Chapter 19. Privacy in an Age of Data
The battle for privacy, waged upon fields of data, will be lost. The reason it will be lost is that, precisely insofar as our social functioning becomes a matter of interacting data, to that degree there is nothing to which a decent concept of privacy can attach. There exists, on the fields of data, neither a self whose dignity is worth defending, nor a self that a global data-processing system is capable of defending. If a decent sense of privacy does not apply, in the first instance, to the socially embedded individual—if it does not first flourish as an ideal in intimate, personal spaces—it cannot flourish in cyberspace.
Privacy is inseparable from a certain willingness to lower one’s eyes and to hold sacred what one knows or chooses not to know about the other person. When it has become a mere drive toward anonymity, it necessarily vanishes as a meaningful standard for our life together, signaling instead our disconnection.
In other words, the ideal of privacy gains substance only in those primary contexts where we know each other well enough to care. Given such contexts as a dominant reality of our lives, we may be able to rise above voyeurism, prurience, and the temptation of gossip so as to respect what deserves respecting in the other person. Lacking such contexts, we cannot win; we will be assimilated to the realities of our technology, where one data bit looks just like another and there can be no special protection for any of them.
Interestingly, the same Net has produced not only our acute fears about loss of privacy, but also serious concerns about unhealthy anonymity. Like so many apparent paradoxes of cyberspace, this is no accident. The two worries belong together. A prevailing impersonality and anonymity is precisely what makes everyone else a potential threat to me. This threat provokes counter-measures; where no one is known, everyone must be suspiciously noted. An atmosphere of suspicion in turn heightens the desire for anonymity.
In other words, relying upon the placeless, nameless medium of the Net for our privacy may produce paradoxical results. Where our aim is to escape recognition by other human beings, it isn’t much use complaining that these others fail to recognize what is worthy of discrete respect in us. We have become invisible to them. The spammer who would not think of going door to door in his neighborhood offering pornography or financial scams, is quite content to inflict these scourges upon millions of unseen Internet users.
Unfortunately, the defense of anonymity becomes a necessity so far as we have already redefined society and our own lives in terms of data transactions. But it is important to realize that no ultimate victory lies in this direction. Rather, we will have an endless contest between privacy-protecting software and privacy-invading software. Once we have reconceived our lives as bodies of data, there is only a technical struggle over these bit-corpses. Those who carry out the struggle (fighting on both sides of the many unresolvable issues) do a necessary and important work, for which I am thankful. But it will all be for nothing if we cannot find a way to bring the corpses alive again.
The Life of a Vibrant Neighborhood
Anyone who wants to pursue these matters should read Jane Jacobs’ classic work, The Death and Life of Great American Cities. She makes vividly clear how to create a crime-ridden district: put barriers between people by any means available—freeways, homogeneous business districts, and inadequate transportation systems; create urban canyons of concrete and steel that are uninhabited after business hours; discourage a continued mixing by people from different classes, ethnic backgrounds, trades, age groups, and so on; and, in general, minimize the routine, mutual exposure of people in conducting all of life’s business.
Jacobs describes wonderful urban areas where safety is both taken for granted and well enforced. Interestingly, in such environments the fact that people are continually noticing each other and looking out for each other goes hand in hand with respect for privacy. Jacobs cites the anthropologist Elena Padilla regarding a “poor and squalid” Puerto Rican district of New York City. In this district people know a great deal about each other just as a matter of public record—who can be trusted, who is defiant of the law, who is competent. “These things are known from the public life of the sidewalk and its associated enterprises.” But at the same time only a highly select group is permitted to drop into the kitchen for a cup of coffee. “It is not considered dignified for everyone to know one’s affairs.”
Jacobs continues:
A good city street neighborhood achieves a marvel of balance between its people’s determination to have essential privacy and their simultaneous wishes for differing degrees of contact, enjoyment or help from the people around. This balance is largely made up of small, sensitively managed details, practiced and accepted so casually that they are normally taken for granted.
Perhaps I can best explain this subtle but all-important balance in terms of the stores where people leave keys for their friends, a common custom in New York. In our family, for example, when a friend wants to use our place while we are away for a week end or everyone happens to be out during the day, or a visitor for whom we do not wish to wait up is spending the night, we tell such a friend that he can pick up the key at the delicatessen across the street. Joe Cornacchia, who keeps the delicatessen, usually has a dozen or so keys at a time for handing out like this. He has a special drawer for them.
Now why do I, and many others, select Joe as a logical custodian for keys? Because we trust him, first, to be a responsible custodian, but equally important because we know that he combines a feeling of good will with a feeling of no personal responsibility about our private affairs. Joe considers it no concern of his whom we choose to permit in our places and why.
Then comes the zinger so far as today’s privacy debates are concerned:
A service like this cannot be formalized. Identifications . . . questions . . . insurance against mishaps. The all-essential line between public service and privacy would be transgressed by [such forms of] institutionalization. Nobody in his right mind would leave his key in such a place. The service must be given as a favor by someone with an unshakable understanding of the difference between a person’s key and a person’s private life, or it cannot be given at all.
Lest you think that Jacobs is addressing the current, technology-centered debate, be aware that she wrote those words in 1961. But she is addressing some of the issues we must tackle. What she is saying is important enough to warrant further quotation:
Or consider the line drawn by Mr. Jaffe at the candy store around our corner—a line so well understood by his customers and by other storekeepers too that they can spend their whole lives in its presence and never think about it consciously. One ordinary morning last winter, Mr. Jaffe, whose formal business name is Bernie, and his wife, whose formal business name is Ann, supervised the small children crossing at the corner on the way to P.S. 41, as Bernie always does because he sees the need; lent an umbrella to one customer and a dollar to another; took custody of two keys; took in some packages for people in the next building who were away; lectured two youngsters who asked for cigarettes; gave street directions; took custody of a watch to give the repairman across the street when he opened later; gave out information on the range of rents in the neighborhood to an apartment seeker; listened to a tale of domestic difficulty and offered reassurance; told some rowdies they could not come in unless they behaved, and defined (and got) good behavior; provided an incidental forum for half a dozen conversations among customers who dropped in for oddments; set aside certain newly arrived papers and magazines for regular customers who would depend on getting them; advised a mother who came for a birthday present not to get the ship-model kit because another child going to the same birthday party was giving that; and got a back copy (this was for me) of the previous day’s newspaper out of the deliverer’s surplus returns when he came by.
Jacobs once asked Mr. Jaffe, “Do you ever introduce your customers to each other?” “No,” came the thoughtful reply. “That would just not be advisable.” This, Jacobs observes, is the well-balanced line “between the city public world and the world of privacy.”
This line can be maintained without awkwardness to anyone, because of the great plenty of opportunities for public contact in the enterprises along the sidewalks, or on the sidewalks themselves as people move to and fro or deliberately loiter when they feel like it, and also because of the presence of many public hosts, so to speak, proprietors of meeting places like Bernie’s where one is free either to hang around or dash in and out, no strings attached.
The Privacy of Community
There is, then—or at least was on the streets of this healthy neighborhood in East Harlem—a vital balance between public exposure and personal privacy, between having to do with each other in manifold ways and leaving each other respectfully alone, between building a public environment of trust and enjoying, within that secure environment, one’s private circle.
Jacobs is describing only one particular sort of urban community, and certainly is not suggesting that the detailed conditions of such a community can be carried over to radically different environments. But the burden of proof, I think, is upon anyone who suggests that the virtues of privacy (or safety) can be enjoyed in a “community” of barricaded individuals who rely centrally upon nonexposure and anonymity for their protection. What one gets is not a community where privacy is honored, but rather the destruction of community altogether. Then privacy has no meaning.
Privacy, after all, is scarcely relevant to the individual living behind a chain-link fence. It can be a concern and a value only where we present ourselves to each other. The “space” we ask for when we ask for privacy, is a space fashioned within and defended by a respectful community. There is no other enduring defense.
The problem is that by the time we have reached a point where data protection has become a major issue, we have mostly abandoned the public spaces as venues for doing business. The automatic teller machine has none of the community virtues of Joe Cornacchia, and it displaces several settings where such virtues might have taken root. Where, then, can the complex values required for privacy be nurtured?
Issues of personal respect don’t arise between packets of data, nor between information processing programs. Data and programs are not caught up in the kind of street life Jacobs describes, and they do not have “respect me” written all over them in the way that people do. They do not inhabit public spaces. Within the global information system every piece of data is perilously close to being globally exposed, and there is no local “community of data” to play a buffering and protecting role. Therefore privacy advocates are, with good reason, trying to write “it’s none of your business” all over every data packet.
But we should realize that this technical protection, necessary though it may be, has little positive relation to any privacy truly conceived. Moreover, it readily contributes to the depersonalization of transactions, thereby further reducing the public spaces where respect for privacy can grow. This is why technologies like public key cryptography, biometric encryption, and digital pseudonyms offer us ambiguous hope at best.
The idea of the pseudonym, for example, is that online data is never traceable to anyone in particular; it is traceable only to a pseudonym. But in order for that to work, there must be no final “giveaway” of the user’s identity. The recipient of a product or service must present himself—pseudonymously—to the teller machine or delivery box or whatever. Post offices or other depots would have to be redesigned to support this absolute anonymity. Where, in Jacobs’ neighborhood, watching after each other on the street was a virtue, the near approach of someone else in this new world of anonymity is a threat. Is that person trying to read my pin number?
If privacy is to emerge as a meaningful public value, it will be in the context of community involvement. Where else can we learn what needs respecting about each other, if not from a knowledge of the other person in particular and of the requirements of a healthily functioning community in general?
It is possible—although it will be a tremendous stretch—for us to extend our gestures of human respect to the abstract, placeless, and timeless data representations of other people. But it isn’t conceivable that we will succeed in this greater challenge while failing the lesser and more familiar one. We cannot—as programmers, application users, corporate employees, consumers—enlarge our respect for persons so as also to embrace data when we have forgotten what respect for persons means in the first place. The delicate balance Jacobs describes in the public life of the sidewalk cannot be lightly manufactured; it grows up in real places, among real presences.
In other words, flesh-and-blood contexts remain the primary schools from which we can try to reach out more widely with our human sympathies. Here’s a simple principle to consider: if you are clearing the way for a new form of data transaction, or proposing some new mechanism for data privacy, then spend at least three times as much effort working toward a means for strengthening community outside these data contexts. Otherwise, you may well be helping to destroy the essential milieu for any privacy worth having.