Why Privacy Isn’t About Secrecy

Edit: I think my arguments here deserve more careful consideration as, upon reflection, I realize much of my point below touches on complex, nuanced trade offs that I did not fully consider at the time of writing. The main question being one of balancing free and open critique with the dissemination of unfair and untrue statements, which I did not intend to take a stance on below.

Privacy laws have been making headlines recently, not least for the massive fines that have been levied against major US corporations (https://www.enforcementtracker.com/). Personally, since I’m a consultant, I’ve been working on my CIPP (https://iapp.org/certify/cippus/), just for sake of gaining some non-technical acumen to supplement my penetration testing practice. Of course most certificates are poor representations of skill, but they help with getting clients and can draw eyes from hiring managers or recruiters, and are an unfortunate necessary evil in the market.

In any case, I decided to write this, as I came to study privacy, as closer examination of the ideas shaping privacy regulation has changed my view on the notion of privacy and why it matters to me, and why it should matter to you. I think, based on what I thought prior to studying privacy, the intuitive sense of privacy regulation is that it typically doesn’t matter if you have nothing to hide or is only valued by tin-hatty conspiracy theorists who believe they need protection from the government.

I won’t bother substantiating my sentiments about national security surveillance which I’m sure is it’s own rich and intriguing topic of moral debate, but rather focus on why “privacy” is actually something you want, and what is intended to be communicated by the common interpretation of the word isn’t actually what the law is meant to guarantee as a right.

As always, the ideas shaping privacy law are getting at something, but it isn’t totally clear based on the common literature and regulation what exactly it is they are meant to protect.

Privacy as the Right to Secrecy

The intuitive sense of the notion of privacy is the right to secrecy. In other words “no one should be able to look at something that I deem personal or private”. This doesn’t really capture the moral right though. This is just a description of one of the consequences of the intended moral right, and a fairly misunderstood one at that. Arbitrarily decreeing certain pieces of information as unable to be viewed by others for any purpose that fits the person who the information is associated with isn’t what the law is intended to protect.

Like all intellectual disciplines, “thought experiments” are useful tools for helping us understand ideas. We use that big beautiful brain to imagine a scenario that doesn’t exist and ask: what’s going on here? In this case, we’d ask: what’s the right thing to occur here? Or rather, what’s the best outcome that could occur here? So let’s use a simple example. Colloquially and tersely put, it seems the most prominent definitions of identity referenced by the texts I’ve read consider privacy to be the “right to be let alone” (https://groups.csail.mit.edu/mac/classes/6.805/articles/privacy/Privacy_brand_warr2.html). But I don’t think this captures either the core of the moral principle underpinning privacy regulation or what Warren and Brandeis are attempting to get at in their writing.

The most obvious question is why should “the right to be let alone” be guaranteed if an individual is an honest, moral person? If we’re all honest and forthright, why does it matter if we are “let alone” or not? Is it not true that if someone behaves honestly and is upstanding that their “right to be left alone” is simply unnecessary? Well, what Warren and Brandeis capture in “The Right to Privacy” fails to really establish the actual reason “the right to be left alone” is important. In fact the phrase itself is a misnomer. In their frame, they suggest that the right is the right to decree something arbitrarily personal by drawing a personal emotional attachment to a scenario or espousing some form of emotional sentiment and then going on to prevent others from their capacity to view objects or information related to an individuals expression of that sentiment, establishing the right as a necessary constraint to prevent the “mental suffering” that occurs when people perceive their right to feeling or being the way they are is impeded upon, causing mental suffering. But that’s not the only way to establish the basis of privacy as a right, and it fails to capture the reality of what is actually morally wrong with the imposition of privacy (in fact I think their frame is deeply problematic for many other reasons, but I won’t elaborate on that here).

So suppose I am a child, and I live with my parents, who are really concerned about me and want to make sure I’m on the right track in life. I have a diary, where I write about girls on the playground and my dreams of being an astronaut when I grow up. But my parents, as concerned as they are, want to be sure there are no “red flags” in my writing.

Never being concerned with my personal writing being viewed I keep my journal in my nightstand, and add a few paragraphs every night, occasionally making a pass through the pages to reflect on my life. Since I am an honest and upstanding child, nothing in my journal is of concern to me if it were viewed by someone else.

Now my parents, being a bit overzealous and worrisome, decide to sneak into my room while I’m at school and have a read through my journal. They don’t find any red flags, but when I arrive home from school I notice that the journal is displaced slightly in my desk, and arrive at the conclusion that they have view it.

In this case my personal innermost thoughts were viewed by someone else, and I was not “let alone”, but it didn’t really matter, since I’m honest and forthright and I don’t feel there will be any negative consequences of them viewing my private thoughts. So was something really morally “wrong” here? Well probably you would assume not and leave the subject there. Since as long as you’re honest, it doesn’t matter… right?

Even if I had an emotional reaction to this and felt sad or upset because it appeared my parents didn’t trust me, or didn’t care about how I would feel, was something really wrong? It might have felt bad because of how I thought about what happened, but how do I ground an argument about the right thing to do in the avoidance of a true loss of a good in nature, or in an argument about what should happen to bring about the most good despite the scenario, and not in my subjective perception of the scenario and associated emotional reaction?

The tendency to think that my parents reading my journal (in the context above) isn’t really a big deal and doesn’t matter because as long as I’m honest and of upstanding moral character no harm can come is typically how I had viewed privacy prior to reading some literature on the topic. Sure, I might have thought it would be nice if my parents trusted me and I had a space to keep my personal thoughts, but for the most part I was unbothered by the idea that anything I did, thought or wrote could be viewed by anyone else. Often times I even liked the idea that my personal reflections could be shared for the sake of building relationships and debating what is true.

So this thought experiment leaves an underwhelming impression of why the “right to be let alone” matters, or what Warren and Brandeis were trying to capture as a moral right. But let’s try another one.

Privacy Redefined

I’m going to propose and defend and alternate view of the idea of “privacy”, namely privacy as the right to control the dissemination of the information that determines how we are viewed. In this context a subjective emotional reaction isn’t the basis for the moral right to privacy but rather the objective experience of nature and the actual lessening of a good (in reality) that occurs when the constraint of an individual’s personal information being unable to be viewed arbitrary or without due case is breached.

Let’s consider another thought experiment, derived from a case referenced by Warren and Brandeis in the “The Right to Privacy” (https://groups.csail.mit.edu/mac/classes/6.805/articles/privacy/Privacy_brand_warr2.html), notably Wyatt v. Wilson, 1820. I couldn’t access the details of the case, but a gestural inclination of the topic is enough to construct a meaningful thought experiment, even if it is totally unrelated to the actual case referenced by Warren and Brandeis.

Suppose I am a prominent figure, a political leader of great esteem. My character is important to me, and it’s important that I display character, grit, good judgment and can be trusted to be a leader for my people. And suppose I fall ill, and become frail and constrained to a hospital bed, and develop jaundice and the obvious appearance of malaise and discrepancy. I look terrible, but the prognosis isn’t bad. My condition is perfectly curable and my doctor expects I will be fully recovered in a matter of weeks.

Suppose now, in this moment of illness, a group of journalists, eager to capture a juicy story, peer into the window of my hospital room and capture photos of me to share with the world in their publication with the headline “[name of ruler] falls ill, will he pull through?”. It begins to appear as though my strength and vitality is waning and I may not be able to live up to my ambitions of leading my people through the next few decades towards a place of prosperity. The journalists were unaware my condition was transient, so the public had no chance of gaining the awareness that I would soon recover, and the perception of me was suddenly impacted negatively, and my character and vitality, and therefore capacity to lead, called into question.

This is a much more interesting moral case, because as a prominent leader and operator in society I lost a much more important and dear right: the right to determine the information that is made available to others that will determine how they view me. And the means and level of detail at which that information is made available to others. I want to be understood as I truly am: a virtuous leader soon to make a resounding come back and take back my place in office to lead my people to prosperity with a passion and fervor, but I’ve now lost control of my capacity to convey the information I want to, to help people understand what I am doing, what I believe and what my intentions are.

And it’s not just what I want, it’s what is true and what will happen in reality because of the breach of the constraint that, in my moment of distress, my personal information (the state of my health and my appearance) wasn’t constrained from arbitrary view. There is now a very real consequence of the breach of this right when my people lose faith in me. There is a cost associated with restoring my public identity and regaining trust and risk associated with losing re-election.

Instead of me being able to determine how (or if) I relay information about what was happening to me, to make sure I paint the correct picture of the scenario, one piece of information was instead taken out of context by someone else and used to paint a picture of my actions and behaviors that was appealing to others and was transmitted massively through channels of media that amplified the ideas purported by the journalists and did serious damage to my character in the eyes of my peers. And my peers are not necessarily unreasonable in thinking that, if I am indeed frail, I may not be fit for office. And the information that shapes the way I am thought of broadly is left on a note of uncertainty and negativity, when in reality I am just as strong as I previously was, and the ideas that could be inferred by the information provided are totally invalid and not necessary or meaningful to convey to the public.

So perhaps the moral right we mean to get at with privacy regulation is the right to control the information that determines how we are viewed, or maybe it’s deeper than that still, and it’s the right to explain ourselves as we intend to, or the right to find the way we want to be viewed prior to having information that might paint a certain picture of our character made public and permanently available to anyone at any time. It’s very easy to make a silly comment or remark without thinking about what it could mean to someone else in another context, or even have an initial reaction and later realize that the reaction is not the way we want to be, but it took a while to find the way we wanted to react and we said something we didn’t mean in that process. If you capture the wrong thing at the wrong moment you can paint an entirely incorrect picture of an individuals character based on… well… nothing at all.

This is only further complicated by the human impulse to make edgy, incomplete, over-generalized and “intrepid” statements about what is actually true by sucking in a colloquially “true” thing and framing a statement in the context of the colloquially “true” thing being totally wrong when it really isn’t and we simply aren’t speaking precisely. A lot of harm can be inferred from theses types of statements, they are very frequently made, and even outside this context it is not practical to speak with complete precision, so there is always risk of misinterpretation and misalignment with character. The challenge of coming across as we actually are is much greater than it seems and the risk of being misinterpreted is much, much, much greater than it seems.

If anyone has the right to take information about you and use it to convey whatever arbitrary picture they might be able to paint with it, and you don’t have the right to control the information that is determining real world outcomes of others judgments of you based on the information that is publicly available, then you have lost the right to represent yourself as you wish, and as you really are, and you are privy to the whims of people who can use what you have said and done in context to create any arbitrary ideas they might be able to. Not to mention the right for certain information to eventually be forgotten if you have changed. It is not common for people to recognize the capacity for growth and a much steeper hill to climb to prove one is “not bad” when there is some evidence, no matter how old, that indicates one is “bad”.

An Example

Here’s a great example of how I am may be losing very real good in life from this phenomenon. About a year ago I applied to a software engineering job at [FAANG Company]. I went through the rigorous interview process but didn’t take it as seriously as I should’ve. I didn’t get good sleep before doing it and didn’t even really prepare that much. I was overconfident and as a result I now understand that I did very poorly. But a year has passed, I’ve grown technically and personally and I am much more than confident that I could pass their interview process now.

But consider that it may be that they have retained their previous judgement in their system somewhere, and now every time I apply to a role a recruiter or hiring manager simply has to look up my previous interview result and use that to determine whether or not I am a good candidate for the next stage of the interview process. This could be a significant barrier to me getting the chance at an interview, even if the information is old and they would be wise to ignore it and give me a chance considering I could’ve grown, they likely won’t if there are other candidates who don’t have similar negative marks, even though this is a totally incoherent and incorrect way of making this determination.

Somewhere, in their possession, is personal information describing my character that is incorrect and in the hands of someone else that I cannot control that is changing real world outcomes in my life, and it’s factually wrong at this point in my life. Life is worse by all accounts: a qualified candidate cannot get the job (wasting both [FAANG Company] and my potential), and I cannot even have the chance to rectify the mistake. This is a true loss and if I had the right to request the deletion of that information I could rectify it. If I was an EU citizen I likely could.

If privacy can be viewed not simply as the “right to be left alone” but the “right to control the information that determines how we are viewed” then I should have the right to have this information erased as I understand it does not represent me and they could never make that judgement themselves with the information they have available.

This is just one example though. How many other cases can you imagine where there exists information in the public sphere determining how you are viewed, what opportunities are available to you, how people communicate with and how many people who what type of people attempt to build relationships with you that you do not control? Do you wish you had this control? Do you understand that’s actually what “privacy” laws are intended to protect?

I didn’t until today. Now I do. And I think it’s a lot more important than I initially realized.