How Much Privacy Do We Really Want?

Americans are always insistent about the enforcement of their rights—even when those rights clash with one another. That need to have it all reaches its zenith in dealing with rights to privacy and information. In this context, people embrace two imperatives simultaneously. First, people think that they are entitled to privacy, which for the moment we should confine to its core conception—the right to control sensitive information about oneself. That right is invoked to keep credit histories or medical records out of the hands of others; to prevent prying reporters and investigators from eavesdropping or taking pictures with telephoto lenses; or from using heat detectors to detect marijuana growing behind walls. Side by side with privacy comes an insistent demand for full disclosure of all information needed for informed decisions, in both the personal and the political realms. Transparency is the buzzword. Patients want full disclosure of medical alternatives; stockholders want detailed information about corporate affairs; and ordinary citizens voting in hotly contested elections demand detailed information.

The same people who value privacy in one breath prize openness in the next. How best to reconcile two inconsistent demands, each of which deserves a place in a universe that neither should dominate? Each person wants information about himself to be kept private so as to project a favorable image and to gain leverage in private dealings with others. He also wants to acquire information about others to deal with them from a position of knowledge and strength. Any one person can attain both objectives so long as others fail on both counts. But socially, once each of us recognizes the like rights of others, compromise is needed to balance the tally between rights and duties.

We have to return to the first principles of government, which are to protect property and to promote voluntary exchange—while maintaining order, supplying infrastructure, and curbing monopoly. We have to think about the role of autonomy and private property. We have to be attentive to the use of contract as a means for regulating the exchange of information. And we have to understand the role of the tort-law command that requires each of us not to trespass against our neighbors. Surprisingly, the logic of the law of eminent domain asserts itself in this context. Properly constrained, the state can act to everyone’s advantage by taking property for which it pays just compensation. For instance, the state can condemn land to prevent any single landowner from blocking the construction of a needed public highway. The technique carries over in unanticipated ways to the law of privacy, even though money is not involved. Rather, the law imposes a system of forced barter between various bundles of rights, just as our basic social contract asks us all to surrender some property (via taxation) to secure the remainder of our liberty and property.

Let’s look first to the contest between privacy and disclosure between strangers, then between people linked by consensual arrangement such as employer and employee or physician and patient.

Tort Law and Privacy Rules

Eavesdropping and Snooping

We can divide spaces into public and private. Presumptively, everyone has an equal right to enter public spaces; a private owner can keep everyone out of his property at will. Private ownership protects privacy, even when there is no explicit right to privacy. The people who can’t enter your land to peer through your window will be much less likely to pry into your personal affairs. But sometimes trespass law does not go far enough, for people can snoop without entering. As early as the 1760s, Blackstone insisted it was improper to "eavesdrop" from a public street on conversations in a private home.

That leap beyond trespass makes sense. To see why, ask someone whether he is entirely satisfied with the hard libertarian line—no trespass, no wrong. Pragmatically, he will ask whether he would be better off under an alternative rule that takes from him his right to eavesdrop on his neighbors and in exchange gives him a right to be free of eavesdropping by others. Most people would accept that state-imposed trade-off and for good reason. It is expensive to protect privacy by self-help when parabolic microphones can cut through brick walls. So a mutual legal prohibition supplies the "average reciprocity of advantage" that is the hallmark of a desirable forced exchange. We’re confident of that result when we look at the analogous voluntary arrangements to govern the eavesdropping problem. Consider the strong social practice in restaurants that makes it inappropriate for the occupants of one table to crane their necks to overhear private conversations nearby. Compliance with that norm allows the removal of partitions between tables, thereby lowering the cost of basic service for all. But the anti-eavesdropping rule has its implicit social limits: No one can claim privacy for conversations conducted in a loud voice that others cannot help but hear.

We do the same thing with visual privacy. Bad social norms would generate too much privacy if no pedestrian on a public street were allowed to look at fellow pedestrians or at private homes. This hypothetical restriction would be perfectly reciprocal but highly disadvantageous, for it is too costly for people to place blinders over their eyes while on public roads. So the actual practice lets everyone observe what they want so long as they do not stalk or stare at others.

Social practice leads to sensible outcomes, which in turn help shape the limits on government’s investigative powers. The Fourth Amendment’s prohibition against unreasonable government searches and seizures applies to government searches by entry into someone’s home. But what about eavesdropping, perhaps with powerful electronic equipment? "Search" should have the same meaning to both public and private actors. This is not to say that government may never search from afar but only that it is required to offer the same justification for remote searches as for actual entry.

Publication of Unfavorable Information

Individuals often make tenuous privacy claims to control the public dissemination of true but unfavorable information about themselves, even when that information is acquired by proper means. Such claims are clearly overstated. Because the information is true, it cannot be the source of error. Because it was acquired by proper means, it cannot be the result of trespass or snooping. Remove those two elements and what is left? A former prisoner or prostitute may claim the right to keep his or her past activities private, so that no one can speak or write about their past without their consent; a candidate for public office wants to keep private evidence of a physical or mental disability. But an organized society that allows aggrieved individuals to ban the unfavorable comments of others comes close to being a police state. Liberty of conscience and thought depends on the free circulation of ideas, which is inconsistent with private veto rights. Constitutional rights to speech and association are thus implicated.

Yet, again, we face the question of limits. Should gay activist groups be able to "out" people who wish to keep their sexual orientation private? Can reporters dredge up long-forgotten records of reformed prostitutes? Close cases, but legal protection against disclosure is too risky. Public reaction, often bordering on hostility and outrage, leads to sensible forms of self-regulation. For instance, most media outlets today will not publish the names of rape victims until (and sometimes, even after) the matter becomes one of common notoriety.

Blended Cases

The hardest cases arise when people trespass or eavesdrop not merely for their own titillation but to publish true accounts to the world at large. Do the lofty ends justify the grubby means? Does the public release of true information, useful in public debate, justify the trespass? Is the individual owner of the property (the information) entitled to damages that compensate, not only for any physical entry or property damage but also for the loss of business or reputation that follows from the publication of the information?

Generally the speech interest is held to trump the privacy interest. People can publish, it seems, stolen information with impunity, even though they would go to jail for selling stolen goods. In one extreme case, an investigative photographer who trespassed on the grounds of a private psychiatric hospital got away with publishing the picture of an ordinary patient who was in the company of a celebrated public figure. In my view, the privacy interest should trump here, for this is no better than a physician selling confidential information about a patient to a newspaper. Originally, a separate law of privacy developed to pick up where trespass left off. But extraordinary claims of freedom of speech have successfully overridden the traditional trespass law because it protects privacy interests. The field has no end of surprises.

Contract, Privacy, and Disclosure

The choice between privacy and disclosure also arises in connection with ordinary contracts. These cases do not turn on the shifting baselines that are used to keep strangers apart. Quite simply, the central proposition should state that all individuals by agreement can regulate the use of information that they share with one another, just as they can with trade secrets. Information can be kept private or shared with others on a limited and confidential basis. Contract is clearly the right way to make those decisions.

It is important, however, to set the right default provision. This simple point has enormous ramifications on much recent privacy legislation. Thus in the credit area, the Gramm-Leach-Bliley statute—take note of its Republican sponsorship—thinks that the right way to ensure that consumers have confidence in a business is to send them notices that they can opt out of the common practice by which firms share data with other businesses, as by selling lists of names for potential advertisements. Yet less than 1 percent of consumers opt out of the programs. The irony is that most consumers are happy to see their names included on mailing lists. And why not? The lists are structured to match promotional material to consumer tastes. The practice thus allows some vendors to avoid sending unwanted information. When privacy restraints are imposed, the advertiser’s cheaper alternative is often a broadside of unwanted circulars. The privacy provisions of Gramm-Leach-Bliley should be repealed—the general public lassitude is reason enough not to require any specific notification of an opt-out procedure. Extensive regulation is simply not necessary.

The stakes are still higher in the medical area. But far from negating the importance of contracts, it is all the more important to get the information that only contracts can provide. Voluntary contracts can facilitate and shape information flows for both personal and business purposes. Patients reveal sensitive information about themselves to physicians on condition that it be used only for medical purposes. Researchers who collect information about individual patients can be required to excise patient names and identifiers from their reports.

This model of freedom of contract is now challenged by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which has overwhelmed this simple regime with a massive regulatory structure. Although there were occasional breaches of duty, the previous system showed no systemic failure. Yet Congress prematurely swung into action with massive intervention.

Previously, the level of confidentiality varied with the kind of information stored, so that psychiatric records received greater protection than simple data on height and weight. Under our new mandate, the basic presumption is that everyone needs to obtain consent for the disclosure or use of any particular "health information," broadly defined to cover all medical and billing records provided by health care providers. Rare is the patient who does not wish to provide consent in order to receive treatment. At this level, the chief cost of HIPAA is its gratuitous administrative burden. But serious problems crop up elsewhere. Medical research is put at risk because the onerous requirements on data collection are of no direct benefit to patients. HIPAA makes it more difficult to do follow-up studies because individual consent—after full disclosure by the researcher—has to be acquired for each fresh request for data. People hate the trivia, and declining participation rates reduce a study’s value.

HIPAA’s consent requirement can also prevent people from receiving needed care. Under current law, all covered entities—which include health plans, hospitals, insurers, and employers, among others—are required to make "all reasonable efforts" to disclose no more than the minimum amount of protected health information necessary to accomplish the intended purpose of the use or disclosure. But who wants potential litigation or administrative action to justify each of the thousands of disclosure decisions that have to be made each year? (Remember that each medical record could easily be used 100 times because it is shared with specialists and pharmacists, used for billing, transferred for medical research, and so on.) The most nerve-racking situation could involve emergency care. Suppose medical records on file at an Illinois hospital are needed for treatment of a person involved in an automobile accident in Ohio. Which records can the Illinois hospital send to the Ohio physician? Who decides? How quickly can the records be sent? Will clarifications and additional requests be required to resolve consent issues? The potential for delays and red tape—thus potential harm to patients—is frightening.

Issues related to excessive protection of privacy also arise in employment settings, where modern uses of privacy override freedom of contracts and often act as a handmaiden to fraud. A job applicant may have a criminal record, but an employer cannot ask for that information before deciding whether to extend an offer. Yet the employer could easily be held responsible for bad actions of that employee under the doctrine of vicarious liability: The hiring could easily increase exposure to theft or personal violence for the employer and other employees, for which civil and criminal sanctions after the fact are at best imperfect remedies.

On this issue, I remain an unrepentant libertarian. The employer should be able to ask any question of the employee that she wants—whether about past criminal conduct, serious medical conditions, or whatever. The employee may refuse to supply whatever information is demanded. In the end, the two can decide whether the information is more valuable when kept private or when shared. Neither norm—privacy or full disclosure—trumps in some abstract sense. Some employers may not care about employee health. But once health care insurance is provided, then it will matter whether the employee drinks, smokes, or exercises on a regular basis. If that information is relevant to an insurer in setting a risk, then it is relevant to the employer who has to foot the bill for the long-term health plan. Often an employer will back off asking some questions because they might drive strong candidates away. In some cases, it will adopt an exclusion—for example, no coverage for AIDS-related conditions—which obviates the need to ask hard questions to begin with. But we should not confuse social prudence with some normative public standard that the privacy norm should prevail over full disclosure.

In the United States today, this position has fallen into disrepute. The Americans with Disabilities Act begins with the premise that disability-based discrimination is impermissible in employment relationships. So information dries up as an employer is forbidden access to sensitive medical information in hiring and insurance decisions. Further proposals are afoot—for example, to make it impermissible to require the release of any sensitive information that employees might have about genetic predispositions to certain conditions, be it Huntington’s disease or breast cancer. That would reverse the classical rule of insurance contracting, which imposed on the insured a duty to disclose any risk or condition that might affect an insurer’s willingness to accept the risk or might affect the premium to be charged. The new rules force employers and low-risk coworkers to subsidize high-risk employees at their own expense. It therefore dulls the incentive to take care of yourself in order to be eligible for insurance. It also spurs firms to tailor coverage in ways that minimize their financial exposure, even if it means abandoning or reducing coverage to other employees.

Conclusion

It seems clear that today’s tension between privacy and full disclosure is here for the duration. In some cases the choices that have to be made will be truly wrenching, and we can ask of our public officials only that they do the best they can in light of the conflicting values at stake. But we would be wrong, I think, to assume that we have reached a point of sad acquiescence in the current situation. The simple truth of the matter is that we get ourselves into deep trouble precisely because we ignore the strong principles of classical liberalism.

We would do a lot better by following a couple of simple rules. In cases involving strangers, courts go wrong when they treat freedom of speech as such a consuming value that it runs roughshod over everything in its way. Speech and property are not mortal enemies but part of the same comprehensive system. Yet, ironically, just as freedom of speech is overvalued, so freedom of contract is too blithely cast aside. In this context, privacy is so exalted that sometimes it cannot be waived at all or, alternatively, it can be waived only in a cumbersome manner on a case-by-case basis. Often the default rules protect privacy when consumers much prefer a regime that allows for full or partial disclosure.

I believe that errors in both directions stem from a single root cause—the failure to appreciate the role of private property and voluntary exchange as the dominant principles in social organization. Novel social challenges are best resolved by following the classical principles of social organization.