Privacy and Surveillance Key Concepts Flashcards
Privacy Paradox
People say they care about privacy but then do not do anything about it due to digital resignation
- People value privacy in different ways
- There are a range of stakeholders
- Different regulatory modalities
Irwin Altman
Privacy is an interpersonal boundary-control process which places and regulates interactions with others. Privacy regulation by persons and groups is somewhat like the shifting permeability of a cell membrane. Sometimes person or group is receptive to outside inputs, and sometimes closes off contacts with the outside environment
What are the different types of privacy?
Spatial
Decisional - we want to make decisions for ourselves without other people having control
Informational - freedom from unwanted surveillance
What are the 3 values of privacy?
Autonomy - smaller scale
Democracy - larger scale, collectively make decisions and govern society ourselves
Protection against abuse of power
Digital resignation w
People say they care about privacy and do nothing about it because they believe there is nothing they can do about it. The individual must try to secure their own privacy when they know those mechanisms will not really do anything
Government Surveillance
Punishment, censorship, abuse of power
Corporate Surveillance
Unfair treatment, manipulation, exploitation.
The sectoral approach of U.S. information privacy statutes
The central role of contracts / “notice and consent”
4th Amendment
Right against “unreasonable searches and seizures” by law enforcement. Limits surveillance by law enforcement and security agencies. Rules of evidence
U.S. Privacy Laws
Important U.S. privacy laws:
- Fair Credit Reporting Act, 1970
- Family Education Rights and Privacy Act, 1988
- Health Insurance Portability and Accountability Act, 1996
- Gramm-Leach-Bliley Act, 2008
Sectoral vs. Omnibus Approach
Sectoral: creating specific regulations tailored to particular industries or types of data, allowing for flexibility and adaptability based on the unique needs and risks of each sector.
Omnibus: established a comprehensive framework that applied uniformly across all sectors, promoting consistency in privacy protections and simplifying compliance but potentially lacking the specificity needed for industry-specific challenges
Notice and Consent
Requirement for organizations to inform individuals about data collection practices and obtain their explicit permission before processing their personal information, ensuring transparency and empowering individuals to make informed choices about their privacy. This principle aims to foster trust between data subjects and organizations while balancing the need for data use with individuals’ rights to control their personal information
GDPR
General data protection regulation
Passed in 2016, went into effect in 2018
Covers all EU companies and all companies elsewhere processing data about EU citizens. Tried to strengthen notice and consent by:
1) raising the privacy floor through more protective minimal standards and default
2) creating more meaningful notice and consent procedures
3) imposing significant penalties for breaking the rules
Contextual Integrity
Rejects notice and consent
Argues that:
1) new tech doesn’t enter into ethical vacuums
2) we have existing expectations about how information should flow, which are attached to particular social contexts
3) ethical burden is on data collectors to respect those norms, not on individual data subjects to police them
