Privacy and the Limits of Law
|
Anyone who studies the law of privacy today may Avell feel a sense of uneasiness. On one hand, there are popular demands for increased protection of privacy, discussions of new threats to privacy, and an intensified interest in the relationship between privacy and other values, such as liberty, autonomy, and mental health.1 These demands have generated a variety of legal responses. Most states recognize a cause of action for invasions of privacy.2
The Supreme Court has declared a constitutional right to privacy, a right broad enough to protect abortion and the use of contraceptives.3 Congress enacted the Privacy Act of 19744 after long hearings and debate. These activities5 seem to imply a wide consensus concerning the distinctness and importance of privacy.
On the other hand, much of the scholarly literature on privacy is written in quite a different spirit. Commentators have argued that privacy rhetoric is misleading: when we study the cases in which the law (or our moral intuitions) suggests that a "right to privacy" has been violated, we always find that some other interest has been involved." Consequently, they argue, our understanding of privacy will be improved if we disregard the rhetoric, look behind the decisions, and identify the real interests protected. When we do so, they continue, we can readily see why privacy itself is never protected: to the extent that there is something distinct about claims for privacy, they are either indications of hypersensitivity7 or an unjustified wish to manipulate and defraud.8 Although these commentators disagree on many points, they are united in denying the utility of thinking and talking about privacy as a legal right, and suggest some form of reductionism.9
This Article is an attempt to vindicate the way most of us think and talk about privacy issues: unlike the reductionists, most of us consider privacy to be a useful concept. To be useful, however, the concept must denote something that is distinct and coherent. Only then can it help us in thinking about problems. Moreover, privacy must have coherence in three different contexts. First, we must have a neutral concept of privacy that will enable us to identify when a loss of privacy has occurred so that discussions of privacy and claims of privacy can be intelligible. Second, privacy must have coherence as a value, for claims of legal protection of privacy are compelling only if losses of privacy are sometimes undesirable and if those losses are undesirable for similar reasons. Third, privacy must be a concept useful in legal contexts, a concept that enables us to identify those occasions calling for legal protection, because the law does not interfere to protect against every undesirable event.
Our everyday speech suggests that we believe the concept of privacy is indeed coherent and useful in the three contexts, and that losses of privacy (identified by the first), invasions of privacy (identified by the second), and actionable violations of privacy (identified by the third) are related in that each is a subset of the previous category. Using the same word in all three contexts reinforces the belief that they are linked. Reductionist analyses of privacy—that is, analyses denying the utility of privacy as a separate concept—sever these conceptual and linguistic links. This Article is an invitation to maintain those links, because an awareness of the relationships and the larger picture suggested by them may contribute to our understanding both of legal claims for protection, and of the extent to which those claims have been met.10
I begin by suggesting that privacy is indeed a distinct and coherent concept in all these contexts. Our interest in privacy, I argue, is related to our concern over our accessibility to others: the extent to which we are known to others, the extent to which others have physical access to us, and the extent to which we are the subject of others' attention. This concept of privacy as a concern for limited accessibility enables us to identify when losses of privacy occur. Furthermore, the reasons for which we claim privacy in different situations are similar. They are related to the functions privacy has in our lives: the promotion of liberty, autonomy, selfhood, and human relations, and furthering the existence of a free society.11 The coherence of privacy as a concept and the similarity of the reasons for regarding losses of privacy as undesirable support the notion that the legal system should make an explicit commitment to privacy as a value that should be considered in reaching legal results. This analysis does not require that privacy be protected in all cases; that result would require consideration of many factors not discussed here. I argue only that privacy refers to a unique concern that should be given weight in balancing values.
My analysis of privacy yields a better description of the law and a deeper understanding of both the appeal of the reductionist approach and its peril. The appeal lies in the fact that it highlights an important fact about the state of the law—privacy is seldom protected in the absence of some other interest. The danger is that we might conclude from this fact that privacy is not an important value and that losses of it should not feature as considerations for legal protection. In view of the prevalence of the reductionist view, the case for an affirmative and explicit commitment to privacy—vindicating the antireductionist perspective—becomes compelling.
I. The Meaning and Functions of Privacy
"Privacy" is a term used with many meanings. For my purposes, two types of questions about privacy are important. The first relates to the status of the term: is privacy a situation, a right, a claim, a form of control, a value? The second relates to the characteristics of privacy: is it related to information, to autonomy, to personal identity, to physical access? Support for all of these possible answers, in almost any combination, can be found in the literature.12
The two types of question involve different choices. Before resolving these issues, however, a general distinction must be drawn between the concept and the value of privacy. The concept of privacy identifies losses of privacy. As such, it should be neutral and descriptive only, so as not to preempt questions we might want to ask about such losses. Is the loser aware of the loss? Has he consented to it? Is the loss desirable? Should the law do something to prevent or punish such losses?
This is not to imply that the neutral concept of privacy is the most important, or that it is only legitimate to use "privacy" in this sense. Indeed, in the context of legal protection, privacy should also indicate a value. The coherence and usefulness of privacy as a value is due to a similarity one finds in the reasons advanced for its protection, a similarity that enables us to draw principles of liability for invasions.13 These reasons identify those aspects of privacy that are considered desirable. When we claim legal protection for privacy, we mean that only those aspects should be protected, and we no longer refer to the "neutral" concept of privacy. In order to see which aspects of privacy are desirable and thus merit protection as a value, however, we must begin our inquiry in a non-preemptive way by starting with a concept that does not make desirability, or any of the elements that may preempt the question of desirability, part of the notion of privacy. The value of privacy can be determined only at the conclusion of discussion about what privacy is, and when—and why—losses of privacy are undesirable.14
In this section I argue that it is possible to advance a neutral concept of privacy, and that it can be shown to serve important functions that entitle it to prima facie legal protection. The coherence of privacy in the third context—as a legal concept—relies on our understanding of the functions and value of privacy; discussion of the way in which the legal system should consider privacy is therefore deferred until later sections.15
A. The Neutral Concept of Privacy
1. The Status of Privacy
The desire not to preempt our inquiry about the value of privacy by adopting a value-laden concept at the outset is sufficient to justify viewing privacy as a situation of an individual vis-à-vis others, or as a condition of life. It also requires that we reject attempts to describe privacy as a claim,16 a psychological state,17 or an area that should not be invaded.18 For the same reasons, another description that should be rejected is that of privacy as a form of control.18
This last point requires some elaboration, because it may appear that describing privacy as a form of control does not preempt important questions. Were privacy described in terms of control, for example, we could still ask whether X has lost control, and whether such loss is desirable. The appearance of a non-preemptive concept is misleading, however, and is due to an ambiguity in the notion of control. Hyman Gross, for example, defines privacy as "control over acquaintance with one's personal affairs."20 According to one sense of this definition, a voluntary, knowing disclosure does not involve loss of privacy because it is an exercise of control, not a loss of it.21 In another, stronger sense of control, however, voluntary disclosure is a loss of control because the person who discloses loses the power to prevent others from further disseminating the information.
There are two problems here. The weak sense of control is not sufficient as a description of privacy, for X can have control over whether to disclose information about himself, yet others may have information and access to him through other means. The strong sense of control, on the other hand, may indicate loss of privacy when there is only a threat of such loss.22 More important, "control" suggests that the important aspect of privacy is the ability to choose it and see that the choice is respected. All possible choices are consistent with enjoyment of control, however, so that defining privacy in terms of control relates it to the power to make certain choices rather than to the way in which we choose to exercise this power. But individuals may choose to have privacy or to give it up.23 To be non-preemptive, privacy must not depend on choice. We need a framework within which privacy may be the result of a specific exercise of control, as when X decides not to disclose certain information about himself, or the result of something imposed on an individual against his wish, as when the law prohibits the performance of sexual intercourse in a public place. Furthermore, the reasons we value privacy may have nothing to do with whether an individual has in fact chosen it. Sometimes we may be inclined to criticize an individual for not choosing privacy, and other times for choosing it. This criticism cannot be made if privacy is defined as a form of control.
Insisting that we start with a neutral concept of privacy does not mean that wishes, exercises of choice, or claims are not important elements in the determination of the aspects of privacy that are to be deemed desirable or of value. This insistence does mean, however, that we are saying something meaningful, and not merely repeating the implications of our concept, if we conclude that only choices of privacy should be protected by law.
Resolving the status of privacy is easier than resolving questions concerning the characteristics of privacy. Is privacy related to secrecy, freedom of action, sense of self, anonymity, or any specific combination of these elements? The answers here are not constrained by methodological concerns. The crucial test is the utility of the proposed concept in capturing the tenor of most privacy claims, and in presenting coherent reasons for legal protection that will justify grouping these claims together. My conception of privacy as related to secrecy, anonymity, and solitude is defended in these terms.
2. The Characteristics of Privacy
In its most suggestive sense, privacy is a limitation of others' access to an individual. As a methodological starting point, I suggest that an individual enjoys perfect privacy when he is completely inaccessible to others.24 This may be broken into three independent components: in perfect privacy no one has any information about X, no one pays any attention to X, and no one has physical access to X. Perfect privacy is, of course, impossible in any society. The possession or enjoyment of privacy is not an all or nothing concept, however, and the total loss of privacy is as impossible as perfect privacy. A more important concept, then, is loss of privacy. A loss of privacy occurs as others obtain information about an individual, pay attention to him, or gain access to him. These three elements of secrecy, anonymity, and solitude are distinct and independent, but interrelated, and the complex concept of privacy is richer than any definition centered around only one of them. The complex concept better explains our intuitions as to when privacy is lost, and captures more of the suggestive meaning of privacy. At the same time, it remains sufficiently distinctive to exclude situations that are sometimes labeled "privacy," but that are more related to notions of accountability and interference than to accessibility.
a. Information Known About an Individual
It is not novel to claim that privacy is related to the amount of information known about an individual. Indeed, many scholars have defined privacy exclusively in these terms,25 and the most lively privacy issue now discussed is that related to information-gathering. Nevertheless, at least two scholars have argued that there is no inherent loss of privacy as information about an individual becomes known.20 I believe these critics are wrong. If secrecy is not treated as an independent element of privacy, then the following are only some of the situations that will not be considered losses of privacy: (a) an estranged wife who publishes her husband's love letters to her, without his consent; (b) a single data-bank containing all census information and government files that is used by all government officials;27 and (c) an employer who asks every conceivable question of his employees and yet has no obligation to keep the answers confidential. In none of these cases is there any intrusion, trespass, falsification, appropriation, or exposure of the individual to direct observation. Thus, unless the amount of information others have about an individual is considered at least partly determinative of the degree of privacy he has, these cases cannot be described as involving losses of privacy.
To talk of the "amount of information" known about an individual is to imply that it is possible to individuate items or pieces of information, to determine the number of people who know each item of information about X, and thus to quantify the information known about X. In fact, this is impossible, and the notion requires greater theoretical elaboration than it has received until now. It is nevertheless used here because in most cases its application is relatively clear. Only a few of the many problems involved need to be mentioned.
The first problem is whether we should distinguish between different kinds of knowledge about an individual, such as verbal as opposed to sensory knowledge, or among different types of sensory knowledge. For example, assume Y learns that X is bald because he reads a verbal description of X. At a later time, Y sees X and, naturally, observes that X is bald. Has Y acquired any further information about X, and if so, what is it? It might be argued that even a rereading of a verbal description may reveal to Y further information about X, even though Y has no additional source of information.28
A related set of problems arises when we attempt to compare different "amounts" of knowledge about the same individual. Who has more information about X, his wife after fifteen years of marriage, his psychiatrist after seven years of analysis, or the biographer who spends four years doing research and unearths details about X that are not known either to the wife or to the analyst?39
A third set of problems is suggested by the requirement that for a loss of privacy to occur, the information must be "about" the individual. First, how specific must this relationship be? We know that most people have sexual fantasies and sexual relationships with others. Thus, we almost certainly "know" that our new acquaintances have sexual fantasies, yet they do not thereby suffer a loss of privacy. On the other hand, if we have detailed information about the sexual lives of a small number of people, and we are then introduced to one of them, does the translation of the general information into personal information about this person involve a loss of privacy? Consider the famous anecdote about the priest who was asked, at a party, whether he had heard any exceptional stories during confessionals. "In fact," the priest replied, "my first confessor is a good example, since he confessed to a murder." A few minutes later, an elegant man joined the group, saw the priest, and greeted him warmly. When asked how he knew the priest, the man replied: "Why, I had the honor of being his first confessor."
The priest gave an "anonymous" piece of information, which became information "about" someone through the combination of the anonymous statement with the "innocent" one made by the confessor. Only the later statement was "about" a specific individual, but it turned what was previously an anonymous piece of information into further information "about" the individual. The translation here from anonymous information to information about X is immediate and unmistakable, but the process is similar to the combination of general knowledge about a group of people and the realization that a certain individual is a member of that group.30
Problems of the relationship between an individual and pieces of information exist on another level as well. Is information about X's wife, car, house, parents, or dog information about X? Clearly, this is information about the other people, animals, or things involved, but can X claim that disclosure of such information is a loss of his privacy? Such claims have often been made.31 Their plausibility in at least some of the cases suggests that people's notions of themselves may extend beyond their physical limits.32
A final set of problems concerns the importance of the truth of the information that becomes known about an individual. Does dissemination of false information about X mean that he has lost privacy? The usual understanding of "knowledge" presupposes that the information is true, but is this sense of "knowledge" relevant here? In one sense, X has indeed lost privacy. People now believe they know more about him. If the information is sufficiently spectacular, X may lose his anonymity and become the subject of other people's attention.33 In another sense, however, X is not actually "known" any better. In fact, he may even be known less, because the false information may lead people to disregard some correct information about X that they already had.34 Another difficulty is revealed when we consider statements whose truth is not easily determinable, such as "X is beautiful" or "X is dumb and irresponsible." Publication of such statements clearly leads to some loss of privacy: listeners now know what the speaker thinks about X, and this itself is information about X (as well as about the speaker). But does the listener also know that X is indeed beautiful? This is hard to tell.35
b. Attention Paid to an Individual
An individual always loses privacy when he becomes the subject of attention. This will be true whether the attention is conscious and purposeful, or inadvertent. Attention is a primary way of acquiring information, and sometimes is essential to such acquisition, but attention alone will cause a loss of privacy even if no new information becomes known. This becomes clear when we consider the effect of calling, "Here is the President," should he attempt to walk the streets incognito. No further information is given, but none is necessary. The President loses whatever privacy his temporary anonymity could give him. He loses it because attention has focused on him.
Here too, however, some elaboration is needed. X may be the subject of Y's attention in two typical ways.36 First, Y may follow X, stare at him, listen to him, or observe him in any other way. Alternatively, Y may concentrate his thoughts on X. Only the first way of paying attention is directly related to loss of privacy. Discussing, imagining, or thinking about another person is related to privacy in a more indirect way, if at all. Discussions may involve losses of privacy by communicating information about a person or by creating an interest in the person under discussion that may itself lead to more attention. Thinking about a person may also produce an intensified effort to recall or obtain information about him. This mental activity may in turn produce a loss of privacy if new information is obtained. For the most part, however, thinking about another person, even in the most intense way, will involve no loss of privacy to the subject of this mental activity. The favorite subject of one's sexual fantasies may have causes for complaint, but it is unlikely that these will be related to loss of privacy.37
c. Physical Access to an Individual
Individuals lose privacy when others gain physical access to them. Physical access here means physical proximity—that Y is close enough to touch or observe X through normal use of his senses. The ability to watch and listen, however, is not in itself an indication of physical access, because Y can watch X from a distance or wiretap X's telephone. This explains why it is much easier for X to know when Y has physical access to him than when Y observes him.
The following situations involving loss of privacy can best be understood in terms of physical access: (a) a stranger who gains entrance to a woman's home on false pretenses in order to watch her giving birth;38 (b) Peeping Toms; (c) a stranger who chooses to sit on "our" bench, even though the park is full of empty benches; and (d) a move from a single-person office to a much larger one that must be shared with a colleague. In each of these cases, the essence of the complaint is not that more information about us has been acquired, nor that more attention has been drawn to us, but that our spatial aloneness has been diminished.39
d. Relations Among the Three Elements
The concept of privacy suggested here is a complex of these three independent and irreducible elements: secrecy, anonymity, and solitude.40
Each is independent in the sense that a loss of privacy may occur through a change in any one of the three, without a necessary loss in either of the other two. The concept is nevertheless coherent because the three elements are all part of the same notion of accessibility, and are related in many important ways. The three elements may coexist in the same situation. For example, the psychiatrist who sits next to his patient and listens to him acquires information about the patient,41 pays attention to him, and has physical access to him. At the same time, none of the three elements is the necessary companion of the other two.
Information about X may of course be acquired by making X the subject of r's attention. When Y follows, watches, or observes X in any way, he increases the likelihood of acquiring information about X. Similarly, when Y is in physical proximity to X, he has an opportunity to observe and thus obtain information about X. Nevertheless, information about X may be obtained when Y has no physical access to X, and when X is not the subject of Y's attention. It is possible to learn information about an individual by questioning his friends and neighbors, and thus without observing the individual or being in his physical proximity. It is also possible to learn information about an individual entirely by accident, when the individual is not even the subject of attention.42
Attention may be paid to X without learning new information about him. The mother who follows her child in order to make sure the child does not harm himself is not interested in gaining new information about the child, nor will she necessarily obtain any new information. Pointing X out in a crowd will increase the attention paid to X, even in the absence of any physical proximity.
Finally, an individual can be in physical proximity to others without their paying attention or learning any new information about him. Two people may sit in the same room without paying any attention to each other, and yet each will experience some loss of privacy.
The interrelations between the three elements may be seen when we consider the different aspects of privacy that may be involved in one situation. For instance, police attempt to learn of plans to commit crimes. Potential criminals may raise a privacy claim concerning this information, but are unlikely to gain much support. The criminal's desire that information about his plans not be known creates a privacy claim, but not a very convincing one. We might be more receptive, however, to another privacy claim that criminals might make concerning attention and observation, or the opportunity to be alone. If constant surveillance were the price of efficient law enforcement, we might feel the need to rethink the criminal law. The fact that these are two independent claims suggests that concern for the opportunity to have solitude and anonymity is related not only to the wish to conceal some kinds of information, but also to needs such as relaxation, concentration, and freedom from inhibition.43
Yet another privacy concern emerges when we talk about the right against self-incrimination. Again, the essence of the concern is not simply the information itself; we do not protect the suspect against police learning the information from other sources. Our concern relates to the way the information is acquired: it is an implication of privacy that individuals should not be forced to give evidence against themselves. Similarly, evidentiary privileges that may also be defended in terms of privacy do not reflect concern about the information itself. The concern here is the existence of relationships in which confidentiality should be protected, so that the parties know that confidences shared in these relationships will not be forced out. In some cases, disclosure will not be sought, and in others the law may even impose a duty against disclosure.
The irreducibility of the three elements may suggest that the complex concept of privacy lacks precision, and that we would do better to isolate each of the different concerns and discuss separately what the law should do to protect secrecy, anonymity, and solitude. Such isolation may indeed be fruitful for some purposes.44 At present, however, the proposed concept suggests a coherent concern that is generally discussed in extra-legal contexts as "privacy." It therefore seems justified to prefer the complex notion of accessibility to the loss of richness in description that would result from any more particularistic analysis.
e. What Privacy Is Not
The neutral concept of privacy presented here covers such "typical" invasions of privacy as the collection, storage, and computerization of information; the dissemination of information about individuals; peeping, following, Avatching, and photographing individuals; intruding or entering "private" places; eavesdropping, wiretapping, reading of letters; drawing attention to individuals; required testing of individuals; and forced disclosure of information. At the same time, a number of situations sometimes said to constitute invasions of privacy will be seen not to involve losses of privacy per se under this concept. These include exposure to unpleasant noises, smells, and sights; prohibitions of such conduct as abortions, use of contraceptives, and "unnatural" sexual intercourse; insulting, harassing, or persecuting behavior; presenting individuals in a "false light"; unsolicited mail and unwanted phone calls; regulation of the way familial obligations should be discharged; and commercial exploitation.45 These situations are all described as "invasions of privacy" in the literature, presumably indicating some felt usefulness in grouping them under the label of "privacy," and thus an explanation of the reasons for excluding these cases from my argument seems appropriate. Such an explanation may also clarify the proposed analysis and its methodological presuppositions.
The initial intuition is that privacy has to do with accessibility to an individual, as expressed by the three elements of information-gathering, attention, and physical access, and that this concept is distinct. It is part of this initial intuition that we want and deem desirable many things, and that we lose more than we gain by treating all of them as the same thing.46 If the concepts we use give the appearance of differentiating concerns without in fact isolating something distinct, we are likely to fall victims to this false appearance and our chosen language will be a hindrance rather than a help. The reason for excluding the situations mentioned above, as well as those not positively identified by the proposed analysis, is that they present precisely such a danger.47
There is one obvious way to include all the so-called invasions of privacy under the term. Privacy can be defined as "being let alone," using the phrase often attributed—incorrectly—to Samuel Warren and Louis Brandeis.48 The great simplicity of this definition gives it rhetorical force and attractiveness, but also denies it the distinctiveness that is necessary for the phrase to be useful in more than a conclusory sense. This description gives an appearance of differentiation while covering almost any conceivable complaint anyone could ever make.49 A great many instances of "not letting people alone" cannot readily be described as invasions of privacy. Requiring that people pay their taxes or go into the army, or punishing them for murder, are just a few of the obvious examples.
For similar reasons, we must reject Edward Bloustein's suggestion that the coherence of privacy lies in the fact that all invasions are violations of human dignity.50 We may well be concerned with invasions of privacy, at least in part, because they are violations of dignity.51 But there are ways to offend dignity and personality that have nothing to do with privacy. Having to beg or sell one's body in order to survive are serious affronts to dignity, but do not appear to involve loss of privacy.52
To speak in privacy terms about claims for noninterference by the state in personal decisions is similar to identifying privacy with "being let alone." There are two problems with this tendency. The first is that the typical privacy claim is not a claim for noninterference by the state at all. It is a claim for state interference in the form of legal protection against other individuals, and this is obscured when privacy is discussed in terms of noninterference with personal decisions.53 The second problem is that this conception excludes from the realm of privacy all claims that have nothing to do with highly personal decisions, such as an individual's unwillingness to have a file in a central data-bank.54 Moreover, identifying privacy as noninterference with private action, often in order to avoid an explicit return to "substantive due process,"55 may obscure the nature of the legal decision and draw attention away from important considerations.56 The limit of state interference with individual action is an important question that has been with us for centuries. The usual terminology for dealing with this question is that of "liberty of action." It may well be that some cases pose a stronger claim for noninterference than others, and that the intimate nature of certain decisions affects these limits. This does not justify naming this set of concerns "privacy," however. A better way to deal with these issues may be to treat them as involving questions of liberty, in which enforcement may raise difficult privacy issues.57
Noxious smells and other nuisances are described as problems of privacy because of an analogy with intrusion. Outside forces that enter private zones seem similar to invasions of privacy. There are no good reasons, however, to expect any similarity between intrusive smells or noises and modes of acquiring information about or access to an individual.58
Finally, some types of commercial exploitation are grouped under privacy primarily because of legal history: the first cases giving a remedy for unauthorized use of a name or picture, sometimes described as invasions of privacy,59 usually involved commercial exploitation.60 The essence of privacy is not freedom from commercial exploitation, however. Privacy can be invaded in ways that have nothing to do with such exploitation, and there are many forms of exploitation that do not involve privacy even under the broadest conception.61 The use of privacy as a label for protection against some forms of commercial exploitation is another unfortunate illustration of the confusions that will inevitably arise if care is not taken to follow an orderly conceptual scheme.62
B. The Functions of Privacy
In any attempt to define the scope of desirable legal protection of privacy, we move beyond the neutral concept of "loss of privacy," and seek to describe the positive concept that identifies those aspects of privacy that are of value. Identifying the positive functions of privacy is not an easy task. We start from the obvious fact that both perfect privacy and total loss of privacy are undesirable. Individuals must be in some intermediate state—a balance between privacy and interaction— in order to maintain human relations, develop their capacities and sensibilities, create and grow, and even to survive. Privacy thus cannot be said to be a value in the sense that the more people have of it, the better. In fact, the opposite may be true.63 In any event, my purpose here is not to determine the proper balance between privacy and interaction; I want only to identify the positive functions that privacy has in our lives. From them we can derive the limits of the value of privacy, and then this value can be balanced against others.
The best way in which to understand the value of privacy is to examine its functions. This approach is fraught with difficulties, however. These justifications for privacy are instrumental, in the sense that they point out how privacy relates to other goals. The strength of instrumental justifications depends on the extent to which other goals promoted by privacy are considered important, and on the extent to which the relationship between the two is established. In most cases, the link between the enjoyment of privacy and other goals is at least partly empirical, and thus this approach raises all the familiar problems of social science methodology.
Two possible ways to avoid these difficulties should be discussed before I proceed further. One approach rests the desirability of privacy on a want-satisfaction basis, and the other argues that privacy is an ultimate value. The want-satisfaction argument posits the desirability of satisfying wishes and thus provides a reason to protect all wishes to have privacy.64 It does not require empirical links between privacy and other goals. Moreover, the notion that choice should be respected is almost universally accepted as a starting point for practical reasoning.85 The want-satisfaction argument cannot carry us very far, however. It does not explain why we should prefer X's wish to maintain his privacy against F's wish to pry or acquire information. Without explaining why wishes for privacy are more important than wishes to invade it, the want-satisfaction principle alone cannot support the desirability of privacy. Indeed, some wishes to have privacy do not enjoy even prima facie validity. The criminal needs privacy to complete his offense undetected, the con artist needs it to manipulate his victim; we would not find the mere fact that they wish to have privacy a good reason for protecting it. The want-satisfaction principle needs a supplement that will identify legitimate reasons for which people want and need privacy. This is the task undertaken by an instrumental inquiry. These reasons will identify the cases in which wishes to have privacy should override wishes to invade it. They will also explain why in some cases we say that people need privacy even though they have not chosen it.66 Thus, these instrumentalist reasons will explain the distinctiveness of privacy.
The attractiveness of the argument that privacy is an ultimate value lies in the intuitive feeling that only ultimate values are truly important, and in the fact that claims that a value is ultimate are not vulnerable to the empirical challenges that can be made to functional analyses.67 But these claims also obscure the specific functions of privacy. They prevent any discussion with people who do not share the intuitive belief in the importance of privacy. Given the current amount of skeptical commentary, such claims are bound to raise more doubts than convictions about the importance and distinctiveness of privacy.
Thus it appears that we cannot avoid a functional analysis. Such an analysis presents an enormous task, for the values served by privacy are many and diverse. They include a healthy, liberal, democratic, and pluralistic society; individual autonomy; mental health; creativity; and the capacity to form and maintain meaningful relations with others. These goals suffer from the same conceptual ambiguities that we have described for privacy, which makes it difficult to formulate questions for empirical research and very easy to miss the relevant questions. More important, the empirical data is not only scant, it is often double-edged. The evaluation of links between privacy and other values must therefore be extremely tentative. Nevertheless, much can be gained by identifying and examining instrumental arguments for privacy; this is the indispensable starting point for any attempt to make sense o£ our concern with privacy, and to expose this concern to critical examination and evaluation.
It is helpful to start by seeking to identify those features of human life that would be impossible—or highly unlikely—without some privacy. Total lack of privacy is full and immediate access, full and immediate knowledge, and constant observation of an individual. In such a state, there would be no private thoughts, no private places, no private parts. Everything an individual did and thought would immediately become known to others.
There is something comforting and efficient about total absence of privacy for all.68 A person could identify his enemies, anticipate dangers stemming from other people, and make sure he was not cheated or manipulated. Criminality would cease, for detection would be certain, frustration probable, and punishment sure. The world would be safer, and as a result, the time and resources now spent on trying to protect ourselves against human dangers and misrepresentations could be directed to other things.
This comfort is fundamentally misleading, however. Some human activities only make sense if there is some privacy. Plots and intrigues may disappear, but with them would go our private diaries, intimate confessions, and surprises. We would probably try hard to suppress our daydreams and fantasies once others had access to them. We would try to erase from our minds everything we would not be willing to publish, and we would try not to do anything that would make us likely to be feared, ridiculed, or harmed. There is a terrible flatness in the person who could succeed in these attempts. We do not choose against total lack of privacy only because we cannot attain it, but because its price seems much too high.69
In any event, total lack of privacy is unrealistic. Current levels of privacy are better in some ways, because we all have some privacy that cannot easily be taken from us.70 The current state is also worse in some ways, because enjoyment of privacy is not equally distributed and some people have more security and power as a result. The need to protect privacy thus stems from two kinds of concern. First, in some areas we all tend to have insufficient amounts of privacy. Second, unequal distribution of privacy may lead to manipulation, deception, and threats to autonomy and democracy.71
Two clusters of concerns are relevant here. The first relates to our notion of the individual, and the kinds of actions we think people should be allowed to take in order to become fully realized. To this cluster belong the arguments linking privacy to mental health, autonomy, growth, creativity, and the capacity to form and create meaningful human relations. The second cluster relates to the type of society we want. First, we want a society that will not hinder individual attainment of the goals mentioned above. For this, society has to be liberal and pluralistic. In addition, we link a concern for privacy to our concept of democracy.
Inevitably, the discussion of functions that follows is sketchy and schematic. My purpose is to point out the many contexts in which privacy may operate, not to present full and conclusive arguments.
1. Privacy and the Individual
Functional arguments depend on a showing that privacy is linked to the promotion of something else that is accepted as desirable. In order to speak about individual goals, we must have a sense of what individuals are, and what they can and should strive to become. We do not have any one such picture, of course, and certainly none that is universally accepted. Nonetheless, privacy may be linked to goals such as creativity, growth, autonomy, and mental health that are accepted as desirable by almost all such theories, yet in ways that are not dictated by any single theory. This may give functional arguments for privacy an eclectic appearance, but it may also indicate the strength of these arguments. It appears that privacy is central to the attainment of individual goals under every theory of the individual that has ever captured man's imagination.72 It also seems that concern about privacy is evidenced in all societies, even those with few opportunities for physical privacy.73 Because we have no single theory about the nature of the individual and the way in which individuals relate to others, however, it should be recognized that the way in which we perceive privacy contributing to individual goals will itself depend on the theory of the individual that we select.
In the following discussion, I will note where a difference in perspective may dictate different approaches or conclusions. These different perspectives relate to theories of human growth, development, and personality. It is easy to see that different answers to questions such as the following may yield different arguments for privacy: Is there a "real self" that can be known? 74 If there is, is it coherent and always consistent? If not, can we identify one that is better, and that we should strive to realize? Are human relations something essential, or a mere luxury? Should they ideally be based on full disclosure and total frankness? Or is this a misguided ideal, not only a practical impossibility? 75
a. Contextual Arguments