The Nature of Privacy
posted by:Steven Davis // 08:41 PM // November 08, 2005 // ID TRAIL MIX
My blog, which is drawn from my paper Privacy, Rights, and Moral Value, consists of two parts: a definition of privacy, which includes an account of the nature of personal information, and replies to some criticisms that might be raised against my definition. I begin with a definition of privacy.
In society T, S, where S can be an individual, institution 1, or a group, possess privacy with respect to some proposition, p, and individual U if and only if
(a) p is personal information about S. (b) does not currently know or believe that p.
In society T, p is personal information about S 2 iff and only most people in T would not want it to be known or believed that q where q is information about them which is similar to p 3, or S is a very sensitive person who does not want it to be known or believed that p . 4 In both cases, an allowance must be made for information that most people or S make available to a limited number others. 5
Referring to a particular person, U, in the analysis of privacy, is to account for the fact that one can possess privacy with respect to one person, but not with respect to another. 6 If I tell my wife something about myself that I tell no one else, I do not have privacy with respect to her and the information that I impart to her, but I have privacy with respect to others. We can say that someone has absolute privacy with respect to some information about himself if no one has the information and partial privacy if there are others who possess the information, but it is not widely know or believed.
The analysis above says nothing about what it is for someone to suffer a loss of his privacy. But it is easy enough to see how this would go. Let us return to the example of the rabbi and his eating blood pudding, a report of which has appeared in a newspaper, and about which the rabbi wishes no one knows. Currently, no one has the information about the event, since everyone connected to the newspaper article has either forgotten it or passed away. Ruth reads the newspaper and discovers what the rabbi did. The rabbi would then suffer a loss of his privacy, since Ruth’s coming to know about the event is sufficient for there to be a loss of the rabbi’s privacy. In the rabbi example, the rabbi wishes that others not know about his eating food that is not kosher, but this is not necessary for a loss of privacy. 7 A loss can occur even when the person who loses his privacy is indifferent about whether others have certain personal information about him. All that is necessary is that in his society most people would not want similar information about themselves to be known or believed, except by those to whom they choose to reveal the information. A loss can occur even when the disclosure is not documented or public, for example, when I tell a friend something that I regard to be personal, who does not pass on the information or when a Peeping Tom looks through my window, who keeps what he sees to himself. 8
I would like to answer a number of criticisms that have been raised and could be raised against my account of privacy. The first criticism is that a change of mind could engender a loss of privacy. Suppose that there is some personal information about a person that he does not wish others to know or believe, but about which most people in his society are indifferent about whether others know or believe it. Further suppose that he changes his mind and is no longer sensitive about the information. It is counter-intuitive that he has lost his privacy with respect to the information, as my account would seem to suggest. What this criticism fails to take into consideration is that on my account a loss of privacy with respect to certain information can only occur if the information is personal information. After the person changes his mind, the information about him is not something about which he is currently sensitive nor are others in his society. Hence, it is not personal information about him and consequently, there is no loss of his privacy once he changes his mind. What we can say is that by changing his attitude towards the information, although he does not suffer a loss of privacy, he no longer has privacy with respect to the information. He and others in his society are indifferent as to whether it is known or believed by others. To this sort of information that is not personal the concept of privacy does not apply. 9
The second criticism of my account turns on surveillance cameras that can record our activities about which we might be sensitive. It could be argued that there is a loss of our privacy even without there being someone who views the recorded tapes of our activities, something that is required by my account of privacy and loss of privacy. 10 This criticism confuses a loss of privacy with a fear of a loss of privacy. Imagine the following cases in which there are surveillance cameras taking pictures, but in which there is no loss of privacy. There are surveillance cameras that someone has set up which records personal information about us, but before he is able to look at the recordings, he dies. There are surveillance cameras set up to record personal information about me, but I am the only person in the world. In neither case is there a loss of privacy. Thus, surveillance is not sufficient for a loss of privacy. 11
The third criticism is that the analysis does not cover everything that is included in privacy, for example what is called physical privacy. Someone comes into my home uninvited. Clearly, there is a loss of my privacy. The analysis, I believe, covers this case. The intruder has gained some information about me that I do not wish him to have, namely, visual information about what the inside of my house looks like, what sorts of possessions I have, how I arrange my dwelling etc. 12 A similar case that some might think is not covered in the analysis is the following. Imagine that I want to be alone and seek solitude by walking far out on a promontory to watch the bounding surf and think about the meaning of life. Someone who knows me spies me from afar and comes out to where I am sitting and plunks herself down beside me. She already knows what I look like and so does not come to have any personal information about me that I wish to keep from others, but some might think that she has intruded into my privacy. I think that this confuses solitude with privacy. 13 It is the former that is lost in this case, not the latter. 14
The fourth criticism is that the account of personal information that I have offered is not necessary for privacy. All that is needed is (a) and (b). 15 On this view, a person has privacy with respect to some information about himself and someone else just in case she is not aware of the information about him. Desires do not come into the picture. There are difficulties, however, with this view. Suppose that Jones has never seen me and does not know what I look like. How I look then is information that Jones lacks, but it is not the sort of information about which others in my community and I are sensitive. On the view that (a) and (b) are sufficient for privacy, I have privacy with respect to my appearance and Jones. If he were to see me in the street and thus, come to know how I look, it would follow from this analysis of privacy that I have lost my privacy about my appearance with respect to Jones, a clearly counter intuitive result. Worse still, there are rather trivial truths about me that I certainly do not care whether anyone knows, nor does anyone in my community care whether similar propositions are known about them. Consider the proposition that I am self-identical 16 and suppose that no one has entertained this proposition about me. On the view under consideration, I have absolute privacy with respect to this proposition and would suffer a loss of privacy were someone to come to believe it about me. Thus, an account of personal information that turns on desires about information is necessary for an account of privacy.
1 ‘Institution’ is meant to cover companies, governments, universities, etc.
2 For the proposition, p, to be about S, there must be a sentence, s, that contains a singular term, t, that were s to be used, t would be used referentially with S as its referent and on this use, s would express p. The proposition, p, then would be what is called a singular proposition. See Steven Davis and Brendan Gillon, Semantics: A Reader. (New York: Oxford University Press, 2004) pp. 83-88.
3 This is in the conditional, since there could be information most people have never considered, but were they to become aware of it, it would be information that they would not want to be known or believed, except perhaps by a limited number of others.
4 This is adapted from Parent, “Privacy, Morality and the Law,” p. 269 - 270.
5 On my account of privacy, someone has privacy to personal information about him, even if the personal information involves his having committed an illegal act, murdering someone, for example. If the police find out that S is the murderer, he has lost his privacy with respect to this information, but his right to privacy has not been violated, since his right to privacy about the murder is overridden by the legitimate state interest in protecting public security. This point is in reply to a criticism of the definition raised by Heidi Maibom and Fred Bennett, private communication.
6 This point is taken from David Matheson’s paper, “Privacy, Knowledge, and Knowableness,” p. 1.
7 Although as David Matheson (private communication) has noted, Ruth’s coming to believe that the rabbi has eaten blood pudding, because she had a dream about the rabbi will not do. For the rabbi to have suffered a loss of privacy, Ruth must have some warrant for her belief about him.
8 The second of William L. Prosser, “Privacy,” (1960) 48 California Law Review p. 389 torts involving privacy is that a loss occurs if there public disclosure of embarrassing private facts and Parent, “A New Definition of Privacy for the Law,” p. 306 takes it as a necessary condition for a loss of privacy that personal information has to be documented.
9 This objection is due to David Matheson, private communication.
10 This was suggested as an objection to my analysis by Steve Mann when I delivered a version of this paper in Toronto in October 2004 at the On the Identity Trail: Understanding the Importance and Impact of Anonymity and Authentication in a Networked Society research group.
11 I shall argue that in these sorts of cases there is a violation of a person’s right to privacy without there being a loss of his privacy.
12 This point was made in David Matheson’s “Privacy, Knowledge, and Knowableness,” p. 22.
13 On some views, for example, Ruth Gavison, in “Privacy and the Limits of Law,” p. 433 solitude is a kind of privacy. If this were the case, then whenever one’s solitude is lost, so too should one’s privacy. In the scenario I present, my solitude is lost, but not my privacy. Hence, solitude is not a kind of privacy.
14 See Parent, “Recent Work on the Concept of Privacy,” p. 348 for a similar point.
15 If (a) and (b) are taken to be sufficient, then there will have to be an account of what makes information personal. One way of understanding personal information is to take it to be information about a person that can be known empirically. This is the account of privacy and personal information that David Matheson offers in “Privacy, Knowledge, and Knowableness” and “The Personal and the Empirical,” (2005) On the Identity Trail. Matheson’s theory of privacy is open to the counterexamples that I offer here.
16 This proposition is an empirical proposition, since it presupposes that I exist, something that can only be known by empirical means. See footnote 53.