Private Data, Public Safety: A Bounded Access Model of Disclosure

A growing volume of crucial information for protecting public health and safety is controlled by private-sector entities. The data are private in two senses—both proprietary and secluded from scrutiny. Controversies over corporate secrecy, such as sealed settlements that hide deaths due to product defects or nondisclosure of potentially hazardous substances, illustrate how corporate privacy and public safety can conflict. Courts are conflicted about when to defer to companies’ claims of the right to keep information private when important public interests are implicated by the data that companies refuse to disclose. This Article proposes allowing what it terms “bounded access” to share private data important to public health and safety with safeguards for the private interests at stake. In contrast to mandated public-disclosure regimes, bounded access would provide information access to trained professionals capable of effectively using data to detect health and safety harms while honoring data protections. The paradigmatic audience for bounded access disclosures is researchers overseen by institutional review boards and trained in how to minimize damage to data owners. Information aggregation and deidentification can help protect the anonymity of the private entities and their product lines, thereby ameliorating the concerns of private entities regarding prematurely rousing consumer panic, injuring brand reputation, or destroying trade secrets. Such bounded access would address the limitations of general public disclosure, such as conflict with the Fifth Amendment takings clause or piling more disclosure on the information overloaded consumer. Information would be rich in technical details to facilitate effective expert analyses rather than pared down for general public consumption. The proposed approach thus balances private-sector interests with the public interest in protecting population health and safety