions, including its individual authorization requirement); Federal Policy for the Protection of Human Subjects, 82 Fed. Reg. 7149, 7260 (Jan. 19, 2017) (providing a definition of “human subject” to be codified at § __.102(e)(1) of the revised Common Rule that will have substantially similar effect).

149 DJ Patil, et al., Your Data in Your Hands: Enabling Access to Health Information, Medium (Mar. 10, 2016), https://medium.com/@WhiteHouse/your-data-in-your-hands-enabling-access-to-healthinformation-6fce6da976cb#.60242uv2i [https://perma.cc/4UQF-NA4P].

150 Evans, Burke & Jarvik, supra note 26, at 2261.

151 Shirts et al., supra note 15.

152 Robert, Cook-Deegan et al., The Next Controversy in Genetic Testing: Clinical Data as Trade Secrets? 21 Eur. J. Hum. Genetics 585, 585 (2013)Google Scholar.

153 Evans, Burke & Jarvik, supra note 26, at 2260.

154 See supra note 45.

155 See Evans, supra note 30, at 107 n.247.

156 See, e.g., 45 C.F.R. § 164.512 (2016) (listing HIPAA exceptions).

157 See, e.g., 45 C.F.R. § 46.116(d) (couching the current Common Rule's waiver provision in permissive language: “An IRB may approve ….”); 45 C.F.R. § 164.512(i) (providing, in the HIPAA waiver provision, that uses and disclosures of a person's data without authorization pursuant to a waiver are “permitted” — i.e., disclosures are allowed but not required). The IRB of a research institution that wishes to receive data from a data holder can approve a waiver authorizing release of the data without individual consent; see Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,464, 82,695 (Dec. 28, 2000) (codified at 45 C.F.R. pts. 160, 164) (rejecting, in the preamble to the HIPAA Privacy Rule, suggestions that HHS should require IRBs that approve waivers to be independent of the entity conducting the research). Under 45 C.F.R. § 164.512(i), recipient-approved waivers permit the data holder to disclose data but do not require it, so the recipient has no way to force the provision of needed data and services.

158 Sarah, L. Cutrona, et al., Design for Validation of Acute Myocardial Infarction Cases in Mini-Sentinel, 21 Pharmacoepidemiology & Drug Safety 274, 278-79 (2012)Google Scholar.

159 See Common Rule Waiver Provision, 45 C.F.R. § 46.116(d) (2015) (describing the waiver provision of the current Common Rule, effective until revisions go into effect on January 18, 2018); Federal Policy for the Protection of Human Subjects, 82 Fed. Reg. 7149, 7267 (Jan. 19, 2017) (replacing the current Common Rule waiver provision with a new provision, to be codified at § __.116(f) of the Common Rule, to be effective January 18, 2018); HIPAA Waiver Provision, 45 C.F.R. § 164.512(i) (2015).

160 See 45 C.F.R. §§ 46.103(b), 46.107–108 (describing IRBs: private ethical review panels, often staffed by employees of the data holder or data-using research institution, to which the Common Rule delegates various aspects of research oversight); 45 C.F.R § 164.512(i)(2)(iv) (allowing waivers of consent under the HIPAA Privacy Rule to be approved by either a Common Rule-compliant IRB or by a HIPAA-compliant “privacy panel” that is similar to an IRB).

161 See supra note 157.

162 See Federal Policy for the Protection of Human Subjects, 82 Fed. Reg. at 7267 (providing, at § __.116(f)(1) of the revised waiver provision, that “[i]f an individual was asked to provide broad consent for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens in accordance with the requirements at paragraph (d) of this section, and refused to consent, an IRB cannot waive consent for the storage, maintenance, or secondary research use of the identifiable private information or identifiable biospecimens.”).

163 Id.

164 See Federal Policy for the Protection of Human Subjects, 82 Fed. Reg. at 7225 (reporting that some public commenters in the proceedings to revise the Common Rule noted that “investigators would continue to seek consent waivers for secondary use of identifiable private information instead of seeking broad consent.”).

165 IOM, Privacy Report, supra note 37.

166 Coleman, supra note 50, at 13-27.

167 IOM, Privacy Report, supra note 37.

168 See supra notes 43-45, 158-59 and accompanying text.

169 See HIPAA Privacy Rule, 45 C.F.R. §§ 160.102, 160.103 (2015).

170 45 C.F.R. § 164.524 (2015). See also Barbara, J. Evans, Michael, O. Dorschner, Wylie, Burke & Gail, P. Jarvik, Regulatory Changes Raise Troubling Questions for Genomic Testing, 16 Genetics Med. 799 (2014)Google Scholar (discussing the scope of this access right at genomic testing laboratories).

171 Evans, Dorschner, et al., supra note 170, at 799-800.

172 Hall, Property, supra note 13, at 650, 660-61.

173 CLIA Program and HIPAA Privacy Rule; Patients' Access to Test Reports, 79 Fed. Reg. 7290 (Feb. 6, 2014) (codified at 42 C.F.R. pt. 493, 45 C.F.R. pt. 164).

174 42 C.F.R. pt. 493 (2015).

175 79 Fed. Reg. at 7292.

176 Evans, Dorschner, et al., supra note 170.

177 See, e.g., Press Release, ACLU, ACLU Files Complaint Against Lab that Refuses to Recognize Patients' Right to Their Own Genetic Information (May 19, 2016), available at https://www.aclu.org/news/aclu-files-complaint-against-lab-refuses-recognize-patients-right-their-own-genetic-information [https://perma.cc/2DK6-G7TJ].

178 HHS, Individuals' Right Under HIPAA to Access Their Health Information [hereinafter HHS, Access Rights], http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/ [https://perma.cc/9NDA-JTJD].

179 Id.

180 Id. See also Evans, Dorschner, et al., supra note 170, at 799.

181 HHS, Standards for Privacy of Individually Identifiable Health Information: Final Rule, 65 Fed. Reg. 82,462, 82,606 (Dec 28, 2000) (to be codified at 45 C.F.R. pts. 160, 164) (quoting Am. Soc. for Testing & Materials, Standard Guide for Confidentiality, Privacy, Access and Data Security, Principles for Health Information Including Computer-Based Patient Records, E1869–97, § 11.1.1 (2014)).

182 Id. (quoting Nat'l Comm. for Quality Assurance & the Joint Comm'n on Accreditation of Healthcare Orgs., Protecting Personal Health Information: A Framework for Meeting the Challenges in a Managed Care Environment 25 (1998)).).

183 CLIA Program and HIPAA Privacy Rule: Patients' Access to Test Reports, 79 Fed. Reg. 7290, 7290 (Feb. 6, 2014) (codified at 42 C.F.R. pt. 493, 45 C.F.R. pt. 164).

184 See supra note 37 and accompanying text (discussing selection bias).

185 U.S. Const. amend. V.

186 Evans, supra note 30, at 102-03.

187 See Susan, W. Brenner & Leo, L. Clarke, Civilians in Cyberwarfare: Conscripts, 43 Vand. J. Transnat'l L. 1011, 1056–57 (2010)Google Scholar (discussing whether the government can require civilian workers to perform services aimed at protecting against cyberterrorism and finding only one example, during the Revolutionary War, where Congress forced civilians to provide services outside the context of conscripted military service).

188 See Steven J. Kelman, Contracting, in The Tools of Government: A Guide to the New Governance 282, 283-85 (Lester M. Salamon ed. 2002) (discussing features of contracts through which the government procures products or services for its use); see also Ruth Hoogland DeHoog & Lester M. Salamon, Purchase-of-Service Contracting, in The Tools of Government: A Guide to the New Governance 319, supra, at 320 (describing contracts in which the government procures services for delivery to third parties such as beneficiaries of welfare programs).

189 See David R. Beam & Timothy J. Conlan, Grants, in The Tools of Government: A Guide to the New Governance 340, supra note 188, at 340-41 (discussing the government's use of grants to stimulate performance of services).

190 Peppet, supra note 131, at 93.

191 Id.

192 IOM, Privacy Report, supra note 37, at 126, 157-59 (“The Privacy Rule does not protect personally identifiable health information that is held or maintained by an organization other than a covered entity.”).

193 U.S. Const. art. I, § 8, cl. 3.

194 See Federal Policy for the Protection of Human Subjects, 80 Fed. Reg. 53,933 (proposed Sept. 8, 2015) (to be codified at 45 C.F.R. pt. 46) (proposing to apply the Common Rule to all clinical trials, regardless of funding source, conducted at institutions that receive public funds). But see Federal Policy for the Protection of Human Subjects, 82 Fed. Reg. 7149, 7150 (Jan. 19, 2017) (noting that the final rule did not implement this proposal and “does not expand the policy to cover clinical trials that are not federally funded.”).

195 Iom, Privacy Report, supra note 37, at 126.

196 DeMarco, supra note 119, at 1040-41.

197 FTC v. Wyndham Worldwide Corp., 799 F.3d 236, 259 (3rd Cir. 2015).

198 See, e.g., FTC, Internet of Things: Privacy & Security in a Connected World (Jan. 2015); FTC, Protecting Consumer Privacy in an Era of Rapid Change: Recommendation for Businesses and Policymakers (Mar. 2012).

199 DeMarco, supra note 119, at 1040-41.

200 Peppet, supra note 131, at 129.

201 Id.

202 Id.

203 Id. at 143-44.

204 Id. at 144.

205 See supra note 45.

206 Peppet, supra note 131, at 145-46 n355.

207 Kish & Topol, supra note 45, at 922.

208 Peppet, supra note 131, at 144-46.

209 Id. at 160.

210 Health Data Exploration Project, supra note 45, at 6-7, 32.

211 Peppet, supra note 131, at 117-48 (describing the problems associated with data-collecting consumer devices).

212 See HHS, Access Rights, supra note 178 (discussing the reasonable cost-based fee).

213 Thomas Hobbes, Leviathan 163 (A.P. Martinich & Brian Battiste eds., Broadview Press rev. ed. 2011) (removed emphasis in original).

214 Id. at 162.

215 See Institutional Review Boards: Report and Recommendations of the National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research, 43 Fed. Reg. 56,174 (Nov. 30, 1978) (discussing the various types of research considered during development of the Common Rule); see also Evans, supra note 30, at 113-129 (discussing how the Common Rule was adapted and applied in the years after 1980 to address informational research).

216 Rochin v. California, 342 U.S. 165, 174 (1952).

217 Union Pac. Ry. Co. v. Botsford, 141 U.S. 250, 251 (1891).

218 Radin, supra note 90, at 958 n.3.

219 See DeMarco, supra note 119, at 1036 (arguing that Locke's labor-desert theory supports the notion that those who invest to collect data have rights in it).

220 Id.

221 Id. at 1014.

222 About the Quantified Self, Quantified Self, http://quantifiedself.com/about/ [https://perma.cc/369C-TWMX].

223 23andMe, https://www.23andme.com [https://perma.cc/53DY-S8F3].

224 Charles Taylor, Sources of the Self: The Making of the Modern Identity 5 (1992).

225 Id. at 8.

226 See, e.g., George, J. Annas, Privacy Rules for DNA Databanks: Protecting Coded ‘Future Diaries,’ 270 JAMA 2346 (1993)Google Scholar.

227 Lawrence Lessig, Code and Other Laws of Cyberspace 152 (1999) (emphasis in original).

228 Evans, supra note 124, at 505.

229 Ruth, R. Faden et al., An Ethics Framework for a Learning Health Care System: A Departure from Traditional Research Ethics and Clinical Ethics, 43 Hastings Ctr. Rep. S16, S16 (2013)Google Scholar.

230 Id. at S18.

231 Id. at S19-20.

232 Id. at S23.

233 Id.

234 Id.

235 Stuart P. Green, The Universal Grammar of Criminal Law: Basic Concepts of Criminal Law by George P. Fletcher, 98 Mich. L. Rev. 2104, 2112 (2000) (citing Donald E. Brown, Human Universals (1991)); see also Robin Bradley Kar, The Deep Structure of Law and Morality, 84 Tex. L. Rev. 877, 885 (2006).

236 Green, supra note 235.

237 Charles Taylor, Philosophy and the Human Sciences, 2 Philosophical Papers 218 (1985) (noting, “In a philosophical argument, we might call this a restriction of freedom, but not in a serious political debate.”).

238 Emilio Santoro, Autonomy, Freedom and Rights: A Critique of Liberal Subjectivity 247 (2003).

239 See Narcissistic Personality Disorder (NPD) Definition, http://www.healthyplace.com/personality-disorders/malignant-self-love/narcissistic-personality-disorder-npd-definition/ [https://perma.cc/FWS7-A6QD] (defining narcissism as “[a] pattern of traits and behaviors which signify infatuation and obsession with one's self to the exclusion of all others and the egotistic and ruthless pursuit of one's gratification, dominance and ambition”) (emphasis added).

240 3 Joel Feinberg, The Moral Limits of the Criminal Law: Harm to Self 305-15 (1986).

241 Taylor, supra note 237.

242 See Evans, supra note 124 (summarizing these deficiencies).

243 See supra notes 139-41 and accompanying text.

244 45 C.F.R. §§ 46.101(f), 46.122 (2015).

245 See Eleanor Singer & Felice J. Levine, Protection of Human Subjects of Research: Recent Developments and Future Prospects for the Social Sciences, 67 Pub. Opinion Q. 148 (2003) (describing all the players involved in developing the standards).

246 Kish & Topol, supra note 45, at 923.

247 There are few reliable statistics indicating how many Americans volunteer their data for informational research. See Mark A. Rothstein, Improve Privacy in Research by Eliminating Informed Consent? IOM Report Misses the Mark, 37 J.L. Med. & Ethics 507, 508 (2009) (“It is not known what percentage of potential research subjects decline to participate, for what types of research, and under what consent mechanisms; nor is there evidence of what the effects are on sample accrual or on the statistical power of the research.”). Based on even the most casual inquiries, however, one concludes that the percentage of Americans who actually volunteer their data for biomedical research is far less than the eighty percent who, according to Kish & Topol's survey data, indicate an interest in doing so.

248 Albert O. Hirschman, Exit, Voice, and Loyalty: Responses to Decline in Firms, Organizations, and States (1970).

249 Id. at 4, 26-29.

250 Id. at 4.

251 Barbara, J. Evans, Power to the People: Data Citizens in the Age of Precision Medicine, 19 Vand. J. Ent. & Tech. L. (forthcoming 2017)Google Scholar.