Information Privacy: What's Abortion Got to Do With It?

In a working group list service, some of the privacy professional around higher education have been enjoying a lively discussion about "privacy."  This blog is a good place to share thoughts to all of you.

It began with a recognition that not only do different people and/or constituents have differing expectations of privacy, but that different strands of "privacy" exist in U.S. law.  Those strands tend to confuse the meaning of information privacy when such professionals attempt to educate within higher education for appropriate privacy practices.  A basic understanding of the different strands of privacy in U.S. law is a good place to begin to address the confusion.  I also believe that once untangled, these strands bring significance to information privacy that is needed not only in higher education but in American cultural generally.  

I have not read a text on privacy law for some time now, which may be for the better in a blog but may also have specialists reeling from my simplification.  Be that as it may, when I think of "privacy" in U.S. law, four strands jump to mind:  (1) family planning, reproduction and sexuality; (2) Fourth Amendment and criminal law; (3) public and consumer law; and (4) torts and civil law.  

1. Family Planning, Reproduction and Sexuality  (Individual v. The State)
The first is probably the one that springs most immediately to the layman's mind.  Before 1965, states could and did have laws that prohibited information about and possession of contraception.  In that year, the Supreme Court decided that such laws violated the Constitution.  Because the word privacy does not exist explicitly in the Constitution, the understanding among the prevailing opinions was that a "penumbra" of rights from Amendments 1,3,4,5 and 9 that amounted to such a right contravened by states that imposed laws interfering with the decisions that married couples made in their "bedrooms" about family planning.  It was not long before the Court expanded the ruling from married to unmarried individuals, and then to a striking down of state abortion laws, and most recently to the decriminalization of adult, consensual sodomy laws.  


2. Fourth Amendment and Criminal Law  (Individuals v. The State)
The second also readily leaps to most people's minds, especially in light of the USA-Patriot Act, T.V. series such as The Soprano's or the The Wire in which there are dramatic depictions of wire taps, and most recently, the Patraeus case, because they all involve electronic surveillance in the telephonic and Internet age.  When first brought to the Court in 1928 in the context of a police wiretap on bootleggers' phones, the Court did not find a violation of the Fourth Amendment.  Clamps on a black box did not resonate with the physical proximity picture of police entering an individual's home.  By 1967, given much change in manners and mores (not least of which was the Griswold case described above about contraception) over time, the Court reversed itself and found a Fourth Amendment right in telephonic communications.  The next year Congress passed a law that outlined rules, procedure and consequences for "wiretapping," drawing an important distinction between content of a phone conversation, which required a warrant, and "conversational detail" such as is found in telephone billing records.  In 1986, Congress amended that law and passed our current criminal communications law: the Electronic Communications Privacy Act.  This law combined and conflated telephony and TCP/IP data networking.  In the Internet context, "content" would be the full email message or specific web page visited by the user; "conversational detail" would be the "metadata" in network logs with source and destination Internet Protocol numbers, time stamps, etc.   

3. Public and Consumer Law (Individuals v. Corporations)
The third has become familiar to the popular mind because they are confronted with it in the form of annual privacy notices from banks and forms to fill out before being seen by a doctor.  The U.S. has a relatively unique "sectoral" approach to public consumer privacy by demarcating specific and narrow bands of information, for example education records (FERPA); financial records (GLBA); health care records (HIPAA) and a series of other one-off categories such as video rental records (as a result of the Bork nomination hearings and the disclosure that he rented pornography from Blockbuster).  Europe and other developed nations such as Australia, New Zealand and Japan have adopted comprehensive data laws that protect personal information in any context held by a company or a corporation.  Twentieth-century history and a tradition of more robust regulation informs the comprehensive approach; in the U.S. historical naiveté and a more powerful market and lobbying sector restrict public privacy laws both by kind and application.  For example, only patient care records of a "covered" entity are actionable under HIPAA, not even all health care records.  Cable subscription records are not protected but might reveal as much if not more about an individual than their bank account records.  Not to mention all those annoying telephone and Internet marketers …

4. Torts and Civil Law  (Individuals v. Individuals)
Established at the turn of the last century, the fourth area is the potential growth industry for plaintiff lawyers in the twenty-first.  Torts such as "misappropriation of likeness" or "invasion of privacy" have taken on real meaning for average people with the explosion of technology.  Tyler Clementi's parents decided not to bring an action against the roommate who has face criminal penalties for "invasion of privacy" but under New Jersey state law they could bring such a case.  A cousin of defamation and libel, these torts used to be reserved mostly for the famous.  But as imaging and information technologies have grown faster than an appropriate use bounded by either case law or personal ethics, violations occur daily awaiting an angry plaintiff and a deep pocket.

To outline these strands is enough for today.  In the next installment I will discuss how and in what ways all of these various strands converge and inform information privacy.

--