Chapter 3 shows why the contracts model doesn’t work: consent is absent in the information economy. Privacy harm can’t be seen as a risk that people accept in exchange for a service. Inferences, relational data, and de-identified data aren’t captured by consent provisions. Consent is unattainable in the information economy more broadly because the dynamic between corporations and users is plagued with uneven knowledge, inequality, and a lack of choices. Data harms are collective and unknowable, making individual choices to reduce them impossible. Worse, privacy has a moral hazard problem: corporations have incentives to behave against our best interests, creating profitable harms after obtaining agreements. Privacy’s moral hazard leads to informational exploitation. One manifestation of valid consent in the information economy are consent refusals. We can consider them by thinking of people’s data as part of them, as their bodies are.

This chapter considers the legacy of respect for individual autonomy and ‘informed consent’ in health research. The primacy of informed consent as a safeguard has led to a systemic regulatory tendency to conceive of and protect privacy as an individual rather than a collective concern. This has limited any regulatory ability to grasp broader social concerns with the use and disclosure of data gathered and generated by health research. Any systemic failure to recognise collective interests in data, and the public interest in (non-personal) data protection, has profound implications for an information age. The chapter reflects on the value of re-negotiating the interests and expectations protected by health research regulation. It recognises the significance of Graeme Laurie’s preferred conception of privacy to enabling such negotiation, and the value of stewardship in establishing normative expectations free of historical encumbrance. Laurie’s conceptualisation of ‘privacy as separateness’, when placed alongside the idea of stewardship, may allow us to rebalance respect to encompass collective interests as fundamental to self-determination and mutual respect.

Privacy and public interest are reciprocal concepts, mutually implicated in each other’s protection. This chapter considers how viewing the concept of privacy through a public interest lens can reveal the limitations of the narrow conception of privacy currently inherent to much health research regulation (HRR). Moreover, it reveals how the public interest test, applied in that same regulation, might mitigate risks associated with a narrow conception of privacy.  The central contention of this chapter is that viewing privacy through the lens of public interest allows the law to bring into focus more things of common interest than privacy law currently recognises. We are not the first to recognise that members of society share a common interest in both privacy and health research. Nor are we the first to suggest that public is not necessarily in opposition to private, with public interests capable of accommodating private and vice versa. What is novel about our argument is the suggestion that we might invoke public interest requirements in current HRR to protect group privacy interests that might otherwise remain out of sight.