- What Kind of Vegetable Are You?
- Footprints and Fingerprints
- Fair Information Practice Principles
- Always On
This chapter is from the book
This chapter is from the book
This chapter is from the book
Fair Information Practice Principles
An earlier information revolution, set in rooms full of disk drives that sprouted in government and corporate buildings in the 1960s, set off a round of soul searching about the operational significance of privacy rights. What, in practice, should those holding a big data bank think about when collecting the data, handling it, and giving it to others?
In 1973, the Department of Health, Education, and Welfare issued “Fair Information Practice Principles” (FIPP), as follows:
Openness. There must be no personal data record-keeping systems whose very existence is secret.
Disclosure. There must be a way for a person to find out what information about the person is in a record and how it is used.
Secondary use. There must be a way for a person to prevent information about the person that was obtained for one purpose from being used or made available for other purposes without the person’s consent.
Correction. There must be a way for a person to correct or amend a record of identifiable information about the person.
Security. Any organization creating, maintaining, using, or disseminating records of identifiable personal data must assure the reliability of the data for its intended use and must take precautions to prevent misuses of the data.
These principles were proposed for U.S. medical data but were never adopted. Nevertheless, they have been the foundation for many corporate privacy policies. Variations on these principles were codified in international trade agreements by the Organisation for Economic Co-operation and Development (OECD) in 1980 and within the European Union (EU) in 1995. In the United States, echoes of these principles can be found in some state laws, but federal laws generally treat privacy on a case-by-case, or “sectorial,” basis. The 1974 Privacy Act applies to interagency data transfers within the federal government but places no limitations on data handling in the private sector. The Fair Credit Reporting Act applies only to consumer credit data but does not apply to medical data. The Video Privacy Act applies only to videotape rentals but not to on-demand movie downloads, which did not exist when the act was passed. Finally, few federal or state laws apply to the huge data banks in the file cabinets and computer systems of cities and towns. American government is decentralized, and authority over government data is decentralized as well.
The United States is not lacking in privacy laws. But privacy has been legislated inconsistently and confusingly and in terms dependent on technological contingencies. There is no national consensus on what should be protected and how protections should be enforced. Without a more deeply informed collective judgment on the benefits and costs of privacy, the current legislative hodgepodge may well get worse in the United States.
The discrepancy between American and European data privacy standards threatened U.S. involvement in international trade because an EU directive would prohibit data transfers to nations, such as the United States, that do not meet the European “adequacy” standard for privacy protection. In 2000 the European Commission created a “safe harbor” for American businesses with multinational operations, but the European Court of Justice declared it inadequate to protect the rights of European data subjects. In 2016, the FTC developed an alternative, Privacy Shield, with a salient enforcement difference: “While joining the Privacy Shield Framework will be voluntary, once an eligible company makes the public commitment to comply with the Framework’s requirements, the commitment will become enforceable under U.S. law.”19
In 2020, The Court of Justice of the European Union (CJEU) ruled that even Privacy Shield was inadequate, because European citizens’ data in the United States would be subject to U.S. government surveillance.20
Privacy as a Basic Right
Browse the Web on a visit to Europe, and you may notice a profusion of pop-ups and banners. Every site, it seems, wants you to consent to the use of cookies and the “processing of your data,” assertedly to improve your browsing experience. While European law takes a stronger view of personal privacy as a fundamental right, European advertisers are just as eager to gather personal data as those in the United States. These banners are the means of asking for “consent to data processing,” as the E-Privacy Directive required.
In 2018, the General Data Protection Regulation (GDPR) established specific individual rights in personal data and obliged businesses to give individuals (“data subjects”) the ability to control the use of that data. Those who collect or process personal data must be able to justify the privacy intrusion based on consent or another “legitimate purpose”; for example, an email provider needs the email addresses of your contacts in order to send emails to their destination, but it doesn’t need their home addresses. Individuals even have the right to withdraw consent, demanding that providers erase the data collected about them. Because the GDPR asserts extraterritorial reach, applying to European citizens wherever they are physically located, many providers outside Europe have also adopted cookie-consent requests and adapted their data handling to be able to respond to data deletion requests.
Despite the paper promise of European law, as of 2020, enforcement has been limited. Only one major fine has been issued, against Google for 50 million euros (roughly $54 million), or about one-tenth of what Google generates in a single day’s ad sales. Without investigation of the hundreds of complaints raised by citizens to their national data protection authorities, it is difficult to say whether Europeans have more privacy online or just more pop-ups to click through.
It is, unfortunately, too easy to debate whether the European omnibus approach is more principled than the U.S. piecemeal approach, when the real question is whether either approach accomplishes what we want it to achieve. The Privacy Act of 1974 assured us that obscure statements would be buried deep in the Federal Register, providing the required official notice about massive governmental data collection plans; it was better than nothing but provided “openness” only in a narrow and technical sense. Most large corporations doing business with the public have privacy notices, and virtually no one reads them. Only 0.3% of Yahoo! users read its privacy notice in 2002, for example. In the midst of massive negative publicity that year, when Yahoo! changed its privacy policy to allow advertising messages, the number of users who accessed the privacy policy rose only to 1%. None of the many U.S. privacy laws prevented the warrantless wiretapping program instituted by the Bush administration, nor the cooperation with it by major U.S. telecommunications companies.
Indeed, cooperation between the federal government and private industry seems more essential than ever before for gathering information about drug trafficking and international terrorism—because of yet another technological development. Twenty years ago, most long-distance telephone calls spent at least part of their time in the air, traveling by radio waves between microwave antenna towers or between the ground and a communication satellite. Government eavesdroppers could simply listen in. Now many phone calls travel through fiber-optic cables instead, and the government is tapping this privately owned infrastructure.
High privacy standards have a cost. They can limit the public usefulness of data. Public alarm about the release of personal medical information has led to major legislative remedies. The Health Insurance Portability and Accountability Act (HIPAA) was intended both to encourage the use of electronic data interchange for health information and to impose severe penalties for the disclosure of “protected health information,” a very broad category including not just medical histories but, for example, medical payments. The bill mandates the removal of anything that could be used to reconnect medical records to their source. HIPAA is fraught with problems in an environment of ubiquitous data and powerful computing. Connecting the dots by assembling disparate data sources makes it extremely difficult to achieve the level of anonymity that HIPAA sought to guarantee. But help is available, for a price, from a whole industry of HIPAA compliance advisors. If you search for HIPAA online, you will likely see advertisements for services that will help you protect your data and also keep you out of jail.
At the same time as HIPAA and other privacy laws have safeguarded our personal information, they are making medical research costly and sometimes impossible to conduct. It is likely that classic studies such as the Framingham Heart Study, on which much public policy about heart disease was founded, could not be repeated in today’s environment of strengthened privacy rules. Dr. Roberta Ness, president of the American College of Epidemiology, reported that “there is a perception that HIPAA may even be having a negative effect on public health surveillance practices.”21
The five FIPP principles, and the spirit of transparency and personal control that lay behind them, have doubtless led to better privacy practices. But they have been overwhelmed by the digital explosion, along with the insecurity of the world and all the social and cultural changes that have occurred in daily life. Fred H. Cate, a privacy scholar at Indiana University, characterizes the FIPP principles as almost a complete bust:
Modern privacy law is often expensive, bureaucratic, burdensome, and offers surprisingly little protection for privacy. It has substituted individual control of information, which it in fact rarely achieves, for privacy protection. In a world rapidly becoming more global through information technologies, multinational commerce, and rapid travel, data protection laws have grown more fractured and protectionist. Those laws have become unmoored from their principled basis, and the principles on which they are based have become so varied and procedural, that our continued intonation of the FIPP mantra no longer obscures the fact that this emperor indeed has few if any clothes left.22
Only sects such as the Amish still live without electricity. It is almost that unusual to live without Internet connectivity, with all the fingerprints it leaves of your daily searches and logins and downloads. Even the old “over-the-air” TV is rapidly disappearing in favor of digital communications.23
Digital TV brings the advantages of video on demand, but with a steep privacy cost. Your television service provider records everything you watch, and when. It is so attractive to be able to watch what we want when we want to watch it that we don’t miss either the inconvenience or the anonymity of the days when all the TV stations washed your house with their airwaves. You couldn’t pick the broadcast times, but at least no one knew which waves you were grabbing out of the air.
Privacy as a Right to Control Information
Privacy is complex and under attack from our peers, our own devices, and governments and corporate marketers. The bits are everywhere; there is simply no locking them down, and no one really wants to do that anymore. The meaning of privacy has changed, and we do not have a good way of describing it. It is not the right to be left alone, because not even the most extreme measures will disconnect our digital selves from the rest of the world. It is not the right to keep our private information to ourselves because the billions of atomic factoids don’t lend themselves to being simply and uniquely classified as either private or public.
Which would we prefer: the new world with digital fingerprints everywhere and the constant awareness that we are being tracked, or the old world with few digital footprints and a stronger sense of security from prying eyes? And what is the point of even asking the question when the world cannot be restored to its old information lockdown?
In a world that has moved beyond the old notion of privacy as a wall around the individual, we could instead regulate those who would inappropriately use information about us. If I post a YouTube video of myself dancing in the nude, I should expect to suffer some personal consequences. Ultimately, as Warren and Brandeis said, individuals have to take responsibility for their actions. But society has drawn lines in the past around which facts are relevant to certain decisions and which are not. Perhaps, the border of privacy having become so porous, the border of relevancy could be stronger. As Daniel Weitzner explains:
New privacy laws should emphasize usage restrictions to guard against unfair discrimination based on personal information, even if it’s publicly available. For instance, a prospective employer might be able to find a video of a job applicant entering an AIDS clinic or a mosque. Although the individual might have already made such facts public, new privacy protections would preclude the employer from making a hiring decision based on that information and attach real penalties for such abuse.24
There can still be principles of accountability for the misuse of information. Some ongoing research is outlining a possible new web technology to help ensure that information is used appropriately when it is known. Perhaps automated classification and reasoning tools, developed to help connect the dots in networked information systems, can be retargeted to limit inappropriate use of networked information. A continuing border war is likely to be waged, however, along an existing free speech front: the line separating my right to tell the truth about you from your right not to have that information used against you. In the realm of privacy, the digital explosion has left matters deeply unsettled.
Paul Ohm posits a “database of ruin”:
Almost every person in the developed world can be linked to at least one fact in a computer database that an adversary could use for blackmail, discrimination, harassment, or financial or identity theft.25
We must, through a combination of law, technology, and norms of behavior, find ways to avoid a mutually assured privacy destruction.
A few beacons of hope come from state lawmakers, most notably in California, and a growing culture of privacy among engineers. Some corporate privacy notices are still boilerplate, but others give the impression that privacy is a product feature, designed to add value for users and respond to their needs.