Hello, World

Thousands of years ago, primitive man left colorful handprints on some cave walls in Lascaux, France. Hey, they seemed to say. I was here. The instinct to reach out and communicate with strangers unconnected by place and time reflects a human truth about the need for companionship in sentience. The first computer program any budding computer scientist learns to write greets mankind: hello, world. Advances in science and communications have caused the amount of such communication, and the richness of information that it conveys about the sender to increase dramatically.

Usually the ownership rights to consumer generated information are provided for via contract in the form of EULAs, and generally give all rights to the website's proprietor. Thus, the list of music that you’ve been listening to as monitored by Last.fm belongs to them. Myspace is not your space; it belongs to Rupert Murdoch, as does information about your online purchasing of everything from groceries to pornography. The Internet is replete with transaction data and metadata. It also contains autobiographical information, such as social networking sites and personal web presences. It frequently contains governmentally-gathered data including criminal records, judgments, and bankruptcies. To the extent that people "voluntarily" disclose such a breathtaking amount of personal information in the name of convenience, narcissistic diversion, or a search for meaning, is there any role for the law to insure that they retain some degree of control over its use?

Important Ones and Zeroes

Two types of personal information are given special treatment by statute: medical information and credit information. The HIPAA is the most significant law regulating medical information. It requires some amount of anonymity in the form of an NPI (National Provider Identifier, a unique number that can’t be reused or transferred between providers), which minimizes use of a patient’s SSN or name, and regulates the use, acquisition, and disclosure of healthcare information. It has provisions to allow patients to review their own file and to demand the correction of inaccuracies. There is no private right of action under HIPAA, only an administrative review board within the department of Health and Human Services tasked with investigating allegations of wrongdoing and taking corrective action. Evidence suggests that oversight in the Bush administration was less than vigorous.

The Fair Credit Reporting Act governs credit reporting agencies that gather data on consumer creditworthiness. It requires mandatory deletion of negative information after seven years, except in the case of tax liens or bankruptcy, which have longer expiry periods. It also gives customers free annual access to their file, and establishes a dispute resolution procedure.

The most striking difference between health and financial information and other sorts of personal information is their relative importance, not in terms of their centrality to one’s sense of self, but the consequences of decisions surrounding such information. Neither statutory scheme allows consumers to modify or hide information that is true, provided that the sunset provision has not passed. It is as if to pretend that this information were shouted in a public square in London circa 1700. If the words are untrue but not spoken with malice, the citizen is at most entitled to a correction.

Contrastingly, the Video Privacy Protection Act was passed in the wake of Robert Bork's nomination to the Supreme Court, to prevent the unauthorized release of audiovisual rental records. A reporter had published Bork's video rental records (arguing it was justified since Bork believes the Constitution does not protect privacy). It's hard to give its passage great significance outside of aggrieved Republicans smarting from defeat siding with Liberal democrats. Of course, who knows what kind of videos Sen. Vitter likes to rent?

Should there be greater protection of personal information?

Companies with a presence on the internet who collect such information can make a reasonably strong contractarian argument for government non-interference. They provide a service that people value, and if people choose to spend their days cataloguing their consumer preferences on a website that they have freely chosen to use, perhaps the government should have nothing to say about it.

Maybe it is the seeming innocuousness of the data that is the problem. If all of the people who have made death threats against the President in the last 50 years loved The Catcher in the Rye, then the amount of information conveyed by our transactions, preferences, and intents is possibly much greater than we realize. Aggregating and mining such data could reveal information at least as personal as our medical and financial records, and could have consequences at least as significant.

Legislative Solutions

One way to deal with the influx of information would be to give consumers strong statutory rights to information that they have created. One could require that all information surrounding a user be destroyed at their request, or bar the transfer of such information. It might also be possible to grant users an unwaiveable copyright interest in their works. It’s impossible to copyright databases and facts, but of course this doesn’t stop most websites from demanding all copyright interests in user-created or supplied work for themselves in their terms of use.

In the short term, some of the most effective advocates for such change may be the industry itself. Obviously, the democratic process does not of its own force imbue citizens with concern for privacy rights. They may need to be hit over the head with it. Repeatedly. Perhaps seemingly unrelated governmental policies may help instigate change. To some extent, it may be possible to piggyback on the laws of other nations. Ultimately the pendulum against privacy may not yet have swung far enough against the public. Everyone has different limits and thresholds of feeling violated. Industry will continue to push the envelope, and they may come up with tradeoffs we are willing to accept along the way, but any legislative impulse that will be truly effective to vindicate public privacy has to come in part from outrage.