Back to Basics: Privacy Ethics (part 2)

So, let's continue the journey through the 'what and why' of privacy. The second argument that Jeroen van den Hoven makes in his contribution Information Technology, Privacy and the Protection of Personal Data is that 'identity relevant information' should be protected, not any data about people (see: Van den Hoven/Weckert (e.d): Information Technology and Moral Philosophy, Cambridge University Press 2008).

Argument number 2: The scope of data protection should cover 'identity relevant information'.

Van den Hoven argues that the European definition of personal data is referential. In order to be 'personal data', the data need to be about a specific person, not just any person. This means that personal data need an identity-relevant context, regardless whether the context is right or wrong. Without such context data have no meaning and are just attributive: they would describe a situation or fact without reference to any specific individual. One could also argue that attributive data are conditional; they only become personal data if another identity-relevant condition occurs, for instance because the raw data is placed in an identity-relevant context or is combined with another piece of identity relevant information.

Because of the narrow definition of personal data in the European Data Protection Directive 95/46/EC, Van den Hoven concludes that attributive data go unprotected, but may very well be used to harm people with the assistance of new technologies such as data mining, profiling, etc. The Article 29 Working Party has recently tried to protect attributive data by dramatically extending the definition of personal data to data that are only conditionally identifiable. The most striking example of this extention to attributive data is example 16 about a collection of graffiti paintings in its Opinion on the Concept of Personal Data (Opinion 4/2007, WP136).

However, this opinion of the Article 29 Working Party has serious consequences. Data protection law does not only tells us what should be protected and why, but also how. It is the 'how' where the problem lies, especially in the case of attributive data. By bringing attributive data under the protection of the Data Protection Directive, all the formalities that come with this protection regime, like notifications, privacy notices, data export restrictions, prior checking, etc, are also triggered.

The argument for bringing attributive data under the protection of the Data Protection Directive is that the Working Party [quote]"assumes that the data controller or any other person has the means likely reasonably to be used to identify the data subject" [unquote]. In other words, there is probably always somebody somewhere who can re-attach an identity-relevant context to what -for most of us- is only meaningless information. For this very reason, some Data Protection Authorities in Europe do not consider key-coded data to be anonymous.....: if somebody has the key, he or she can always apply an identity-relevant context to the coded data, and therefore such coded data should be considered 'personal data' and treated in full compliance with the Directive.

The same argument is used to bring dynamic IP-addresses under the full protection of the Directive; the Internet Service Provider can always find out who was using a particular IP-address at a particular time. The fact that the government has given itself broad powers to collect information from private databases and to combine this information with other information, is the main argument for the position that electronic footprints, such as leaving an IP-address when visiting a website, are never completely anonymous and should thus be protected by the data protection laws.

This argument directly impacts businesses that collect attributive information to improve their products and services. They don't care who made the "electronic footprints" that their customers leave behind. As long as they have no intention of sharing this information with other parties or to use the data to harm their customers, there is little privacy risk for such data.

And here we uncover the key issue in the underlying ethical and legal debate that is currently going on. As soon as a piece of information about a person is disclosed, the privacy of that piece of information is -in principle- lost forever (see also Van den Hoven). If the party that holds that piece information does not know to whom that piece of information belongs and has no intention of ever finding it out, the likely impact on the privacy of that person -now and in the future- is close to zero. It is a 'footprint' made by 'somebody'.

However, the very fact that another party, most notably the government, can force the keeper of attributive data to release the data, triggers the slumbering privacy risk. This third party may be able to attach identity-relevant information to the otherwise anonymous data. This could be done by various means, such as forcing the disclosure of the key to unlock the data, pattern recognition and data mining, or combining various pieces of data with identity-relevant information that is already in the database. According to Van den Hoven such information is then used in another "sphere of access". It is the crossing into that other sphere where the slumbering privacy issue comes to the surface.

So, the moral problem that is presented here is: Should people's "footprints" that are only attributive be protected ?

My answer to that question is a affirmative "Yes", for the simple reason that the slumbering privacy risk may reveal itself at any time, any place, sometimes intentionally, but very often by accident. Therefore, people who have access to the "footprints" of other people, should be careful as to what part of this information to reveal to the outside world, because they have no way of knowing whether the data may have identity-relevant meaning to others. Speaking "hypothetically" about a real case with strangers at a party, or putting your holiday pictures of strangers on the Internet, could be a risk to privacy and should therefore be avoided.

BUT, unlike the Article 29 Working Party, I don't think that it is necessary to bring such data under the scope of the Data Protection Directive by default. They could very well be protected by criminal law or civil/tort law, so as to address any harm that is inflicted on the individual by the misuse of these data. Where somebody intentionally or accidentally has revealed such "footprints" to other people, and by doing so has brought such data outside the original "sphere of access", the victim may very well have a valid claim on that person for violation of privacy, if this piece of information is later used to harm that person. But bringing ALL attributive footprints within the scope of data protection legislation is one big step too far.

Privacy: Who's Problem Is It ?

Last week, I was interviewed by a professor who was researching the 'economics of privacy'. He wanted to know why organizations invest in privacy protection. Are there economic drivers for establishing privacy policies? Or is privacy just a 'Lawyers Paradise'?

It is an interesting question. In her PhD-thesis, professor Overkleeft -a Dutch law professor- stated that "privacy is a mandarin science" (G. Overkleeft-Verburg, De Wet Persoonsregistraties; Norm, Toepassing en Evaluatie, 1995). What she meant with that remark is, that there are only a handful of people (lawyers, commissioners, academics) who are privvy to the details of privacy theory and privacy practice. For everybody else, privacy is just a vague feeling, a buzz word, that is often misunderstood and sometimes misused or inappropriately applied. More than 10 years later, it is a safe bet that privacy still is a Mandarin science.... at least, in Europe.

In Europe, privacy is considered a fundamental right, which is laid down accordingly in the EU Charter of Fundamental Rights. But Europe's fundamental problem is its inability to turn the fundamental right of privacy into a people's issue. Europe claims that it has the best privacy laws in the world. Or at least, the eurocrats in Brussels and the Data Protection Authorities in Europe think so. This belief is even enshrined in article 25 of Directive 95/46. The "Digital Fortress Europe"-rule prohibits data export to countries that do not have an "adequate level of protection". Europe fiercely protects the personal data of its citizens, both in Europe and abroad. But in Europe's streets nobody knows those laws, and worse..... hardly anybody cares. The bureaucrats have reduced privacy protection to a legal compliance problem. For the average man, it is hardly an issue. But in the Information Age, privacy should be a matter of concern to everybody, not only to a "happy few", such as the data protection authorities, the lawyers, and a handful of privacy-rights activists. Privacy should not be something driven by law and supervisory authorities, but something driven by internal values of organizations and governements and the need to earn the trust of their stakeholders. Privacy should be something that people care about.

Take for instance The Netherlands. There are no privacy rights groups anymore. Bits of Freedom, a small Dutch digital rights movement, decided to liquidate itself a few years ago. Even worse, the "Dutch People" got the Big Brother Award 2007 because of their lack of interest in privacy. The average Dutchman likes to say that he has "nothing to hide (except his PIN-code)". On the other hand, there are plenty of law firms around that have some sort of a privacy practice. And an increasing number of organizations, companies as well as government agencies, are appointing privacy officers, or have some other form of in-house privacy expertise.

So, the professor's question seems to be a valid one. WHY do organizations invest in privacy if their stakeholders don't seem to care much about it? The answer is probably a complex one. Some organizations seem to have a privacy progam because they want to be seen as acting responsibly towards society. They invest in privacy because of their internal values. For others, it is an issue that they think may give them a comptetitive edge in the market. They invest in privacy to win, but are probably willing to drop it, if it doesn't pay off. And for many others it is just a matter of compliance with a set of very difficult and vague laws, and they do their best to be compliant. They invest in privacy because of risk avoidance and legal compliance.
However, I am also afraid that for most organizations it is just another law with which they -consciously or unconsciously- do not to comply. They don't invest in privacy simply because their stakeholders -internal or external- don't care about it. So why bother....?

So what did I tell the professor in the end? I told him that as long as we don't have good privacy metrics that enable us to show how much organizations lose if they don't protect the privacy of their customers and employees (either in actual cost, in opportunity cost or in lost sales because of lack of trust), the primary reason for investing in privacy is legal compliance and avoidance of legal risk. As long as people remain indifferent about their privacy, there will be no incentive to invest in stronger privacy protection in organizations. Thus, privacy will remain the problem of the legal department. It is seen as a cost rather than a benefit.

When we think of how to shape Privacy 2.0 in the 21st century, we also have to figure out how to make privacy a people's issue.