Data Privacy and Confidentiality
Privacy concerns who may access and control information about a person; confidentiality concerns the duty to protect information shared in trust. Candidates must grasp identifiability (direct identifiers, quasi-identifiers, and re-identification via linkage), de-identification and anonymization (and why k-anonymity, l-diversity, and differential privacy are tools with trade-offs, not guarantees), purpose limitation, data minimization, retention limits, and contextual integrity - information flows are appropriate when they match the norms of the context in which data was shared.
Traps: (1) treating removal of names as sufficient anonymization when quasi-identifiers (age, ZIP, dates) permit linkage; (2) assuming aggregated data is safe - small cells can reveal individuals; (3) confusing privacy (a person's interest) with confidentiality (a professional/relational duty) and security (technical safeguards); (4) ignoring inference - sensitive facts derived from non-sensitive data still raise privacy harms; (5) forgetting that privacy is contextual, so a use acceptable in one setting may be a violation in another.
Rule of thumb: apply data minimization plus purpose limitation plus contextual integrity together - collect the least data, use it only for the stated purpose, and check whether the flow respects the norms of the original context.
Worked example: A dataset of "anonymous" hospital visits includes birth date, admission date, and ZIP. Combining these with public voter rolls can re-identify individuals. The correct analysis flags quasi-identifiers and recommends generalization, aggregation, or differential privacy rather than assuming anonymity.