Health-related Information as Personal Data in Europe: Results from a Representative Survey in Eu27

Editor's Notes

• #2: On behalf of my co-authors I’m presenting Health-related Information as Personal Data in Europe: Results from a Representative Survey in EU-27
• #3: First of all a little background about my institution the Institute for Prospective Technological Studies The institute is part of Joint Research Centre (JRC) of the European Commission. As a service of European Commission our mission is to provide customer-driven scientific and technical support for the conception, development, implementation and monitoring of EU policies. we work very close to policy-makers but we are independent
• #4: Within this context in 2009 we launched a project to analyze the attitudes of Europeans towards Electronic Identity and Data protection in Europe On one hand, policy makers, patients and health care organizations are concerned about the need to protect medical and health-related information. On the other hand, bottom up developments are arguing that users do not really care about data protection as long as sharing such data produces more value than it destroys. There is, however, a clear gap, so our objective was: To identify and characterize individuals' perception, behaviours and attitudes towards health-related information regarding electronic identity and data protection in Europe This research is based on a representative sample of people in EU27. The survey was conducted in 27 EU Member States via a national random-stratified samples of approximately 1,000 interviews; Almost 27,000 Europeans aged 15 and over were interviewed face-to-face in their homes. The questionnaire tackled issues related with data disclosure in different context, including: health and personal information, Disclosure in Social Networking Sites and on eCommerce sites trust, concerns, risks approval required for disclosure and sensitivity of DNA data
• #5: It worth pointing out the legal background of European Union Data Protection Directive (95/46/EC) This directive is the general EU law in the field of protection of personal data and the most prominent legislative act regulating the processing of medical data. Its objective is to protect the privacy of individuals while enabling the free flow of personal data within the EU in the context of the internal market. The directive provides special protection for personal data related to health, prohibiting in principle its processing. Limited exemptions to this prohibition principle are foreseen in the Directive, in particular if processing is required for specified medical and healthcare purposes, if the data are processed by a health professional subject to an equivalent obligation of secrecy. Recommendation No. R (97) 5 on the Protection of Medical Data (Feb. 13, 1997) This recommendation explicitly defines the expression "medical data" ("which refers to all personal data concerning the health of the individual. It refers also to data which have a clear and close link with health as well as to genetic data"), and the expression "genetic data" (which refers to all data, of whatever type, concerning the hereditary characteristics of an individual or concerning the pattern of inheritance of such characteristics within a related group of individuals"). Directive on Patients’ Rights in Cross-Border Healthcare: Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare. Key Action 13: Undertake pilot actions to equip Europeans with secure online access to their medical health data by 2015 and to achieve by 2020 widespread deployment of telemedicine services; Key Action 14: Propose a recommendation defining a minimum common set of patient data for interoperability of patient records to be accessed or exchanged electronically across Member States by 2012.
• #6: All respondents were asked what information they consider to be personal. Around three-quarters of Europeans think that financial information , medical information such as patient records, health information and their national identity number and/or card number or passport number are personal A second group of data, includes fingerprints (64%), home address (57%), mobile phone number (53%), photos of people (48%), and their name (46%). Finally, about a third of Europeans consider as personal their work history (30%) and who their friends are (30%); their nationality (26%), things they do, such as hobbies, sports, places they go (25%), and the websites they visit (25%)
• #7: To confirm the complementarities of types of personal data, we carry out a factor analysis This analysis reveals that t here are three main types of information people considered personal ‘jointly’: social information, identifiers and sensitive information. Not surprisingly, medical information is grouped as sensitive information.
• #8: From a socio-demographic point of view Female (75%) Middle-age 25-39 and 40-54 (75%, 76%), Higher level of formal educatio n (81%), Manager (83%) or other white collar (78%), Affluent (76%) and Internet users (78%) are more likely to consider medical information to be personal These characteristics reveal a small socio-economic divide in the perception of the importance of personal medical data These results point to a significant disparity in the perception on one’s own health, as people from poorer backgrounds may be less protective of their medical data privacy than wealthier Europeans.
• #9: At country level, a large majority of European interviewees see medical information as personal. But respondents located in the north and west of the European Union are most likely to regard medical information as personal.
• #10: All respondents were asked whether their specific approval should be required before any kind of personal information is collected and processed. 74% stated that their approval should be required in all cases 12% in the case of personal information collected on the Internet 8% in the case of sensitive information (health religion, political beliefs or sexual preferences). Individuals who stated that specific approval should be required in all cases are more likely to consider medical information as personal (76%) than individuals who do not consider this type of information as personal (24%).
• #11: Respondents were asked to what extent they trust institutions to protect their personal information. Individuals who considered medical information as personal are more likely to trust health and medical institutions (86%), national public authorities (73%); and banks and financial institutions (66%) vs. (74%, 68%, and 59% respectively). On the contrary, they are less likely to trust shops and department stores (62%); internet companies (73%), and phone companies (68%) (44%, 49% and 62% respectively). These results point out the difficulties that shops, Internet, phone and mobile companies and ISPs may have to launch and/or maintain any health business initiative, which implies the disclosure of medical information, due to the importance of trust in the health field . On the other hand, national public authorities; banks and financial institutions and specially health and medical institutions could benefit from this level of trust to launch or support this kind of initiatives (as Personal Health Records).
• #12: Companies holding personal information may sometimes use it for a purpose other than that for which it was collected (e.g. for direct marketing or targeted online advertising), without informing the individuals concerned. Respondents were asked how worried they were about this use of their information. Individuals who considered medical information as personal are slightly more likely to be concerned (74%) than those who did not consider this type of information as personal (66%). We then checked the relationship between trust and concern, in relation to personal health information. Overall, individuals who consider medical information as personal are more likely to be concerned about stealth re-use of their personal data than individuals who did not consider it personal, regardless of whether they trust or not data controllers. On the one hand, individuals who consider medical information as personal and trust national public authorities, Banks and financial institutions and Health and medical institutions are more likely to be concerned (approximately 70%) than individuals who did not consider this type of information as personal (approximately 65%). That is, trust makes very little difference to people who do not consider medical information as personal, but a large difference for those who consider their medical data to be personal. On the other hand, trust is extremely important, almost critical, for shops and department stores, Internet companies, Phone and mobile phone. In this case, trust matters a lot for all, in that trust is associated with significantly lower values of percentage of concerned across the sample, for both people who consider medical data as personal and otherwise.
• #13: All respondents were asked how worry they were about the re-use of their information for other purposes like direct marketing or targeted online advertising), without informing the individuals concerned. Individuals who considered medical information as personal are slightly more likely to be concerned (74%) than those who did not consider this type of information as personal (66%). Respondents were asked whether they heard of or experienced issues related to data loss and identity theft in the last 12 months . Respondents who considered medical information as personal are more likely to have heard about it through television, radio, newspapers, the Internet (45% media awareness) than those who did not consider it as personal (32%). Social awareness (word of mouth and/or acquaintance) and self-family experience (you directly and/or a member of your family) were not found to be statistically significant. This emphasises the importance of media in health communication campaigns to raise awareness as to risks related to data loss or theft. Moreover, respondents who consider medical information as personal are more likely to have heard about a public authority in their countries responsible for protecting their rights regarding personal data (36%) than those who did not consider this type of information as personal (28%). Furthermore, respondents who considered medical information as personal are more likely to state that they would want to be informed by a public authority or by a private company whenever information they hold about them is lost or stolen (91% vs. 78%) and to have the same rights and protections over their personal information regardless of the EU country in which it is collected and processed (79% vs. 57%). Also, those who consider medical information as personal are more likely to state that the enforcement of the rules on personal data protection should be dealt with at European level (47%) than those who did not consider it as personal (38%).
• #14: The survey also included questions related with Web 2.0. About a third of all Europeans use SNS and/or websites to share pictures, videos..   Slightly over half of all internet users (52%) use a social networking site and 44% use websites to share pictures, videos, movies, etc. It’s important to emphasise the socio-demographic characteristics that influence social networking and sharing sites. These are age, education, occupation, financial situation, household composition and frequency of Internet use. This characterisation points out several digital divides related with motivation, access, uses and skills of individuals. These divides are related with the social determinants of health.
• #15: Factor analysis was carried out to check the complementarities of the personal information disclosed in SNS and sharing sites . The respondents who use SNS and sharing sites were then asked which types of personal information they disclosed in these environments . Factor analysis identified three three main types of information Web 2.0 users disclose 'jointly': Social information; Sensitive information and Traditional identifiers. Indeed, people mostly share social information on SC sites but also basic identity information: almost eight out of ten social computing users, revealed their name (79%) and around half disclosed photos of themselves (51%) or their nationality (47%). Almost four in ten disclosed the things they do (for example hobbies, sports, places they go), their home address, and who their friends are (all three 39%). One-third shared their tastes and opinions (33%) and a quarter gave their mobile phone number (23%). Fewer respondents disclosed their work history (18%), their national identity number, identity card number, or passport number (13%). Financial information such as salary, bank details and credit record (10%), and medical information such as patient record and health information (5%) are unlikely to be disclosed on SC sites.
• #16: If we focus on medical information, o nly 5% of web 2.0 user disclose this type of information on SNS and sharing sites 3% of Internet users disclosed medical information in the context of eCommerce Crossing perception of medical information as personal with this type of behaviour allowed us to profile four different types of individuals. The first two groups include ‘self-revealing’ Web 2.0 users who disclose medical information (5%). Within this group we can identify those who consider this type of information as personal (4%) and those who do not consider it as personal (1%). Even though both groups are generating online medical information contents, different perceptions of this type of information as personal raises a different level of awareness and caution. But a majority of social computing users do not disclose medical information (95%). Within this group are individuals who consider medical information as personal (73%) and this group may be labelled as "Cautious" and individuals who do not consider it as personal (22%) labelled as "Indifferent". Due to the small number of social computing users who disclose medical information, we examine here three groups only
• #17: To put results in perspective, it should be kept in mind that we are talking of internet users who also use social computing sites. Self- revealing users are more likely to be in the older age (40-54 and 55+ cohorts (25% and 14% respectively); to end education at the age of 16-19 (46%); to live in a house with three persons (28%); not to have difficulties to pay their bills; and to be heavy Internet users at home. Cautious users are slightly more likely to be female; to be 15-24 (29%) or 55+ (12%); to be students (19%) or manual workers (23%); to end education at the age of 16-19 (41%) or 20+ (34%); to live in a house with 4+ (34%); not to have difficulties to pay their bills; and to be heavy Internet users at home and at work. Indifferent users are slightly more likely to be male (56%); to be 15-24 (38%); to be student (26%); to be still studying (25%) or end education at 20+; not to have difficulties to pay their bills; and to be heavy Internet users at home and at work. ---------- More specific differences include: Cautious users are more likely to be female while indifferent individuals are more likely to be male. This characteristic points out the importance of women regarding health issues. If we consider that individuals above 40 have more probability of having a health problem (specially those above 55+) or being responsible of caring for their families, it is not surprising that self-revealing individuals are more likely to be older than cautious and indifferent individuals (this profile is the youngest one). Due to the age characterization cautious and indifferent individuals are more educated than self-revealing individuals. Nevertheless, the education level of self-revealing individuals remains high The fact that household composition is statistically significant reveals the importance of social life of medical information and emphasises the role of the individuals as mediators of health information. It is worth pointing out that predictors of internet use and social computing use (young age, wealth, household composition, education) are also related with social determinants of health. Thus, while self-revealing individuals have a slightly lower socio-economic status than cautious and indifferent individuals (education and difficulties to pay bills), they are in a better socio-economic status than people who do not use the Internet
• #18: Looking at the wider picture, we examine whether there is a relation between Internet use for medical information in a country [1] , and disclosure of medical information in the context of social networking (self-revealing, cautious, indifferent). In short, the correlation is weak for all three behaviours across EU27. The absence of patterns indicates the lack of network effect in the number of users generating medical information content and the number of users seeking health information on the Internet. Medical information on the Internet at large and disclosure of online personal data appear to be unrelated at country level.
• #19: The two main reasons given by respondents for the disclosure are to access the service (61%) and to connect with others (52%). Around one-fifth of the respondents do so for fun (22%), to obtain a service adapted to their needs (18%), or to get a service for free (18%). People who self-reveal medical information appear to disclose (in general), for pragmatic reasons: they are more likely to disclose to get a service for free; to save time at the next visit; to benefit from personalised commercial offers and to receive money or price reduction. On the contrary, they are less likely to disclose information to connect with others or for fun Self-revealing individuals are behaving consistently for all types of data ------------- This trend could be understood as a niche market to launch digital health services as health personal records or SNS to support groups of individuals with the same health problems, especially chronic conditions. However we have to emphasise the importance of trust in relation with health. On the other hand we also need to take into account that the group of indifferent users is sharing health related information that they think can hardly be considered a risk or raise concern (i.e. disease-related information that is clearly curable and has no future consequences for the individual such as: fever, appendix problems, chickenpox, etc…). It is also interesting to note that whether it is considered as personal or not, the information disclosed [e.g. cautious and indifferent types] makes little difference in terms of the reasons why people disclose. The only statistically important difference relates to the reason "connecting with others", which is more significant as a reason for ‘cautious’ users than for ‘indifferent’ users. Again, this underlines the importance of the nature of the information actually disclosed, rather than the perceptions: people who are cautious in relation to their medical information (therefore aware) need not be cautious in relation to data of social nature disclosed [Figure 3]. In essence this means that while self-revealing individuals are behaving consistently for all types of data (including health-related information), cautious individuals who are concerned about revealing their health information are instead more likely to disclose other items on Social Computing sites than indifferent individuals who share very few data overall. In essence this means that while self-revealing individuals are behaving consistently for all types of data (including health-related information), cautious individuals who are concerned about revealing their health information are instead more likely to disclose other items on Social Computing sites than indifferent individuals who share very few data overall.
• #20: Social Computing users were asked which three (out of ten) potential risks they associated with disclosure of personal information [1] . Around four in ten respondents mention information being used without their knowledge (44%), being victim of fraud (41%) and information being shared with third parties without their knowledge (38%). Around one-third mention the risk of identity theft online (32%) and that the information will be used to enable sending them unwanted commercial offers (28%). About a quarter of respondents fear that the information will be used in different contexts from the ones where they disclosed it (25%). Just 3% of respondents stated spontaneously that they perceive no risks. Self-revealing SC users are more likely to perceive reputation damage and misunderstanding of their views and behaviors connected with disclosure of personal information
• #21: SC users who disclosed medical information (self-revealing) are more likely to consider that these sites sufficiently inform their users about the possible consequences of disclosing personal information (65%) than SC users who did not disclose this type of information (47% cautious and 61% indifferent) Concerning responsibility, SC users were asked who should take care of the information they have disclosed. Firstly, half of the respondents point to themselves (50%), while one-third point to the social networking or sharing sites (33%). Even fewer respondents mention public authorities (17%). Overall, therefore, attribution of responsibility appears stable regardless of disclosure and perception of medical information.
• #22: National public authorities and European institutions are considered as the most trusted institutions by SC users who disclose medical information (self-revealing). These individuals are more likely to trust national public authorities (80%) than cautious (76%) and indifferent (71%). Furthermore, even though the level of trust is lower, self-revealing individuals are more likely to trust shops and department stores (55%) and Phone companies (49%) and Internet companies (45%) than cautious (40%, 38% and 33% respectively) and indifferent (49%, 46% and 43% respectively).
• #23: In line with this finding, SC users who disclose medical information are also slightly less likely to consider that specific approval is required before personal information is collected and processed [Table 17]. However, in the context of personal information asked on the Internet these individuals are more likely to consider specific approval. Also, they are more likely to be concerned about the re-use of personal data for different purposes (75% self-revealing – 70% cautious – 66% indifferent). Thus, again, context makes a difference to people’s attitudes, in this case concern grows as we move closer to actual experience of SC users. In this case, percentage of individuals who considered medical information as personal and stated that specific approval should be required in all cases (76%) is lower than the percentages of self-revealing individuals (61%) while concern about re-use is strikingly similar
• #24: Respondents who had disclosed personal information on SC sites were asked how much control they felt they had over the information they had disclosed, such as the ability to amend, delete or correct this information Perception of control does not vary significantly whether SC user disclosed or not medical information. Nevertheless SC users who did not disclose medical information and did not consider it as personal (indifferent) are slightly more likely to feel they have control over the information than cautious users [Table 18]. SC users who do not disclose medical information are more likely to state that they would like their personal data to be completely deleted whenever they decide it (79% cautious; 71% indifferent vs. 63% self-revealing). On the other hand, self-revealing individuals are more likely to want to have the possibility to delete personal data when they change Internet provider (23% self-revealing vs. 11% indifferent) [Table 19]. In accordance with these results, self-revealing individuals are more likely to consider data portability important (84%) than cautious individuals (75%) and indifferent individuals (80%)
• #26: SC users who disclose medical information (self-revealing individuals) are more likely to be aware of identity theft (see Table 20) firstly through word of mouth and/or acquaintances (33% social awareness) and secondly through a member of their family and/or themselves (14% Self-family awareness) while it is also likely that they are unaware of identity theft (28%). Conversely, cautious individuals are made aware primarily through Media awareness (49%) and secondarily through social awareness while it is also very likely that they are unaware (37%) of such situations. Similarly, indifferent individuals are more likely to be unaware (44%) and secondarily made aware through Media awareness (37%). Most SC users desire to be informed by a public authority or by a private company whenever information they hold about them is lost or stolen. Cautious individuals are slightly more likely to want to be informed (94%) than self-revealing and indifferent individuals (both 90%) Similar consensus emerged among SC users about the importance of having the same data protection right across European Commission (see Table 22): more than 95% of the individuals consider it important. Cautious individuals are more likely to consider it very important (56%) than self-revealing (52%) and indifferent (49% individuals)
• #27: There is no statistically significant relationship between SC users who disclose medical information and those who do not disclose this type of information in the case of deciding at which level the enforcement of the Data Protection rules should be dealt with Finally, all respondents were asked about the need for special protection of genetic data as sensitive personal data [1] . Seven out of ten Europeans stated that special protection is needed definitely (68%) and a quarter to some extent (25%). However, self-revealing individuals are less likely to consider that this special protection is needed definitely (55%) than cautious (75%) and indifferent (60%) individuals. In essence this is evidence that self-revealing individuals are not likely to be revealing genetic information while sharing information over Social networks.
• #28: Around three-quarters of Europeans think that medical information such as patient records and health information (74%) is personal. Thus, Health information, financial information and national identity information are equally perceived to be personal. There is a slight socio-economic divide in the perception of medical data as personal between well educated, white collar, wealthy respondents [more likely to say it is personal], and those with lower education, outside the labour market and less wealthy. There are significant country differences in the perception of medical information as personal ; while a large majority of European interviewees see medical information as personal, respondents located in the north and west of the European Union are most likely to regard medical information as personal. In the south east the situation is different, especially in Poland (46%), Portugal and Romania (each 50%) and Bulgaria (52%). In these countries, identity credentials, such as identity cards and passports, are deemed to be personal over and above sensitive information (financial, medical). Considering medical data as personal makes a large difference to a range of regulatory preferences . Those who consider medical information as personal are more likely to want to be informed whenever information held about them is lost or stolen (91% vs. 78%) and to desire the same protection over their personal information regardless of the EU country in which it is collected and processed (79% vs. 57%). People who consider medical information as personal are more likely to be concerned about stealth re-use of their personal data than individuals who did not consider it personal, regardless of whether they trust or not data controllers. But trust in data controllers is a powerful mediating factor. Trust in public institutions significantly reduces the worry of those who care about their medical data. And trust in shops, Internet companies and phone companies is extremely important, almost critical, as it is associated with significantly lower concerns across the sample, for both people who consider medical data as personal and otherwise. Although a majority of people consider that medical information is personal, still a small percentage do disclose it – medical information is disclosed in the context of eCommerce (3%) and Social networking (5%). They are aware of the risks involved and still they do it; it can only mean that they are getting a benefit from the disclosure or are obliged to do it. There are three groups of Europeans concerning medical information disclosure in the context of Social Computing . " Self-revealing " social computing users disclose medical information (5%). " Cautious " users consider medical information as personal and do not disclose (73%). " Indifferent " neither consider it as personal nor do they disclose it (22%). These three groups consist of Internet users who are also users of social computing sites – thus largely users who are better educated and in a better socio-economic status than non-Internet users – who however, are statistically different in many other respects. Cautious users are slightly more likely to be female (51% vs. 49%) while indifferent individuals are more likely to be male (56% vs. 44%); this characteristic points out the importance of women in relation to health issues. It is not surprising that self-revealing individuals are more likely to be older than cautious and indifferent individuals (this profile is the youngest one) since older individuals are more likely to either face a health problem themselves or care for someone else in the family. Although due to age self-revealing users are also less educated than cautious or indifferent individuals, their overall high education makes the risk of health illiteracy minimal and thus a higher potential of health information to empower individuals, with a positive impact on health outcomes. Moreover, self-revealing Internet users are more likely to be using the Internet in more sophisticated ways; cautious users carry out more eCommerce and eGovernment transactions – which may be the reason they are indeed cautious; while indifferent Social Computing site users are less likely to do either (that is, they largely carry out ordinary Internet activities, email and search). Finally, self-revealing individuals share information to: (a) connect with others – one would think similar individuals; (b) so as to get a service for free – in relation to their condition; and (c) to save time at the next visit – presumably when receiving a service over time.
• #29: Although a majority of people consider that medical information is personal, still a small percentage do disclose it – medical information is disclosed in the context of eCommerce (3%) and Social networking (5%). They are aware of the risks involved and still they do it; it can only mean that they are getting a benefit from the disclosure or are obliged to do it. There are three groups of Europeans concerning medical information disclosure in the context of Social Computing . " Self-revealing " social computing users disclose medical information (5%). " Cautious " users consider medical information as personal and do not disclose (73%). " Indifferent " neither consider it as personal nor do they disclose it (22%). These three groups consist of Internet users who are also users of social computing sites – thus largely users who are better educated and in a better socio-economic status than non-Internet users – who however, are statistically different in many other respects. Cautious users are slightly more likely to be female (51% vs. 49%) while indifferent individuals are more likely to be male (56% vs. 44%); this characteristic points out the importance of women in relation to health issues. It is not surprising that self-revealing individuals are more likely to be older than cautious and indifferent individuals (this profile is the youngest one) since older individuals are more likely to either face a health problem themselves or care for someone else in the family. Although due to age self-revealing users are also less educated than cautious or indifferent individuals, their overall high education makes the risk of health illiteracy minimal and thus a higher potential of health information to empower individuals, with a positive impact on health outcomes. Moreover, self-revealing Internet users are more likely to be using the Internet in more sophisticated ways; cautious users carry out more eCommerce and eGovernment transactions – which may be the reason they are indeed cautious; while indifferent Social Computing site users are less likely to do either (that is, they largely carry out ordinary Internet activities, email and search). Finally, self-revealing individuals share information to: (a) connect with others – one would think similar individuals; (b) so as to get a service for free – in relation to their condition; and (c) to save time at the next visit – presumably when receiving a service over time.