on the one hand.
On the other,
aggregate data is (generally) not identifiable... as long as it's stuff that is COMMON enough. That's the sticking point, really. If you are a rare disease patient, there
is no such thing as "aggregate" data.
As we've all seen (at least if you've followed news stories on this stuff for a decade, as I have)-- even in publications where the information is ostensibly "anonymous" the tabulation of food allergy fatalities lists a few gender/age/allergen/method of exposure combos that I
know the names of.
For example--
13y F milk allergy-- cafeteria cross-contamination, at school.
That's Sabrina Shannon.
It's distressing to me to
know their names. It's distressing because it feels dehumanizing to see them reduced to table entries in a paper... on the other hand, if I can figure out who those people are, then that points out the problem with the idea of not requiring consent for aggregated or anonymous use.
Anyone who is in a highly unusual (e.g. publication-worthy) situation as a patient-- that is, warranting a case study-- MUST give consent. IMO. As AI/data mining becomes more sophisticated, also, that line needs to be moving toward protecting privacy, not stripping it away.