Right to privacy

History

The concept of a human "right to privacy" begins when the Latin word ius expanded from meaning "what is fair" to include "a right – an entitlement a person possesses to control or claim something," by the Decretum Gratiani in Bologna, Italy in the 12th century.

In the United States, an article in the 15 December 1890, issue of the Harvard Law Review entitled "The Right to Privacy," written by attorney Samuel D. Warren II and future U.S. Supreme Court Justice Louis Brandeis, is often cited as the first explicit finding of a U.S. right to privacy. Warren II and Brandeis wrote that privacy is the "right to be let alone," and focused on protecting individuals. This approach was a response to recent technological developments of the time, such as photography and sensationalist journalism, also known as "yellow journalism."

Privacy rights are inherently intertwined with information technology. In his widely cited dissenting opinion in Olmstead v. United States (1928), Brandeis relied on thoughts he developed in the article "The Right to Privacy." In that dissent, he urged that personal privacy matters were more relevant to constitutional law, going so far as to say that "the government was identified as a potential privacy invader." He writes, "Discovery and invention have made it possible for the Government, by means far more effective than stretching upon the rack, to obtain disclosure in court of what is whispered in the closet." At that time, telephones were often community assets, with shared party lines and potentially eavesdropping switchboard operators. By the time of Katz, in 1967, telephones had become personal devices with lines not shared across homes and switching was electro-mechanical. In the 1970s, new computing and recording technologies raised more concerns about privacy, resulting in the Fair Information Practice Principles.

In recent years, there have been few attempts to clearly and precisely define the "right to privacy."

As an individual right

Alan Westin believes that new technologies alter the balance between privacy and disclosure and that privacy rights may limit government surveillance to protect democratic processes. Westin defines privacy as "the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others". Westin describes 4 states of privacy: solitude, intimacy, anonymity, and reserve. These states must balance participation against norms:

Each individual is continually engaged in a personal adjustment process in which he balances the desire for privacy with the desire for disclosure and communication of themself to others, in light of the environmental conditions and social norms set by the society in which they live.

— Alan Westin, Privacy and Freedom, 1968

Under liberal democratic systems, privacy creates a space separate from political life, and allows personal autonomy, while ensuring democratic freedoms of association and expression. Privacy to individuals is the ability to behave, think, speak, and express ideas without the monitoring or surveillance of someone else. Individuals exercise their freedom of expression through attending political rallies and choosing to hide their identities online by using pseudonyms.

David Flaherty believes networked computer databases pose threats to privacy. He develops 'data protection' as an aspect of privacy, which involves "the collection, use, and dissemination of personal information". This concept forms the foundation for fair information practices used by governments globally. Flaherty forwards an idea of privacy as information control, "individuals want to be left alone and to exercise some control over how information about them is used".

Marc Rotenberg has described the modern right to privacy as Fair Information Practices: "the rights and responsibilities associated with the collection and use of personal information." Rotenberg emphasizes that the allocation of rights are to the data subject and the responsibilities are assigned to the data collectors because of the transfer of the data and the asymmetry of information concerning data practices.

Richard Posner and Lawrence Lessig focus on the economic aspects of personal information control. Posner criticizes privacy for concealing information, which reduces market efficiency. For Posner, employment is selling oneself in the labor market, which he believes is like selling a product. Any 'defect' in the 'product' that is not reported is fraud. For Lessig, privacy breaches online can be regulated through code and law. Lessig claims that "the protection of privacy would be stronger if people conceived of the right as a property right," and that "individuals should be able to control information about themselves". Economic approaches to privacy make communal conceptions of privacy difficult to maintain.

Adam D. Moore has argued that privacy, the right to control access to and use of personal information is closely connected to human well-being. He notes that "having the ability and authority to regulate access to and uses of locations, bodies, and personal information, is an essential part of human flourishing" and while "the forms of privacy may be culturally relative . . . the need for privacy is not."

As a collective value and a human right

There have been attempts to reframe privacy as a fundamental human right, whose social value is an essential component for the functioning of democratic societies.

Priscilla Regan believes that individual concepts of privacy have failed philosophically and in policy. She supports a social value of privacy with three dimensions: shared perceptions, public values, and collective components. Shared ideas about privacy allow freedom of conscience and diversity in thought. Public values guarantee democratic participation, including freedoms of speech and association, and limit government power. Collective elements describe privacy as a collective good that cannot be divided. Regan's goal is to strengthen privacy claims in policy making: "if we did recognize the collective or public-good value of privacy, as well as the common and public value of privacy, those advocating privacy protections would have a stronger basis upon which to argue for its protection".

Leslie Regan Shade argues that the human right to privacy is necessary for meaningful democratic participation, and ensures human dignity and autonomy. Privacy depends on norms for how information is distributed, and if this is appropriate. Violations of privacy depend on context. The human right to privacy has precedent in the United Nations Declaration of Human Rights. Shade believes that privacy must be approached from a people-centered perspective, and not through the marketplace.

Privacy laws in different jurisdictions

Privacy laws apply to both public and private sector actors.

Australia

Australia does not have a constitutional right to privacy. However, the Privacy Act 1988 (Cth) provides a degree of protection over an individual's personally identifiable information and its usage by the government and large companies. The Privacy Act also outlines the 13 Australian Privacy Principles.

Australia also lacks a tort against invasions of privacy. In the 2001 case of Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd, 208 CLR 199, the High Court of Australia explained that there stood the possibility of "a tort identified as unjustified invasion of privacy", but that this case lacked the facts to establish it. Since 2001, there have been some state-based cases—namely the 2003 case Grosse v Purvis, QDC 151; and the 2007 case Doe v Australian Broadcasting Corporation, VCC 281—that attempted to establish a tortious invasion of privacy, but these cases were settled before decisions could be made. Further, they have received conflicting analyses in later cases.

Canada

Canadian privacy law is derived from the common law, statutes of the Parliament of Canada and the various provincial legislatures, and the Canadian Charter of Rights and Freedoms. Perhaps ironically, Canada's legal conceptualization of privacy, along with most modern legal Western conceptions of privacy, can be traced back to Warren and Brandeis's "The Right to Privacy" published in the Harvard Law Review in 1890, Holvast states "Almost all authors on privacy start the discussion with the famous article 'The Right to Privacy' of Samuel Warren and Louis Brandeis".

China

The Constitution is the highest law in China. Privacy rights have been applied throughout China. The Constitution provides direction for all states in China and it further stipulates that "all states must abide by and be held accountable for any violation of the Constitution and the law; the law specifically protects civil rights of a citizen's personal dignity and confidentiality of correspondence." China has a new standard and the first of its kind for the country coming into effect 1 January 2021, the Civil Code is the first of its kind sweeping law replacing all laws covering general provisions, real property, contracts, personality rights, marriage and family, inheritance, tort liability, and supplementary provisions.

In many cases raised in the legal system, these rights have been overlooked as the courts have not treated each case with the same legal precedent for each case. China deploys mass surveillance on its population including through the use of closed-circuit television.

The 2021 Data Security Law classifies data into different categories and establishes corresponding levels of protection. It imposes significant data localization requirements, in a response to the extraterritorial reach of the United States CLOUD Act or similar foreign laws.

The 2021 Personal Information Protection Law is China's first comprehensive law on personal data rights and is modeled after the European Union's General Data Protection Regulation.

European Union

The right to privacy is protected in the EU by European Convention on Human Rights Article 8:

1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

— European Convention on Human Rights

Compared to the United States, the European Union (EU) has more extensive data protection laws.

The General Data Protection Regulation (GDPR) is an important component of EU privacy law and of human rights law, in particular Article 8(1) of the Charter of Fundamental Rights of the European Union.

Under GDPR, data about persons, independent from their citizenship, may only be gathered or processed under specific cases, and with certain conditions. Requirements of data controller parties under the GDPR include keeping records of their processing activities, adopting data protection policies, transparency with data subjects, appointing a Data Protection Officer, and implementing technical safeguards to mitigate security risks.

Council of Europe

The Council of Europe gathered to discuss the protection of individuals when the Convention Treaty No.108 was created and opened for signature by member states and for accession by non-member States.

The Convention closed and was then renamed Convention 108: Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data.

Convention 108 has undergone 5 ratifications with the last ratification 10 January 1985 officially changing the name to Convention 108+ and providing the summary stating the intent of the treaty as:

The first binding international instrument which protects the individual against abuses which may accompany the collection and processing of personal data, and which seeks to regulate at the same time the transfrontier flow of personal data.

Increase use of the Internet and technological advancement in products lead to the Council of Europe to look at Convention 108+ and the relevance of the Treaty in the wake of the changes.

In 2011 the modernization of Convention 108+ started and completed in 2012 amending the treaty with Protocol CETS No223.

This modernization of Convention 108+ was in progress while the EU data protection rules were developed, the EU data protection rules would be adapted to become the GDPR.

India

The new data sharing policy of WhatsApp with Facebook after Facebook acquired WhatsApp in 2014 has been challenged in the Supreme Court. The Supreme Court must decide if the right to privacy can be enforced against private entities.

The Indian Supreme Court with nine-judge bench under JS Khehar, ruled on 24 August 2017, that the right to privacy is a fundamental right for Indian citizens per Article 21 of the Constitution and additionally under Part III rights. Specifically, the court adopted the three-pronged test required for the encroachment of any Article 21 right – legality – i.e. through an existing law; necessity, in terms of a legitimate state objective and proportionality, that ensures a rational nexus between the object of the invasion and the means adopted to achieve that object.

This clarification was crucial to prevent the dilution of the right in the future on the whims and fancies of the government in power. The Court adopted a liberal interpretation of the fundamental rights to meet the challenges posed an increasing digital age. It held that individual liberty must extend to digital spaces and individual autonomy and privacy must be protected.

This ruling by the Supreme Court paved the way for decriminalization of homosexuality in India on 6 September 2018, thus legalizing same-sex sexual intercourse between two consenting adults in private. India is the world's biggest democracy and with this ruling, it has joined United States, Canada, South Africa, the European Union, and the UK in recognizing this fundamental right.

India's Data Protection law is known as Digital Personal Data Protection Act, 2023. Legal scholars such as Arghya Sengupta have written extensively on the implications of the Supreme Court's recognition of privacy as a fundamental right, through both academic work and contributions at the Vidhi Centre for Legal Policy.

Israel

In Israel privacy protection is a constitutional basic right and is therefore protected by the Basic Law. Basic Law: the Knesset passed on 12 February 1958, by the Third Knesset. The Twelfth Knesset update to the Basic Law occurred on 17 March 1992. This update added to the law Human Dignity and Liberty by defining: Human freedom in Israel as being the right to leave the country and enter it, as well as the right to privacy and intimacy, refrainment from searches relating to one's private property, body and possessions, and avoidance of violations of the privacy of one's speech, writings and notes.

October 2006 Israel established a regulatory authority, the PPA, part of the Ministry of Justice. PPA defined the Privacy Law and associated regulates based on two principles: general right to online privacy and the protection of personal data stored in databases.

New Zealand

New Zealand is committed to the Universal Declaration of Human Rights and has ratified the International Covenant on Civil and Political Rights, both of which contain a right to privacy. Privacy law in New Zealand is dealt with by statute and the common law. The Privacy Act 2020 addresses the collection, storage and handling of information. A general right to privacy has otherwise been created in the tort of privacy. Such a right was recognised in Hosking v Runting [2003] 3 NZLR 385, a case that dealt with publication of private facts. In the subsequent case C v Holland [2012] NZHC 2155 the Court recognised a right to privacy in the sense of seclusion or a right to be free from unwanted intrusion.

Russia

The Constitution of the Russian Federation: Article 45 states:

1. State protection of human and civil rights and freedoms in the Russian Federation shall be guaranteed.
2. Everyone shall the right to protect his (her) rights and freedoms by all means not prohibited by law.

The Russian Constitution specifically articles 23 and 24, institutes individual citizen the right to privacy. Russia, a member of the Strasbourg Convention, ratified processing of personal data against automatic processing and afterwards adopted a new convention. The new Russian Federal Law No.152-FZ R implemented on 27 July 2006, was updated to cover Personal Data and this law extends privacy to include personal and family secrets. Its main target is to protect individuals' personal data.

Privacy entered the forefront of Russian legislature in 2014 when the approach to privacy turned to the goal of protecting privacy of government operations and the people of Russia. The amendments originally modified the Personal Data Law which has since been renamed The Data Localisation Law. The new law requires business operators who collect any information on Russian citizens' must maintain the collected data locally. This means that data transmission, processing, and storage must be in a database in Russia. 1 March 2021, the new amendment came into effect. Consent from the data subject is required if the data operator wants to use the data publicly.

United States

The Constitution of the United States and the United States Bill of Rights do not explicitly include a right to privacy.

In the US, the right of marital privacy was recognized by the Supreme Court in Griswold v. Connecticut, 381 U.S. 479 (1965) as falling within the penumbra of the Bill of Rights.

In 1890, Warren and Brandeis drafted an article published in the Harvard Law Review titled "The Right To Privacy" that is often cited as the first implicit finding of a U.S. stance on the right to privacy.

Right to privacy has been the justification for decisions involving a wide range of civil liberties cases, including Pierce v. Society of Sisters, which invalidated a successful 1922 Oregon initiative requiring compulsory public education; Roe v. Wade, which struck down an abortion law from Texas, and thus restricted state powers to enforce laws against abortion; and Lawrence v. Texas, which struck down a Texas sodomy law, and thus eliminated state powers to enforce laws against sodomy. Dobbs v. Jackson Women's Health Organization later overruled Roe v. Wade, in part due to the Supreme Court finding that the right to privacy was not mentioned in the constitution, leaving the future validity of these decisions uncertain.

Legally, the right of privacy is a basic law which includes:

1. The right of persons to be free from unwarranted publicity
2. Unwarranted appropriation of one's personality
3. Publicizing one's private affairs without a legitimate public concern
4. Wrongful intrusion into one's private activities

However, outside of recognized private locations, American law, for the most part, grants next to no privacy for those in public areas. In other words, no verbal or written consent is needed to take photos or videos of those in public areas. This laxness extends to potentially embarrassing situations such as when actress Jennifer Garner bent over to retrieve something from her car and revealed her underwear to create a whale tail. Because the photographer took the photo in a public location, in this case a pumpkin patch, circulating the photo online was a legal act.

For the health care sector where medical records are part of an individual's privacy, The Privacy Rule of the Health Insurance Portability and Accountability Act was passed in 1996. This act safeguards medical data of the patient which also includes giving individuals rights over their health information, like getting a copy of their records and seeking correction. Medical anthropologist Khiara Bridges has argued that the US Medicare system requires so much personal disclosure from pregnant women that they effectively do not have privacy rights.

CCPA

In 2018, California set out to create a policy promoting data protection, the first state in the United States to pursue such protection. The resulting effort is the California Consumer Privacy Act (CCPA), reviewed as a critical juncture where the legal definition of what privacy entails from California lawmakers' perspective. The California Consumer Protection Act is a privacy law protecting the residents of California and their Personal identifying information. The law enacts regulation over all companies regardless of operational geography protecting the six Intentional Acts included in the law.

The intentions included in the Act provide California residents with the right to:

1. Know what personal data is being collected about them.
2. Know whether their personal data is sold or disclosed and to whom.
3. Say no to the sale of personal data.
4. Access their personal data.
5. Request a business to delete any personal information about a consumer collected from that consumer.
6. Not be discriminated against for exercising their privacy rights.

Mass surveillance

United States

Governmental organizations such as the National Security Agency (NSA), CIA, and GCHQ amongst others are authorized to conduct mass surveillance throughout other nations in the world. Programs such as PRISM, MYSTIC, and other operations conducted by NATO-member states are capable of collecting a vast quantity of metadata, internet history, and even actual recordings of phone calls from various countries. Domestic law enforcement at the federal level is conducted by the Federal Bureau of Investigation, so these agencies have never been authorized to collect US data. PRISM has faced criticism for privacy concerns, in that it collects "metadata and communication content." However, scholars have argued that programs like PRISM do more good than harm, in that they protect Americans from foreign threats.

After the September 11 attacks, the NSA turned its surveillance apparatus on the US and its citizens.

In March 2013, James Clapper, the Director of National Intelligence at the time, testified under oath that the NSA does not "wittingly" collect data on Americans. Clapper later retracted this statement.

The US Government's own Privacy and Civil Liberties Oversight Board (PCLOB) reviewed the confidential security documents, and found in 2014 that the program did not have "a single instance involving a threat to the United States in which the program made a concrete difference" in counterterrorism or the disruption of a terrorist attack.

China

The Chinese government is conducting mass surveillance in Xinjiang province for detention of Muslims. As part of its "Strike Hard Campaign against Violent Terrorism" policy the authorities in China have subjugated 13 million Turkish Muslims to the highest order of restrictions.

During the COVID-19 pandemic the Chinese authorities documented the contact information and travel history of every individual and issued red, yellow and green badges/codes for transportation and entering stores. These badges/codes were also sometimes misused to freeze bank accounts and pressurize the protestors who were angry about the severe restrictions. The privacy of these health codes remain unacknowledged and unaddressed.

Journalism

It is often claimed, particularly by those in the eye of the media, that their right to privacy is violated when information about their private lives is reported in the press. The point of view of the press, however, is that the general public has a right to know personal information about those with status as a public figure. This distinction is encoded in most legal traditions as an element of freedom of speech.

Publication of private facts

Publication of private facts speaks of the newsworthiness of private facts according to the law and the protections that private facts have. If a fact has significant newsworthiness to the public, it is protected by law under the freedom of the press. However, even if the fact is true, if it is not newsworthy, it is not necessarily protected. Digital Media Law Project uses examples such as sexual orientation, HIV status, and financial status to show that these can be publicly detrimental to the figure being posted about. The problem arises from the definition of newsworthiness.

Newsworthiness

According to Digital Media Law Project, the courts will usually side with the press in the publication of private facts. This helps to uphold the freedom of the press in the US Constitution. "there is a legitimate public interest in nearly all recent events, as well as in the private lives of prominent figures such as movie stars, politicians, and professional athletes." Digital Media Law Project supports these statements with citations to specific cases. While most recent events and prominent figures are considered newsworthy, it cannot go too far and too deep with a morbid curiosity. The media gain a lot of leverage once a person becomes a prominent figure and many things about their lives become newsworthy. Multiple cases such as Strutner v. Dispatch Printing Co., 442 N.E.2d 129 (Ohio Ct. App. 1982) show that the publication of a person's home address and full name who is being questioned by the police is valid and "a newsworthy item of legitimate public concern." The last part to consider is whether this could be considered a form of doxxing. With the court upholding the newspaper's right to publish, this is much harder to change in the future. Newsworthiness has much around it that is held up by court rulings and case law. This is not in legislation but is created through the courts, as many other laws and practices are. These are still judged on a case-by-case basis as they are often settled through a lawsuit of some form. While there is a fair amount of case law supporting newsworthiness of subjects, it is hardly comprehensive and, news publications can publish things not covered and defend themselves in court for their right to publish these facts.

Technology

Private sector actors can also threaten the right to privacy – particularly technology companies, such as Amazon, Apple, Facebook, Google, and Yahoo that use and collect personal data. These private sector threats are more acute due to AI data processing.

In some American jurisdictions, the use of a person's name as a keyword under Google's AdWords for advertising or trade purposes without the person's consent has raised certain personal privacy concerns. The right to privacy and social media content laws have been considered and enacted in several states, such as California's "online erasure" law protecting minors from leaving a digital trail. State laws, such as the CPPA in California, have granted more comprehensive protection.

However, the United States is lagging behind European Union countries in protecting privacy online. For example, the "right to be forgotten" ruling by the EU Court of Justice protects both adults and minors. The General Data Protection Regulation has made significant progress to protect privacy from these risks, and it has led to a wave of privacy and data protection laws around the world.

Privacy is a major issue in the health care sector with technology becoming an essential component of it. Connecting personal data of patients to internet makes them vulnerable to cyber attacks. There are also concerns about how much data should be stored and who should have access to it.

Protection of minors

United Kingdom

Laws and courts in the UK uphold the protection of minors in the journalistic space. The Independent Press Standards Organisation (IPSO) in the UK have shown that the usage of footage of a 12-year-old girl being bullied in 2017 can be retroactively taken down due to fears of cyber-bullying and potential harm done to the child in the future. This was after the Mail Online published the video without any attempt to hide the identity of the child. Following the newsworthiness point, it is possible that content like this would be allowed in the United States due to the recentness of the event. Protection of minors is a different matter in the United States with new stories about minors doing certain things and their faces are shown in a news publication. The Detroit Free Press, as an example, chose to do a hard-hitting story about prostitution and drugs from a teenager but never named her or showed her face, only referring to her and the "16-year-old from Taylor". In the UK, during the case of Campbell v MGN, Lord Hope stated that the protection of minors will be handled on a case-by-case basis and affected by the child's awareness of the photo and their expectation of privacy. Many factors will be considered such as the age of the children, activity, usage of real names, etc.

United States

The protection of minors in the United States often falls on the shoulders of the Children's Online Privacy Protection Act (COPPA). This protects any children under the age of 13 from the collection of their data without their parent's or guardian's permission. This law is the reason why many sites will ask if you are under 13 or require you to be 13 to sign up. While this law is intended to protect preteen children, it fails to protect the information of anyone older than 13, including teenage minors. It also begins to overlap with other privacy protection laws such as the Health Insurance Portability and Accountability Act (HIPAA).