• Aucun résultat trouvé

American expectations of privacy in an information age


Academic year: 2021

Partager "American expectations of privacy in an information age"

En savoir plus ( Page)

Texte intégral


Jeffrey A. Meldman

January 1981

CISR No. 66 Sloan WP No. 1180-81

* Copyright .1981 J. A. Meldman. The text of this paper was originally presented at the Fourteenth Annual Hawaii

International Conference on Systems Science, Honolulu, Hawaii, January 1981.


Rapidly increasing applications of computer-based information technology in realms of social activity have had considerable impact on society itself. This is cer-tainly to be expected. The exchange and use of information about individual persons lie at the very heart of such

private social institutions as banking, credit, insurance, and even medical care. Numerous governmental activities such as taxation, census taking, licensing of drivers, etc., also rely greatly on personal information. More personal social relationships such as trust, friendship, and love depend even more critically on the personal information

1 that individuals choose to share with one another. As technology provides faster and cheaper means to collect, maintain, and exchange personal information, the social arrangements based upon this information are necessarily

affected. One social value that is particularly affected is the expectation of privacy.


There is no universally accepted definition of privacy. The word usually denotes an individual's expectations of control over information about himself. But this encom-passes expectations of several kinds. Perhaps most funda-mentally, it denotes an individual's expectations to be free from undue intrusion. Most individuals expect some degree of privacy in the sense of being undisturbed and

unobserved within certain boundaries that society recognizes as their private domains. The expectations may apply to physical domains, such as an individual's home, or to less tangible domains, such as the information contained in a diary.

There is a second set of expectations concerning freedom from undue dissemination. These involve circum-stances in which an individual reasonably expects his name or photograph or other personal information not

to be disclosed by someone else to other individuals or to the public at large. These expectations may apply to infor-mation improperly obtained by an intrusion (e.g., from a stolen diary), as well as to information entrusted to

someone else for a specific purpose (e.g., census information). A third set of expectations, one that only recently

has become part of the notion of privacy, concerns the fairness of decisions made about an individual. To a more and more explicit extent individuals are coming to expect,


whenever decisions must be made about them on the basis of personal information, that the information be accurate, relevant, and complete. As a consequence, individuals will often expect to be able to see the "files" that

government agencies and private organizations maintain about them.

There is strong evidence of a substantial and growing concern among the American public over threats to their expectations of personal privacy. A recent study of

public attitudes toward privacy reveals 64 percent of the public expressing such concern as of December 1978. A similar study conducted a year earlier evoked concern from only 47 percent of the public. The later study also

found that 50 percent of the computer industry executives surveyed, and 74 percent of the members of Congress surveyed shared the public's concern.2 (See Table 1.) Seventy-six percent of the American public (and 67 percent of the

computer industry executives) expressed the opinion that the right to privacy is as fundamental for the individual and for a just society as are life, liberty, and the

pursuit of happiness. In regard to intrusion and dis-semination, the public ranked finance companies and credit bureaus first among all organizations both for asking for more personal information than is necessary and for not

doing enough to keep personal information confidential.4 (See Table 2.) Only 38 percent of the public trust the


N CO ul O (N r -i N -N O e' c- -4 N C) LA C ) m ', co N ,9 -?' Ur a %D LO -4 I CN LA cn o o LO (v v 0 ; v C, ? 1 CS C m i"-r` I-cn a) tH ns -I , ' d a) a) o a) x 4-) 4.3 m 4.) n >- a) a) Cz U E U) 4 64 .4 rd .O a) 4 U U T H U 0 r U H oN (., r- 0 -1 1-4 rdp a), Z~r-O -W ' 31


(( w Q r-4Z U


Z -H U 0 u dPI 0 ra _ 3 ( Va) 0z $4 U 8 dP r,ja) U CN (N (N m r" CN 1-4c ;>. -I >1 0 a4 0 r> 0 ai) a a) r4 3 0O 0 >. '4 E- dP y e-k+ -I ) _+ (0 2J. -U r r_ V ,-4 1-4,.. v U) 4-)1 z *. a a) r. 0 co C -__. ___·____________^___



QUESTION: Which organizations ask for more personal information than is really necessary?


QUESTION: Which organizations should be doing more to maintain

confidentiality of cersonal information? Responses (%) Finance companies Credit bureaus Insurance companies Internal Revenue Service

Credit card companies The CIA


Government welfare agencies

Newspapers, magazines, and television


Employers Hospitals

The Census Bureau

Local police

Congressional committees

Social Security Administration

The telephone company Private doctors 45 44 38 38 37 34 33 32 31 29 25 24 24 23 22 21 17 11 Organization Responses (%) Credit bureaus Finance companies Credit card companies

Government welfare agencies Internal Revenue Service Insurance companies The FBI


Newspapers, magazines, and television

Local police

Congressional committees Banks


Social Security Administration The Census Bureau


The telephone company Private doctors Organization 45 43 42 41 37 37 35 34 34 34 31 30 29 27 26 23 22 17 - -.. . .1 1 - -.- ,, - -- , -


, _ , _ _- --.


-federal government to use personal information properly, and only 36 percent trust business organizations to do the same.5 Fifty-four percent of the public--and 53 percent of computer industry executives--believe that the

pres-ent uses of computers are an actual threat to personal privacy.6

The public's concern about privacy and its specific expectations with respect to intrusion, dissemination, and fairness in decision making must, of course, be balanced against other social values. Among these are the economic efficiency of commerce, the public's right to know, and the freedom of speech and press. As in so many other situations of conflicting social goals, the law has had to deal with this balance. The legal doctrines that have evolved with respect to privacy have established the

boundaries within which an individual's expectations of privacy are socially recognized. It is not surprising that this evolution often has had to be responsive to new technologies and practices related to information.

American privacy law has evolved along three distinct paths: the right to sue a person or organization for a

tortious invasion of one's privacy, the constitutional right against governmental invasion of privacy, and the protection afforded by statutes against privacy invasions

related to the files of personal information maintained by private and governmental organizations. The last of

these most directly affects today's computer-based infor-mation activities, but it will be helpful first to look


briefly at the conceptual development of privacy law along the first two paths.

The earliest path in the evolution of privacy

law was in the area of torts. Torts are private wrongs (like battery and defamation) for which one party sues another for compensatory damages. Unlike similar suits based on contractual promises, tort suits are based on a set of pre-existing rights and duties recognized by the courts. Until about 100 years ago, privacy was not among these recognized rights. In 1881 a woman was awarded damages for an intrusion, during her childbirth, of a

man pretending to be a medical assistant. But such cases were then rare. In 1890 the right to privacy was first

explicitly formulated in a now famous law review article by Louis Brandeis (then an attorney practicing in Boston)

and his law partner Samuel Warren. Warren and Brandeis were concerned about a new technology--instantaneous photography--in conjunction with the sensationalistic practices of many of the newspapers of the time. They viewed the taking of an unauthorized photograph of an

individual as an unacceptable intrustion into the indivi-dual's private domain. The unauthorized circulation of

such a photograph, in their view, was an unacceptable

dissemination of something that only the individual should have the right to make public. After reviewing the


evolution of American tort law, which they rightly

characterized as recognizing more and more the intangible aspects of both person and property, they called upon the courts to recognize explicitly the general concept of a right to privacy.

The courts were rather slow to follow their sugges-tion. It was not until 1905 that a state supreme court

(Georgia) decided that privacy was among the recognizable rights that private citizens enjoyed vis-a-vis each

other.9 The court awarded damages to a plaintiff whose name had been used without his permission in a testimonial advertisement. Today, through court decisions and legis-lative actions, similar rights are recognized throughout the various jurisdictions of the United States. While the details differ from state to state, the full comple-ment of these tortious invasions of privacy can be

summarized as follows:l0

(1) Appropriation, for the defendant's advantage of the plaintiff's name or likeness.

(2) Intrusion upon the plaintiff's seclusion, or into his private affairs.

(3) Public disclosure of embarassing private facts about the plaintiff.

(4) Publicity which places the plaintiff in a false light in the public eye.


These four forms of invasion establish rules that help to determine boundaries within which intrusion is

legally unacceptable and outside of which dissemination is legally unacceptable.

The second major path of privacy law has been in the area of constitutional protection from governmental

invasion. While the Constitution nowhere mentions pri-vacy explicitly, several of the rights enumerated in the

first ten amendments (the "Bill of Rights") embody various aspects of personal privacy. For example, the First

Amendment right of assembly ("freedom of association") was held in 1958 to have been violated by an Alabama

statute that required the N.A.A.C.P., as an out-of-state corporation, to deliver its membership list to the state.1 1 The Supreme Court held that the N.A.A.C.P.'s claim of

immunity from state scrutiny of membership lists "is so related to the right of the members to pursue their lawful private interests privately and to associate freely with others in so doing as to come within the protection of the Fourteenth Amendment."1 2 (The Fourteenth Amendment brings most of the protections of the Bill of Rights

into operation against state governments much as they operate themselves against the federal government.) Recall, however, that another portion of the First Amendment--the freedom of speech and press--involves


rights that inherently oppose the right to privacy. It was not until 1965 that the Supreme Court

explicitly declared a constitutional right to privacy. In Griswold v. Connecticut the Court struck down a

Connecticut statute prohibiting -the use of contraceptives, holding that this activity fell within certain consti-tutionally protected zones of privacy that had to be

protected if full meaning was to be given to the enumerated rights in the first ten amendments. Besides the First Amendment right of assembly just mentioned, the Court

pointed to the Fourth Amendment right against unreasonable search and seizure, the Fifth Amendment right against self-incrimination and the right to due process, and the

Third Amendment right against the quartering of troops in one's home. In the abortion decisions in 1973, the

Court followed the precedent it had established in Griswold, holding that the right to privacy "is broad enough to

encompass a woman's decision whether or not to terminate her pregnancy."

The component rights from which the Supreme Court fashioned the constitutional right to privacy are mainly concerned with preventing governmental intrusion. The one exception is the Fifth Amendment right to due process. Loosely speaking, this affords to an individual a

guarantee of fairness in the making of decisions by which


the government might deprive him of his life, liberty or property. In many cases this implies a judicial proceeding, such as a trial or hearing, with certain

traditional (and presumed) fairness safeguards--the right to present and to cross-examine witnesses, the rules of evidence, etc. (The Sixth Amendment expands these rights of fairness in the case of criminal prosecutions, but

this was not included in the privacy-related rights

out-lined in Griswold.) Similar expectations of fair treat-ment in the decision-making process, with respect to private organizations as well as to government agencies

have become a major component of privacy law as it is emerging in the third path, the statutory protection of privacy.

Congressional concern about the protection of privacy began in earnest in the mid-sixties, chiefly in response

to a proposal to establish a National Data Center, a

central statistical pool of personal information to be

assembled and shared by all federal agencies.l5 The pro-posal, along with a review conducted by the Bureau of

the Budget,1 6 neglected any consideration of possible privacy problems, and to many of its critics, the whole

project raised the spectre of George Orwell's "Big

Brother." Hearings held before a House Subcommittee

during the summer of 1966 revealed a growing concern that


____lpll_^__···___(_____·_^---law and in constitutional ____lpll_^__···___(_____·_^---law- would be difficult to

apply directly to the possible abuses posed by computer-17

based information files. For several reasons, includ-ing these privacy objections, the proposal was never carried out. Nonetheless, the proposal pointed out what appeared to be a growing need for legislative safeguards aimed directly at large-scale data bases, manual as

well as automated, in the hands of private organizations as well as in the hands of government.

The first significant piece of federal privacy legislation was the Fair Credit Reporting Act of 1970.1 Under this statute, a person who is denied consumer credit as a result of an unfavorable credit report has the

right to be told the name and location of the credit reporting agency that supplied the report. The consumer can then go to the reporting agency, which is obligated to tell the individual the nature and substance of the consumer's file. It should be noted that the consumer does not have the right to see or to copy the file itself. (However, most of the large credit reporting agencies today will voluntarily provide a copy of the report for a fee of about five dollars.) If the consumer disagrees with the accuracy or completeness of the

information contained in the file, he may, after


the agency has had an opportunity to correct or reaffirm the contents, append a short statement stating the facts from the consumer's point of view. The reporting agency is required thereafter to disseminate the consumer's statement to whomever it disseminates the file itself.

(In practice, many reporting agencies have been found to disseminate only a note that a dispute exists about which information is available upon further request.19). This is an early example in which a certain amount of information fairness is required of a private organization.

In 1974 the Family Educational Rights and Privacy Act (the "Buckley Amendment") afforded similar rights to

students (or, in the case of minors, to their parents). 20 Under this legislation, students have the right actually

to see and to copy their files ("education records"), the right to a hearing if they disagree with the accuracy or completeness of the files, and again the right to append a statement if the hearing does not resolve the dispute

to their satisfaction. In addition educational institutions are now under strict regulation with regard to the dissemi-nation of students' education records, both to persons

outside the institution and to some persons within the institution. Each institution is also required to prepare and to distribute to students a detailed statement of its privacy policy.


of 1974.21 This is the most comprehensive federal privacy legislation enacted in the U.S., and it has served as

a model for several state privacy laws. As it was origi-nally introduced into the Senate, the bill would have regulated data bases in private organizations as well as in government agencies. 2 (This was the approach later


to be taken in some of the European privacy laws. ) In the version that ultimately passed, only federal agencies were covered, but a Privacy Protection Study Commission was established to look into the question of privacy

regulation in the private sector.

The Privacy Act regulates the collection, maintenance, and disclosure of records about individuals, whether these records are manual or automated. Some of the highlights of the act are illustrated in Figure 1. In the figure,

the outer box represents a federal agency, and the inner box represents its system of records.

The act protects against undue intrusion by requiring an agency, to the greatest extent practicable, to request personal information directly from the data subject (not from a third party) whenever the information may result

in adverse determinations about the individual's rights, benefits, and privileges. Then, in making the request, the agency must inform the individual of the legal

authority authorizing the request, whether compliance is


data subject

third parties


~ ~ ~~~~

I n I] l~ I _


not when data can result

in adverse determination

flu Ild I I I fly I i L




FIGURE 1 ! I - -_ _ _ __ ] ._


_ _ X _ -7






mandatory or voluntary, the principal purpose for which the information will be used, other routine uses that may be made of it (including disclosures outside of the agency), and the consequences, if any, to the individual for not supplying the information. Theoretically, this permits the individual to make an informed decision about whether or not to supply the information. Another pro-vision of the act prohibits most federal, state and local government agencies from denying any right, benefit, or privilege to an individual for refusing to disclose his social security number, absent statutory authority to the contrary.

Federal agencies may maintain in their records only such information as is relevant and necessary to their

legally defined purposes. They may not maintain information concerning individuals' exercise of their First Amendment rights. Records must be maintained with sufficient

accuracy, relevance, timeliness and completeness to assure fairness in determinations about the individual.

The act provides explicitly for access by the data subject not only to his files but also to a log that

must be kept of external disclosures. If the data subject wishes to dispute the contents of the file he may request an amendment and then, if he wishes, an agency review of the outcome of his request. If he is still dissatisfied, he may take the dispute directly into Federal Court.


With respect to dissemination, personal information may be disclosed within the agency only to those employees who have a need for the record in the erformance of

their duties. Outside of the agency it may normally be disclosed pursuant only to written permission of the data subject or to a previously indicated routine use. Federal agencies are also prohibited from selling or renting mailing lists, except where specifically author-ized by law.

In addition to these restrictions on collection, maintenance, and disclosure, the act requires agencies to

publish annual notices describing the nature of the

personal records they keep, and to establish appropriate administrative, technical, and physical safeguards to insure the security of these records.

As was mentioned above, the Privacy Act also estab-lished a Privacy Protection Study Commission. One of its charges was to investigate information practices in the private sector and to make recommendations concerning possible mandatory and voluntary remedies where needed. The commission held hearings for two years, paying parti-cular attention to credit, financial, medical, insurance, educational, and employment record-keeping practices. As a result of these hearings, the commission found an

accelerating trend toward the accumulation in organizations' records of more and more personal details of individuals.


--It found that organizations tend to make and keep records about individuals for purposes that go beyond the rela-tionships they have with the individuals, and that more and more records are collected, maintained, and disclosed by organizations that have no direct relationship with the individuals. Finally, they determined that neither current law nor current technology gives the individual the tools he needs to protect his legitimate privacy


interests in these records. The commission made a sweeping series of recommendations for separate legisla-tive regulation in each of the industries it studied. In the case of employment records, voluntary reforms were urged. Throughout their recommendations three policy goals were stressed:

(1) to create a proper balance between what an individual is expected to divulge to a record-keeping organization and what he seeks in

return (to minimize intrusiveness);

(2) to open up record-keeping operations in ways that will minimize the extent to which

recorded information about an individual is itself a source of unfairness in any decision about him made on the basis of it (to maximize fairness); and

(3) to create and define obligations with respect to the uses and disclosures that will be made of recorded information about an individual

(to create legitimate, enforceable expectations of confidentiality). 25

These goals can be seen to meet precisely the three sets of privacy expectations that we have traced from early American privacy law.


As a consequence of the commission's recommnenda-tions, a considerable amount of privacy legislation has been introduced in Congress. Among these are a medical records bill, a fair financial information practices

bill (encompassing privacy reforms in consumer reporting, credit granting, credit and check authorization, deposi-tory banking, and insurance), and an

electronic-funds-transfer privacy bill.

Taken together with the Privacy Act of 1974, this

proposed legislation demonstrates how our expectations

of privacy need continually to be reexamined and rearti-culated as information technology continues to advance.


See Charles Fried, An Anatomy of Values: Problems of Personal and Social Choice (Cambridge, gMass.: Harvard U. Press, 1970), Chapter IX ("Privacy and Personal Relations.")

Louis Harris and Alan F. Westin, The Dimensions of

Privacy: A National Opinion Research Survey of Attitudes Toward Privacy (Stevens Point, Wis.: Sentry Insurance, 1979) pp. 12-14.

3Ibid., p. 15.

Ibid., pp. 28-29.

5Ibid., p. 22.

6Ibid., p. 76.

7De May v. Roberts 46 Mich. 160, 9 N.W. 146 (1881).

Samuel Warren and Louis Brandeis, "The Right to Privacy," 4 Harvard Law Review 193 (1890).


Pavesich v. New England Life Insurance Co., 22 Ga. 190, 50 S.E. 68 (1905).


1N.A.A.C.P. v. Alabama, 357 U.S. 449 (1958).

1 2Ibid. at 466.

1 3

Griswold v. Connecticut, 381 U.S. 479 (1965).

1 4

Roe v. Wade, 410 U.S. 113, 153 (1973).


Library of Congress, Legislative Reference Service,

"Information Concerning the Proposed Federal Data Center," (August 1966).

16U.S. Bureau of the Budget, "Review of a Proposal for

a National Data Center" (The "Dunn Report"), (December 1965).

1 7See U.S. Congress, House of Representatives, "Hearings on the Computer and Invasion of Privacy Before a

Sub-committee of the House Committee on Government Operations,

89th Cong. 2d Sess. (July 26-28, 1966).

See 15 U.S.C. § 1687 et. seq.


Privacy in an Information Society (Washington, D.C.: Government Printing Office Superintendent of Documents, Stock No. 052-003-00395-3, July 1977), p. 69.

20See 20 U.S.C. § 1232g.

2 1

P.L. 93-579 (Dec. 31, 1974), in part creating 5 U.S.C. § 552a.

22S. 3418, 93rd Cong., May 1, 1974.


E.g., the German Data Protection Act.

2 4

Personal Privacy in an Information Society, supra n. 19, p. 8.

2 5Ibid., pp. 14-15, italics in the original.


Documents relatifs

Isocontours of the maximum positioning error in millimeters of the manipulator with two joints throughout its Cartesian workspace obtained with BARON.1. RealPaver and BARON were used

Dans le cadre de nos recherches, nous avons utilisé la méthodologie déve- loppée par Ouellette (2011) puisque celle-ci est tout à fait adaptée à l’atteinte de nos objectifs.

Il est également montré que la correction des résultats de fatigue par le coefficient de concentration de contrainte local, déterminé par la méthode des éléments finis à partir

La consommation est différentielle en ce sens qu’elle n’est pas identique dans chaque partie du quartier et pourrait être consécutive à la hiérarchisation de cette partie de

Beyond that, working with F-Storm helps us to identify other important challenges including: (1) Decoupling the utilization of FPGA accelerators from specific DSP systems: It will

Measurements were compared to mixing ratios calculated from the chamber volume and the known amount of HCHO injected into the chamber; measurements were also compared between

engineering education in the African region, that effective industria lization which meets national aspirations here must be built on the major though not exclusive participation of

Previous research work has developed tools that provide users with more effective notice and choice [9, 18, 19, 31]. With increasing concerns about privacy because of AI, some

BUIJZEN Moniek Adrienne Radboud University Nijmegen Radboud Universiteit Nijmegen NL SNIHCY Social Network Implementation of Health Campaigns Among Youth SH2. CORNELISSEN

In this chapter I want to describe five different areas: the development of voluntary activities, relations with businesses outside, relations with local councillors, the

Therefore, a negative trend exists in the public on weight loss by the cultural institu- tion as for social communication processes, though they remain to be the entities,

2) Internship Quality: Once the internship has ended, the parties to this agreement are invited to submit an assessment of the quality of the internship. The

Débats historiographiques contemporains.. Rétrospection

Our study provides new evidence on this crucial issue by examining the impact of a central clearing reform on key factors that a↵ect price stability, such as volatility,

Si la couche informatique que constituaient les ERP n’était pas suffisante à elle seule pour améliorer le fonctionnement des organisations (Meysonnier et Pourtier, 2005) (1) ,

When a fragment of social knowledge, produced within a given institution I, moves to another one I u in order to be used, the ATD’s epistemological hypothesis

The anthropological theory of the didactic (hereafter ATD) is at the same time a theory in the scientific usual meaning of the term, that is, an organised

From the positions of the synchronous angles, it is possible to deduce the propagation constants of the guided modes of the sample under test and derive the optical and

In this prospective 10-year study in elderly aged 60 years and over, there was a 1.3% per year reduction in the standardized incidence of hip fracture in women but not in men..

Votre établissement a-t-il mis en place des programmes pour former ses collaborateurs à la lutte contre le blanchiment de capitaux et le financement du terrorisme et les

Votre établissement a-t-il mis en place des programmes pour former ses collaborateurs à la lutte contre le blanchiment de capitaux et le financement du terrorisme et les

We study the application of Benders decomposition to solve mixed integer programming formulations of the network design problem.. A new methodology for accelerating

Tetrahedral and Cuboidal Clusters in Complexes of Uranyl and Alkali or Alkaline-Earth Metal Ions with rac- and (1R,2R)-trans-1,2-Cyclohexanedicarboxylate.. Pierre Thuéry,