De nouvelles technologies transforment nos vies et, en ce faisant, ont le
pouvoir de nous enlever tout sens de vie privées. Parmi les
autres développements qui menacent la confidentialité,
l'administration des programmes gouvernementaux sera de plus en plus
consolidée au niveau des services et juridictions;
l'exécution des services gouvernementaux reposera de plus en plus
sur le secteur privé, et les systèmes interactifs devront
nécessairement inclure des dispositifs d'accès et
d'indification. L'auteur offre des recommandations quant au traitement
de ces sujets. Privacy issues on the Information Highway are going to be of enormous
concern but I don't think we can deal with them without first addressing
the technological context in which we find ourselves. So I'd like to give
you a glimpse of some studies on the impact of technology on society at
large. I'll also refer to some specific studies on technology and
individual privacy and the problems these studies identified. And,
finally, I'd like to leave, for your consideration, some fundamental rules
of the road for how we might seek to preserve our sense of privacy in this
new electronic world.
New technologies are driving the changes that are taking place in
information management and communication processes and, in fact, they are
driving these changes so fast that we've lost most of the conventional
benchmarks we have traditionally used to evaluate our circumstances.
In his book, The Twilight of Sovereignty3, Walter Wriston described what has happened in information
technologies over the past few decades by analogy to a six-passenger
automobile. To see a comparable change in the automobile as we have seen
in information technologies, Wriston argues, the automobile would have to
seat six hundred (600) persons, travel safely at fifty-five hundred
(5,500) miles per hour and get twenty-six hundred (2,600) miles to the
gallon. It would also have the same price and be the same size as the
original passenger car.
And not only have information technology capabilities exploded in
recent years, they have, as well, increasingly fostered the growth of big
business because of the value attached to the information they produce.
It is worth noting that, in 1995, Microsoft Corporation is worth more than
General Motors. In Canada alone, information industries are worth about
$45 billion a year and employ more than 300,000 people. Governments,
banks, pharmacies and telemarketers are using their sophisticated products
and services. By the year 2005, information industries are projected to
grow to $90 billion and employ twice as many Canadians.
This is the electronic climate of our times. And it is a sometimes
harsh and inflexible environment for those of us who work trying to
safeguard the fundamental human right of privacy. And, notably, as well,
that environment is being driven by two types of people: those who
understand what they do not manage, and those who manage what they do not
understand. (Personally, I'm inclined to think that there are more of a
third type, you know, the ones whose VCR clocks are still flashing 12:00
noon -- those for whom technology is something they will never understand
and never manage.)
Of course, that in itself is part of the problem. There are a
significant number of "technophobes" out there who will simply
refuse to play the game of technology -- or who will have to be trained
and coaxed. A recent U.S. study put the numbers as high as 25 to 50 per
cent of the population -- people who are anxious about any interactions
with computers and who have negative attitudes about technology and its
societal impact. If that large a segment of the population is suspicious
of the technologies themselves, how comfortable are they going to be about
the privacy of their personal information transacted on those systems?
Invariably, however, most of us will continue to embrace technological
change as we always have -- for reasons of comfort and convenience -- for
better profits and efficiency -- in a word, for progress.
But
latent in that seed of progress is always the germ of regress.
New applications of technology will transform all aspects of our lives,
but, in so doing, these new systems, telecommunications devices and
bio-technologies have the power to strip us of any sense of personal
privacy.
In February of last year, I had the privilege of hearing Frank Ogden,
that wonderfully engaging futurist from Vancouver. What Mr. Ogden had to
say, however, did not comfort me because in his opinion there is no longer
any privacy in our present technological age and there would certainly be
none in the future. Our lives, he claimed, are open books to anyone with
the wits, desire, and technology to read them.
For example, he mentioned, several years previously, he had obtained,
through technological means, the KGB desk books on all US foreign
intelligence activities -- but not to worry, he said, because, six months
prior to that, he had already obtained the US President's briefing books
on those same issues.
So anecdote aside, according to Ogden, there are no secrets in the
electronic world and there are no borders. Conventional political
frontiers are obsolete and laws can provide little protection, indeed,
present no obstacle, moral or otherwise, to those who will use technology
to enter any database or communications systems for pleasure or gain.
Now as much as I admire Mr. Ogden, and it's hard not to be a great fan
of his, it seems to me that the rapture of technology has so mesmerized
him that perhaps he has neglected other equally meaningful and significant
interests. By striving to be one with the technology, he has perhaps
swung the balance to an extreme and, while his point of view may be valid,
the other extreme or at least other considerations demand our attention.
I mention Mr. Ogden simply to emphasize the nature of two competing and
strikingly divergent views on the question of technology. One view claims
that technology should be driving the changes that are taking place in
information management and communications processes and that we should
follow wherever those changes lead -- the other suggests that technology
simply offers us choices and that human values should direct the changes
that technology offers us.
In discussing these divergent views and the impact of technology on our
lives, I should mention the work of Neil Postman whose l992 book entitled
Technopoly4 will likely become one of the
landmark studies in the field.
His thesis, simply stated, is that we are in danger of becoming what he
calls a "Technopoly", a system in which technology of every kind
is cheerfully granted sovereignty over all aspects of our lives. He
argues that while technologies are indispensable to our lives, we must
understand and control them and place them in the context of our larger
human goals, our social values, and our national intentions.
As well, he says, when we admit a new technology into our culture, we
must do so with our eyes open. Often the discoverer of an art or
innovation is not the best judge of the good or harm that will accrue to
those who use it.
And, in this regard, he points out that technological change is not
additive or subtractive -- it is ecological in the sense that one
significant change generates total environmental change. By way of an
example from nature, if we remove all of a species from an environment, we
are not left with the same environment minus that species; we have
a new environment because we have reconstituted the conditions of
existence.
In the same way, a new technology does not simply add or subtract -- it
changes everything. For example, fifty years after the invention of the
printing press, we did not have the same old Europe plus the
printing press. We had an entirely different Europe. Likewise after
television, we did not have the same old society plus television, we had
"Another World" (That's a pun for all you soap-opera fans.)
So it is not enough, in his view, simply to consider whether
communications will be more effective on electronic highways, or whether
information exchanges will be better supported on fully connected systems.
That only brings an immediate, practical answer, and one which may deter
us from asking ourselves what other serious human and social impacts may
result from the new technology. In building this new electronic world,
what changes may we be causing to our social environment, to our human
ecology?
Another of my favourite thinkers in this field is Arthur Cordell. In
his many works about the perils of an information age, Cordell points out
that new applications of technology bring about new ways of social
interaction, that they are transformative in nature, changing both our
personal as well as our professional lives.5
Therefore, in assessing new technologies, we need to know how the
technology changes our conception of reality, our relationships to each
other, our goals and our values.
Obviously, it is a mistake to assume that every technological change or
innovation has a one-sided effect, either good or bad. Every technology
is probably both a blessing and a curse. My point, in raising the
thoughts of Postman and Cordell, is simply that we are all of us caught up
in being zealots for technology wondering what technology can do, but not
reflecting on what it can undo.
And what I think Postman and Cordell are saying is that we should
recognize and consider what has been poetically termed as the "intimations
of deprival", that we should recognize those hints and indications of
what's being lost, or what voices and values are being silenced, and then
gain the footing to question the underlying assumptions in the trade-offs.
Now what does all of this have to do with privacy? Well, for many
years scholars have been considering the impact of technology on privacy.
But what really is "Privacy"? Perhaps that classic formulation of
privacy, "the right to be let alone", is surely at the heart of what
Canadians seek to preserve. But in 1995, such a phrase can only emphasize
how quaint that expectation is in a society where information and
communications technologies have changed the very context of our lives.
So perhaps a more useful definition (from American Professor of Law,
Alan Westin), is that privacy is, "the claim of individuals to determine
for themselves when, how, and to what extent, information about themselves
is communicated to others."
It is simply the right of individuals to control the flow of
information about themselves, the right to fair, reasonable and
confidential information practices. This claim of informational privacy
assumes that all information about an individual is fundamentally his or
her property to communicate or withhold as desired -- it is the democratic
notion of self-determination or autonomy, which, in the case of
information, dictates that no one should have more control over a person's
information than the person.
But the more that can be known about a person, the less that person's
control. And these days, in an information society, our individual
autonomy and our sense of control are on the line. That is the heart of
the privacy problem and that is why privacy has become one of the hot
buttons in the debate on the electronic world.
The studies so far have concluded that dramatic advances in
telecommunications and information technology change the relationship
between individuals and government. New technologies are able to deal
with personal information faster; new electronic highways will deliver
that personal information more extensively, and cheaper than ever before.
And what has happened is that the vulnerability of the information and
the consequent loss of privacy have been seen by some as the inevitable
trade-offs against this greater speed, efficiency, and cost-effectiveness.
Privacy is often at the top of the list of rights to be traded off for
other perceived benefits, usually because it's not recognized as an issue
until it's lost. But once lost, there is no remedy -- you can't get it
back, it's gone. So while we are tempted with technology's benefits, we
often overlook its vulnerabilities.
In that regard, I should tell you that, a few years ago, John Updike
wrote a short story for the New Yorker about a family's new
home security system. The system monitored everything -- doors, windows,
exterior lights, interior lights, the garage -- you name it!
Unfortunately, it became increasingly difficult for the family to enter or
leave the house. When any family member forgot to push the right button
or throw the right switch, the result was predictable. Off went the
alarm. The family had to learn to accommodate to system. They had to
become more careful; they had to become less free about coming and going.
Until one day, reflecting on how they had lost their freedom of movement,
it dawned on the father. The last line of the story were his words:
"We've been robbed."
Perhaps that is the risk we face if we are not vigilant in the new
electronic world. We may find ourselves robbed of our privacy.
And we don't want to be robbed of our privacy. As some of you know, a
comprehensive 1993 Canadian survey of public attitudes towards privacy
revealed a "pervasive sense that personal privacy is under seige" -- 52
per cent were "extremely concerned", and about 90 percent were at least
moderately concerned over their personal privacy. In other words, as a
contemporary issue, it is right up there with such issues as unemployment
and the environment, and actually ahead of national unity.6
The survey also revealed that, beyond generalities, the public doesn't
know a lot about this issue but that where it does understand a specific
matter, it has no trouble rendering a verdict. I give you cellular
telephones as an example. Most people know that such devices can be
monitored. Seventy-seven percent of people surveyed were in favour of
measures to protect the privacy of such communications; eighty-three
percent did not believe that anyone should record any private cellular
phone conversations for any reason.
But what the survey revealed most dramatically was the existence in the
public of a deep sense of unease: an awareness that advanced technologies
are impinging on their lives in ways they don't yet understand; and a
desire to know more and to have much more control and personal involvement
in the decision-making process.
Even more on point is a recent Gallup survey conducted for Andersen
Consulting entitled "What Canadians think about the Information
Highway".7
Gallup found Canadians remarkably aware of the new phenomenon -- more than
half had heard or read about it, compared to the normal awareness on new
issues which usually falls between one-third and one-half of respondents.
The survey also confirmed that there is market. More than two thirds
thought that the product, as they understood it, was a "good idea".
However, the warning signs are clear. When asked to indicate their
level of concern for their privacy because information about them might be
handled by companies involved in the Information Highway, 83.7 per cent
described themselves as very concerned or somewhat concerned.
Anderson staff were quick to volunteer that this high degree of concern
about privacy had surprised them and clearly had to be dealt with if the
highway is to proceed.
Now the electronic highway is a wonderful metaphor and one I don't want
to beat to death. But some have suggested that we are pulling onto this
highway with only half of us fully equipped with seat belts and air bags
all round, while the other half is still debating whether to install
headlights and brakes. Certainly we can't deal with the profound privacy
issues by painting a few lines on the tarmac and hastily erecting a few
highway signs just before ribbon-cutting.
We have to integrate this issue right at the development stage. If we
don't, we risk losing the public's confidence in the privacy and security
of their personal information. But more critically, if we don't deal with
this now, Canadians risk becoming the electronic highway's crash-test
dummies. At a minimum, the public is entitled now to the fullest and
frankest exposition possible about the technology and its social and
economic consequences.
Let me illustrate what can happen to the introduction of new
technologies, when the appropriate human consideration, strategic
planning, and public consultation do not take place, by giving you the
example of a recent debate over smart cards as part of the US health care
reform plan.
A smart card is basically a credit-card sized device containing one or
more integrated circuit chips which perform the functions of a
microprocessor. It is, in other words, a credit-card sized computer,
capable of storing, retrieving and processing information stored on the
chip.
And here's what happened in the States. Early during his presidential
campaign, then-Governor Clinton, in response to critics who said that job
growth while he was in office had been mostly low-tech, cited the fact
that AT&T manufactured smart cards in Arkansas. And one of his
campaign platforms was the commitment to "provide everyone with smart
cards coded with personal medical information." His proposal was that
people would be assigned a smart card at birth which could then be used
throughout their lives for storage of medical information and claims
processing, a sort of "cradle to grave smart card".
This was the first that many Americans had ever heard about a smart
card and the response from the American Civil Liberties Union and others
was swift and negative. They cited concerns that Americans' privacy would
be diminished, that private health information would be read by everyone
and that the cards raised the spectre of a national ID card. They
implored the administration to drop the idea. Once the story hit the
front pages, it became a genie that would not go back into its bottle.
The idea was withdrawn.
So what happened here? First, you have to be struck by the evidence,
if more was needed, that the expectation of privacy is expanding and that
technologies which are perceived to undermine it are in for heavy weather.
Second, it is apparent from the controversy that most people, including
the critics, do not understand the new technologies. It's particularly
ironic in this case because smart cards, when properly used, are
potentially one of the most powerful tools to enhance individual control
over personal information.
But what is most apparent is that the Clinton administration had to
drop the technology from its agenda because it had underestimated the
public's concern. It failed to put all the issues before the public for
discussion, failed to get input from all the affected parties and failed
to explain the technology or to extol its privacy pluses. It may prove an
expensive lesson and one we must learn from.
So what are the privacy issues that arise as we revamp our systems for
delivery on the Information Highway. This audience does not have to be
told that electronic delivery represents a qualitative change in the
environment of government information practices. The walls are coming
down. Linking existing networks into a vast, fully connected and
interoperable system will inevitably join in one system the information
holdings of all sectors of society, public and private. But what will
these changes mean for privacy and why should we be concerned?
Some have envisaged the coming changes as being accompanied by three
main features:
1) The administration of government programs will be consolidated not
only across departments but also across jurisdictions. It is not
cost-effective for one department to proceed to develop electronic
delivery mechanisms by itself. Therefore, because of economies of scale
and scope, electronic systems may lead to the walls coming down between
government agencies and programs, not only within governments but also
between levels of governments. This leads to the potential threat that
government, as such, would become a single, centralized, autocratic body
rather than a constitution of separate institutions, thus raising anew, in
some people's minds, the spectre of Big Brother, the all-knowing
government, the surveillance society.
Such a situation would require major changes in laws, mandates and
approaches, and would certainly have a profound impact on the privacy of
an individual's information and relationship with government.
2) Delivering services or benefits electronically will depend on
private sector involvement. In other words, as a citizen, receiving
government services will not simply involve the electronic interchange of
your information between you and the government, but between you, the
government and the private sector. Private sector providers, as
components of the government delivery systems, could become repositories
of vast databases on Canadians, a situation some view with alarm, and
rightly so, because privacy protection exists almost exclusively in the
public sector. Except for Quebec, there is virtually nothing in current
or contemplated legislation or regulation that protects an individual's
privacy in the private sector.
3) A third inevitable feature of any single interactive government
system is some sort of access and identification device. And that device
is almost inevitably an identity card, a prospect that is worrisome for
many.
Frankly, there is nothing ominous in replacing a piece of paper with a
piece of plastic that carries the same information and serves the same
purpose. What is of concern, is the prospect, proposed by some, that we
be forced to carry a single, national identification card, documenting our
lives, which petty bureaucrats and police can demand at will.
A national identification card violates a fundamental notion of
democracy -- the liberty to live innocent lives free from surveillance by
the state -- or anyone else. Identification documents that must be
carried at all times effectively become an internal passport without which
we are nobody. This is marvellously efficient, undeniably accurate, but
the ultimate tool of state control. The notion that we should be required
to prove that we are who we say we are is anathema to North Americans.
This is surely what some of us here and many of our parents and
grandparents came here to escape.
Historically, we are opposed to the government initiating any such
card, as witness the continuing controversy over the Social Insurance
Number (SIN);
Now I am not suggesting that scenarios which involve consolidation of
programs, private sector involvement and some means of personal
authentication are perverse notions to be rejected. I am simply
suggesting that whatever the scenario, the major problems that will arise
will be in direct relation to how well we are able to explicitly consider
the implications of information technology in relation to the protection
of timeless human values such as privacy.
Certainly, the Office of the Privacy Commissioner does not believe that
technology is incompatible with the preservation of our values and
freedoms. It is fairly obvious that the uses of technology are largely
determined by the framework in which they are developed. All
infrastructures could have been designed differently if the first design
priority had been human development rather than technological development.
So where does that leave us? Or, as someone once asked: Is technology
going to lead us to disaster, or can we get there on our own?"
The answer, I think, is simply that we must now make the effort to
establish clear rules of the road to cover the privacy implications of the
information highway generally. I know of no highway -- electronic or
conventional -- that can function well without rules of the road.
If we can clearly define the rights and responsibilities of
individuals, corporate bodies, and governments and make the whole process
transparent, we might be able to deal openly and intelligently with the
kind of disquiet revealed by the surveys I mentioned.
So let me leave you with some privacy fundamentals to consider as we
move on to the Information Highway of the Electronic World:
(This is extremely significant as ignorance gives rise to concerns and
consequences. The example I cited in the States is just one of many where
a government has foundered in the promulgation of a program because of its
lack of candour or its lack of understanding the necessity of educating
the public.)
(In this latter regard, I want to assure you that no Privacy
Commissioner is looking for new work -- we've all got lots to do. But
whether it's the private or the public sector, I don't think anybody is
going to enjoy any particular level of public credibility if there is not
a system of independent arbitrament. I know I have yet to see a hockey
game I really enjoyed when the referee came out wearing the sweater of one
of the teams. You now, that really doesn't work too well. You want to
see that black and white shirt on somebody who is only there to see that
the game is played fairly. I think the same is true here.)
So, yes, if we wish to obtain the benefits of technology, and to
preserve the kind of society in which we see each other, not simply as
de-personalized, nameless data subjects, but as living, breathing human
beings, then we have got to put some proper rules of the road so that when
information concerns a living human being, it cannot be used without the
knowledge and consent of that person, and that person must have some
control over its collection, its disposition and its storage. If those
things are absent from the Information Highway, it will mean the
obliteration of a very important part of lives.
We need new laws, not in the 21st century, long after the highway is
opened. We need them now. Without them, no one's privacy will be
assured.
Let me leave you with the eloquent words attributed to Sir Thomas More
in the screen version of A Man For All Seasons. More, a
lawyer, was debating with his daughter, also a lawyer, who pleaded with
her father to save his head from the executioner. "The law is simply a
collection of words.", she argued. To which he replied: "Cut down the law
and who can stand in the winds that blow?"
Well, the winds are blowing pretty forcefully and, in the absence of
decent rules, we are running the risk of exposing ourselves to a
relentless spate of arbitrary marketplace decisions being made about some
very private, personal information.
I am less worried about governments as they have had or will have
experience in working with laws on how to handle personal information.
The federal Privacy Act8 has not brought the
Government of Canada to its knees to comply with some very simple
principles about how to handle its billions of pieces of personal
information about Canadians. If we had similar codes of behaviour applying
to all the rest of the informational transactions that take place around
us, we would not have a great deal to worry about. But we do not.
Enormously greater quantities of information are going to become
available to enormously greater numbers of people. And unless we can
build into these systems rules of access and collection that respect
control of the individuals whose information is involved, we are really
standing on the threshold of an unhappy destiny for personal privacy. And
we will all be the losers for that.
So, the faint-hearted and the privacy-alert may be asking themselves
whether this is it? Does the Information Highway spell the doom of
individual autonomy and render privacy but a myth? Or do we still have
time for peaceful co-existence between privacy and technology?
Our answer is "Yes", but only by dealing with Canadians' concerns now
can we take the steps to ensure that this new electronic world respects
our ethical environment and our ecology of humanness. Technology and
efficiency concerns should not dictate the shape and vision of our future.
The issue, to paraphrase Professor Heather Menzies of Carleton University,
is not whether you are for or against technology -- the issue is really
what vision of society, what conception of progress do we share against
which the application of technology can be evaluated, judged, and where
warranted, redesigned.
Privacy is only one of the many elements in this intriguing question,
but it's an important one. How well privacy fares -- that is to say, how
much respect for human dignity and individuality we preserve -- will
determine whether in the end we have a society where God truly does come
out of the machine.
It was Thoreau who said that inventions are but an improved means to an
unimproved end. Here is our opportunity to prove that by marrying the
technology with the values, we can move forward not only by improved means
but also to an improved end.
[1] May be cited as/On peut citer comme suit:
Brian Foran, "Privacy on the Information Highway: Myth or Reality?",
Government Information in Canada/Information gouvernementale au
Canada, Vol. 2, no. 2.4 (fall/automne 1995). Originally presented as an address to the Records Management Institute,
21 June 1995, Ottawa, Ontario.
[3] Walter Wriston, The Twilight of Sovereignty:
How the Information Revolution is Transforming Our World. New
York: Simon & Schuster, 1992.
[4] Neil Postman, Technopoly: The Surrender of
Culture to Technology. New York: Knopf, 1992.
[5] Arthur J. Cordell, "The Perils of an Information
Age," Policy Options, April 1991.
[6] Privacy Revealed: The Canadian Privacy
Survey. Ottawa: Ekos Research Associates, 1993.
[7] The Information Highway: What Canadians
Think About the Information Highway. Anderson Consulting, 1994.
[8] R.S.C. 1985, c. P-21.
New technologies are transforming our lives, and in doing so have
the power to strip us of any sense of personal privacy. Among other
developments threatening privacy, the administration of government
programs will increasingly be consolidated across departments and across
jurisdictions; delivery of government services will increasingly rely
upon the private sector; and, interactive systems will necessarily
include access and identification devices. The author offers
recommendations for dealing with these issues.
Notes
<URL:http://www.usask.ca/library/gic/v2n2/foran/foran.html>
Brian Foran
Special Advisor
Office of the Privacy Commissioner of Canada/
Commissariat à la protection de la vie
privée du Canada
112 Kent
Ottawa, Ontario
K1A 1H3