Preventing Invasion of Privacy in Psychological Testing

Psychological testing is one of the most powerful tools a clinician has – but it comes with a serious responsibility. When a psychologist administers an assessment, they are often uncovering deeply personal information: a person’s fears, cognitive patterns, emotional vulnerabilities, trauma history, and more. Not all of that information is something the client expected or wanted to share. This is where the ethical concern of invasion of privacy becomes critical. Understanding what it means, why it matters, and how ethical guidelines address it is essential for both practitioners and the people they assess.

What invasion of privacy means in psychological testing 🔗

Privacy, in the context of psychology, is not simply about keeping secrets. According to the American Psychological Association (APA), privacy is the right of individuals to control the sharing of themselves and their personal information. Invasion of privacy occurs when a psychological test – intentionally or not – extracts information beyond what the client knew they were disclosing, or beyond what is relevant to the purpose of the assessment.

This is not a trivial concern. Legal scholars have noted that psychological testing, by probing a person’s innermost thoughts, may constitute one of the most intrusive forms of privacy violation – in some cases even more so than physical examinations. Personality tests, in particular, have long been criticized when used in contexts where the personal information uncovered has little relevance to the purpose at hand, such as employment screening or school counseling.

A privacy issue arises specifically when any of the following conditions are present: the client does not participate willingly, the client is unaware of what information is being gathered, or the client does not understand how that information will be used. All three of these conditions point to a single solution: transparency.

The role of informed consent in protecting privacy 🔗

Informed consent is the first and most fundamental line of defense against privacy violations in psychological assessment. It is not a formality – it is an ongoing process that begins before the first test question is asked.

The APA Ethics Code Standard 9.03 requires psychologists to obtain informed consent before conducting assessments. This means explaining the nature and purpose of the assessment, who will receive the results, the limits of confidentiality, any fees involved, and giving the client the opportunity to ask questions. The client must also be informed that participation is voluntary, and that they may withdraw at any time without negative consequences.

The APA’s revised 2024 Ethics Code draft further expands these requirements for testing, assessment, and evaluation (TAE). It specifies that informed consent must cover possible benefits and unintended consequences, privacy and confidentiality risks (especially with electronic testing services), third-party involvement, and the individual’s right to ask questions and receive direct answers. This updated guidance reflects the growing complexity of how assessments are administered and how data is stored today.

The APA’s practice guidelines emphasize that informed consent must also be tailored to the individual. A form designed for adult clients looks different from one for minors, where parents or guardians must be included in the consent process and confidentiality protections explained in age-appropriate language. Forensic assessments require yet another distinct approach, given that their results may be used in legal proceedings rather than for treatment.

Confidentiality: the ongoing obligation 🔗

Once testing begins, the duty to protect privacy continues through the principle of confidentiality. Confidentiality refers to the protection of identifiable information from unauthorized persons – and it is described by the APA as a cornerstone of professional psychology, because the effectiveness of services depends on clients trusting that their disclosures will be protected.

Breaches of confidentiality – whether through loss or theft of records, misuse of computerized data, or unauthorized disclosure – can result in serious consequences. These include disciplinary action and professional sanctions by the APA, action by state licensing authorities, and civil legal proceedings if the breach causes harm to the client.

The HIPAA Privacy Rule, issued by the U.S. Department of Health and Human Services, adds a legal layer to these ethical obligations. It establishes national standards for protecting individually identifiable health information, including psychological test data held by covered healthcare providers. Under HIPAA, clients generally have the right to access their health records, request corrections, and control how their information is disclosed to third parties. Psychologists working in covered entities must comply with these rules in addition to their professional ethics codes.

It is worth distinguishing between test data and test materials here, as the two have different disclosure rules. According to the APA Ethics Code, test data includes raw scores, client responses, and the psychologist’s notes – all of which are unique to the individual client. Test materials, by contrast, include instruments, manuals, and protocols that do not contain client-specific information. Test data is subject to patient access rights under HIPAA; test materials are generally disclosed only to qualified psychologists or under court order, in order to protect the integrity of the tests themselves.

Minimizing intrusions: collecting only what is necessary 🔗

Beyond informed consent and confidentiality, ethical psychological practice requires that psychologists actively work to minimize intrusions on privacy. APA Standard 4.04 instructs psychologists to include in their communications only information that is directly relevant to the purpose for which it is being gathered.

This principle has direct implications for how tests are chosen. Not every assessment tool is equally invasive. A psychologist conducting a workplace evaluation, for example, should select instruments that measure what is relevant to job performance – not tools that probe deeply into a person’s personality or personal history when such information serves no clear assessment purpose. Research published in PMC highlights this tension particularly in the context of digital assessments, noting that some tools – such as those using social media data – may gather far more information than is necessary for the assessment goal, creating privacy risks that the client may not even be aware of.

This is not merely about limiting questions. It also means being thoughtful about how data is stored, who has access to records, and how long data is retained. Data protection research points out that psychometric data breaches carry both legal and reputational consequences – and undermine the very trust that makes psychological assessment effective. Regulations like the General Data Protection Regulation (GDPR) in Europe have reinforced this by imposing strict rules on how personal data – including psychological assessment data – is stored and processed.

Privacy in non-clinical settings: a higher risk zone 🔗

The concern about invasion of privacy is particularly acute when psychological tests are used outside of clinical treatment settings – in schools, workplaces, or research contexts. In these environments, the client may not fully understand that a test is psychological in nature, may feel coerced into participating, or may not see how the results will be used.

Legal scholars have described personality testing in schools as a potential invasion of privacy, particularly when students are subjected to structured forced-choice inventories without adequate disclosure. Critics have compared such practices to administering truth serums – an affront to personal dignity – because the test extracts information about inner thoughts that the individual has not consciously chosen to share.

The ethical obligation in these settings is the same: psychologists must ensure that consent is genuinely informed, that participation is not coerced, and that the information gathered is limited to what is necessary and relevant. The APA acknowledges that consent may sometimes be waived – for example, when testing is mandated by law or is a routine organizational activity – but even in those cases, clients must be told the nature and purpose of the assessment in understandable language.

Balancing thoroughness with respect for privacy 🔗

There is an inherent tension in psychological assessment: gathering enough information to produce a valid, clinically useful result often means asking difficult, personal questions. The goal is not to eliminate this tension but to manage it ethically.

This balance is achieved through several complementary practices. First, psychologists must select assessment tools that are appropriate and proportionate to the referral question. Second, they must communicate clearly with clients about what the process involves before it begins. Third, they must store and handle data securely, limiting access to those with a legitimate need. And fourth, they must be transparent with clients about who will receive the results and in what form.

When clients understand what a test involves, why it is being conducted, and how their information will be protected, the risk of a perceived – or actual – invasion of privacy is significantly reduced. Transparency does not compromise the quality of an assessment. It strengthens it, because clients who trust the process are more likely to engage openly and honestly.

What do you think? If you were asked to undergo a psychological assessment for employment or academic purposes, what information would you want disclosed to you before agreeing to participate? And how do you think psychologists should handle situations where a test reveals sensitive personal information the client did not anticipate sharing?

References

1. https://apps.apa.org/APACommentingPortal/attachments/Site125_Draft%20Revised%20Code_Final_Dec_2024.pdf
2. https://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=2030&context=dlj
3. https://www.polk.edu/wp-content/uploads/5-APA-Ethics_Code_2002.pdf
4. https://www.apaservices.org/practice/business/management/informed-consent
5. https://eric.ed.gov/?id=ED075473
6. https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
7. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html
8. https://pmc.ncbi.nlm.nih.gov/articles/PMC4301032/
9. https://pmc.ncbi.nlm.nih.gov/articles/PMC8261642/
10. https://blogs.psico-smart.com/blog-privacy-concerns-and-data-protection-in-psychometric-assessments-160435
11. https://www.repository.law.indiana.edu/iustitia/vol4/iss1/2/