Foran, "Privacy on the Information Highway, Myth or Reality?" Government Information in Canada/Information gouvernementale au Canada, Volume 2, number/numéro 2 (fall/automne 1995)

Privacy on the Information Highway:
Myth or Reality? 1

Brian Foran,
Special Advisor, Office of the Privacy Commissioner 2

New technologies are transforming our lives, and in doing so have the power to strip us of any sense of personal privacy. Among other developments threatening privacy, the administration of government programs will increasingly be consolidated across departments and across jurisdictions; delivery of government services will increasingly rely upon the private sector; and, interactive systems will necessarily include access and identification devices. The author offers recommendations for dealing with these issues.

De nouvelles technologies transforment nos vies et, en ce faisant, ont le pouvoir de nous enlever tout sens de vie privées. Parmi les autres développements qui menacent la confidentialité, l'administration des programmes gouvernementaux sera de plus en plus consolidée au niveau des services et juridictions; l'exécution des services gouvernementaux reposera de plus en plus sur le secteur privé, et les systèmes interactifs devront nécessairement inclure des dispositifs d'accès et d'indification. L'auteur offre des recommandations quant au traitement de ces sujets.

Privacy issues on the Information Highway are going to be of enormous concern but I don't think we can deal with them without first addressing the technological context in which we find ourselves. So I'd like to give you a glimpse of some studies on the impact of technology on society at large. I'll also refer to some specific studies on technology and individual privacy and the problems these studies identified. And, finally, I'd like to leave, for your consideration, some fundamental rules of the road for how we might seek to preserve our sense of privacy in this new electronic world.

New technologies are driving the changes that are taking place in information management and communication processes and, in fact, they are driving these changes so fast that we've lost most of the conventional benchmarks we have traditionally used to evaluate our circumstances.

In his book, The Twilight of Sovereignty3, Walter Wriston described what has happened in information technologies over the past few decades by analogy to a six-passenger automobile. To see a comparable change in the automobile as we have seen in information technologies, Wriston argues, the automobile would have to seat six hundred (600) persons, travel safely at fifty-five hundred (5,500) miles per hour and get twenty-six hundred (2,600) miles to the gallon. It would also have the same price and be the same size as the original passenger car.

And not only have information technology capabilities exploded in recent years, they have, as well, increasingly fostered the growth of big business because of the value attached to the information they produce. It is worth noting that, in 1995, Microsoft Corporation is worth more than General Motors. In Canada alone, information industries are worth about $45 billion a year and employ more than 300,000 people. Governments, banks, pharmacies and telemarketers are using their sophisticated products and services. By the year 2005, information industries are projected to grow to $90 billion and employ twice as many Canadians.

This is the electronic climate of our times. And it is a sometimes harsh and inflexible environment for those of us who work trying to safeguard the fundamental human right of privacy. And, notably, as well, that environment is being driven by two types of people: those who understand what they do not manage, and those who manage what they do not understand. (Personally, I'm inclined to think that there are more of a third type, you know, the ones whose VCR clocks are still flashing 12:00 noon -- those for whom technology is something they will never understand and never manage.)

Of course, that in itself is part of the problem. There are a significant number of "technophobes" out there who will simply refuse to play the game of technology -- or who will have to be trained and coaxed. A recent U.S. study put the numbers as high as 25 to 50 per cent of the population -- people who are anxious about any interactions with computers and who have negative attitudes about technology and its societal impact. If that large a segment of the population is suspicious of the technologies themselves, how comfortable are they going to be about the privacy of their personal information transacted on those systems?

Invariably, however, most of us will continue to embrace technological change as we always have -- for reasons of comfort and convenience -- for better profits and efficiency -- in a word, for progress.

But latent in that seed of progress is always the germ of regress. New applications of technology will transform all aspects of our lives, but, in so doing, these new systems, telecommunications devices and bio-technologies have the power to strip us of any sense of personal privacy.

In February of last year, I had the privilege of hearing Frank Ogden, that wonderfully engaging futurist from Vancouver. What Mr. Ogden had to say, however, did not comfort me because in his opinion there is no longer any privacy in our present technological age and there would certainly be none in the future. Our lives, he claimed, are open books to anyone with the wits, desire, and technology to read them.

For example, he mentioned, several years previously, he had obtained, through technological means, the KGB desk books on all US foreign intelligence activities -- but not to worry, he said, because, six months prior to that, he had already obtained the US President's briefing books on those same issues.

So anecdote aside, according to Ogden, there are no secrets in the electronic world and there are no borders. Conventional political frontiers are obsolete and laws can provide little protection, indeed, present no obstacle, moral or otherwise, to those who will use technology to enter any database or communications systems for pleasure or gain.

Now as much as I admire Mr. Ogden, and it's hard not to be a great fan of his, it seems to me that the rapture of technology has so mesmerized him that perhaps he has neglected other equally meaningful and significant interests. By striving to be one with the technology, he has perhaps swung the balance to an extreme and, while his point of view may be valid, the other extreme or at least other considerations demand our attention.

I mention Mr. Ogden simply to emphasize the nature of two competing and strikingly divergent views on the question of technology. One view claims that technology should be driving the changes that are taking place in information management and communications processes and that we should follow wherever those changes lead -- the other suggests that technology simply offers us choices and that human values should direct the changes that technology offers us.

In discussing these divergent views and the impact of technology on our lives, I should mention the work of Neil Postman whose l992 book entitled Technopoly4 will likely become one of the landmark studies in the field.

His thesis, simply stated, is that we are in danger of becoming what he calls a "Technopoly", a system in which technology of every kind is cheerfully granted sovereignty over all aspects of our lives. He argues that while technologies are indispensable to our lives, we must understand and control them and place them in the context of our larger human goals, our social values, and our national intentions.

As well, he says, when we admit a new technology into our culture, we must do so with our eyes open. Often the discoverer of an art or innovation is not the best judge of the good or harm that will accrue to those who use it.

And, in this regard, he points out that technological change is not additive or subtractive -- it is ecological in the sense that one significant change generates total environmental change. By way of an example from nature, if we remove all of a species from an environment, we are not left with the same environment minus that species; we have a new environment because we have reconstituted the conditions of existence.

In the same way, a new technology does not simply add or subtract -- it changes everything. For example, fifty years after the invention of the printing press, we did not have the same old Europe plus the printing press. We had an entirely different Europe. Likewise after television, we did not have the same old society plus television, we had "Another World" (That's a pun for all you soap-opera fans.)

So it is not enough, in his view, simply to consider whether communications will be more effective on electronic highways, or whether information exchanges will be better supported on fully connected systems. That only brings an immediate, practical answer, and one which may deter us from asking ourselves what other serious human and social impacts may result from the new technology. In building this new electronic world, what changes may we be causing to our social environment, to our human ecology?

Another of my favourite thinkers in this field is Arthur Cordell. In his many works about the perils of an information age, Cordell points out that new applications of technology bring about new ways of social interaction, that they are transformative in nature, changing both our personal as well as our professional lives.5

Therefore, in assessing new technologies, we need to know how the technology changes our conception of reality, our relationships to each other, our goals and our values.

Obviously, it is a mistake to assume that every technological change or innovation has a one-sided effect, either good or bad. Every technology is probably both a blessing and a curse. My point, in raising the thoughts of Postman and Cordell, is simply that we are all of us caught up in being zealots for technology wondering what technology can do, but not reflecting on what it can undo.

And what I think Postman and Cordell are saying is that we should recognize and consider what has been poetically termed as the "intimations of deprival", that we should recognize those hints and indications of what's being lost, or what voices and values are being silenced, and then gain the footing to question the underlying assumptions in the trade-offs.

Now what does all of this have to do with privacy? Well, for many years scholars have been considering the impact of technology on privacy. But what really is "Privacy"? Perhaps that classic formulation of privacy, "the right to be let alone", is surely at the heart of what Canadians seek to preserve. But in 1995, such a phrase can only emphasize how quaint that expectation is in a society where information and communications technologies have changed the very context of our lives.

So perhaps a more useful definition (from American Professor of Law, Alan Westin), is that privacy is, "the claim of individuals to determine for themselves when, how, and to what extent, information about themselves is communicated to others."

It is simply the right of individuals to control the flow of information about themselves, the right to fair, reasonable and confidential information practices. This claim of informational privacy assumes that all information about an individual is fundamentally his or her property to communicate or withhold as desired -- it is the democratic notion of self-determination or autonomy, which, in the case of information, dictates that no one should have more control over a person's information than the person.

But the more that can be known about a person, the less that person's control. And these days, in an information society, our individual autonomy and our sense of control are on the line. That is the heart of the privacy problem and that is why privacy has become one of the hot buttons in the debate on the electronic world.

The studies so far have concluded that dramatic advances in telecommunications and information technology change the relationship between individuals and government. New technologies are able to deal with personal information faster; new electronic highways will deliver that personal information more extensively, and cheaper than ever before.

And what has happened is that the vulnerability of the information and the consequent loss of privacy have been seen by some as the inevitable trade-offs against this greater speed, efficiency, and cost-effectiveness. Privacy is often at the top of the list of rights to be traded off for other perceived benefits, usually because it's not recognized as an issue until it's lost. But once lost, there is no remedy -- you can't get it back, it's gone. So while we are tempted with technology's benefits, we often overlook its vulnerabilities.

In that regard, I should tell you that, a few years ago, John Updike wrote a short story for the New Yorker about a family's new home security system. The system monitored everything -- doors, windows, exterior lights, interior lights, the garage -- you name it! Unfortunately, it became increasingly difficult for the family to enter or leave the house. When any family member forgot to push the right button or throw the right switch, the result was predictable. Off went the alarm. The family had to learn to accommodate to system. They had to become more careful; they had to become less free about coming and going. Until one day, reflecting on how they had lost their freedom of movement, it dawned on the father. The last line of the story were his words: "We've been robbed."

Perhaps that is the risk we face if we are not vigilant in the new electronic world. We may find ourselves robbed of our privacy.

And we don't want to be robbed of our privacy. As some of you know, a comprehensive 1993 Canadian survey of public attitudes towards privacy revealed a "pervasive sense that personal privacy is under seige" -- 52 per cent were "extremely concerned", and about 90 percent were at least moderately concerned over their personal privacy. In other words, as a contemporary issue, it is right up there with such issues as unemployment and the environment, and actually ahead of national unity.6

The survey also revealed that, beyond generalities, the public doesn't know a lot about this issue but that where it does understand a specific matter, it has no trouble rendering a verdict. I give you cellular telephones as an example. Most people know that such devices can be monitored. Seventy-seven percent of people surveyed were in favour of measures to protect the privacy of such communications; eighty-three percent did not believe that anyone should record any private cellular phone conversations for any reason.

But what the survey revealed most dramatically was the existence in the public of a deep sense of unease: an awareness that advanced technologies are impinging on their lives in ways they don't yet understand; and a desire to know more and to have much more control and personal involvement in the decision-making process.

Even more on point is a recent Gallup survey conducted for Andersen Consulting entitled "What Canadians think about the Information Highway".7 Gallup found Canadians remarkably aware of the new phenomenon -- more than half had heard or read about it, compared to the normal awareness on new issues which usually falls between one-third and one-half of respondents. The survey also confirmed that there is market. More than two thirds thought that the product, as they understood it, was a "good idea".

However, the warning signs are clear. When asked to indicate their level of concern for their privacy because information about them might be handled by companies involved in the Information Highway, 83.7 per cent described themselves as very concerned or somewhat concerned.

Anderson staff were quick to volunteer that this high degree of concern about privacy had surprised them and clearly had to be dealt with if the highway is to proceed.

Now the electronic highway is a wonderful metaphor and one I don't want to beat to death. But some have suggested that we are pulling onto this highway with only half of us fully equipped with seat belts and air bags all round, while the other half is still debating whether to install headlights and brakes. Certainly we can't deal with the profound privacy issues by painting a few lines on the tarmac and hastily erecting a few highway signs just before ribbon-cutting.

We have to integrate this issue right at the development stage. If we don't, we risk losing the public's confidence in the privacy and security of their personal information. But more critically, if we don't deal with this now, Canadians risk becoming the electronic highway's crash-test dummies. At a minimum, the public is entitled now to the fullest and frankest exposition possible about the technology and its social and economic consequences.

Let me illustrate what can happen to the introduction of new technologies, when the appropriate human consideration, strategic planning, and public consultation do not take place, by giving you the example of a recent debate over smart cards as part of the US health care reform plan.

A smart card is basically a credit-card sized device containing one or more integrated circuit chips which perform the functions of a microprocessor. It is, in other words, a credit-card sized computer, capable of storing, retrieving and processing information stored on the chip.

And here's what happened in the States. Early during his presidential campaign, then-Governor Clinton, in response to critics who said that job growth while he was in office had been mostly low-tech, cited the fact that AT&T manufactured smart cards in Arkansas. And one of his campaign platforms was the commitment to "provide everyone with smart cards coded with personal medical information." His proposal was that people would be assigned a smart card at birth which could then be used throughout their lives for storage of medical information and claims processing, a sort of "cradle to grave smart card".

This was the first that many Americans had ever heard about a smart card and the response from the American Civil Liberties Union and others was swift and negative. They cited concerns that Americans' privacy would be diminished, that private health information would be read by everyone and that the cards raised the spectre of a national ID card. They implored the administration to drop the idea. Once the story hit the front pages, it became a genie that would not go back into its bottle. The idea was withdrawn.

So what happened here? First, you have to be struck by the evidence, if more was needed, that the expectation of privacy is expanding and that technologies which are perceived to undermine it are in for heavy weather.

Second, it is apparent from the controversy that most people, including the critics, do not understand the new technologies. It's particularly ironic in this case because smart cards, when properly used, are potentially one of the most powerful tools to enhance individual control over personal information.

But what is most apparent is that the Clinton administration had to drop the technology from its agenda because it had underestimated the public's concern. It failed to put all the issues before the public for discussion, failed to get input from all the affected parties and failed to explain the technology or to extol its privacy pluses. It may prove an expensive lesson and one we must learn from.

So what are the privacy issues that arise as we revamp our systems for delivery on the Information Highway. This audience does not have to be told that electronic delivery represents a qualitative change in the environment of government information practices. The walls are coming down. Linking existing networks into a vast, fully connected and interoperable system will inevitably join in one system the information holdings of all sectors of society, public and private. But what will these changes mean for privacy and why should we be concerned?

Some have envisaged the coming changes as being accompanied by three main features:

1) The administration of government programs will be consolidated not only across departments but also across jurisdictions. It is not cost-effective for one department to proceed to develop electronic delivery mechanisms by itself. Therefore, because of economies of scale and scope, electronic systems may lead to the walls coming down between government agencies and programs, not only within governments but also between levels of governments. This leads to the potential threat that government, as such, would become a single, centralized, autocratic body rather than a constitution of separate institutions, thus raising anew, in some people's minds, the spectre of Big Brother, the all-knowing government, the surveillance society.

Such a situation would require major changes in laws, mandates and approaches, and would certainly have a profound impact on the privacy of an individual's information and relationship with government.

2) Delivering services or benefits electronically will depend on private sector involvement. In other words, as a citizen, receiving government services will not simply involve the electronic interchange of your information between you and the government, but between you, the government and the private sector. Private sector providers, as components of the government delivery systems, could become repositories of vast databases on Canadians, a situation some view with alarm, and rightly so, because privacy protection exists almost exclusively in the public sector. Except for Quebec, there is virtually nothing in current or contemplated legislation or regulation that protects an individual's privacy in the private sector.

3) A third inevitable feature of any single interactive government system is some sort of access and identification device. And that device is almost inevitably an identity card, a prospect that is worrisome for many.

Frankly, there is nothing ominous in replacing a piece of paper with a piece of plastic that carries the same information and serves the same purpose. What is of concern, is the prospect, proposed by some, that we be forced to carry a single, national identification card, documenting our lives, which petty bureaucrats and police can demand at will.

A national identification card violates a fundamental notion of democracy -- the liberty to live innocent lives free from surveillance by the state -- or anyone else. Identification documents that must be carried at all times effectively become an internal passport without which we are nobody. This is marvellously efficient, undeniably accurate, but the ultimate tool of state control. The notion that we should be required to prove that we are who we say we are is anathema to North Americans. This is surely what some of us here and many of our parents and grandparents came here to escape.

Historically, we are opposed to the government initiating any such card, as witness the continuing controversy over the Social Insurance Number (SIN);

Now I am not suggesting that scenarios which involve consolidation of programs, private sector involvement and some means of personal authentication are perverse notions to be rejected. I am simply suggesting that whatever the scenario, the major problems that will arise will be in direct relation to how well we are able to explicitly consider the implications of information technology in relation to the protection of timeless human values such as privacy.

Certainly, the Office of the Privacy Commissioner does not believe that technology is incompatible with the preservation of our values and freedoms. It is fairly obvious that the uses of technology are largely determined by the framework in which they are developed. All infrastructures could have been designed differently if the first design priority had been human development rather than technological development.

So where does that leave us? Or, as someone once asked: Is technology going to lead us to disaster, or can we get there on our own?"

The answer, I think, is simply that we must now make the effort to establish clear rules of the road to cover the privacy implications of the information highway generally. I know of no highway -- electronic or conventional -- that can function well without rules of the road.

If we can clearly define the rights and responsibilities of individuals, corporate bodies, and governments and make the whole process transparent, we might be able to deal openly and intelligently with the kind of disquiet revealed by the surveys I mentioned.

So let me leave you with some privacy fundamentals to consider as we move on to the Information Highway of the Electronic World:

  1. Privacy considerations must be recognized specifically in the provision, use and regulation of the information system;

  2. The network must be governed by a fair information code established in law;

  3. Individuals should be able to control their own information, including what details are transmitted over the network;

  4. Government should limit its collection of personal data for electronic services to the minimum needed to provide the service;

  5. Service providers should not disclose information without the individual's explicit consent and should explain their data collection practices to individuals;

    (This is extremely significant as ignorance gives rise to concerns and consequences. The example I cited in the States is just one of many where a government has foundered in the promulgation of a program because of its lack of candour or its lack of understanding the necessity of educating the public.)

  6. Information about individuals' transactions must also be governed by the code; that is the pattern of the transactions, not just the data in each individual transaction;

  7. Government should ensure that the information goes when and where it is intended. It must protect the confidentiality of the electronic communications, perhaps through encryption;

  8. There should be no charge to protect your privacy;

  9. There should be an independent oversight body to monitor the system.

    (In this latter regard, I want to assure you that no Privacy Commissioner is looking for new work -- we've all got lots to do. But whether it's the private or the public sector, I don't think anybody is going to enjoy any particular level of public credibility if there is not a system of independent arbitrament. I know I have yet to see a hockey game I really enjoyed when the referee came out wearing the sweater of one of the teams. You now, that really doesn't work too well. You want to see that black and white shirt on somebody who is only there to see that the game is played fairly. I think the same is true here.)

So, yes, if we wish to obtain the benefits of technology, and to preserve the kind of society in which we see each other, not simply as de-personalized, nameless data subjects, but as living, breathing human beings, then we have got to put some proper rules of the road so that when information concerns a living human being, it cannot be used without the knowledge and consent of that person, and that person must have some control over its collection, its disposition and its storage. If those things are absent from the Information Highway, it will mean the obliteration of a very important part of lives.

We need new laws, not in the 21st century, long after the highway is opened. We need them now. Without them, no one's privacy will be assured.

Let me leave you with the eloquent words attributed to Sir Thomas More in the screen version of A Man For All Seasons. More, a lawyer, was debating with his daughter, also a lawyer, who pleaded with her father to save his head from the executioner. "The law is simply a collection of words.", she argued. To which he replied: "Cut down the law and who can stand in the winds that blow?"

Well, the winds are blowing pretty forcefully and, in the absence of decent rules, we are running the risk of exposing ourselves to a relentless spate of arbitrary marketplace decisions being made about some very private, personal information.

I am less worried about governments as they have had or will have experience in working with laws on how to handle personal information. The federal Privacy Act8 has not brought the Government of Canada to its knees to comply with some very simple principles about how to handle its billions of pieces of personal information about Canadians. If we had similar codes of behaviour applying to all the rest of the informational transactions that take place around us, we would not have a great deal to worry about. But we do not.

Enormously greater quantities of information are going to become available to enormously greater numbers of people. And unless we can build into these systems rules of access and collection that respect control of the individuals whose information is involved, we are really standing on the threshold of an unhappy destiny for personal privacy. And we will all be the losers for that.

So, the faint-hearted and the privacy-alert may be asking themselves whether this is it? Does the Information Highway spell the doom of individual autonomy and render privacy but a myth? Or do we still have time for peaceful co-existence between privacy and technology?

Our answer is "Yes", but only by dealing with Canadians' concerns now can we take the steps to ensure that this new electronic world respects our ethical environment and our ecology of humanness. Technology and efficiency concerns should not dictate the shape and vision of our future.

The issue, to paraphrase Professor Heather Menzies of Carleton University, is not whether you are for or against technology -- the issue is really what vision of society, what conception of progress do we share against which the application of technology can be evaluated, judged, and where warranted, redesigned.

Privacy is only one of the many elements in this intriguing question, but it's an important one. How well privacy fares -- that is to say, how much respect for human dignity and individuality we preserve -- will determine whether in the end we have a society where God truly does come out of the machine.

It was Thoreau who said that inventions are but an improved means to an unimproved end. Here is our opportunity to prove that by marrying the technology with the values, we can move forward not only by improved means but also to an improved end.


[1] May be cited as/On peut citer comme suit:

Brian Foran, "Privacy on the Information Highway: Myth or Reality?", Government Information in Canada/Information gouvernementale au Canada, Vol. 2, no. 2.4 (fall/automne 1995).


Originally presented as an address to the Records Management Institute, 21 June 1995, Ottawa, Ontario.


Brian Foran
Special Advisor
Office of the Privacy Commissioner of Canada/
  Commissariat à la protection de la vie
  privée du Canada
112 Kent
Ottawa, Ontario
K1A 1H3

[3] Walter Wriston, The Twilight of Sovereignty: How the Information Revolution is Transforming Our World. New York: Simon & Schuster, 1992.

[4] Neil Postman, Technopoly: The Surrender of Culture to Technology. New York: Knopf, 1992.

[5] Arthur J. Cordell, "The Perils of an Information Age," Policy Options, April 1991.

[6] Privacy Revealed: The Canadian Privacy Survey. Ottawa: Ekos Research Associates, 1993.

[7] The Information Highway: What Canadians Think About the Information Highway. Anderson Consulting, 1994.

[8] R.S.C. 1985, c. P-21.


Letters to the Editor / Lettres au rédacteur en chef