Journal of Information, Law and Technology

Privacy in the Age of Information

Erick Bohlman
Swift, Popuch & Bohlman
Chicago, USA
erickeb3@aol.com

This is a commentary published on: 16 August 2002 

Citation: Bohlman E, 'Privacy in the Age of Information’, The Journal of Information, Law and Technology (JILT). 2002 (2) <http://elj.warwick.ac.uk/jilt/02-2/bohlman.html>

1. Introduction
Ruby was an expectant mother. One week before her baby was due, she received a coupon in the mail for diapers. Ruby took the coupon to the supermarket and bought the diapers. Shortly thereafter, she started receiving more coupons for diapers, baby formula, and other child-care goods. Ruby needed these items, and was happy to use the coupons. Two weeks after her baby was born, a man called to congratulate Ruby on becoming a mother and suggest that she purchase additional life insurance. ‘How do you know that I just had a baby?’ she asked. Ruby felt violated. Throughout the next year, the phone kept ringing and the mail kept coming. One day, Ruby decided that she had finally had enough. She was very rude to a telemarketer: ‘Don’t call me anymore,’ she said, ‘and don’t give out my telephone number.’ Ruby hung up the phone. One week later, Ruby received a call from the camp of a political candidate who pledged to put an end to unwanted ‘junk-mail’ and bothersome telephone solicitations.

Coincidence? Hardly. Modern information technology has changed not only how commercial transactions occur, but, more fundamentally, the subject matter of commerce itself. A continually growing, highly-pervasive industry has recently emerged, purely devoted to the collection, arrangement, and dissemination of personal information; that is, information that can be attributed to an identifiable individual. Today, information databases, in and of themselves, are highly valuable commercial commodities.

Recent improvements in digital database-storage technology have changed the ways in which data can be altered, examined, summarized and restructured to produce new or newly tailored information.

When committed to paper and trapped within the confines of a manual file, the utility of information is markedly limited. But, when the information is available in an electronic data base of virtually endless dimension, open to analysis and processing at a rate of many millions of functions per second, and capable of being transmitted through time and space at the speed of light, the computer transforms the character of the information itself, let alone the society that employs such technology.

A computer operator with access to electronic information data banks can quickly and easily rearrange facts, incorporate new material, compile multiple databases and make other transformations of information. ‘Whether one has the right to do so is a question of law and legal policy, but the medium supplies the capability.’

Creative marketing consultants are utilizing these new capabilities and incorporating this technology into their marketing schemes. Practices of modern marketing strategists include: 

(1) studying census data to make guesses about consumers based on the characteristics of everyone in a particular zip code; 

(2) buying lists of magazine subscribers; 

(3) perusing newspapers for birth, death and marriage announcements; 

(4) culling public real-estate records; 

(5) screening court documents and the publications of judicial proceedings; and 

(6) documenting consumer buying habits with checkout scanners and in-store video cameras.

Consumers may feel manipulated by these practices or complain that their privacy has been invaded. Unfortunately, though, these individuals may be victims without legal recourse. Most cases involving privacy rights that empower an individual to control the use and discourse of personal information rest on statutory, as opposed to common law, authority, and involve information held by the government. The Freedom of Information Act (‘FOIA’), for example, exempts information from mandatory disclosure by the federal government if disclosure would constitute an unwarranted invasion of privacy. Similarly, the Privacy Act of 1974 (‘Privacy Act’) was established to provide certain controls over what personal information is collected by the federal government and how it is used. 
Instead of devoting its resources toward creating new ways to limit and restrict data collection and dissemination by the private sector, the federal government is currently acting on legislation that would substantially expand government surveillance powers, including the use of a controversial Internet monitoring system, for purposes of combating terrorism. This unprecedented power on the part of the government to access and review computer records of its citizenry will likely create even greater legal concerns. For now, though, with respect to the private sector, Congress has remained uninvolved. Generally, it is only the consumer and the business conscience of the industry that monitor the collection, use and dissemination of information.

Therefore, consumers upset with the exploitation of personal information by the private sector are forced to look to the common law. Commentators have suggested that the tort of invasion of privacy through the publication of private facts may provide an answer. The Restatement (Second) of Torts defines this tort as the publication of a matter concerning the private life of another that is highly offensive to a reasonable person and that is not of legitimate public concern. However, the First Amendment to the United States Constitution limits government interference with the dissemination of speech. 

Nonetheless, this article argues that when personal facts are compiled into extensive dossiers or profiles, the nature of the information is transformed into something which should thereby acquire common law protection under the laws of the United States, despite the mandate of the First Amendment.

2. Analysis
Most states recognize the tort of publication of private facts in one of two forms. Some states follow the definition originally enumerated by Professor William L. Prosser which includes three elements for this type of invasion of privacy: 

(1) a public disclosure; 

(2) of private facts; 

(3) that would be offensive and objectional to a reasonable person of ordinary sensibilities. Other states follow the Restatement (Second) of Torts version, which adds a fourth element to those delineated by Prosser, essentially incorporating the First Amendment defense;

(4) the published material must not be a matter of legitimate public concern.
2.1 Public Disclosure
In order for the public disclosure of private facts tort to apply, the disclosure must be relatively widespread. Generally, commercial data maintained in computer data banks is disseminated to individuals or small groups, one at a time. Thus, in order for a person whose personal information has been collected and disseminated for commercial purposes to prevail in an invasion of privacy claim, he or she must prove that, under the circumstances, the scope of the disclosure was sufficiently public.

In Rycroft v. Gaddy, the Court of Appeals of South Carolina considered whether the disclosure of personal information to a small group of people was sufficient to constitute an invasion of privacy. Kenneth Rycroft and Rene Tanguay were partners in a corporation. Rycroft brought a suit for dissolution of the corporation. During discovery, pursuant to a subpoena issued at the request of Tanguay and his attorney, Clifford Gaddy, Rycroft’s bank produced records of Rycroft’s checking account. No one other than Tanguay, Gaddy and one other individual reviewed the records.

Consequently, Rycroft brought an action against Gaddy and Tanguay for invasion of privacy based on public disclosure of private facts. The court held that ‘publicity,’ not merely ‘publication,’ is required in order to substantiate an action for the publication of private facts. Communication to an individual or to a small group of people, absent exceptional circumstances, will not ordinarily give rise to liability.

However, in Beaumont v. Brown, the Supreme Court of Michigan examined whether the disclosure of personal information to only a few people, whose special knowledge of those facts was extremely embarrassing to the plaintiff, was sufficient to support a cause of action. Arthur Zink, personnel director for the Michigan Department of Labor (the Department), terminated the employment of Robert Beaumont, an employee and member of the U.S. Army Reserve. Barry Brown was the director of the Department at that time. Subsequently, Zink wrote a letter to the U.S. Army Reserve Components Personnel and Administration Center stating that he had fired Beaumont, and that Beaumont was ‘extremely disloyal,’ abusive of his reserve status, and insubordinate.

Beaumont brought suit against Zink and Brown for invasion of privacy. Zink and Brown moved for summary judgment, claiming that the publication was not large enough to constitute an invasion of privacy. The court stated that ‘[t]o begin with ‘communication to the general public’ is somewhat ambiguous, because a communication rarely, if ever, reaches everyone. It is therefore in order to consider the significance of the communication to the public.’ Accordingly, the court denied the defendants’ motion, holding that a publication of personal facts to a group of people whose special knowledge of those facts would be embarrassing to the plaintiff is sufficient to warrant a trial on the merits.

Although personal data which is stored in computer data banks for commercial purposes is usually not disclosed to large groups of people, the significance of the communication can be quite substantial. The use of the information can be extremely embarrassing or harmful to the data subject, even if disclosed to just one individual. Because of personal information maintained on computer data banks, data subjects may be denied credit, employment or entrance into social organizations. Furthermore, data subjects are likely to receive calls from bothersome telephone solicitors and unwanted ‘junk mail.’ Therefore, the collection and dissemination of personal data for commercial purposes should ordinarily be sufficient to constitute a public disclosure in a privacy action.

2.2 Private Facts
In order to support a cause of action for the publication of private facts, the facts must be sufficiently ‘private.’ Not all personal information is private information. In order for facts to be private, there must be a reasonable expectation that they will remain private. Some commentators have alleged that individual facts contained in computer data banks, which are disclosed for commercial purposes, are frequently: 

(1) not the type of matter which most people expect to remain private; 

(2) contained in public records and therefore not private; or 

(3) relevant, even though they are often not current.

(1) Reasonable Expectation of Privacy:
Personal facts which are disseminated must be ‘private’ in order to state a cause of action for invasion of privacy. It may be contended that the individual facts which are contained in commercial databases, although personal in a literal sense, are not private in a legal capacity, because there is no legitimate expectation of privacy as to those facts.
	
In Wolf v. Regardie, the District of Columbia Court of Appeals considered whether the publication of a person’s wealth as amassed through large-scale real estate dealings was the type of personal information that is also considered to be private. William Wolf was an attorney and successful real estate mogul. After being declined an interview with Wolf, Regardie, a business trade magazine, published a story on Wolf and his real estate dealings. Wolf sued for invasion of privacy. The court held that the prominent nature of Wolf’s real estate transactions destroyed any legitimate expectation of privacy that he may have had; thereby denying a cause of action.
However, in Mason v. Williams Discount Center, Inc., the Missouri Court of Appeals examined whether the publication of a plaintiff’s not-so-visible financial transactions could be the subject of a public disclosure of private facts claim. Williams Discount Center is a retail outlet which placed in its store, in clear view of its patrons, a list of names under the heading ‘no checks.’ Robert Mason’s name was on that list. Accordingly, Mason brought suit for invasion of privacy. The court held that small-scale financial dealings, such as Mason’s, are the type of private matter that invasion of privacy actions were designed to protect.

The bulk of the material contained in commercial databases involves relatively discrete personal information, such as supermarket purchases and magazine subscriptions. This information is more similar to that in Williams Discount Center than it is to that in Regardie. Therefore, the facts collected and disseminated through computer data banks should normally be the type of information that can give rise to a claim for public disclosure of private facts. However, if the information is obtained from public records, the otherwise private information may lose its private character.

(2) Public vs. Private Facts:
Generally, ‘information appearing on a public record is not private fact, no matter how embarrassing or distasteful the content of the information may be.’ Furhtermore, the public nature of the facts is also unaffected merely because the information is presented in a different form. Much of the material contained in commercial data banks is obtained from public sources: U.S. census data; newspapers; birth, death and marriage records; public real estate records; court documents; etc. Therefore, there is a strong presumption that most of this material, by itself, is not private information.

However, part of an individual’s sense of privacy is derived from the knowledge of the lengths through which another person would have to proceed in order to retrieve various bits of personal information from public records. The very inefficiency of the process serves to preserve a substantial measure of individual privacy. ‘Computer technology, however, has made these protections part of a lost era.’ Thus, when personal information is collected from multiple public sources and combined into a solitary dossier or personal profile, a cause of action for public disclosure of private facts may arise.

In United States Department of Justice v. Reporters Committee for Freedom of the Press, the U.S. Supreme Court was confronted with the issue of whether a collection of remote public facts in a computer database, all of which exist independently in diverse public records, could amount to private information. A CBS news correspondent had requested, pursuant to the Freedom of Information Act (FOIA), Charles Medico’s criminal history ‘rap sheet’ from the Federal Bureau of Investigations (Bureau). The rap sheet contained information relating to minor crimes which were not the subject of great public curiosity. Private information is exempt from disclosure under the FOIA. Hence, the Bureau, believing that the rap sheets contained private data, refused to disclose the information.

The court noted that ‘there is a difference between public records that might be found after a diligent search of courthouse files, county archive and local police stations throughout the county, and a computerized summary located in a single clearinghouse of information.’ The court concluded that ‘the fact that an event is not wholly private does not mean that an individual has no interest in limiting disclosure or dissemination of the information.’ Accordingly, the court refused to require disclosure of the rap sheet.

Moreover, a computer analysis of public data can amount to more than a mere collection of public records. In Ashbury Park Press, Inc. v. New Jersey Department of Health, the Superior Court of New Jersey considered whether a ‘spread sheet’ analysis of public records was, itself, a public record. The New Jersey Department of Health had conducted an examination of state hospital financial information; resulting in a computer spread sheet detailing the result. A reporter for the Ashbury Park Press requested this information. The Department, believing that this was private data, denied disclosure of the information. The court agreed with the Department and refused to require disclosure, stating that the spread sheet was not a public record, but more like an analysis or work product that represents tentative conclusions and opinions.

As the preceding cases suggest, although much of the information included in commercial databases is derived from public records, data subjects should have a privacy interest in preventing the unauthorized dissemination of this information. Consequently, it can be argued that the collection of personal data, as well as its disclosure, is a violation of privacy. Regardless, the remote public origin of data, which has been assembled in a central database, does not necessarily mean that the database is merely a collection of public facts.

(3) Outmoded Information:
Information which was once public can, over time, become private. According to the Restatement, the lapse of time between the occurrence of an event and its subsequent disclosure is one factor to be considered in determining whether facts are public or private. Commercial data banks evolve over time and much of the information maintained therein is not current. Accordingly, it is necessary to determine whether any of the personal information assembled in such a database, that would otherwise be public, has lost its public status.

In Lindemuth v. Jefferson County School District, the Colorado Court of Appeals had to determine whether the publication of a person’s past criminal history, several years previous, was an invasion of privacy. Mark Lindemuth, now an assistant high school basketball coach, had once been convicted of child molestation. Fourteen years later, Donald Schneider, the head coach, began spreading rumors about Lindemuth’s past conduct. Lindemuth then filed suit against Schneider and the Jefferson County School District for invasion of privacy. The court held that the long time period between Lindemuth’s conviction and Schneider’s publication did not render the fact of Lindemuth’s prior molestation conviction private.
However, in Melvin v. Reid, the California District Court of Appeals considered whether the facts pertaining to a seven-year-old murder trial had subsequently become private facts. Gabrielle Darly Melvin was a former prostitute who had been acquitted of murder in 1918. In 1925, the defendants released a movie documenting the murder trial and surrounding circumstances. Melvin, who had since given up prostitution and was leading a private life, brought suite for invasion of privacy. The court determined that, because of the lapse of time and Melvin’s desire to maintain a private life, the defendant’s publication of the once-public facts constituted an invasion of privacy.

These cases indicate that, under certain circumstances, public facts can become private over time. In Lindemuth, the court implied that the plaintiff’s conviction of child molestation, although dated, was still a matter of public concern. Lindemuth was working with children, and his past conviction was relevant to his current lifestyle. However, in Melvin, the plaintiff’s past had no effect on her current life or that of anyone around her. Consequently, when once-public facts contained in commercial databases are no longer current, they must be examined in order to determine if they have lost their public nature.

2.3 Offensive and Objectional to a Reasonable Person
In order to maintain a cause of action for the public disclosure of private facts, the disclosure must be offensive and objectional to a reasonable person of ordinary sensibilities. Many of the individual facts contained in commercial databases are not, in and of themselves, offensive. However, ‘the increasing use of computers and sophisticated information technology, while essential to the efficient operation of government, has greatly magnified the harm that occurs from any collection, maintenance, use, or dissemination of personal information.’ Therefore, when facts are combined into extensive dossiers or personal profiles and maintained on computer data banks, the compilations may constitute offensive material.

In Whalen v. Roe, the United States Supreme Court contemplated whether the collection of personal information in a central computer file could amount to an invasion of privacy. The New York legislature had enacted a law requiring certain drug prescriptions to be made on a specific form, filed with the State Health Department, and recorded in a central computer data bank. The forms contained information identifying the prescribing physician; the dispensing pharmacy; the drug; and the patient’s name, address and age. A group of physicians challenged this law, claiming that it constituted an unwarranted invasion of privacy.

Justice Brennan, in a concurring opinion, recognized that ‘[t]he central storage and easy accessibility of computerized data vastly increase[s] the potential for abuse of that information.’ However, because none of the information had been unreasonably disclosed, and the conditions necessary for disclosure were extremely limited and regulated, the court held that the mere collection of the information did not support an invasion of privacy claim.
	
Moreover, in Briscoe v. Reader’s Digest Ass’n, Inc., the California Supreme Court undertook to define the circumstances when the publication of personal facts is offensive and objectional to a reasonable person. ‘The claim is not so much one of total secrecy as it is of the right to define one’s circle of intimicy – to choose who shall see beneath the quotidian mask. Loss of control over which ‘face’ one puts on may result in literal loss of self-identity and is humiliating beneath the gaze of those whose curiosity treats a human being as an object.’
	
As these cases demonstrate, the harm to an individual is exaggerated when multiple facts are compiled in centralized computer data banks. ‘As a result of modern data processing, dossier building, and record keeping, the individual is steadily losing control over personal information.’ It is the exposure to strangers in such a cumulative sense, through an unauthorized and unknown composite dossier or personal profile, without an opportunity to mitigate the effects of such disclosure, that works an invasion of privacy and interferes with the individual’s right to self-expression.

2.4 Not a Matter of Public Concern
According to the Restatement (Second) of Torts, in order to substantiate a claim for the public disclosure of private facts, the disclosed material must not be a matter of legitimate public concern. Further, states which do not follow the Restatement version of this tort may nevertheless violate the First Amendment if they restrict the dissemination of information which is of public concern. Thus, courts must balance the First Amendment value of the type of communication at issue against the state interest in prohibiting the disclosure of personal information. ‘The line is to be drawn when the publicity ceases to be the giving of information to which the public is entitled.’

(1) First Amendment Value of the Information:
Not all speech is protected by the First Amendment equally. Communication of news and other speech received the highest degree of First Amendment Protection. ‘’News’ includes all events and items of information . . . which have ‘that indefinable quality which arouses public attention.’’ Commercial communication, on the other hand, receives less protection. Commercial communication is ‘expression related solely to the economic interests of the speaker and its audience.’ Most of the information maintained on commercial data banks is, by its very nature, disclosed for commercial purposes, and should therefore receive reduced First Amendment protections.
	
In Dun & Bradstreet, Inc. v. Greenmoss Builders, Inc., the United States Supreme Court discussed the different First Amendment values accorded various types of communication. Dun & Bradstreet, a credit reporting agency, falsely reported that Greenmoss Builders, Inc. had filed a petition for bankruptcy. In response to Dun & Bradstreet’s failure to correct this information, Greenmoss Builders filed suit for defamation.
	
The court, in order to determine the degree of First Amendment protection to attach to the credit report, looked to the purpose of the First Amendment: ‘The First Amendment ‘was fashioned to assure unfettered interchange of ideas for the bringing about of political and social changes desired by the people.’’ The court held that sanctioning a credit reporting agency for false credit reports would not significantly interfere with the ‘unfettered interchange of ideas.’’ Accordingly, the court extended only minimal protection to the credit report.
	
The information contained in commercial data banks, like that in Dun & Bradstreet, is normally commercial information. Generally, such information pertains to an individual’s interest of and financial undertakings so that the purchasers of the information can target these individuals for marketing purposes. Therefore, the First Amendment value of maintaining and disclosing such information should be extremely limited.

(2) State Interest in Proscribing Disclosure:
Although the disclosure of information contained in commercial data banks deserves some protection against restriction, the state has a strong interest in the protection of its citizenry against unwarranted invasions of privacy. The storage of data on centralized computer data banks further amplifies the state’s interest. ‘This use of computers has two effects: it facilitates inspection of an individual’s personal data and it may prolong the life of the data beyond a time when it has any real validity in describing the individual.’ Hence, information disclosed for commercial purposes generally is not a legitimate matter of public concern, justified by the First Amendment, and may be proscribed in order to prevent invasions of privacy.

3. Conclusion
Generally, information contained in computer databases and disseminated for commercial purposes can give rise to a cause of action for public disclosure of private facts. However, each database and the information that it contains is unique and must be analyzed on a case-by-case basis. No sweeping conclusions are apparent, and none shall be drawn by this author. What is apparent, is that government must act to address these new threats to consumer’s privacy by the private sector. 

 ‘The machine, as Orwell once called ‘the genie that man has thoughtlessly let out of its bottle and cannot put back again,’ has allowed new concentrations of power . . . which utterly dwarf the individual and threaten individuality as never before.’ 

When relatively insignificant bits of information are assembled and maintained in centralized computer data banks, and when the information is identifiable to specific individuals, the result is a dangerous synergy – a combination that proves potentially much more deadly than the sum of its components.