 Internet research introduces new complications to these longstanding definitions and regulatory frameworks intended to protect subject privacy. For example, researchers increasingly are able to collect detailed data about individuals from sources such as Facebook, Twitter, blogs or public email archives, and these rich data sets can more easily be processed, compared, and combined with other data (and datasets) available online. In numerous cases, both researchers and members of the general public have been able to re-identify individuals by analyzing and comparing such datasets, using data-fields as benign as one’s zip code (Sweeny 2002), random Web search queries (Barbaro &amp; Zeller 2006), or movie ratings (Narayanan &amp; Shmatikov 2008) as the vital key for reidentification of a presumed anonymous user. Prior to widespread Internet-based data collection and processing, few would have considered one’s movie ratings or zipcode as personally-identifiable. Yet, these cases reveal that merely stripping traditional “identifiable” information such as a subject’s name, address, or social security number is no longer sufficient to ensure data remains anonymous (Ohm 2010), and requires the reconsideration of what is considered “personally identifiable information” (Schwartz &amp; Solove 2011). This points to the critical distinction between data that is kept confidential versus data that is truly anonymous. Increasingly, data are rarely completely anonymous, as researchers have routinely demonstrated they can often reidentify individuals hidden in “anonymized” datasets with ease (Ohm 2010). This reality places new pressure on ensuring datasets are kept, at the least, suitably confidential through both physical and computational security measures. These measures may also include requirements to store data in “clean rooms”, or in non-networked environments in an effort to control data transmission.