~ gabriella giudici

In 1890, in a classic article that many scholars now regard as a seminal work on privacy, Samuel Warren and Louis Brandeis described privacy in terms of “being let alone”¹² or being free from intrusion.¹³ This conception of privacy, as nonintrusion, is also evident in the writings of two U.S. Supreme Court justices: Louis Brandeis in Olmstead v. U.S. (1928) and William Brennan in Eisenstadt v. Baird (1972). Is such a view of privacy adequate? We should first note that some versions of the nonintrusion theory tend to confuse the condition (or content) of privacy with a right to privacy. This confusion is especially apparent in the writing of nonintrusion theorists, such as Brandeis, who defines privacy as “the right to be let alone” (Olmstead 475, Brandeis dissenting; italics added), and Brennan, who describes privacy as the “right of the individual…to be free from unwarranted government intrusion” (Eisenstadt 453; italics added).¹⁴

Another kind of problem with the nonintrusion theory is that, in defining privacy in terms of being free from intrusion, it confuses privacy with liberty. Although the two notions are closely related, they can also be distinguished from one another. Consider that privacy is essential for liberty in that it makes possible the exercise of liberty. Whereas liberty allows individuals to hold ideas that might be politically unpopular, it is privacy that enables them to disclose their ideas to certain individuals while concealing from others the fact that they hold those unpopular ideas. So it is useful to distinguish between the concepts of privacy and liberty. Unfortunately, the nonintrusion theory of privacy does not help us to do so.

Let us now consider the seclusion theory of privacy. According to this view, privacy is identified with “being alone.” One variation of this theory can be found in remarks by Ruth Gavison, who describes a person as enjoying “perfect privacy” when that person is “completely inaccessible to others”—that is, when no one has “physical access to [the individual]” (1980, 428). Another variation of the seclusion theory can be found in Alan F. Westin’s description of privacy as the “voluntary and temporary withdrawal of a person from the general society through physical [means] in a state of solitude” (Westin 1967, 7).¹⁵Warren and Brandeis also suggest a variation of the seclusion theory when they describe privacy in terms of “solitude” and the necessity for individuals sometimes to “retreat from the world” (1890, 196).

The seclusion theory, unlike the nonintrusion theory, avoids confusing privacy and liberty. And because the seclusion theory provides an account of privacy that is essentially descriptive, it avoids confusing the content or condition of privacy with a right to privacy. In describing privacy in terms of one’s being secluded from others, however, the seclusion theory tends to confuse privacy with solitude. It suggests that the more alone one is, the more privacy one has. In this scheme, it would seem to follow that a person stranded on an island in which there are no human inhabitants would have complete privacy, or what Gavison refers to as “perfect privacy.” We can, however, question whether a person in such a situation enjoys privacy in any meaningful sense. We can also ask whether one’s ability to experience solitude is essential for an individual to have privacy. Contrary to what is implied in the seclusion theory, we will see that it is possible for one to enjoy privacy while not necessarily having solitude.

Both the nonintrusion and seclusion theories address privacy concerns that pertain to physical access to individuals—that is, in the form of (physical) access through observation (as in the case of the seclusion theory) or in the form of unwarranted intrusion into one’s personal space through someone physically accessing one’s personal papers, home, and so forth (as in the nonintrusion theory). These kinds of privacy concerns are sometimes addressed under the category of “accessibility privacy” (DeCew 1997, 76). Other aspects of the nonintrusion theory pertain to concerns about interference with an individual’s ability to make certain kinds of decisions, which are sometimes analyzed under the category of “decisional privacy.” Privacy analysts note that in the United States the concept of privacy has evolved, initially being associated with intrusion (physical access), then being associated with concerns about interference (in decision making), and, more recently, being associated with concerns about the flow of personal information. So, perhaps not surprisingly, recent privacy theories have tended to analyze the concept of privacy in terms of conditions having to do with access to and control over personal information. In describing information-related privacy concerns, including access to personal information stored in computer databases, many authors now use the expression “informational privacy.” Two kinds of theories that pay particular attention to informational-privacy issues are the control and the limitation theories.

Variations of the control theory of privacy—the view that one has privacy if and only if one has control over information about oneself—can be found in the writings of Charles Fried (1990), Arthur Miller (1971), Alan F. Westin (1967), James Rachels (1975), and others (e.g., Elizabeth Beardsley [1971]). According to Fried, privacy “is not simply an absence of information about us in the minds of others, rather it is the control over information we have about ourselves” (1990, 54). Miller embraces a version of the control theory when he describes privacy as “the individual’s ability to control the circulation of information relating to him” (1971, 25). A version of the control theory is also endorsed by Westin when he describes privacy as the “claim of individuals…to determine for themselves when, how, and to what extent information about them is communicated to others” (1967, 7). And Rachels appeals to a version of the control theory of privacy in his remarks concerning the connection between “our ability to control who has access to information about us and our ability to create and maintain different sorts of relationships” (1975, 297).

Unlike the nonintrusion and the seclusion theories, the control theory of privacy separates privacy from both liberty and solitude. Perhaps the control theory’s most important insight is recognizing the role of choice that an individual who has privacy enjoys. Consider the fact that someone who has privacy is able to grant, as well as to deny, others access to information about himself or herself. But the control theory is unclear with respect to two important points, viz., in telling us: (a) which kinds of personal information one can expect to have control over, and (b) how much control one can expect to have over one’s personal information.

Regarding (a), we can ask whether someone can reasonably expect to have control over all of his or her personal information. For example, if you are seen by an acquaintance while shopping at a certain grocery store, you have no control over whether your acquaintance has gained information about the fact that you shop at this particular store (even if for some reason you do not wish this information about you to be known by that person). Perhaps the kind of personal information over which you can expect to have control is limited to “nonpublic personal information” (what some now refer to as NPI), which includes information about sensitive and confidential data, such as financial and medical records. This kind of information can be contrasted with personal information that is public in nature, or “public personal information” (PPI), such as information about where a person works, lives, shops, dines, and so forth.¹⁶ However, a distinction between one’s having control over NPI and having control over PPI is not always made—at least not explicitly—by those who subscribe to the control theory of privacy.

As noted above, control theorists are also unclear with respect to (b)—that is, how much control one can expect to have. What, exactly, are control theorists asserting when they say that one must have control over one’s personal information in order to have privacy? Are they claiming that one must have total or absolute control over one’s personal information as a necessary condition for privacy? If so, this would seem implausible on practical grounds. Consider the fact that people are required to disclose certain kinds of information about themselves in ordinary day-to-day transactions, especially those involving commerce. Control theorists need to specify more clearly how much control over one’s personal information, in particular how much control over one’s PPI versus one’s NPI, one can expect to have in order to enjoy privacy.

Control theorists can also be interpreted as holding a conception of privacy that is counterintuitive to our conventional understanding of that notion. For example, many control theorists seem to imply that one could reveal every bit of personal information about oneself and yet still enjoy privacy. However, the prospect of someone disclosing all of his or her personal information and still somehow retaining privacy, merely because he or she had control over whether to reveal that information, would seem to be counter to our intuitions about what is required for privacy, as well as to the way we use that concept in ordinary discourse. Although one could exercise one’s individual autonomy in choosing to disclose every piece of one’s personal information to others, it would be difficult to understand how one could still retain one’s privacy in that case.¹⁷ It would seem that the control theory confuses privacy with autonomy.

Let us now examine the limitation theory of privacy, variations of which can be found in the writings of Gavison (1980), Parent (1983), and others (e.g., Allen [1988]). In this scheme, one has privacy when access to information about oneself is limited or restricted in certain contexts. Gavison embraces a variation of this theory when she describes privacy as a “limitation of others’ access” to information about individuals (1980, 428). And Parent seems to endorse a version of the limitation theory when he defines privacy as the “condition of not having undocumented personal knowledge about one possessed by others” (1983, 269).

One virtue of the limitation theory of privacy is that it correctly recognizes the importance of setting up contexts or “zones” of privacy to limit or restrict others from access to one’s personal information. Another strength of this theory is that it avoids confusing privacy with autonomy, as well as with liberty and solitude. Unfortunately, the limitation theory seems to underestimate the role of control or choice that is also required in one’s having privacy; it does not take into account that someone who has privacy can choose to grant others access to information about himself or herself, as well as to limit (or even deny) others from access to that information. The limitation theory also seems to imply that one has privacy only to the extent that access to information about oneself is limited or restricted. For example, Gavison notes that an individual, X, enjoys “perfect privacy” when “no one has information about X” (1980, 428). On this view, the more one’s personal information can be withheld (or kept secret) from others, the more privacy one has. Thus, in the account of privacy offered in the limitation theory, privacy can easily be confused with secrecy.¹⁸

It would seem that each of the four traditional privacy theories examined thus far is inadequate. We saw that each confuses privacy with such notions as liberty, solitude, autonomy, and secrecy. We saw also that with respect to informational-privacy concerns the control and the limitation theories provide a better account than do the nonintrusion and the seclusion theories. Thus both the control and the limitation theories would seem to be more promising frameworks for analyzing privacy concerns affecting computers and information technology. Next we consider how key elements in these two theories can be incorporated into one unified and comprehensive account of privacy.

Moor (1990, 1997) introduced, and Moor and I (2001) expanded upon, a model of privacy referred to here as the Restricted Access/Limited Control (RALC) theory of privacy. RALC proceeds on the assumption that an adequate theory of privacy needs to differentiate the concept of privacy from both the justification and the management of privacy. Accordingly, the RALC framework has three components: an account of the concept of privacy, an account of the justification of privacy, and an account of the management of privacy. Let us briefly examine each component.

In analyzing the concept of privacy, RALC distinguishes between the condition of privacy (that is, what is necessary to have privacy in a descriptive sense) and a right to privacy. We will see how this distinction enables us to differentiate between a loss of privacy and a violation or invasion of privacy. But how, exactly, is privacy defined in this framework? According to RALC, an individual has privacy “in a situation with regard to others [if] in that situation the individual … is protected from intrusion, interference, and information access by others” (Moor 1997, 30; italics added).¹⁹ The notion of a “situation,” which has a critical role in the definition of privacy, is left deliberately indeterminate or unspecified so that it can “range over states of affairs” that we normally regard as private. A situation, says Moor, can be an “activity in a location,” a “relationship,” or the “storage and access of information, such as that stored in … or manipulated in a computer” (1990, 76). In a situation in which one is naturally protected or shielded from intrusion and access by others, one has descriptive or “natural” privacy.

RALC also draws an important distinction between a naturally private situation and a normatively private situation. In the former type of situation, individuals are shielded or blocked from observation, interference, and intrusion by natural means—for example, physical boundaries in natural settings, such as when one is hiking or camping in the woods. In a naturally private situation, privacy can be lost but not violated or invaded, because there are no norms—conventional, legal, or ethical—according to which one has a right to be protected. This is not the case, however, with normatively private situations, which can include the following: locations, such as a person’s house (where outsiders are expected to knock and get permission to enter); relationships, such as religious confessions; activities, such as voting; and information, such as medical records (Tavani and Moor 2001). In normatively private situations, one’s privacy can be violated or invaded, in addition to being lost, because of laws and norms that have been established to protect those situations.

Because the RALC theory links the concept of privacy with the notion of protecting individuals by limiting or restricting access to persons or information about persons, RALC might initially appear to be simply a variation of the limitation theory. In fact, Dag Elgesem interprets RALC, as articulated in an earlier formulation (Moor 1997), in this way when he writes:

But it seems that on [Moor’s] view, we have to admit that we always have some degree of privacy, since there will always be billions of people who have physically restricted access to us … [and] … precisely because all situations are private to some degree, it is difficult to see how the private situations are distinguished from the public ones on this theory. (1999, 289)

Moor and I (2001) have responded to Elgesem’s criticism by pointing out that the relevant public/private distinction involving situations is one that is drawn normatively and not descriptively, as Elgesem seems to infer in his interpretation of RALC.²⁰ In our reply to Elgesem, we show as well why the RALC theory is not merely another variation of the restricted-access theory by pointing out that RALC also recognizes the role that control plays in the theory of privacy—viz., in the justification and management of privacy.

We have seen that RALC defines privacy in terms of protection from intrusion and information gathering by others (through situations or zones that are established to restrict access), not in terms of control over information. In our analysis of the control theory of privacy, we saw some of the difficulties of trying to define privacy in a way that requires one to have control over one’s information. For example, we saw that there were both theoretical and practical difficulties with such a definition. Furthermore, we saw that it was possible for one to have privacy without having complete control, and to have control over information without having privacy. Yet the notion of “limited control” plays an important role in the overall (tripartite) scheme in the RALC theory of privacy.

To see how the notion of control works in the RALC framework, consider the example of one’s medical information. That information is private because a normative zone has been established to restrict people from accessing the information, not because an individual has complete control over who has access to that information within a medical setting. Doctors, nurses, financial administrators, and insurance providers may have legitimate access to various pieces of it. But why does information included in one’s medical records deserve normative protection? One justification is that individuals seek to avoid embarrassment and discrimination. Another related justification is that individuals seek control over their lives. They need some degree of control, even if limited, over whom they associate with, what jobs they hold, and what insurance plans they select. Privacy policies that protect information in a particular situation by normatively restricting others from accessing that information provide individuals with limited controls.²¹

Control is also important for the management of privacy. In managing one’s privacy, however, one need not have absolute control over information about oneself (as implied in many versions of the control theory of privacy). Instead, an individual needs to have some degree of control with respect to three elements: choice, consent, and correction. A person needs some control in choosing situations that offer others the level of access the person desires, which can range from total privacy to total publicity. One can also manage privacy through the consent process—for example, one can waive one’s right to restrict others from access to certain kinds of information about oneself. Regarding the role that correction of personal information plays in managing privacy, individuals need to be able to access their information and to amend it if necessary.²² Limited controls such as choice, consent, and correction are made possible by adequate privacy policies. In part 2 of this essay, we will see how RALC provides us with a mechanism for framing such policies.

It is perhaps worth summarizing some key features of RALC at this point. Because RALC differentiates the concept of privacy from both the justification and management of privacy, it has three important components. The concept of privacy is defined in terms of protection from intrusion and information access by others in the context of a situation. One has normative privacy in a situation where one is protected by explicit norms, policies, or laws that have been established to protect individuals in that situation. Although privacy is defined in terms of protection and restricted access, the notion of control also plays an important role in the RALC framework—both in justifying and in managing privacy. Part of the justification for framing privacy policies is that these policies provide individuals with the limited controls they need to manage their privacy. To see how an adequate privacy policy can be framed, let us apply RALC to a specific privacy issue involving information technology.

Data mining is a computerized technique that uses pattern-matching algorithms derived from research and development in the field of artificial intelligence (AI) to analyze vast amounts of information.²⁷ The use of data-mining tools has frequently led to the “discovery” of patterns in data that are implicit and nonobvious. When applied to information about persons, data mining can generate new and sometimes nonobvious classifications or categories of people. Thus, individuals whose personal information is accessible to data-mining tools can become identified or associated with newly created groups—including groups whose existence those individuals might never have imagined.²⁸ It is in this sense that data mining is sometimes said to reveal “new facts” about people.

Because current privacy laws offer individuals little to no protection with respect to how information about them acquired through data-mining activities is subsequently used, the practice of mining personal data raises some serious challenges for protecting personal privacy.²⁹ For one thing, data-mining tools have provided many information merchants with a wealth of data about individuals, which can be sold to third parties. For another thing, the process used to acquire this kind of information is not transparent to the people affected.

We should first of all ask whether the practice of mining personal data on the Internet necessarily violates or invades an individual’s privacy. Applying the RALC theory, we find that an individual, X, may indeed lose some privacy (in a descriptive sense) whenever data about X is accessed. However, we have seen that the mere loss of privacy by an individual in a particular situation does not necessarily constitute an invasion of that individual’s privacy. So it is not yet clear whether X’s privacy has been violated or invaded in a normative sense. Should all personal information currently accessible to data-mining technology be declared normatively private? In other words, does it constitute a situation in which that information should be protected in some normative sense? Alternatively, should all personal information that is currently available online to those who mine data be viewed as public information? We could begin by asking whether there is something in the nature of personal information itself—that is, some inherent feature or characteristic of that information—that could help us to answer this question.

According to the RALC theory, there is nothing in personal information per se—as a particular category or kind of information, for example—that can help us to determine whether it should be classified as public or private. Rather, it is the context or situation in which personal information is, or can be, used by others that we must take into consideration in determining whether some particular kind of personal information should or should not be declared normatively private.

Because of the role that specific contexts play in determining when personal information should be granted normative protection, it might seem that privacy standards in the RALC theory are simply arbitrary. Moor (1997, 30), however, shows why this is not so, in his discussion of a case in which we are asked to determine whether information regarding salaries for college professors should be construed as public information that does not need normative protection or be construed as private information that deserves normative protection. Moor notes that we can have good reasons for making information about faculty salaries public in one context—for example, at state colleges; alternatively, we can have good reasons for declaring this same kind of information to be normatively private in other contexts—for example, at small private colleges. So, in the RALC theory there is nothing inherent in information pertaining to faculty salaries per se that tells us whether or not this information, in general, should be protected as a normatively private situation.

As Moor indicates, it is always the situation or the zone, not the kind of information itself, that is used in determining whether information should be normatively protected. This distinction is helpful in analyzing a problem that Nissenbaum describes as the challenge of protecting “privacy in public” (Nissenbaum 2004), which is also a key issue in the controversy over data mining.

Nissenbaum points out that although we have privacy norms (that is, explicit privacy laws and informal privacy policies) that protect personal information considered to be intimate and sensitive—for example, medical records and financial records—normative protection does not generally extend to personal information considered to be neither sensitive nor intimate. She also indicates that most normative accounts of privacy have a theoretical “blind spot” when it comes to questions about how to protect personal information in public contexts or in what she calls “spheres other than the intimate” (Nissenbaum 1998). Her analysis of this problem illustrates some of the controversies associated with the practice of mining personal data from “public” sources. At first glance, such a practice might seem innocuous because of the public aspect of the data involved. Nissenbaum, however, exposes and questions two assumptions regarding the status of personal information in the public sphere: that (a) “there is a realm of public information in which no privacy norms apply” and (b) “an aggregate of information does not violate privacy if its parts, taken individually, do not” (2004, 455 and 458).³⁰

Information merchants that use data-mining techniques might be inclined to defend their practices by appealing to the kind of reasoning found in (a) or (b), or both. But do (a) and (b) provide adequate grounds on which to construct an online privacy policy for collecting and processing personal information in the commercial sphere? To comply with RALC, the assumptions in (a) and (b) would first have to be made explicit and then be justified in the court of rational debate. RALC requires that the parameters of a situation involving access to personal information are “completely public” and known to all those in or affected by a situation. The rules and parameters defining the situation must be explicit and public, and individuals must have the opportunity to debate whether or not a certain situation should be declared normatively private. These requirements are specified in Moor’s Publicity Principle, which states:

Rules and conditions governing private situations should be clear and known to the persons affected by them. (1997, 32; italics Moor)³¹

Let us now consider how this principle can be applied to situations involving the mining of personal information.

To comply with the Publicity Principle, an adequate online privacy policy affecting data mining would need to spell out clearly the privacy requirements for online consumers who engage in commercial transactions with Web sites that use data-mining technology. These consumers must first be informed that data-mining techniques are being used by those Web sites. Furthermore, the consumers must be told that information about them acquired via data mining could subsequently be used in ways they might not have explicitly authorized, and that these uses could threaten their privacy. In this scheme, the onus would no longer be on consumers to discover for themselves that data-mining practices are used in online contexts. Instead, it would be incumbent upon online businesses to inform consumers whether and how data-mining practices are being used and how a consumer’s personal information can be affected.

Why do online consumers need to be explicitly told that information about them is being acquired via data-mining techniques? For one thing, it would not be reasonable to expect that average consumers would be aware that this kind of technology exists and is used to make important decisions about them, such as in determining their credit scores. By having an explicit policy in which consumers are made aware of the existence of data-mining practices and their implications, consumers could negotiate with online business about how their personal information will be used once it has been collected. The ability for consumers to have some say in how their personal information can subsequently be used by businesses would certainly seem to be a key component in any privacy policy that purports to be open or transparent. It would also comply with RALC’s Publicity Principle, which requires the explicit consent of the consumer to have his or her data be used for data-mining purposes.

Although many (if not most) users would likely opt out of having their personal data mined, some might be inclined to opt in because of potential financial advantages. For example, some consumers might elect to participate if, in return, they are offered discounts or rebates on items purchased.³² The important point, of course, is that online consumers who chose to participate would be explicitly aware of what the rules are because the process is open or transparent. Furthermore, they would be able to make informed choices (that is, they would have limited control) about whether and how their personal data could be used.

Alternative proposals for addressing privacy issues generated by data-mining technology have also been advanced. Some proposals advocate the construction of new categories of privacy protection, while others call for privacy solutions that are technology based. I will briefly describe an example of each. Anton H. Vedder (2004) has argued for a new category of privacy protection, which he calls “categorical privacy” because it concerns privacy issues that he believes are peculiar to data mining.³³ Although Vedder’s scheme helps us to identify some of the specific privacy-related concerns associated with data-mining technology, it does not provide us with either a systematic or a comprehensive solution to online privacy concerns associated with similar kinds of information technologies.³⁴

A different kind of proposal has been advanced by advocates of technology-based solutions, such as privacy-enhancing technologies (or PETs). Those who support this view believe that PETs empower users by enabling them to control their privacy in online transactions. Unfortunately, however, technology-based solutions such as PETs, like proposals to expand categories of privacy protection for data mining, do not provide systematic or comprehensive approaches to resolving the broader dimensions of privacy issues affecting online activities.³⁵ Both kinds of proposals suggest solutions that are narrow and ad hoc, in that they focus on concerns that are specific to data mining per se, as opposed to broader concerns about online privacy in general. A virtue of RALC is that it enables us to address online privacy concerns affecting data mining without having to expand upon our existing categories of privacy protection, as Vedder proposes, or without having to design tools or technology-based solutions, such as PETs, that can at best function as a “quick fix” to privacy concerns that need to be understood in a context much broader than the specific technologies that generate them.

Alternatively, we have seen how RALC enables us to frame a privacy policy for data mining that also has broad applications in online contexts. For example, the same procedure used in determining whether personal information accessible to data-mining technology should be declared a normatively private situation can also be applied in the analysis of other online privacy controversies that qualify as “situations.” Consider, for example, privacy controversies surrounding Internet cookies. Applying RALC, we can use a similar procedure to decide whether personal information currently accessed by cookies technology should be protected as a normatively private situation. Again, there is no need to frame a new category of privacy protection or to depend on new tools (for example, PETs) to address privacy concerns associated with cookies. In this way, RALC offers us a comprehensive and systematic procedure for addressing online privacy concerns that can affect a wide range of technologies.