What Do We Mean By Privacy?

1. What Do We Mean By Privacy? • Is it the opposite of public, or publicness? • Is it the same as secrecy? • Is it about being left alone? • Does it differ from intimacy? • Is it about controlling our personal information? • Is it about autonomy, dignity? • Should we have a right to privacy?

2. Social Construction of Privacy • Cultural considerations • Socio-economic differences • Gender, generation…. • Real space vs. online spaces (and its slipperiness) • Privacy as a claim, entitlement, or legal right • Depends on context (Nissenbaum’s notion of contextual integrity – will get to that later)

3. Technology Has Exacerbated Privacy Issues & Claims • Turn of (last) century – concerns re camera and publishing photos in newspapers (Warren & Brandeis) • Now, globalization of information and digitization create infinite possibilities: remixing, repackaging, storage capacities, fast transmission across borders & platform, infinite data-mining & third party surveillance…

4. Warren & Brandeis, 1890, the “right to be left alone.” • Use of news photography in newspapers…new disruptions in social boundaries …  • Instantaneous photographs and newspaper enterprise have invaded the sacred precincts of private and domestic life; and numerous mechanical devices threaten to make good the prediction that “what is whispered in the closet shall be proclaimed from the house-tops.” For years there has been a feeling that the law must afford some remedy for the unauthorized circulation of portraits of private persons… the question whether our law will recognize and protect the right to privacy in this and in other respects must soon come before our courts for consideration (Warren and Brandeis, 1890).

5. “I’m accused of something I didn’t do. It’s not me. I have the same name. That’s it.” • Said Alistair Butt, a 15-year old top student in Orleans, ON. Alistair’s name appeared on a new ‘no fly’ list (the Passenger Protect Program) initiated by the Canadian government in conformity with US security laws. Said his mother: “Canada’s telling him he’s guilty until proven innocent every time he flies” (CBC News, 2007).

6. Privacy International – 4 Dimensions of Privacy (cited by Dowding, 2011) These models often intersect in the social, policy, and legal domains. • information privacy, also referred to as data protection – the collection, management and distribution of administrative, governmental, and medical records; 2) bodily privacy – the protection of personal bodies from invasive procedures and practices such as genetic testing and workplace drug testing;

7. 3) privacy of communications – privacy of mediated communication including postage, telephony, telecommunications; and 4) territorial privacy – limiting surveillance of individuals and collectives within workplaces and public and commercial spaces through video surveillance, CCTV, and biometric technologies.

8. Definitions of Privacy (adapted from Val Steeves in Mediascapes, 2006, 2010) • As a human right • As an essential part of the democratic process • As a social value • As data protection

9. Privacy as a Human Right Essential aspect of human dignity and autonomy • Right to privacy linked to the development of international human rights legislation… • Post WWII, response to Nazism--UN Declaration of Human Rights (1948), Art. 12: “no one shall be subjected to arbitrary interference with his privacy, family, home or correspondence” • Canada: original signatory of UN Dec., 1976 ratified International Covenant on Civil and Political Rights, guaranteeing same right to privacy as Declaration

10. Privacy as a Democratic Value • Conceptualized as individual freedom and autonomy • Intrinsic to citizenship • Tension now: risk society, surveillance society (or paranoid society?; security vs. privacy, post 9/11):Governmental security regimes coupled with a heightened military-industrial-security complex have in many ways normalized a ‘security state’ wherein many citizens concede some or much of their civil rights in exchange for an illusion of greater security • How do digital technologies weaken our sense of community, communication, democracy, and privacy?

11. Privacy as a Social Value • Consider our own sense of personal proxemics… • We need to be able to control and define our relationships with others and the state… • Surveillance can endanger our sense of trust – but has surveillance become normalized (consider ubiquity of CCTV et al) • With globalization how has our sense of intimacy changed? In large urban centres? In small communities? • How have socio-technical developments & design enabled/constrained ‘reasonable expectations’ of privacy • What happens when the default setting is more transparency – and you don’t want it? Re: Zuckerberg and Facebook

12. Privacy as Data Protection • Changes in technology create new conception of protecting personal privacy, e.g. from paper-based systems to databases to inter-networked global internet systems • Issues of data mining and cross-compilation across diverse databases • Transborder flows of data and issues of national and cultural sovereignty

13. Council of Europe: 1980 Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data • Framework for collection, use, access, accuracy, and disposal of personal information • Cultural constructs - Europeans more sensitive of the need to protect personal information from governments and individuals in light of WWII

14. OECD - Guidelines Governing the Protection of Privacy and Transborder Data Flows of Personal Data, 1980 • Fair information practices included: data protection • Disclosure for purpose of data collection • Prove relevance of data collection • Ensure data is accurate, high quality • Procure security safeguards against unauthorized data access • Use data only for purposes for which it is collected • Establish open policies re: nature of data and how it is stored • Collector of data must be accountable for its collection and use

15. Issues in Data Retention • EU Directive on Data Protection: Requires that member countries adopt or adapt national data protection laws by 1998 • Proposes limitation • Data quality • Transparency • Security • Rights of access • Restrictions on transfer • http://www.cdt.org/privacy/eudirective/

17. When data is collected… • Why is information being collected? • Why and how will personal information be disclosed to third parties? • Can individuals get access to data with ability to correct or amend? • How can data integrity be ensured? • How long will data be retained? – in what format?

18. In Canada -- is privacy a human right? • Patchy • Canadian Charter of Rights and Freedoms does not include express right • Courts have ruled for “reasonable expectation” of privacy (R. v. Duarte, 1990). • Conundrum: in digital world, what is reasonable expectation?

19. House of Commons Report re Privacy, ca. 1995 • Looks at privacy as a social good, a common good • A fundamental human right • Privacy a balancing act between competing interests • Delineates ethical blueprint of core privacy principles (personal space, personal communications, of information, physical privacy, freedom from surveillance) • Later, Privacy Rights Charter, see http://www.parl.gc.ca/37/1/parlbus/chambus/senate/bills/public/S-21/S-21_1/S-21_text-e.htm

20. Social Media & Privacy: Problematics & Paradoxes • How has the internet exacerbated/eased the collection of personal information? • Cookies and user profiles - useful or privacy destructive? Appropriate use? • Case of DoubleClick…, SNS, third party marketing, Google, Facebook, other social media ‘transparency’‘options’

21. Social media create multifaceted and integrated databases and hyper-textual modes of information. One of the characteristics of social media is their two-sided nature; while they have the ability to empower citizens, at the same time they make citizens more vulnerable to surveillance manipulation, through tools such as cookies, personal information gathered by search engines, e-mail surveillance and increasingly sophisticated algorithmic formulations that can aggregate, synthesize, and distribute information to third-party marketers.

22. Social media also create a “modern permanent record” (Dixon and Gellman, 2011, p.7) - a compilation of all of the digital traces that we leave as we navigate amongst different websites and social media platforms, and conduct numerous online transactions, from shopping for books on Amazon.com to engaging in forms of civic participation such as contributing to political forums. Our physical locations can be tracked, monitored, and remembered and rendered extremely difficult to erase – as is the case with geo-location tools such as FourSquare, where we can actively reveal our daily perambulations in order for our friends and colleagues to follow us, or to receive tips on consumer discounts or recommendations.

23. Infrastructural Sovereignty? • Data retention and the impact of our personal information across national borders raise ethical and legal issues which are contentious and subject to legal scrutiny; serious issues related to Canadian sovereignty arise when Canadian data is outsourced to the United States and subject to the US Patriot Act, enacted after September 11.

24. Privacy in Canada • We have no explicit constitutional right to privacy, but…. • Sections 7, 8, and 10 of the The Canadian Charter of Rights and Freedoms have been interpreted by courts to contain some privacy rights… • However, Charter does not apply to private sector, only governments • Privacy legislation rooted in language of the marketplace

25. Quebec’s Constitutional Privacy Protection • Art. 5 of Quebec Charter of Human Rights and Freedoms (1975)-respect for private life • Civil Code amendment of 1987-respect of individual privacy • Quebec’s Act respecting access to documents….-individual right to access to personal and non-p info held by levels of governments… • Act Respecting Protection of Personal Information in Private Sector (1994)

26. Privacy Act (1982) • Federal legislation • Regulates collection, use, disclosure and disposal of personal information held by government/public sector • Does not apply to private companies-e. eg., telecom, insurance, banks, broadcasting • Deals only in data • No penalties for violation

27. PIPEDA-Personal Information Protection & Electronic Documents Act (2001) • Federal legislation • Code of fair information practices for business • Related to collection, use and disclosure of personal information • Consensus of a variety of stakeholders • Onus on Privacy Commissioner of Canada

28. PIPEDA • Balance: commercial rights vs. individual rights • Is business compliance a nightmare? • Are voluntary codes sufficient? • Can it improve consumer confidence (e.g, with e-commerce?) • Currently updating

29. Tensions with PIPEDA • Privacy for consumer rights • Privacy issues are trade issues • See selected cases at Privacy Commissioner of Canada…www.privcom.gc.ca

30. Canadian Standards Association Model Code for Protection of Personal Information (1996) • Provides principles for management of private information • Specifies minimum requirements for adequate protection of personal information held by organizations • Increases awareness of protection of personal information • Provides standards for measurement of personal information by international community

31. Privacy Protection Codes • Voluntary codes • Industry and private sector companies • Canadian Bankers Assoc. brought code into line with Canadian Standards Association Code (CSA) • Are voluntary models adequate? “suffers from perception that individual’s privacy rights are in hands of those who have the most to gain from the processing of personal data” (Colin Bennett)

32. Nissenbaum’s Notion of Contextual Integrity • “The framework of contextual integrity is a justificatory framework for establishing whether socio-technical devices, systems, and practices affecting the flow of personal information in a society are morally and politically legitimate. Although, as such, is is neither a theory of a legal right to privacy or a definition of a legal concept of privacy, it can serve as a foundation for law and regulation by providing a standard against which legislation (existing or proposed) and detailed rules are tested” (p.236, Privacy in Context (2010).

33. Privacy Enhancing Technologies (PETs) and Privacy • Smart cards • Biometric encryption • CCTC or CCTV • Electronic Monitoring • Genetic Testing • RFIDs

34. Privacy Rights Advocates and Activist PI Groups • EPIC: www.epic.org • PIAC: www.piac.ca • Privacy International: www.privacyinternational.org • EFF: www.eff.org • CPSR: www.cpsr.org • GILC: www.gilc.org • CIPPIC: www.cippic.ca • And government (federal, provincial privacy commissions)

35. Jennifer Stoddart, Privacy Commissioner of Canada, quoted in Butler, 2009. • It’s part of growing up as a human experience to do more extreme things, to try things, to test yourself, to draw attention to yourself…until now, most generations could do that in relative obscurity. I worry that this isn’t possible now. At some point, what people did when they were 18 at some wild party will come back to haunt them when they’re running for elected office at 38.

49. Lisa Feinberg, Univ. of Ottawa law student, on CIPPIC complaint • Social networking sites know a lot about us, but we know very little about them. We should incorporate the issues around social networking websites into our education system. Educators should teach us about privacy protection. Privacy is integral to maturity — we need a safe space to grow into ourselves. It is important for us to be able to recognize when a space is not safe — when there are unwanted listeners. It is also important for us know that we have rights: we cannot be bound by illegal terms of service. We should be taught to challenge the questionable practices of these online social networking sites. As customers of these commercial websites, we have a voice…