## 3 Discussion
### Privacy and Data Protection: Old Regimes in a New Age
In an American example, the Health Insurance Portability and Accountability Act (HIPAA) focuses on \"protected health information\" (PHI), which is \"individually identifiable health information\" ([20]). Traditionally, this meant controlling access to and, if and as needed, reducing paper records containing sensitive information. However, the growing impact of information and communications technologies on recordkeeping, along with a general confusion of \"data\" and \"records,\" means that PII can now be treated as just a small subset of data, often divorced from its source record. This is a dangerous approach because it strips the data of its context, thereby removing the ability to determine whether the data is \"private\" for a particular purpose. For example, the Personal Information Protection Act of British Columbia permits covered organizations to use PII without consent if \"the use is clearly in the interests of the individual and consent cannot be obtained in a timely way\" ([21], Section 15(1)(a)). Determining whether the use is \"clearly in the interests of the individual\" is obviously a fact-driven analysis. In a simple case, the broader context of the situation might permit one to determine without the context of the record if the PII should be used--for example, pulling up the blood type of an unconscious individual who is bleeding out. However, not every case is simple. If law enforcement is trying to locate a person who might be in danger, knowing the context of the records from which addresses are being pulled is critical to determine the usefulness of those addresses. Establishing protection at record level, rather than data level, would lead to a better result. Furthermore, data mining and other big data techniques are increasingly rendering data-level privacy protection worthless. There is a growing literature on algorithmic redlining [22], disparate impact from big data analytics ([23; 24]), and the challenges posed to due process by algorithmic decision-making [25]. Presumably, no mortgage lender is out there programming decision-making algorithms to reject, for example, visible minority applicants. However, in a very real sense, they do not need to: based on the hundreds or thousands of other data points, the machine comes to same conclusions--with the same impact--as human evaluators reading coded references to an applicants' \"urban lifestyle.\" Similarly, Target stores did not need to see a test to know if a customer was pregnant [26]. The big data decision-making algorithms' entire purpose is to discriminate, to make distinctions based on huge volumes and varieties of data. Thus, the challenge with algorithmic discrimination--as in the case of a privacy approach that relies upon PII--is the loss of judgment. \"The machine is incapable of determining whether a distinction is ethical or not. Unless we come up with a comprehensive theory of discrimination that can be represented algorithmically, we have no rigorous way of distinguishing between ethical and non-ethical machine-based discrimination [...however,] [s]ome of our ethical and moral criteria are so fragile, nuanced, and culturally dependent that it is not clear that the machine will ever be capable of appropriately weighing them\" ([27], p. 5). Yet, the data-driven approach to PII assumes that, albeit redacting or pseudonymizing the most sensitive bits of data, we prevent the algorithm from \"filling in the blanks\" using the vast amounts of other data at its disposal. However, walling off bits of data as PII, while leaving all of the other data available open to whatever techniques clever data holders can devise, is a futile approach. The data-centric approach to privacy will be less and less useful in facilitating trust in cloud-based records. The new European General Data Protection Regulation (GDPR) explicitly recognizes these challenges, and seeks to establish a higher standard of trust for its citizens.