New Directions in Surveillance and Privacy

Benjamin J. Goold, Daniel Neyland, Benjamin J. Goold, Daniel Neyland

• Publisher: Willan
• Year: 2013
• ISBN:
  9781134046065
• Edition: 1
• Topic: Ciencias sociales
• Subtopic: Criminología

The field of surveillance studies is growing at a rapid rate, fuelled by a growing interest in the questions that lie at its heart and a deep unease about the future of individual privacy. What information is held about us, to what extent that information is secure, how new technologies ought to be regulated, and how developments in surveillance will affect our ordinary and everyday lives?

Deliberately multi-disciplinary in character, this book examines these questions from the perspective of a broad range of fields, including sociology, management research, law, literary analysis and internet studies. As privacy comes under increasing threat and surveillance activities grow in quantity and diversity, so too the academic field needs to develop in new directions, form new perspectives, and gain new insights. In keeping with this aim, the chapters of this book consider how individuals, organisations, and states are engaged in the compilation, mobilization, scrutiny and use of ever increasing amounts of information.

Divided into three sections focusing in turn on legal regulation, technologies of surveillance, and the future of privacy and surveillance, this collection provides a unique and eclectic insight into the question of how the spread of surveillance is changing our lives and the societies in which we live.

Part I

---

Regulation

Chapter 1

---

The limits of privacy protection

James B. Rule

It would be hard to imagine a more thoroughly inter-disciplinary topic than privacy, and the efforts in legislation and policy to protect it. How to make sense of the demands on personal data in today’s world, and what constitutes a reasonable response, are questions too big for any one line of thinking.

One form of analysis required here is obviously that of empirical social science. Like any other state of human affairs, today’s pressures for appropriation of personal information require explanation in human terms. And the social, political and economic chemistry of the processes that have brought privacy to the fore since the 1960s are clearly no open-and-shut case. True, some observers (including many who should know better) are willing to bypass this question with a kind of intellectual shrug – simply stating that ‘technology’ is to blame for the loss privacy in today’s world. Against such views, I want to argue that the demands for personal information from organisations underlying today’s privacy controversies stem from fundamental changes in relations between large institutions, both government and private, and ordinary ‘private’ citizens. To frame any response to privacy issues, we need to understand the changes in social relations, political power and economics implicated in these developments.

A second domain of thinking that must inform any such response is the strictly normative thinking of philosophy – notably, ethics. What essential claims should any individual be able to make to reserve given domains of his or her life as private? Do people have any compelling right to withhold information about themselves that should override the rights of others who ‘need’ to access such information? Warring responses to these far-reaching questions, it turns out, tap tensions between contending traditions of ethical thought that go back centuries – well before anyone thought of committing personal data to large-scale computerised, or indeed written, records (Rule et al. 1980).

True, virtually everyone can join in decrying the ‘invasion’ of privacy. But this is simply because ‘invasion’ has become a term denoting those demands on personal data held excessive. Faced with the challenge to give account of which demands ought to be acceptable and which should not, we find ourselves in a thicket of conflicting rationales.

I emphasise this multiplicity of considerations in weighing privacy issues, particularly because I mean to return to it at the end of these remarks. Between now and then, I aim to develop the briefest sketch of the evolution of privacy as an issue. Here I seek to put forward my own empirical analysis of the social and economic forces that have made large-scale personal record-keeping such an endemic point of controversy in the world’s ‘advanced’ democracies – and which make solutions to such controversies so problematic and highly-contested. At the end I want to argue that much of this intractability stems from disagreement – or more, perhaps, ambivalence within public opinion as to the proper claims of privacy against other values at stake in public affairs.

I would place the origins of privacy as a public issue to the United States in the 1960s (Rule 2007). Here I understand ‘privacy’ in a particular sense – that is, the struggles between institutions and individuals over access to and use of personal information on the latter. To be sure, demands for privacy in other senses also figure in public debate – as in claims to ‘privacy’ (in the sense of autonomy from government control) in matters of birth-control and abortion. And to be sure, privacy in many senses has been a subject of speculation and debate for much longer than 40 years. But about four decades ago the idea took shape that the creation and use of vast datafiles on individuals by government and private institutions required state supervision and restraint. At that point, privacy in this sense became a public issue – a matter of claims and counterclaims over prerogatives of organisations to collect information about people, and individual rights to constrain or block such collection (Rule et al. 1980).

The first such controversy to trigger action at the federal level in the United States had to do with consumer credit. By the 1960s, American public opinion had registered with dismay that consumers’ access to credit – in accounts with merchants, home mortgages, credit cards and the like – depended on the exchanges of personal information that had been largely hidden. When further publicity showed that the contents of these decisive files could readily be erroneous, confused or inappropriate, classic privacy demands arose: Something must be done, the refrain went, to protect people’s interests in the treatment of ‘their’ information. In short, institutional treatment of personal data systems was too important to be left – as it had always been in the past – to the discretion of the institutions themselves.

The immediate result of these controversies was passage of the Fair Credit Reporting Act (1970) – a template for much further privacy legislation, including the much better known Privacy Act of 1974, governing treatment of personal information in certain federal government systems. This remains today America’s most comprehensive privacy law. Since 1974, the United States has enacted no further legislation guaranteeing privacy rights across different sectors of record-keeping. Instead American law-makers have set down ad-hoc rules for specific uses of personal data in specific settings – such as health care files, financial records, and video rentals.

Other democracies, starting a bit later than the United States, have generally established broader privacy rights and – most privacy-watchers would agree – more forceful institutions for their enforcement. Sweden adopted comprehensive privacy legislation, governing treatment of personal information in both public and private systems, in 1973. Following closely in the 1970s were Germany, France, Norway and Denmark. In 1995, the European Community promulgated its Privacy Directive, requiring each member country to follow a single template of privacy rights and procedures in its national legislation.¹

Today, virtually every liberal democracy around the world has some national privacy code. Some of the most recent countries to adopt such codes are Argentina, India and Taiwan. The great majority of these countries have hewn closer to the European than the US model – establishing broad rights holding for personal data held in many different institutional settings, and creating some form of national ombudsman to defend such rights. But even including the United States as some sort of outlier, one can identify a core of principles as constituting what I am prepared to call a global consensus approach to privacy protection. In the briefest summary, and with no claims to comprehensiveness, let me identify the core of these principles.

1 The keeper of any system of personal records is responsible for the safety, security and integrity of the data so stored.

2 The existence, purposes, and workings of such systems should be readily accessible to public understanding.

3 A single figure (a ‘privacy officer’ or ‘data controller’) should be identified publicly as responsible for safeguarding the privacy interests affected by the working of each such system.

4 Information held in such systems must be collected legally and fairly.

5 Individuals must be able to review the content of information held on them in such systems and the uses and disclosures of such information; individuals must be able to obtain redress for inaccurate and inappropriate uses and disclosures of such data.

6 Personal data should only be collected in the form and to the extent necessary to fulfil the purposes of the system.

7 Information held in file should be as accurate and up-to-date as necessary to fulfill the purposes of the system.

8 Information collected for one purpose should not be used or released for other purposes, except under legal requirement or with permission of the individual.

9 Information held in file should be collected with the knowledge or consent of the person concerned.

(Rule 2007: 26)

Other privacy scholars summarising the same array of legislation and policy have produced similar encapsulations of key principles guiding global privacy protection efforts (Bennett and Raab 2003: 26).

These nine points make up, of course, a kind of composite portrait – blurring important details and downplaying differences among the world’s many influential privacy codes. But with those limitations acknowledged, I believe that most privacy-watchers would recognise in these nine points the essentials of a global consensus on the requirements of meaningful privacy protection policies.

Indeed, I believe that many commentators would identify in these points what they might regard as the ‘mature’ response to the dilemmas posed by mass institutional monitoring of individuals’ lives. From this perspective, these nine key principles provide a successful template for resolving the most intractable dilemmas in treatment of personal data. This is, to say the least, an optimistic position.

I am not one of the optimists. The pages to follow aim at showing why these precepts seem to me to leave some of the most pressing questions in privacy protection unanswered.

One problem is that, even where officially accepted for many purposes, the precepts are not applied to all forms of personal data collection and use. Above all, they are rarely held binding on the extensive personal data systems maintained by coercive and investigative agencies of the state – law-enforcement, counter-espionage and counter-terrorism agencies, above. Police, tax authorities, and intelligence agencies in most countries would regard it as ludicrous that their surveillance operations should be required to be open to inquiry and challenge from those under surveillance, for example – at least while such investigations are under way. Certainly there are good reasons why such activities should not always be held to the same standards of openness and accountability in handling personal data that are expected, say, of credit reporting agencies. But the idea that privacy protection codes should have no bearing on activities of these agencies should certainly give pause.

Secondly, the nine consensus principles imply a kind of parity between isolated individuals and large institutions that ill fits the realities of their relative positions. The underlying idea seems to be that personal data are exchanged in some sort of equal transaction between institution and individual, where each party gains something and gives up something of equal value. This thinking would seem to underlie the notion that personal data should only be collected, as Point 9 notes, ‘with the knowledge or consent of the person concerned’. Of course, individuals may refuse their consent to having their names checked against watch lists on boarding air flights, or their credit accounts monitored when they seek credit. But in most cases, such refusal of consent to the demands of monolithic organisations comes at a drastic cost: being excluded from access to air travel or to consumer credit, in these cases. The bargaining positions of individuals confronting such organisations are not enviable.

In fact, ‘consent’ is a notoriously slippery notion when applied to contexts like these. Very commonly in practice, ‘consent’ to the most far-reaching appropriation and scrutiny of information about one’s self is a condition of access to what most people would consider basic amenities of everyday life – access to consumer credit, for example, or ability to board an airliner, or rental of a car. However one may view the rights and wrongs of the claims made by the institutions for personal data in settings like these, it should be clear that individuals’ ‘consent’ to such demands hardly indicates their assent to the principle underlying the demand – so much as recognition of the marked imbalance of power between the parties.

Thus a major UK bank requires that applicants for accounts sign a consent statement reading:

Where considering your application and where appropriate from time to time during your relationship with us, we will make searches about...