Source/Privacy Rights

History

What is the oldest source in any country that mentions this right?

Most sources say that the first mention of this right is The Right to Privacy written by Samuel Warren and Louis Brandeis and published in the Harvard Law Review in 1890. Both were Boston attorneys and Brandeis would go on to serve as a United States Supreme Court Justice for 23 years (Louis Brandeis, n.d.). In this essay, they note that the legal scope of rights broadens over time and posit that the right to life has expanded to “the right to be let alone,” which had become an increasingly difficult feat with new technologies (Warren & Brandeis, 1890, 193, 195).

Warren and Brandeis (1890) acknowledge that, at the time, there was little-to-no legal protection of this right. They look at defamation law and determine while it alludes to privacy law, there are limitations to privacy protection from this area of law as it only considers a damaged reputation, not instances in which an individual wishes something remained secret (Warren & Brandeis, 1890, 197; Bycer, 2014). They also looked at copywriting and publishing law, which only applies to one’s own work (Warren & Brandeis, 1890, 199). They determine that the right to privacy can extend beyond these areas of law as the right should be able to wholly prevent the depiction of private life (Warren & Brandeis, 1890, 218). In the last part of this essay, they set out limitations to the right of privacy – privileged information remains under defamation law (to allow for the operation of courts), privacy ceases with consent to publish, gossip is not in the realm of privacy law, and intention and truth do not prevent a breach of such right.

However, Warren and Brandeis cite at least two instances that predate The Right to Privacy which discuss the right to privacy. The earliest is the citing of an 1820 statement from Lord Cottenham, who, in agreement with Lord Eldon, felt that were a king’s illnesses recorded by a doctor and published while that king was still alive, a court would not permit its publishing, as he claimed this circumstance would breach the king’s privacy (Warren & Brandeis, 1890, 205; Bycer, 2014). Additionally, they acknowledge that the right to privacy has already been regulated in France since 1868. Section 11 of the 1868 Loi Relative à la Presse (Press Law) says that all periodic writings about a private fact of life are violations punishable by a fine of 500 francs. Pursuit of the violation may only be undertaken by the affected party (Warren & Brandeis, 1890, 214, footnote 1).

Resources

Bycer, M. (2014). Understanding the 1890 Warren and Brandeis “The Right to Privacy” Article. National Juris University. Retrieved Sept. 10, 2021, from https://nationalparalegal.edu/UnderstandingWarrenBrandeis.aspx Louis Brandeis. (2020, Nov. 9). Britannica. Retrieved Sept. 8, 2021, from https://www.britannica.com/biography/Louis-Brandeis Warren, S. & Brandeis, L. (1890, Dec. 15). The right to privacy. Harvard Law Review 4(5), 193-220. http://links.jstor.org/sici?sici=0017-811X%2818901215%294%3A5%3C193%3ATRTP%3E2.0.CO%3B2-C

Is there another noteworthy written source from the past that mentions this right?

The right to privacy has diverged in many ways since its most notable first mention in The Right to Privacy by Samuel Warren and Louis Brandeis. What started in 1890 as the idea of protection against gossip about oneself and the ability to enjoy life uninterrupted has evolved into various international and national conventions and laws.

The right to privacy was first enshrined at a supranational level before it was established in individual states (Krishnamurthy, 2020, 26). The right’s first appearance in legal documentation was in the United Nation’s (UN) 1948 Universal Declaration on Human Rights (UDHR). Article 12 of the UDHR (1948) states “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.” The UHDR is not a treaty, so the right was not yet entrenched and more of a suggestion for states to incorporate into their laws and practices.

Two years later, the Council of Europe passed the Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR) which has similar tones in Article 8, though with an exception for national security in Article 8 (2) but is legally binding (1950). The ECHR was the first agreement at any level to express the right to privacy. Article 8 of the ECHR specifically protects one’s family life, personal life, correspondence, and home (Roagna, 2021, 9). Worldwide, the right to privacy became codified in 1966 with the passage of the UN’s International Covenant on Civil and Political Rights (ICCPR), in which Article 17 has almost identical language to the UDHR’s Article 12. In subsequent UN treaties, this right to privacy was explicitly granted to children and migrants as well (Convention on the Rights of the Child, 1989, Art. 16; International Covenant on the Protection of All Migrant Workers and Members of Their Families, 1990, Art. 14).

Complying with the ICCPR

In the United States, the right to privacy was not originally codified but established through a variety of Supreme Court cases beginning in the 1960s (Privacy, n.d.). In 1965, the Court ruled on Griswold v. Connecticut. The majority opinion written by Justice Douglas claims that the express personal freedoms named in the First, Third, Fourth, Fifth, and Ninth Amendments create an implied “zone of privacy” (Privacy, n.d.). Justice Harlan’s concurring opinion, referenced in later Supreme Court privacy cases, claims privacy zones derive from the Fourteenth Amendment (Privacy, n.d.). Later, legislation was passed regulating specific sectors, beginning in 1974 with the Family Educations Rights and Privacy Act (FERPA), which protects student data, and the Privacy Act which regulates the use of data by federal agencies (History of privacy timeline, 2021).

The European Court of Human Rights has refined the implementation of ECHR Article 8 through case law (Roagna, 2021, 7). In deciding these cases, the Court must decide if the complaint is related to Article 8 and, if so, if the right has been interfered with outside of the exceptions laid out in Article 8 (2) (Roagna, 2021, 11). For this reason, there is no clear-cut definition as to which national laws may conflict with Article 8 (Roagna, 2021, 12). The Court has provided protections for ‘quasi-familial’ relationships, relationships that may develop later (i.e., one has the right to adopt), the development of personality, photographs, and data collection, ruling these areas are part of private and/or family life (Roagna, 2021, 10-19). The Court has also provided lengthy protections to family life with a broad definition of family which evolves with European customs (Roagna, 2021, 27). The protection of a home has also been interpreted broadly, requiring continuous ties to a location, mostly due to the French translation of “home” to “domicile” (Roagna, 2021, 30-31). The Court rules for high protection of means of communication as it can be easily breached (Roagna, 2021, 32). This protection includes information gathered from monitored internet use and remains in places no matter the content of the message (Roagna, 2021, 32).

The Digital Era: Since these international conventions have become effective and enforceable, there has been a lot of technological change and little change in these agreements (Human right to privacy, n.d.). The UN Human Rights Committee (UNHRC) noted in General Comment 16, adopted regarding ICCPR’s Article 17 in 1988, that the legislation in many states was not enough to ensure the “protection against both unlawful and arbitrary interference,” and that data collection “must be regulated by law” (Krishnamurthy, 2020, 27; UN Human Rights Committee, 1994, para. 2 & 10). In essence, this comment was requesting states enact more protective privacy law legislation, and, specifically, data regulation law, as the right to privacy evolved to be dominated by electronic data (Krishnamurthy, 2020, 27).

There have been two approaches to this call for better data privacy regulation: general regulation and regulation by sector. The European Union has taken the general regulation approach with the passage of the 1995 European Data Protection Directive and the 2016 General Data Protection Regulation (GDPR). The GDPR affects people and companies worldwide, requiring that data collected is truly needed, accurate, processed safely, and that all of this is done in a clear, legal, and transparent way (Krishnamurthy, 2020; Wolford, n.d.). The United States has chosen to regulate privacy data by sector, beginning with FERPA in 1974 (Krishnamurthy, 2020, 29; History of privacy timeline, 2021). This approach has led to some strict laws preventing unauthorized access to personal information in some areas regulated by specific legislation (Krishnamurthy, 2020, 29). In areas without specific legislation, however, Americans take great liberties while collecting data (Krishnamurthy, 2020, 29). Put in combination with the lacking legislation preventing interference or data attacks, some question how compliant the United States is with Article 17 of the ICCPR (Krishnamurthy, 2020, 29). However, as of 2020, 29% of states are still drafting or have yet to draft such legislation (UN Committee on Trade and Development).

Resources

Convention for the Protection of Human Rights and Fundamental Freedoms. The Council of Europe. Nov. 4, 1950. https://rm.coe.int/1680a2353d Convention on the Rights of the Child. United Nations (UN) General Assembly (UNGA). Nov. 20, 1989. https://www.ohchr.org/en/professionalinterest/pages/crc.aspx History of privacy timeline. (2021). The University of Michigan. Retrieved Sept. 9, 2021, from https://safecomputing.umich.edu/privacy/history-of-privacy-timeline Human right to privacy in the digital age, The. (n.d.). American Civil Liberties Union. Retrieved Sept. 8, 2021, from https://www.aclu.org/other/human-right-privacy-digital-age International Covenant on the Protection of All Migrant Workers and Members of Their Families. UNGA. Dec. 18, 1990. https://www.ohchr.org/Documents/ProfessionalInterest/cmw.pdf International Covenant on Civil and Political Rights. UNGA. Dec. 16, 1996. https://www.ohchr.org/en/professionalinterest/pages/ccpr.aspx Krishnamurthy, V. (2020, Jan. 6). A tale of two privacy laws: The GDPR and the International Right to Privacy. AJIL Unbound 114, 26-30. doi:10.1017/aju.2019.79 Privacy. (n.d.). Cornell Law School Legal Information Institute. Retrieved Sept. 8, 2021, from https://www.law.cornell.edu/wex/privacy Roagna, I. (2012). Council of Europe human rights handbook: Protecting the right to respect for private and family life under the European Convention on Human Rights. Council of Europe. https://www.echr.coe.int/LibraryDocs/Roagna2012_EN.pdf UN Committee on Trade and Development. (2020). Data Protection and Privacy Legislation Worldwide. Retrieved Sept. 9, 2021, from https://unctad.org/page/data-protection-and-privacy-legislation-worldwide UN Human Rights Committee. (1994). General Comment 16. Thirty-third session. HRI/GEN/1/Rev. 1 Retrieved Sept. 9, 2021, from https://undocs.org/HRI/GEN/1/Rev.1 Universal Declaration on Human Rights. UNGA. Dec. 10, 1948. https://www.un.org/en/about-us/universal-declaration-of-human-rights Wolford, B. (n.d.). What is GDPR, the EU’s new data protection law? GDPR EU. Retrieved Sept. 9, 2021, from https://gdpr.eu/what-is-gdpr/

Legal Codification

Is it contained in the US Constitution?

The right to privacy is not explicitly contained in the United States Constitution.

References

Privacy. (n.d.). Cornell Law School Legal Information Institute. Retrieved Sept. 8, 2021, from https://www.law.cornell.edu/wex/privacy

Has it been interpreted as being implicit in the US Constitution?

In the United States, the right to privacy was not originally codified but established through Supreme Court cases around the 1960s (Privacy, n.d.). Prior to this time, the Court recognized in Snyder v. Massachusetts (1934) that some concepts of fairness are fundamental, but not expressed. In 1965, the Court heard and decided Griswold v. Connecticut. In the majority opinion, Justice William Douglas argues that the Court had previously ruled on cases in which rights were not explicit in the Bill of Rights, but the rights were justifiable to the Court through the First and Fourteenth Amendments (Griswold v. Connecticut, 1965, par. 11). Later in the opinion of the court, he states that in other cases, such as Boyd v. United States (1886), Mapp v. Ohio (1961), and Poe v. Ullman (1961), the court used the ‘penumbras’ of the First, Third, Fourth, Fifth, and Ninth Amendments to make decisions on implicit liberties (Griswold v. Connecticut, 1965, pars. 14-15). Combined, these penumbras create what the Griswold v. Connecticut majority opinion calls “zones of privacy” (Privacy, n.d.). In a concurring Griswold opinion, Justice Arthur Goldberg argues that while liberties extend beyond the Bill of Rights, he, Chief Justice Earl Warren, and Justice William Brennan feel that the Due Process Clause of the Fourteenth Amendment does not include “all of the first eight amendments” (Griswold v. CT, 1965, par. 21). However, in a different concurring opinion, Justice John Marshall Harlan found “[t]he Due Process Clause of the Fourteenth Amendment stands […] on its own bottom” (Griswold v. CT, 1965, par. 53; Privacy, n.d.). Justice Harlan’s concurring opinion became the predominant argument used in later privacy cases (Privacy, n.d.).

In 1967, the Supreme Court decided the case of Katz v. United States (Katz v. US, n.d.). Katz, located in Los Angeles, had been using a public phone booth to inform bettors in Boston and Miami, and in an effort to convict him, federal agents tapped the phone booth (Katz v. US, n.d.). A lower court allowed this evidence to be admitted, but Katz claimed it was a violation of the Fourth Amendment (Katz v. US, n.d.). The Supreme Court sided 7-1 with Katz and establishes that “the Fourth Amendment protects people, not places” (Katz v. United States, 1967). In a concurring opinion, Justice Harlan established the Expectation for Privacy Test (Katz v. US, n.d.; Expectation of Privacy, n.d.). This test is two-fold – the individual must have an expectation for privacy which is rooted in law and society finds that expectation for privacy to be reasonable – and has been used as a basis for privacy since (Expectation of Privacy, n.d.).

After these two cases, the Supreme Court has continued to extend the right to privacy, notably so in three landmark cases: Eisenstadt v. Baird (1971), Roe v. Wade (1972), and Lawrence v. Texas (2003) through the use of the Fourteenth Amendment and Justice Harlan’s concurring Griswold opinion (Privacy, n.d.). Eisenstadt extended the use of contraceptives beyond married couples to individuals (Privacy, n.d.). Roe extended the right to privacy to the women’s right to have an abortion (Privacy, n.d.). Lawrence v. Texas overturned Bowers v. Hardwick (1986) and extended privacy to private conduct (Privacy, n.d.).

References

Expectation of Privacy. (n.d.). Cornell Law School Legal Information Institute. Retrieved Sept. 13, 2021, from https://www.law.cornell.edu/wex/expectation_of_privacy Griswold v. Connecticut, 381 U.S. 479 (1965). https://www.law.cornell.edu/supremecourt/text/381/479 Katz v. United States. (n.d.). Oyez. Retrieved September 13, 2021, from https://www.oyez.org/cases/1967/35 Katz v. United States, 389 U.S. 347 (1967). https://www.law.cornell.edu/supremecourt/text/389/347 Privacy. (n.d.). Cornell Law School Legal Information Institute. Retrieved Sept. 8, 2021, from https://www.law.cornell.edu/wex/privacy Snyder v. Massachusetts, 291 U.S. 97 (1934). https://www.law.cornell.edu/supremecourt/text/291/97

Are there any exceptions in American law to this right?

Most recent US legislation regarding the right to privacy concerns the collection, retention, and transfer of personal data. Under the Department of Justice, the Office of Privacy and Civil Liberties (OPCL) enforces privacy laws, recommends privacy policies (including exceptions), and responds to data breaches (Office of Privacy and Civil Liberties, n.d.).

Freedom of Information Act 1966 (as amended 2016)

In 1966, Congress passed the Freedom of Information Act (FOIA). This act granted anyone the ability to request access to federal agency records but not the records of private companies. However, nine exemptions and three exclusions may prevent access to these records (Freedom of Information Act, n.d.). The exclusions are narrow and related to law enforcement and ongoing intelligence investigations and are unaffected by FOIA (Freedom of Information Act, n.d.). The exemptions authorize government agencies to withhold information from those requesting it (Freedom of Information Act, n.d.). The nine exemptions prevent the sharing of information if it is classified for national security, part of internal rules or practices, prohibited through other laws (such as the Privacy Act, see below), a trade secret, legally protected, a medical file, law enforcement records, regarding bank supervision, or locational information (Freedom of Information Act, n.d.). FOIA was most recently updated with the FOIA Improvement Act of 2016, which increased transparency and altered procedures (OIP Summary of the FOIA Improvement Act of 2016, 2016).

Privacy Act 1974

The Privacy Act of 1974 was an effort to balance the “governments’ need to maintain information” and the “rights of individuals to be protected against unwarranted invasions of their privacy” (Walls, n.d.; Privacy Act of 1974, 5 U.S.C. § 552a, n.d.). It prevents agencies from disclosing records to any person or agency unless it falls into one of the twelve approved guidelines (Walls, n.d.; Privacy Act of 1974, 5 U.S.C. § 552a, n.d.). The most used reasons which allow for disclosure are subsections 1, 2, and 3 of 5 US Code § 552a(b) (Overview of the Privacy Act: 2020 Edition, 2021). Subsection One allows for the disclosure of information between agencies on a need-to-know basis. Subsection Two allows the FOIA to overrule the Privacy Act with regards to when to disclose information. Subsection Three allows for disclosure to another party if their use is similar to the use for which the data was originally collected. This third exception is quite broad, which causes controversy (Overview of the Privacy Act: 2020 Edition, 2021). Other exceptions include use for public record (used for the Census or National Archive data), or requests by law enforcement or the court system. In addition to putting forth information disclosure guidelines, this act requires agencies to keep accurate records of how, where, and why they sent information if they had sent information (Privacy Act of 1974, 5 U.S.C. § 552a, n.d.).

Gramm-Leach-Bliley Act 1999

The Gramm-Leach-Bliley Act (GLBA) was passed to regulate the transfer of consumers’ “nonpublic personal information” by financial institutions (FDIC, 2021). At its core, the law says financial institutions cannot pass along personal data to third parties unless the customer is put on notice, given the opportunity to opt out, and they do not opt out (FDIC, 2021). Exceptions to this rule appear in Sections 13-15 (FDIC, 2021, VIII-1.3). Section 13 permits the transfer of some personal data to a third party if they are performing services on behalf of the financial institution, but they must be contractually bound to not do anything else with the data (FDIC, 2021, VIII-1.3). Section 14 allows the bank to disclose information as needed to perform banking functions initiated by the customer, while Section 15 extends that disclosure to normal financial institution acts, such as fraud detection (FDIC, 2021, VIII-1.3). Of these exceptions, only Section 13 requires the customer to be notified that their information is being shared (FDIC, 2021).

USA PATRIOT Act 2001 & USA Freedom Act 2015

Enacted less than two months after the 9/11 attacks, the PATRIOT Act was passed with the intention of increasing homeland security by allowing surveillance techniques used in local crime to be used to fight terrorism (Highlights of the USA PATRIOT Act, n.d.; USA PATRIOT Act, n.d.). Most importantly, this law allowed for the sharing of information between law enforcement agencies at various levels without notice (Highlights of the USA PATRIOT Act, n.d.). This law wasn’t the most protective of civil rights and liberties and to rectify that President Obama signed the USA Freedom Act in 2015, ending government collection of metadata (Patriot Act, n.d.; Fact sheet, 2015).

Resources Fact sheet: Implementation of the USA Freedom Act of 2015. (2015, Nov. 27). Central Intelligence Agency. https://www.intelligence.gov/index.php/ic-on-the-record-database/results/787-fact-sheet-implementation-of-the-usa-freedom-act-of-2015 Federal Deposit Insurance Corporation (FDIC). (2021, April). FDIC Consumer Compliance Examination Manual: VIII-1.1 Gramm-Leach-Bliley Act. Author. https://www.fdic.gov/resources/supervision-and-examinations/consumer-compliance-examination-manual/index.html Freedom of Information Act, 5 U.S.C. § 552. (1966). Freedom of Information Act, The. (n.d.). Department of State. Retrieved Sept. 14, 2021, from https://foia.state.gov/learn/foia.aspx Highlights of the USA PATRIOT Act. (n.d.) Department of Justice. Retrieved Sept. 14, 2021, from https://www.justice.gov/archive/ll/highlights.htm Office of Privacy and Civil Liberties. (n.d.). Department of Justice. Retrieved Sept. 14, 2021, from https://www.justice.gov/opcl OIP Summary of the FOIA Improvement Act of 2016. (2016, Aug. 17). Department of Justice. https://www.justice.gov/oip/oip-summary-foia-improvement-act-2016 Overview of the Privacy Act: 2020 Edition. (2021, Feb. 16). Department of Justice. https://www.justice.gov/opcl/overview-privacy-act-1974-2020-edition/disclosures-third-parties Patriot Act. (n.d.) History.com. Retrieved Sept. 14, 2021, from https://www.history.com/topics/21st-century/patriot-act Privacy Act of 1974. 5 U.S.C. § 552a. (n.d.). Department of Justice. Retrieved Sept. 14, 2021, from https://bja.ojp.gov/program/it/privacy-civil-liberties/authorities/statutes/1279#vf4tzl Privacy Act, 5 U.S.C. § 552a(b). (1974). USA PATRIOT Act. (n.d.). Department of Justice. Retrieved Sept. 14, 2021, from https://bja.ojp.gov/program/it/privacy-civil-liberties/authorities/statutes/1281 Walls, T. (n.d.). FOIA v. Privacy Act: A comparison chart. IAPP. https://iapp.org/resources/article/foia-v-privacy-act-a-comparison-chart/

Culture and Politics

Is this right interpreted and exercised in different ways in different countries? Focus on particular countries in which the right is interpreted distinctively

The right to privacy has been interpreted in various ways. The EU has strict legislation regarding data privacy and the Council of Europe has outlined in Article 8(1) of the ECHR (1950) the right to privacy in the four spheres of family life, private life, communication, and the home (Wolford, n.d.). On the other hand, the United States has outlined protections from government interference in the private sphere in the Bill of Rights, has comparatively less (& less encompassing) legislation on the issue, and has relied on the courts to protect people from private entities and in the home (U.S. Constitution; 1787, Amendment 4; Privacy, n.d.). These differences result in a more consistent application of privacy rights in Europe compared to the United States.

In the home, Europeans have had a safe, private space since 1950 (ECHR, 1950), Art. 8(1)). In the United States, this right wasn’t concrete until long after the Supreme Court began ruling on the privacy cases in the mid-1960s (Privacy, n.d.). However, it remains that Americans have a higher expectation of privacy in the home than in a public area (Electronic Surveillance, n.d.). In an extreme example of lack of privacy in the home, Albanians working for the Soviet government did not own anything in their homes – the state owned it all (Lubonja, 2001, 239).

Exceptions to privacy at home include police entering with and, in some cases, without a warrant. New Zealand also utilizes court-issued warrants to prevent officials from entering the home, but if officials are actively preventing a crime, enforcing a law, making an arrest, or aiding in an emergency, they do not need a warrant (Community Law, n.d.). Within the European Union, this warrant can come from a court within any part of the EU’s jurisdiction. The European Evidence Warrant (EEW) allows a warrant issued to gather evidence to be valid across the EU and the European Arrest Warrant (EAW) applies this principle to the arrest of criminals taking exploiting the open borders within the EU (European evidence warrant, 2006; European arrest warrant, n.d.). EEWs can also be used to get cell phone records (The European evidence warrant, 2006). the United States, a customer can ask for those records to be turned over to authorities or authorities can use a subpoena (FCC 2019).

The Prüm Convention demonstrates another aspect of inter-European collaboration in crime-solving efforts, leading to interesting implications for data privacy. Belgium, Austria, the Netherlands, Germany, France, Luxembourg, and Spain all signed this treaty, to which other nations can opt-in, in an effort to increase cross-border security (Prüm Convetion, 2005). At the roots, it allows the parties to ask each other for help solving crimes by sharing data from each nation’s crime database (Walsch, 2008, 86). By not creating an international crime database, each nation is required to ask other nations for the needed data (Walsch, 2008, 86). This method allows the shared data to be governed by each nation’s specific data privacy laws, but it lands in an unregulated grey area after the data transfer (Walsch, 2008, 85). Differences in privacy law become clear when looking at what personal data is collected from people. Some states collect DNA in all criminal cases, others only when the person has been in prison for over two years, and others do not collect DNA at all (Walsch, 2008, 86). In the context of solving international crime, these differences mean some states tend to be more helpful than others.

Resources Community Law. (n.d.). Entry powers: When the police can come into your home. Retrieved Sept. 21, 2021, from https://communitylaw.org.nz/community-law-manual/chapter-31-police-powers/entry-powers-when-the-police-can-come-into-your-home/entry-without-a-warrant-to-prevent-or-investigate-crimes/ Electronic Surveillance. (n.d.). Cornell Law School Legal Information Institute. Retrieved Sept. 20, 2021, from https://www.law.cornell.edu/wex/electronic_surveillance European arrest warrant. (n.d.). European Commission. Retrieved Sept. 21, 2021, from https://ec.europa.eu/info/law/cross-border-cases/judicial-cooperation/types-judicial-cooperation/european-arrest-warrant_en European Convention on Human Rights. Council of Europe. Nov. 4, 1950. https://www.echr.coe.int/documents/convention_eng.pdf European evidence warrant. (2006, June 1). European Commission. Retrieved Sept. 21, 2021, from https://ec.europa.eu/commission/presscorner/detail/en/PRES_06_168 European evidence warrant, The: The acquisition and admissibility of foreign evidence. (n.d.). Academy of European Law. Retrieved Sept. 20, 2021, from https://www.era.int/cgi-bin/cms?_SID=d241949ae554074b1e14fd12b7f05d3f5d1e38df00162723613600&_sprache=en&_bereich=artikel&_aktion=detail&idartikel=121538 Federal Communications Commission (FCC). (2019, Dec. 30). Protecting your privacy: Phone and cable records. https://www.fcc.gov/consumers/guides/protecting-your-privacy Lubonja, F. (2001). Privacy in a totalitarian regime. Social Research 68(1), 237-254. https://www.jstor.org/stable/40971449 Privacy. (n.d.). Cornell Law School Legal Information Institute. Retrieved Sept. 8, 2021, from https://www.law.cornell.edu/wex/privacy Prüm Convention. AT-BE-DE-ES-FR-LU-NL. May 27, 2005. 10900/05. https://ec.europa.eu/anti-fraud/sites/default/files/docs/body/prumtr.pdf U.S. Constitution. Amendment IV. https://www.archives.gov/founding-docs/constitution-transcript Walsch, C. (2008, Nov. 9). Europeanization and democracy: Negotiating the Prum Treaty and the Schengen III Agreement. Politicka Misao, XVL(5), 81-90. Wolford, B. (n.d.). What is GDPR, the EU’s new data protection law? GDPR EU. Retrieved Sept. 9, 2021, from https://gdpr.eu/what-is-gdpr/

Is this right exercised in different ways depending on the political governance regime in place (democracy, autocracy, hybrid regime)?

Rhoda Howard and Jack Donnelly (1986) put forth six regime types: liberal, minimal, traditionalist, communist, corporatist (authoritarian), and developmental. When comparing regime type to the ‘valuation of privacy,’ liberal regimes are ranked highly, and minimal regimes are ranked very highly (Howard & Donnelly, 1986, 814). The other regime types, all communitarian regimes rather than individualistic, were ranked low or very low regarding privacy (Howard & Donnelly, 1986, 814). At their cores, communitarian regimes do not have privacy because it can be argued, as Howard and Donnelly (1986, 211) do, that the allowance of freedoms may lead to self-destruction. Thus, privacy is ignored (Howard & Donnelly, 1986, 211). Fatos Lubonja agrees with this sentiment, writing that privacy did not exist in Albania under the totalitarian regime, and cites his experience in Albanian prisons as an example (Lubonja, 2001). He also admitted to self-censorship in the private diaries which originally got him arrested, supposing many others had censored themselves in the same way (Lubonja, 2001, 247).

Resources Howard, R.E., & Donnelly, J. (1986, Sept.) Human dignity, human rights, and political regimes. The American Political Science Review 80(3), 801-817. https://doi.org/10.2307/1960539 Lubonja, F. (2001). Privacy in a totalitarian regime. Social Research 68(1), 237-254. https://www.jstor.org/stable/40971449

Is there general and widespread belief that this right is a fundamental right that should generally be protected (and that exceptions should be rare)?

The right to privacy is expressed in many places: Article 12 of the Universal Declaration of Human Rights (1948), Article 17 of the International Covenant on Civil and Political Rights (1996), Article 7 of the Charter of Fundamental Rights of the European Union (CFREU) (2009), and Article 8 of the European Convention on Human Rights (ECHR) (1950). Nationally, this right has been cited in the 1988 Brazil Constitution and United States case law (derived from the US Constitution). In India, the Supreme Court ruled unanimously in 2017 that the right to privacy for all people falls under Article 21, which provides the “protection of life and personal liberty” (McCarthy, 2017; Mahaprata & Choudhary, 2017). However, many exceptions to privacy are also listed alongside the right to privacy in these supreme documents, despite the belief in its inviolability.

Article 8(2) of the ECHR provides that privacy interference can only occur in instances “of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.” Article 7 of the CRFEU can be breached by a search or arrest warrant issued by any EU state (European arrest warrant, n.d.; European evidence warrant, 2006). In Article 5 Sections X-XII, the Brazilian Constitution outlines the right to privacy in areas related to private life, the home, and correspondence. These sections also clearly outline exceptions; Section XI recognizes that officials can enter a home “in cases of flagrante delicto, disaster or rescue, or, during the day, with a court order,” and Section XII allows criminal proceedings to methodically breach this privacy. In the United States, privacy zones – derived from the First, Third, Fourth, Fifth, and Ninth Amendments in Griswold v. Connecticut (1965) in conjunction with the Due Process Clause in the Fourteenth Amendment – have extended privacy to Americans in various ways (Privacy, n.d.). Again, a court-issued search or arrest warrant may breach this right to privacy, especially in the home.

Data Privacy

The US has very little data privacy due to a lack of legislation and regard. Most data regulation is due to compliance with the 2018 implementation of the EU’s General Data Protection Regulation, which applies to any company collecting any data on European citizens or companies with a large number of customers based in Europe (Wolford, n.d.). On the other hand, the Brazilian Supreme Court extended these Article 5 protections to data privacy in 2020 (Bioni & Monteiro, 2020). Additionally, New Zealand’s Information Privacy Principles (IPP) in Article 22 of the Privacy Act 2020 protect data collection, but also provides some exceptions in IPP 11 and 12.

Relationships

In 2018, the Indian Supreme Court declared part of Section 377 unconstitutional against Articles 14, 15, 19, and 21 of the Constitution (Rai, 2018). This ruling allowed those in LGBT relationships privacy in the home, but again, this privacy was not granted in public spaces (Rai, 2018). Similarly, the right to a private relationship went through the courts in the United States. First, it was granted to interracial couples in 1967 through Loving v. Virginia (1967) and then to same-sex couples through Obergefell v. Hodges in 2015. In Brazil, relationships are protected under Article 5(X), which states “personal intimacy, private life, honor and reputation are inviolable, guaranteeing the right to compensation for pecuniary or moral damages resulting from the violation thereof” (Brazil Constitution, 1988).

Communication

Private communication is protected under Article 5(XII) of the Brazilian Constitution (1988). In the United States, the right to private communication became convoluted with the 2001 USA PATRIOT ACT, which authorized the interception and disclosure of communication under certain circumstances.

Resources

Bioni, B.R. & Monteiro, R.L. (2020, June 9). A landmark ruling in Brazil: Paving the way for considering data protections as an autonomous fundamental right. Future of Privacy Forum. https://fpf.org/blog/a-landmark-ruling-in-brazil-paving-the-way-for-considering-data-protection-as-an-autonomous-fundamental-right/ Brazil Constitution. (1988). https://www.constituteproject.org/constitution/Brazil_2017.pdf?lang=en Charter of Fundamental Rights of the European Union. Dec. 1, 2009. https://fra.europa.eu/en/eu-charter Constitution of India. (1950). https://legislative.gov.in/constitution-of-india European arrest warrant. (n.d.). European Commission. Retrieved Sept. 21, 2021, from https://ec.europa.eu/info/law/cross-border-cases/judicial-cooperation/types-judicial-cooperation/european-arrest-warrant_en European Convention on Human Rights. Council of Europe. Nov. 4, 1950. https://www.echr.coe.int/documents/convention_eng.pdf European evidence warrant. (2006, June 1). European Commission. Retrieved Sept. 21, 2021, from https://ec.europa.eu/commission/presscorner/detail/en/PRES_06_168

Does public polling reveal insights about the right as experienced in different countries?

Worldwide

A 2018 Deloitte survey has revealed that the EU’s General Data Protection Regulation (GDPR) is having a positive international impact on the perception of data collection and storage even just six months after its implementation (Deloitte, 2018, 4). The GDPR has had a worldwide effect on privacy laws as it requires all companies which collect data on EU citizens to comply with the law, regardless of the location of their headquarters (Wolford, n.d.). At the most basic level, respondents felt companies have begun to care more about data protection (Deloitte, 2018, 6). Additionally, over 3 out of 4 respondents were aware of their rights under this law and some had already used this knowledge to alter what data companies were collecting about them (Deloitte, 2018, 13, 14, 19). On the other hand, 19% of those polled felt that organizations did not care about privacy (Deloitte, 2018, 6) and only 51% felt the law had put them in control of the personal data that companies have access to (Deloitte, 2018, 18).

European Union

In a 2019 European Union (including North Macedonia) study conducted a year after the implementation of the GDPR, the European Commission concurred with Deloitte in that the GDPR had made people more aware of their rights (Vandystadt & Voin, 2019). However, only 20% of these respondents knew which authority was responsible for protecting privacy rights (Vandystadt & Voin, 2019; Awareness of the general data protection regulation, 2019).

United States

In 2002, a Harris Poll found that 63% of respondents found the privacy legislation in place to be inadequate (EPIC, 2021). In 2019, 75% of those surveyed felt the government should regulate companies and their use of personal data (Auxier, 2020). In 2020, 79% of the population wanted national privacy legislation enacted (Auxier, 2020). It is clear that over time, Americans have become more concerned about the use of their personal data, especially in the private sector (Auxier et al., 2019; Auxier, 2020). Despite this fact, the United States has still not enacted sweeping privacy legislation at a national level. At the state level, California was the first state to enact privacy legislation in 2018, and at least nineteen other states have followed suit with the hope that it will signal the federal government to propose some sort of national privacy legislation for ease of compliance (Sabin, 2021). However, Americans seem to be fine with either approach, with polls showing around 70% find their state government to be responsible for this issue and the same percent find the federal government to be responsible (Sabin, 2021).

New Zealand

In 2012, the New Zealand Privacy Commissioner published a privacy study completed by UMR Research. This study found that 90% of people wanted the government to protect their data and be told by companies how their data was being used (Privacy Commissioner, 2012, 9). Interestingly, only 66% were concerned about the presence of their personal data online (Privacy Commissioner, 2012, 12). However, 88% of respondents wanted businesses to be punished if they were using data incorrectly, and 97% wanted the Privacy Commissioner to be able to reprimand companies if they were breaching the then enforceable 1993 Privacy Act (Privacy Commissioner, 2012, 23, 10). Since this study was published, the 1993 Privacy Act has been updated. Now, if an investigation reveals a breach of duty or misconduct, Article 96 of the Privacy Act 2020 requires the Commissioner to refer the matter to authorities, reflecting some of the public’s wants revealed in the 2012 poll.

British Columbia In 2020, Canadian non-profit, Freedom of Information and Privacy Association or FIPA, worked with Ipsos and polled British Columbians surrounding their attitudes regarding privacy law. About half of them were unsure if the current laws were protective enough or admitted they thought current privacy laws were lacking (FIPA, 2020). When asked about the transparency of Canadian companies, 50% felt companies were not open about their data practices and 75% felt that Canadian companies may send their data to non-Canadian companies (FIPA, 2020). However, one-third of respondents from the same study knew British Columbian privacy law and its protections and three-quarters would like a public education initiative to teach these protections (FIPA, 2020).

Resources

Auxier, B. (2020, May 4). How Americans see digital privacy issues amid the COVID-19 outbreak. Pew Research Center. https://www.pewresearch.org/fact-tank/2020/05/04/how-americans-see-digital-privacy-issues-amid-the-covid-19-outbreak/ Auxier, B., Rainie, L., Anderson, M., Perrin, A., Kumar, M., & Turner, E. (2019, Nov. 15). Americans and privacy: Concerned, confused, and feeling lack of control over their personal information. Pew Research Center. https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/ Awareness of the general data protection regulation – one year on. (2019). European Commission. https://europa.eu/eurobarometer/surveys/detail/2222 Deloitte. (2018). A new era for privacy: GDPR six months on. https://www2.deloitte.com/content/dam/Deloitte/uk/Documents/risk/deloitte-uk-risk-gdpr-six-months-on.pdf Electronic Privacy Information Center (EPIC). (2021). Public opinion on privacy. https://epic.org/privacy/survey/ FIPA. (2020, June 4). British Columbians want action on privacy protection: Polling results. https://fipa.bc.ca/2020-privacy-poll/ Privacy Act 2020, 2020 No. 31, (2021). https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.html Privacy Commissioner. (2012, Apr.). UMR omnibus results. https://www.privacy.org.nz/assets/Files/Surveys/Privacy-Commission-UMR-Omni-Results-Apr-2012.pdf Sabin, S. (2021, Apr. 27). States are moving on privacy bills. Morning Consult. https://morningconsult.com/2021/04/27/state-privacy-congress-priority-poll/ Vandystadt, N., & Voin, M. (2019, July 24). GDPR shows results, but work needs to continue. European Commission. https://europa.eu/eurobarometer/api/deliverable/download/file?deliverableId=69715 Wolford, B. (n.d.). What is GDPR, the EU’s new data protection law? GDPR EU. Retrieved Sept. 9, 2021, from https://gdpr.eu/what-is-gdpr/

Limitations / Restrictions

What are the typical exceptions or limitations placed on this right?

Article 8(2) of the European Convention on Human Rights (ECHR) presents exceptions to the right to privacy. Privacy is granted “except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others” (1950). The Universal Declaration on Human Rights (1948) and the International Covenant on Civil and Political Rights (1996) allow for reasonable, non-arbitrary searches. These exceptions allow privacy to be breached with a court-issued warrant. Most exceptions stem from these documents and it should be noted that the United Nations extended the right to privacy to online spheres (Office of the United Nations High Commissioner for Human Rights, 2013, I§5). Additionally, the European Union implemented the General Data Protection Regulation (GDPR) which prevents the sharing of personal data with outside sources (Wolford, n.d.). The GDPR applies to any companies operating in or with the EU causing it to have international implications (Wolford, n.d.).

Resources

European Convention on Human Rights. Council of Europe. Nov. 4, 1950. https://www.echr.coe.int/documents/convention_eng.pdf International Covenant on Civil and Political Rights. United Nations General Assembly (UNGA). Dec. 16, 1996. https://www.ohchr.org/en/professionalinterest/pages/ccpr.aspx Office of the United Nations High Commissioner for Human Rights. (2014, June 30). The right to privacy in the digital age. A/HRC/27/37. https://www.ohchr.org/EN/HRBodies/HRC/RegularSessions/Session27/Documents/A.HRC.27.37_en.pdf United States Constitution. 1787. https://www.senate.gov/civics/constitution_item/constitution.htm Universal Declaration on Human Rights. UNGA. Dec. 10, 1948. https://www.un.org/en/about-us/universal-declaration-of-human-rights Wolford, B. (n.d.). What is GDPR, the EU’s new data protection law? GDPR EU. Retrieved Sept. 9, 2021, from https://gdpr.eu/what-is-gdpr/

Under American jurisprudence, what permissible exceptions exist?

The Fourth Amendment states “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized” (1791). While this amendment protects the right to privacy from the government, it also brings forth exceptions: reasonable search and seizure as well as infringements allowed by court-issued warrants seeking specific items or people. Other amendments used to extend privacy by the Supreme Court, namely the First, Third, Fifth, Ninth, and Fourteenth, do not have notable exceptions regarding privacy.

Limitations of Reasonability

Defining what constitutes a reasonable search has proven to be difficult. In Katz v. United States (1967) the Supreme Court ruled the Fourth Amendment protects “people, not places” and created the Katz test to determine where it is reasonable to expect privacy from law enforcement and a warrant is needed (Katz v. United States, 1967). This test examines whether the information was meant to be kept private and if it had been disclosed (Hu, 2018, 129). Prior to the Katz test, the court used the trespass test, a common-law approach to the Fourth Amendment in which physical intrusion can violate the Fourth Amendment. Fifty years after Katz, the Court again relied on the trespass test in United States v. Jones (Hu, 2018, 130; United States v. Jones, 2012). In doing so, the court claimed while the Katz test extended the right to privacy to people, it did not revoke the traditional common-law protections (United States v. Jones, 2012). Hu, citing Justices Sotomayor and Alito, feels that the Katz test ends before cyber-surveillance begins and recognizes the need for change (Hu, 2018, 139, 141).

In analyzing Fourth Amendment Supreme Court rulings, Orin Kerr found that four general models have been used to decide privacy cases (2017, 524). These models vary in scale (micro or macro) and normativity (normative or descriptive) and consider one of the following: how public the information is, what information was found, the actions that were taken, or whether or not government conduct should be regulated (Kerr, 2017, 506, 524). Karr claims the last of these considerations was the basis for the Katz ruling (2017, 519). Unfortunately, the Supreme Court has used all four of these models to both protect and deny privacy and has not provided clear guidance as to what is a reasonable search (Ker, 2017, 507, 508). Kerr concludes by suggesting there is no one size fits all test or model because of the importance of case facts (2017, 525). As such, Kerr would rather see many definitive models so that the limitations of reasonability are clear and contextualized for future court decisions at all levels (2017, 542).

Privacy Violations by a Non-Government Entity

The Supreme Court has rarely ruled on notable cases in which the privacy offender was not a government entity. However, in Senn v. Tile Layers Protective Union (1937) the Court ruled that Senn could not invoke his privacy in work against the right to publicity of the union’s picketing (Richards, 1334). In the opinion of the Court, Justice Brandeis held that because it was a commercial dispute and affected the competition for customers, the right to privacy was not applicable (Richards, 1334). He also protected counter-speech in this opinion (Richards, 1334).