003024488 Contents Acknowledgments Contributors Privacies: An Overview Beate Rissler Privacy in American Law Anita L. Allen Interpreting Doctrines of Privacy: A Comment on Anita Allen Nicola Lacey Gender and Pr Beate Rissler icy: A Critique of the Liberal Tradition Personal Autonomy and the Law: Sexual Harassmer Privacy, and che Dilemmas of Regulating Jean L. Cohen Privacy and Autonomy: A Comment on Jean Cohen Maeve Cooke Privacy and the Body: The Publicity of Affect Moira Gatens 19 2 B 98 13Driving to the Panopticon A PHILOSOPHICAL EXPLORATION OF THE RISKS TO PRIVACY POSED BY THE INFORMATION TECHNOLOGY OF THE FUTURE Jeffrey Reiman Michel Foucsule being watched and be altered and our very character wi —Hubere Humphrey mn our guard to protect the government's purposes ate beneficent. Louis Brandeis and private sector project highway transportation echnology to order to make highway travel safer, speedier, and more efficient. The short-term goal, already partially reali computers to track vehicles and provide drivers wi cerning road conditions and optimal routes. The long-term goal, current- ly in the experimental stage, is to use computers to take over the driving itself, The project, however, is not without its risks. According to the Driving to the Panopticon 195 ieee, “IVHS information systems ion on where travelers go, the routes they use, and This inform: to disadvantage indi- of what the Privacy Task. sues Committee ” T hope that my tit makes clear that I don' regard the threat to privacy posed by Inte Vehicle Highway Systems as a strawman at all. Nor do I think that the committee’ vague reference to use of information to individual vantage does any more than begin to hint at the nature of cha The Panopticon was Jeremy Bentham’ plan for 2 prison in which large numbers of convicts could be kept under sutvellance by very few ‘guards.? The idea was to build the prison ircle around the guard post. All the prisoners would be silhouetted against light coming into the s from windows on the outside of the circle. Their movements would be visible to a single guard in the center. The French philosopher Michel Foucault used Bentham’s Panopticon as an ominous metaphor for the mechanisms of large-scale social control that characterize the modem world.’ He contendes the model surpris- “ons resemble factories, schools, barracks, became, perhaps subconscious als, which all resemble As Bentham realized and Fou emphasized, the system works seen—will be enough co produce Indeed, awareness of being visible, wrote makes people the agents of their own subjection. knows it, assumes responsi- ie makes them play spontaneously upon him- bes in himself the power in which he simultaneously plays both roles; he becomes the principle of his own subjection,§ ‘went on to stretch the Panopticon metaphor beyond archi- tecture to characterize the practices of conventional me thought subject us « control because they create a worl ich the details of our lives become symptoms exposed to a clinical gaze—even if no one is acwually196 JEFFREY REIMAN looking want to stretch the Panopticon metaphor yet further, to ple visible but also the way that makes An incriguing and 1g feature of the suspicion about the threat to privacy posed by IVHS is that the information that would be the public ic obser- officers in or 10 unobjectionable pu ld that normal observ ide on a applied to “the follo streets and highways,”* even when the followin racking a the driver's possession, In United States wx Karo, the Supreme Court held that “while in [thei oon public roads... [the defendants had no priva visually observed in these put whether she is punctual, whether she is faithful ‘Wasserstrom observes, in an article first published ‘mation already collected in data banks at that time, could produce a doing... th the one I could s jemory. There is, then, something to learn about privacy from the sort of threat that IVHS represents locked doors and closed curt observable act » but also from the way our pul are dispersed over space and time. If we direct our pri- vacy-protection efforts at reinforcing our doors and ct the way in which modern means of ins, we may miss lection threaten our es and making them ‘metaphor for the new thre the fishbowl But a threat to privacy is only worrisome insofar as privacy is value a Driving to the Panopticon 197 ings chat are valuable. No doubt privacy is valu- able to people who have mischief vo hide, but that is not enough to make it generally worth protecting. However, it is enough to remind us that Iso has costs, The more privacy we have, the information that society needs to stop or pun- ish wrongdoers. Moreover, the curtain of privacy that is traditionally brought down around the family has often provided cover for the sul dren. Privacy is at privacy is essential to a free society is to believe that i is worth its costs. Bue, then, freedom itself is not a free lunch, A free society is a dangerous and often chaotic one. Let us, then, look at the value of privacy. By privacy, I understand the condition in which other people are deprived of access to either some information about you or some expeti- ence of you. For the sake of econom) shorten this and say thae pri- acy isthe condition in which others are deprived of access ro you, Under access 1 include experience alongside information, since I think that privacy is about more than information, Your to take a shower unwatched is part of your privacy eve warchers may gain no information about you that they didn’t already get in their high school biology course. Or, if you think that they might afterall gai information aboue us thae ‘Note that I have de lack of access 10 you. more impor- including control as part of privacy leads to anomalies. For example, s that “in our culture the excretory func more of less absolute privacy, so vacy is viola sing. in our cul- cone does not have control over who gets to observe one’s performance of the excretory fun198 JEFFREY REIMAN inp ince prying on someone in the privy is su privacy, privacy must be a condition independent of the iss Its easy to get confused here, since chere are some priv in which control is of great importance. For example, we d want to restrict access to our naked bodies; we want to be able to decide who gets to see or touch them. The privy should remind us, howeve he definition of privacy would of privacy to only that part of privacy which is precisely the result in bea value because it gives us ‘our understanding of the value which contol is imporcant— ieds case. He ends up taking privacy to resource is ink that Fried is with someone without—or at a with him, and one can ing a lot of private infor- ¢ private information with one’s psy- thereby in the definition of privacy we will find che sort of privacy we want in the bedroom, but not of the sort ‘we want in the bathroom, In our bedrooms, we want to have power over who has access to us; in our bathrooms, we just want others deprived of that access, But notice here that the sort of privacy we want in the bed- room presupposes the sort we want in the bathroom. We cannot have dis- ir discretion. In the bathroom, is all we want. In the bedroom, ly the power to decide at our discretion who does have access. What is common to both sorts of privacy interests, then, is that n for our own control. But ocher time: cs lack the access. This is imporcant for our purposes, tion that IVS systems will gather i Driving so the Panopticon 199 tat our discretion. Ie wi 5 to have, From the definition of privacy just given follows a specific concep- tion of the right to privacy. The right to privacy is not access to me—ie is my righ be infor- trol ace Having privacy is not the same 1 can have either without the other. [ ca rsonal information about, or experience of, s should be kept out of other peoples reach. Such norms may be legal Ive already quoted some of the legal norms governing the right to priva- cy in the United States.” If, however, we think that individuals ou have others deprived of access to some of theit perso not 2 law says so, then we to privacy. And we will wai ing it up with an effective legal right. Since I chink that IVHS threatens our privacy in ways that go beyond current legal rights, lam concen defend a moral right to privacy. To say that someone has a moral right to privacy doesn't say much unless we know what the scope of that right is, what things or activities a Person has a right ro keep ouc of other people’ view. For anyone who docsnit live in a cave or in a desert, a completely is impossible. the scope of a Person's privacy (say, their religious beliefs) and other things (say, the color of their eyes) are not. Often, as cases like Roe ox. Wade and Bowers os, a free society should have as extensive a tight to pri- vacy as is compatible with reasonably safe social coexistence, while others200 JEFFREY REIMAN of political opinions and plans) should be protected. As the tension be- tween current law and fears about IVHS shows, there disagreement over whether the accumulation of bits of public information should come under the scope of privacy To resolve such disagreeme: we must get clear on the value of pri- ivacy, of, equivalently, having an effective is an especially important and good thing for human I be able co determine what must come under the scope of ¢ value to be realized. vacy. IF we know why ight suf- fer as a result of the information about us that would then be gathered. Here it is of great importance that a fully developed IVHS will not exist in an informational vacuum. IV igside that provided by other developments already in existence and likely to grow, such as computerization of census and IRS information; computer records of people's credit-card purchases, their bank transactions, their credit his- tories generally, their telephone call of arrests that end in acqui ighway on which we will all soon be riding, with ic recording ofall interactions, noc to mention the FBI's desire to keep it eternally wire-tappable.” It has been observed, by the way, that as people conduct the business of their dai s, mere knowledge of whom people call— ‘now readily available to police agencies—“would give law enforcers exten- sive access to people's hal complex that, in le from a single poi is as a factor in helping to bring about this whole ct that I shall consider the threat posed by IVHS. ted information—but this is the only way to sce the threat accu rately, The reason is this: we have privacy when we can keep personal things out of the publ mn gathering in any particular sealm may not seem to pose a very grave threat precisely becaus. Driving to the Panopticon 20 erally possible to preserve one’s privacy by escaping into other realms. Consequently, as we look at each kind of information gathering in isola- tion benign?! However, as each effect isto close off yet another escape route from public access, so that, when the wl place, its overall effect on privacy will be greater than che sum of the effects of d Whac we need to know is IVHS'5 role in bringing about this overall effect, and plays that role by contributing to the e he whole com- is put into pract plex of information-gatheting modal 1 call this whole complex, of which IVHS 1 the infor. ‘ational Panopticon, Ici the tisks posed to privacy by the informational Panopticon as a whole that I shall explore. Ride with me, then, into the informati ex what we stand to lose if our lives become acterize the potential risks under four headings: of freeclom; (b) the risk of intrinsic loss of freedom of psychopolitical metamorphosis. All ome cleat in due course, I have give - larly unwieldy and ugly heading preci isthe one that I regard as least fami speculative, and most ominous. The nod to Kafka is i I should add that these headings are not put forth ical di They are meant simply to get uneuly philosophical categories, they will cru ble if pressed coo hard. If however, we see them for what they are, they will give us an orderly picture of the risks that IVHS and the rest of the informational is picture will be just a negative image of the value of privacy. risk of extrinsic Loss (©) symbolic risks; and se strange headings last category a pi The Risk of Extrinsic Loss of Freedom By extrinsic loss of freedom, I mean all those ways in which lack of privacy makes people vulnerable to having theit behavior controlled by others. Most obviously this refers to the fact that people who want to do Uunpopular or unconventional actions may be subject to social pressure in form of denial of certain benefits—jobs, promotions, or membership in formal or informal groups—or even blackmail, if their actions are Known to others. Even if they have reason to believe that their actions202, JEFFREY REIMAN ‘ight be known to others and that those others might penalize them, likely to have a chilling effect on them that will constrain the range of their freedom to act.”” Remember, it is by inducing the consciousness of visi bility chae the Panopticon, functioning of power.” words, “assures the automatic ressures to id other forms of functions to pro- 1g the unpleasant consequence: erty to perform them. actions and thus increasing his is not ‘a matter of the freedom to do immoral or illegal acts. It applies equ: unpopular political actions them: » the moral status of these actions be left to individuals to decide wus that not everything that a majority of citz ¢ made illegal. (Think here of pornography, gamblin, ss, and homosexual or pre- or extramarital heterosexual sex. be wrong to force people legally to conform to the m views on such issues, it would be equally wrong to use harsh so h the same effect. For this reason, I pres- argued in On yy and its informal social was not, by the way, against people trying to persuade one another about what is moral. Actually, he thoughe thae we should do more of that than we normally do. He distinguished, however, between appeals to reason and appeals to force or its equivalent: harsh, informal social penalties. Trying to persuade thi yy making arguments and pro- ducing evidence can be done in public forums without pointing, fi and thus without put i Teaves the members of ‘Threatening the min¢ because it changes peo} them, witht ity with stigmatization of ostracism works is by attaching painful consequences 0 changing their minds at all. Privacy protects people from preserves their freedom, st whether the idea that people need privacy to act Driving to the Panopticon 203 pressure, and thus only those with weak characters need dark private cor- nets in order to act freely. In differ is objection can be raised 3c, and so I want t0 give a rally have to be designed for the for some ideal people that we would like to see or be. Just as Madison observed that if people were angels we wouldnt need government at all, so we might add that if pe heroes we wouldn't need privacy at all. Since people are neither angels nor (except in a few instances) heroes, we need both government and privacy. Second, just because people are not angels, some will be tempted to penalize those who act unconventionally. Even if people should ideally be able to pressure in the form of stigmatization ot ostracism, it remains unjust that they should suffer these fates sim- le were ippose we wanted to make our citizens into the sorts of ‘own judgments and in acting igments. And this experience would have to be given to them before they have the strong characters we want them to attain. They red from pressures toward social conformiey while sorts of people who are not vulnerable, They would need privacy in order to become the sorts of peo- ple who don't need it?” Much as 2 school for char- ‘00 is privacy. And since this school must provide continuing education for adults, as well as teach children, we need privacy as an abid- ig feature of the society. In short, the vast majority of actual people need cy for free action, and those who do nor, needed privacy to become that way. With or without heroes, we need privacy. order to become t isk of Intrinsic Loss of Freedom By intrinsic loss of freedom, I point to ways in which denial of pri- ’ freedom directly, independenely of the ways in which it makes chem susceptible to social pressure or penalties. Put differently, I204 JEFFREY REIMAN want here to suggest that privacy is not just a means of protecting free- dor rs ive of freedom in a + of importa ce of control in the defi. f privacy.” I concluded there that control is not part of privacy b in some cases itis part of what privacy makes possible. For me to be able to decide who touches my body, or who knows the dei sonal history, those things must not be generally acces: their discretion. That means that ways. important what I loss of freedom. I am not here denied the choices by fear of certain consequences; { am denied them directly because privacy is the condition of their being choi Another intrinsic loss of freedom is the following. A number of wit ers have emphasized the ways in which some actions have a different nature when they are observed than they do wh clearest in cases that are distant from IVHS: ct front of others is a different act from uttering the same critical words to private. And, of course, making love before an audience is some- ig quite differene from the same act don ate. In the case of our informational Panopticon, the alteration is more subtle. Every act—say, driving to mn X at time T—is now a more complex event. It now becomes driving to X at T and creating a record of driving to X as T. These differ from one another as leaving a message machine differs from rehearsing the same words in one’ imagi my every ‘mational Panopticon) is also the depositing of a record, not only are my acts changed but, in ad& for me in someone's answering mn, my freedom Xat T without leaving a record, ¢ freedom of acting spontancously. In a insurance; one would aso be recording in a permanent way one date and a varity of other facts about oneself. No ma and actions at any given moment .. persons would think more care- they did things that would become part ofthe record. Life would to this degree become less spontanco 1g t0 the Panopticon 205 ally dencify with the outside observer's viewpoint and add that alongside your own view- point on your action. This double vision makes your act different, whether the act is making love or taking a drive, The targets of the Panopticon know and feel the eye of the guard on them, making their actions differ- ent than if they were done in private. Theit repertoire of possible actions diminishes as they lose those choices whose privacy. ic nature depends on Symbolic Risks Elsewhere I have argued that privacy is a social ritual by which we show one another that we regard each person as the owner of herself, her body, and her thoughts. I are thought to belong to some larger whole or greater purpose. This is also why invasions of privacy are wrong even when they don't pose any risk to reputat the invader will noc use what he observes in any harmful way, even when aware that her privacy is being invaded. Aside from any at invasions of privacy threaten, suc Is ownership of i ity. The Peeping To thus unjust, contempt. now of his ability of others. Those who los and authority ate there- 1 are specimens belong ate them.” They are someone else's da mn-was a design for a prison, an in effect suspends a person's ise he ed, and thus ui I said earlier Panopticon makes ou ble from a single point. Here it is worth noting that that point is outside of us, where the guardian stands. The206 JEFFREY REIMAN Panopticon symbolizes a kind of dra our individual sovereignty away and outside of us into a single center. We become its data to observe at its will our outsides belong to its ins T have called this a symbolic risk because it affects us as a message, a message inscribed in an institutional structure. We are not deprived of wes are deprived perm nently or the way that prisoners are deprived temporarily. Rather, the arrangement of the institution broadcasts an image of us, to us, as beings lacking the authority to withdraw ourselves from view. It conveys the loss of self-ownership to us by announcing that our every move is a datum for observation by others. As a symbolic message, it insult than injures, But, of course, what is symbolic is almost never merely symbolic. By symbols do we come to acquire our self conceptions. They shape the way we identify ourselves to ourselves and to one another, and thus they up in the informational yours with less respect. And I owning themselves are precisely accept ownership of their actions and thus responsibility for them. They naturally insist on ownership of their des- vacy threatens an incalculable loss. What will it be worth ifa man should gain the world but lose his ing we now enjoy but i e currently are, something less nobl is the fear expressed in the quotation from Hubert Humphrey at che beginning of this chaprer.%* What I sh The popular science- society characterized by widespread information gathering, including a full IVHS system, However, to me, the most interesting feature of the film that the denizens of the society depicted there speak, and Driving to the Panopticon 207 can only be described as childish. They have an over simplified way of labeling hich they live. Total visibil- life and makes them ivacy he gets, and, as he moves toward ivacy. I want to suggest th: two-way street. ‘The deprivation of privacy stunts maturity and keeps people suspended in a childish How dos ‘onsider the words of Edward Bloustein, the man who is compelled to live every minute of his life among others and whose every need, » fancy or gratification is subject to public become the feelings of every man, Such Fungible; he is not an individual, ’imself as subject to public observa- sion, he naturally experiences himself as subj review. Asa con- sequence, he will acceptable. People who are shaped to a& in safe ways, to hol he most widely accepted views—indeed, the lowest common denominator of conventional208 JEFFREY REIMAN fe that is subject to social conve fe that is separate from social conventi deeper inner given litle and more of your inner make y fe is made sense of from without, the need to nner life shrinks. You lose both the prac- tice of making your own sense out of your deepest and most puzzling longings and the potential for self-discovery and cre in a rich inner life. Your inner em ipoverished, and your is the most ominous possibility of all— the source of criticism of convention, the rebellion, and renewal. To say that people who suffer loss will be easy to oppress doesn't say enough. They won't have to be ‘oppressed, since there wont be a them that is tempted to drift from the beaten path or able to see beyond it. They will be the “one- dimensional men’ that Herbert Marcuse feared. The art of such people the inner personal core th source of creativi , we reach something deep and rarely noted about the liberal vision—something that shows the profound link between liberal- review, rather than simply absorbing them unquestioned from outside.” Moreover, the liberal stress- es, and of their this requires a kind of and to experiment with space in which to reflect on and entertain bel them—a private space. Deepet still, however, che liberal ies of private inner life. n has wor can form theit own views, democratic voting becor of conventionality, and individual freedom mere voluntary conformity: And, unless, in forming their own views, people can find ews, neither democracy not iman life, Driving to the Panopticon 209 Protecting Privacy in Panopticon image of the im up that value as the protection of freedom, of moral personality, and ofa rich and critical inner life. If IVHS endan- gers this value ave to bring the heretofore pul tion about travel on public streets under the scope of privacy. Bur th of what is necessary. We should remember Bentham and Foucault’s recognition that the Panopticon ‘works even if no one is in the guardhouse. The risks that are posed by the ig seen, but from the knowledge that one is visible. This means that protecting ourselves from the risks I have described will be harder Consider wwe might imagine. privacy can be protected in two ways, which I shall ns of privacy and the material cont formal conditions of privacy I mean general cally give one a right to privacy or have a sis sions of modesty or reserve or of appr Such rules material being in rush-hour subway train have a way of respecting each other's privacy even though they have, materially, extensive access to one another other hand, one can have the mat ind the material co in place. For example, after my students are duly shocked by Hobbes’ defense of absolute political authority;*' I remind them that, when Hobbes wrote, the west coast of England to che east coast, and about two weeks from north coast to lobbes’s time, without any formal cor subjects’ lives than, say, straints, surely had less actual abil a contemporary U.S. president, even guards.210 JEFFREY REIMAN ‘That constitutional safeguards can be and have been ignored by the powerful bears a lesson for us: material co prevent invasions of privacy than formal conditions can. Material condi tions have a kind of toughness chat the formal conditions never can match. ‘Thus, formal conditions of privacy can never fully guarantee protection of privacy when the material conditions for protecting privacy ate lacking or, equivalently, wh ions for invading privacy are at privacy are a kind of power, corrupting, and, to paraphrase he more corrupting its likely to be. vacy. What is more, the continued and in. the other sorts of information that make up th should remember Louis Brandeis’s warning, quoted at the outset of this chapter, and watch out for threats to liberty dressed in beneficent ‘existence of all this collecsed inform © bring these different records together will add up to an enormous to amass detailed portraits of people’ asion of privacy on an unheard-of scale. One has very optimistic indeed about the power of rules, to think that formal gu antees of privacy will protect us. To the extent that we ate not so opti ourselves as visible even if we are not being observed, which will bring i the risks e ions for our v total vis- place in the years ahead, we will necd to pre- vent not only the misuse of information but also the fear shat itis being ‘misused, That is the lesson of the Panopticon. We will have to protect peo- ple, nor only from being seen but also from feeling visible. Thus, we will sd more than ever before to teach and explain the importance of priva- «9 $0 that respect for it becomes second nature, and violation of it repug- nant. And, of course, we will need more than ever to make sure that our llows are complying with the formal at protect privacy. If we are to protect privacy in the informational Panopticon, we'te really going to have to keep an eye on one another! Driving to the Panopticon 201 Notes is chapter is a revised version of a paper originally presented at the Symposium ‘on Privacy and Intelligent Vehicle-Highway Systems (sponsored by the Federal Highway Adminis 169-88. The version from Critical Moral Liberalism IVHS AMERICA Legal ciples: Comment 2. Jeremy Bentham, “Panopticon, of, The Inspe Bowring, ed., The Works of Jeremy Benthas (New York: Discipline and Pu Vintage, 1979) The Birth of the Prion, trans 228, See p. 200 for a descr 6. Ibid, 202-3, “The panoptic schema ee 468 U.S, at roman, acy: Some Arguments and wophical Dimensions of Privacy [cited hereafter a5 PDOP| (Cambridge: Cambridge University Press, 1984), 325-26. Originally published in Richard Bronaugh, ed., Philosophical Law (Westport, CT: Greenwood, 1978), 148-66, ivacy.” PDOP, 209-10. take away only ups the cost of doing so, the fone has any privacy in his home, since crooks can break even though212 JEFFREY REIMAN Driving t0 the Panopticon 213 ts oF Law,” PDOP, 363-64, pease 9; Harmondsworth: Penguin, 1974), (ay, because of draconian 25. Iralso forces the majority to test their own beliefs in the open court of would mean that those functions led by privacy-and thar sounds quite impl: mn gives additional reasons ys in her “Privacy and thi public discussion, Ion, James Madison, end John Pleivacy also contributes to learning, creativity and autonomy by the individ against ridicule and censure at early stages of groping and experimentation.” Gavison, "Privacy and the Lis the world, or his own portion of back into Bur there are thereby have a ally taken as one that Ic ery, 17. See notes 8 and 9, above, rivaey, Intimacy, and Personhood,” Philotophy and 26-44. a worne may be entered at the will of another, versation may be overheard atthe will of another, whose marital and imacies may be overscen at the will of another, is less ofa man, has less human ect of Human, (0986). 1, Interestingly, the “information highway” is the inverted image of IVHS: here the intelligence comes first and then the roadways 20. John Schwaree, Fights Wireap Propostl: incon Plan Would Scare Consumers off ‘Data Highway,” Washington March ; from C7). thac “so long as che mails ate Says 34+ Hubert H. Humphrey, foreword to The fnruder, by Edward V. Long (New York: Praeger, 196 35. Bloustein, “Privacy as an Aspect of Human Dignit 36. “In the absence of, 4 person, the greater one’s 39. See Benn, “Privacy, Freedom, and Respect for Pet Freedom, and Respect for starement of this ideal and a di 40. fc214 JEFFREY REIMAN tant for autonomy, the Limits of Law,” 369-70. chhorse, Waggon and Post: Land Carriage and Communi tions under the Tudors and Sta A Private Point-of-View 62-84, | am indebted to ersity Department of History for 43. Olmstead vs. U.S..277 US. 43 PRIVACY IN AND VIA THE M (1928) (J. Brandeis, dissenting), ° Gertrud Koch rst glance, the concepts of privacy and the media seem to con- thing of a dichotomy. The public sphere dexermines the pr vate in the log sense, in that whatever is not public is con- signed to the private sphere. In view of the fact that most normative rules bed apart from the or from the public sphere as a historical site. In what 's, however, I shall be trying out a kind of thought-experiment, in which I at the private does not necessarily have to be paired conceptually with the public, and in order to be conceived, one would concerned, lely with my own beliefs. This definition would include the negative ight o be free of public interference, regardless ofthe fact that such prac- #3 have obviously a public character or seem to be more private. Hence,