Remarks to the International Association of Privacy Professionals panel discussion entitled "The National Privacy & Security Debate"

Home > Past Releases and Reports > Remarks to the International Association of Privacy Professionals panel discussion entitled "The National Privacy & Security Debate"

Remarks to the International Association of Privacy Professionals panel discussion entitled "The National Privacy & Security Debate"

February 27, 2003

I'm pleased that nudity has been such a prominent topic on this panel so far. That's because we have two obligations up here today. The first is to be entertaining, and I can think of nothing better to capture attention than nudity. (Be assured that I am only going to talk about it, lucky for you.) But also because the methods we use to protect privacy in the appearance of our bodies can be very enlightening to the privacy discussion generally.

The panelists we have heard from have discussed a number of things: why privacy is important, whether personal information can be treated as an asset and who owns it, and the crucial distinction between privacy from government and privacy in the private sector.

But no one has yet defined privacy. And I think that's essential to do if you are going to be able to gauge your own efforts and, for those of us in the world of public policy, if we are going to be able to judge whether law and regulation advances privacy or not, how successful it is at doing that.

To illustrate the importance of having our terms defined, let me do a thought experiment with you: I am conducting a conference much like this one next week. It is going to have plenary sessions like this one, and a number of different tracks. But I'm not going to tell you the subject of the conference. I'm just going to tell you what the tracks are. It will be up to you to figure out what the conference is about.

The five tracks are:

Techniques for Avoiding Bruises

To Wax or Not to Wax

Staying Cool, Staying Fresh

Red, Green, or Something Else

Meaty, Mushy, or Just Right

Now what is this conference about? Is it about taking your vacation at the beach this summer? No, of course, it's about apples.

But half of these tracks apply not just to apples, but to other fruits and vegetables as well. Just like my conference next week, this conference is about all kinds of different information policies. You are dealing with spam, security, identity fraud, fairness, and so on. All of these are information policies and they all have something to do with privacy, or at least they come close. But unless you know what is privacy and what is not, you can not know when you have delivered privacy to your customers or when a law moves privacy forward or backward.

Let me give you the definition of privacy that we have been working with at Privacilla: Privacy is the subjective condition people enjoy when they have power to control information about themselves and when they exercise that power consistent with their interests and values.

Very quickly, let me parse that definition for you. First, privacy is a subjective condition. I can't tell you when you have privacy and you can't tell me when I have privacy. Likewise, you can't pass a law that tells people they have privacy. That is up to them to decide.

Next, privacy requires people to have the power to control information about themselves. This implicates governments the most, because they can take information from people by force of law. They can convert information to new uses after they collect it, even contradicting statements they make at collection about how they will use it. Only governments can use information about people to harm them. Businesses must bargain for information one way or another and they can not use it to hurt you.

Finally, privacy happens when consumers understand how information moves and how they are choosing privacy or other interests. I think, as often as consumers seek privacy, they seek convenience, low cost, customization, and so on. Privacy is a priority, but it is in constant tension with other consumer interests. We can't guess very well what exactly consumers want. But we should try to make sure their choices are informed.

So there you have a definition of privacy that you can use to figure out whether law and public policy move the ball forward or backward. You can use it to determine whether your own efforts to comply with laws are helping privacy or not.

The alternative, leaving privacy undefined, just makes it a political football and the source of unending complex and costly regulations. Between the Gramm-Leach-Bliley law and HIPAA alone, we as a society have spent billions of dollars, and I think we ought to know whether we have gotten our money's worth.