In debates regarding access and control of personal information, it is sometimes argued that an appropriate balance needs to be struck between individuals and organizations: individuals claim that they should be able to control who has access to their information, and organizations, including government and business groups, claim to need that information in order to make appropriate decisions. how can a reasonable resolution be reached that would satisfy both parties?