The art of privacy

"Metaphors on (non-) compliance in the data-driven era"

Luca Bolognini

• Publisher: Rubbettino Editore
• Year: 2022
• eBook ISBN: 9788849871975
• Topic: Art
• Subtopic: Art General

What do Titian and Leonardo da Vinci have to do with privacy and (non-) compliance with rules in the era of digital data and algorithms? What do Canaletto's and Guardi's vedute have to do with due diligence, or Pietro Longhi's rooms with smart working? What connects a 16th Century court artist and a 21st Century Data Protection Officer? Can a painter be entirely artificial and non-human, and can a still life be made up – instead of flowers, wildfowl, and bottles – of hardware, software, and obsolete documents? Is an electronic work of art just art or can it hide, or even constitute in and of itself, valid legal titles? Is a copy – of a painting or a legal document – always a forgery and an objectionable offence? In this engaging exploration, which spans centuries of art from its most ancient forms to today's crypto art, the author – a data protection lawyer and collector – takes us on an extraordinary metaphorical journey, interweaving the sense of beauty and the common sense of regulations, compliance and creativity, the aesthetics of innovation and of penalties. 75 years after Carnelutti's Art of Law, The Art of Privacy is a unique book that already promises to become a classic of legal literature in years to come. It succeeds in providing the "key of imagination" for scholars, legal consultants, and business managers to free themselves from their specialist cages, while also intriguing and challenging digital art enthusiasts.

1. The Art of the Panorama (or the overall view)

Panorama as a method of juridical understanding

Overall views matter, as much in eighteenth-century art as they do in the profession of a privacy and data protection lawyer. Beyond my computer screen, on the walls there are shepherds with their flocks, cows, horses and children with cats, dogs, and other pets. All around, there are rolling hills, streams, and houses in the distance. Beautiful skies, clouds tinged with a thousand hues. Seventeenth- and eighteenth-century landscapes surround me and abound in my memories, from galleries, auctions, and museums over the years, both etchings and paintings.

Among the landscapes in my home, there is a Ponte Milvio free of nightlife three hundred years ago, a Tuscan valley by Zuccarelli before the terraced villas (a tiny and endearing painting), a coastal countryside scene painted by an artist from Northern Europe who came to Italy in the eighteenth century, and an enormous tempera that towers above the sofa, as if it were a window looking onto an ancient landscape, illuminated at dawn. The tempera is my favourite, painted in the style of Gaspard Dughet but a century later by an unknown artist in Rome: vivid, fragile, and solemn. Trees and leaves, the inlet of a silvery stream. The leaves are green, orange, yellow, some red, each one represents a single brushstroke and looks good enough to eat, those lush branches, warm and crunchy like freshly baked biscuits. It makes you want to give a name to all these characters, whether they are vegetable, animal or human, and to the places that can be seen in the background.

Giving names to creatures and things (even digital things, why not) is the first step in beginning to objectify them, to differentiate them from ourselves and find our way in what is new. But it is not enough. It is essential to step away from innovation to be able to fully grasp it. In fact, if you think about it, “calling” someone or something is an act of distancing, it implies a clear distinction between ourselves and the one who is “called”: normally we “call” when, or because, we are distant. For tennis players, keeping the right distance from the ball is vital, just as it is for painters from their canvasses and the subjects they depict and portray. Only an immature professional would get too close and lose sight of the bottom line, the strategic plan, and the sense behind the legal position. Good and evil become blurred, due to excessive immersion and proximity to the object under assessment.

When I was a young intern, I too had a tendency to dive into the painting and lose myself among places that, at such close quarters, became anonymous, disorienting and distorted out of all proportion. I thought I was doing a good job and instead I was stunting my ability to help the client solve their legal problems. Experience over the years has helped me keep my skills on a firm leash, held at the right objective distance from the facts.

Take the nine general principles imposed by the GDPR (the now infamous European data protection and privacy law), which must be adhered to right from the initial design phase of any new services, processes, and products (therefore, also artworks that include personal data): “lawfulness”, “fairness”, “transparency”, “purpose limitation”, “data minimisation”, “accuracy”, “integrity and confidentiality”, “storage limitation”, and “accountability”[1].

Violating even just one of the above-mentioned principles can result in severe penalties. It would not be possible to implement any of those principles concretely without placing the personal data processing in an overall perspective, not squashed up against the eyes and nose of the lawyer. We need to slot those principles into a panorama of meaning. After all, what is the “purpose”, or the limit we set for so many important consequences of legitimacy in data processing according to European law, if not a panorama, a viewpoint and, ultimately, a destination to be reached?

Stretching between us and the horizon is a path, and as we journey along it, we are asked to choose the route that is shortest and most direct (minimisation) and fastest (storage limitation), to follow the Traffic Laws (lawfulness), to give way and not cut anyone off (fairness), to keep our windscreen clean and use our headlights in the dark (transparency), to avoid swerving and keep to our lane by paying attention to the road markings (accuracy), to ensure our vehicle is properly serviced and not a dangerous rattletrap with no seatbelts and worn out tyres (adequate security), and to be able to show that we comply with these rules (with working mileage and speed gauges, driving licence and vehicle registration papers). The fact is that, while travelling, the perspective of the driver or passenger is not enough: broader orientations are needed, whether they are technological, such as a satnav, or spiritual, such as the desire to travel and to get from A to B for some good reason. This metaphor is not forced but flows simply and spontaneously: lanes and road signs are artworks and, together, “legal directions”.

How often, when interpreting a legal issue, also regarding privacy and personal data protection, have I hit a brick wall unable to find my way through intricate labyrinths? I have often felt trapped. Inadequate for the client who placed their hopes in me, in my “legal art”. Then, as if by magic, I looked away from the scene and observed the perimeter from above, pinpointing the escape routes and making out the overall picture that I hadn’t seen before.

It is not just about looking for emergency exits. This is not an escape room challenge or a race to see who is faster or smarter. The perspective of a landscape and its horizon really can clarify our sense of reality. The meaning of an event, a choice, or a direction. What might appear, at first glance, to be a clear violation of the rules can take on other connotations if viewed from different perspectives or distances. Just as the principles of transparency and fairness (loyalty) can be affected by the posture and context of the observer. A particular detail – while unjustifiable and meaningless taken by itself – acquires a role and gravitas within the overall view.

What I would like to underline is that on a legal-digital level, and even more so in the eyes of a privacyist, human beings do not exist in a vacuum. Individuals exist only in relation with themselves and with others. These “others” are not only people, but also contexts, things, and public and private places. There is no data processing that is lawful or unlawful at all times and no matter what, just as there is no absolutely lawful or unlawful act, however right or wrong, praiseworthy or punishable regardless of the circumstances. The value of actions and omissions should be assessed, each time, in a way that is dynamic and interconnected with the panorama and the presence (or absence) of a context.

A “trickster” might dabble in optical illusions that make things appear not as they are, depending on the angle they are viewed from; but what I want to convey here, in all honesty, is that the meaning of events and actions can objectively vary depending on the context, and how they are observed. Taking this further, we could argue that even visual deception – be it a trompe-l’œil or a more technological illusion – can become a key for reading and understanding things more deeply.

Remember the craze for psychedelic paintings with three-dimensional optical illusions? Towards the end of the 1990s, those posters were all the rage in student rooms and in some bars and clubs: seemingly nothing more than endless repetitions of colourful patterns but, if you stare at them long enough and let your gaze slip out of focus, 3D images materialise that look like they are moving. It was so satisfying to see those “phoenixes” rise from the colourful ashes of a poster you had dismissed as incoherent. In some cases, the illusion is the right solution, the keystone, the password for deciphering the figures hidden beneath the apparent nonsense.

A targeted and highly intrusive direct marketing campaign may seem like nothing more than email spam, but if we scratch away the surface preconceptions, we may find a text that is clear, well-written, balanced, and fair, proof that the personalised profiling is simply the fulfilment of a contractual service requested by the customer-user. And that changes everything.

A lawyer’s job is a bit like that: searching for the meaning of a human story, beyond appearances or face value. Like in crime fiction, where goodies and baddies are not always what they seem: the “hero” may turn out to be the “villain” and vice versa. Leaving aside absolutist extremes better suited to TV drama, human behaviour and actions can never be painted in solid colours. If you take the time to analyse them thoroughly, they always reveal nuances that can make them easier to understand and accept, and therefore less condemnable out of hand. And here let me add an important point about the driving metaphor: up to now, I have mentioned only those people and contexts the driver must engage with to legitimise their journey, as if the highway code (or, metaphors aside, privacy legislation) covered the entire range of legal aspects to be considered once the car is started. But the truth is that in the legal panorama it is inevitable that other freedoms and other rights will come to the fore, besides personal data protection. If we observe subjects interacting with one another in a (more or less metaphorical) landscape, we cannot think that data protection is their only right: there are many others that contribute a sense of proportion to the painting.

Likewise, when driving a car, you must pay attention to more than just the rules of the road. There is life, out there. You could suddenly swerve to avoid a collision or accelerate over the speed limit during a medical emergency: both these acts are dangerous and illegal taken in abstract, but they may be justified on balance having weighed up all the factors involved. Whilst acting in apparent violation of the rules, we may in fact be safeguarding the right to life or exercising legitimate self-defence. A speed camera photo would not be able to capture that balance, and the result would be an unjust fine.

Privacy legislation is not monochrome, either. It is made up of an array of positive and negative shades, and intrinsic contrasts to be unravelled. In this way, what appears to be an illegal form of data processing may turn out to be necessary to ensure compliance with the general principles of the GDPR or the European Union Charter of Fundamental Rights. For example, the long-term storage of a list of contacts who no longer wish to receive promotional communications (that is, users who have opted out of advertising messages) could be legally justified, despite – to all appearances – the purpose not being expressly contemplated. This is because the only way to ensure compliance with the subject’s wish to not be contacted anymore for direct marketing purposes is to keep a record of their contact over time.

The paradox is that, in order to comply with the storage limitation principle, we would need to erase all memory of the data subject’s selected privacy options, thereby violating their rights in the end through an excess of zeal. The “negative” purpose should be developed, as a traditional analogue photo-artist would do, without digital cameras. Developing the negative generates a large and decipherable image, capable of revealing details, colours, perspectives, and depths that are otherwise invisible: only then can we fully grasp the meaning of the photo and its protagonists, beyond any mastery of the photographer’s human touch.

Business mapping: a work in portraiture and landscape

The essential premise of any consultancy on legal compliance, whether about privacy or non-privacy, is precise knowledge of the factual data, which will then be evaluated from a legal perspective. In cou...

Table of contents

• Cover
• Sinossi
• Frontespizio
• Colophon
• Introduction: why The Art of Privacy?
• 1. The Art of the Panorama (or the overall view)
• 2. The Art of Domestic Privacy (and Smart Working)
• 3. The Art of Company Organisation (and the DPO-manager at court)
• 4. The Art of Obscuring (and the lawyer-restorer)
• 5. The Art of Legal Beauty (and reputational imperfection)
• 6. The Art of Forgery (and the ethical limitations to imitations and fake compliance)
• 7. The Art of Cybersecurity (or digital exorcisms)
• 8. The Art of the Efficient Violation (and persuasion to compliance)
• 9. The Art of Legal Vagueness (or the domain of liquid legislation)
• 10. The Art of Artificial Intelligence (or of digital still life)
• 11. The Art of Innovation (and non-compliant compliance)
• Index of paintings