I started this series back in May with my first post on this topic. Given the whole summer has already gone by, let me repeat my introduction:
“The time for a national discussion of our right to privacy and what that really means is long overdue. I will try to contribute to that discussion in a series of posts on digital privacy. Particular points I will discuss include the following:
- That the right to privacy has already been established as a constitutional right;
- That technology assisted statistics has already made protecting and hiding your personal identity and personal identification information impossible;
- That the data that is collected on you in database warehouses around the globe is and ought to be yours and yours alone to surrender, no matter how it was collected;
- That the economic size and scale of companies such as Google renders “opting out” impractical and our laws ought to recognize that reality;
- That therefore the burden of maintaining privacy and security of identification should be on the organizations and corporations that provide services, not the individual; and
- That these principles must be established not just on the federal level but on the international level.”
That post continued by addressing the first bullet in the above list as I outlined how our constitutional right to privacy came to be recognized in the Constitution and through two key Supreme Court decisions.
This second article will explore the idea that “technology assisted statistics has already made protecting and hiding your personal identity and personal identification information impossible.”
To understand why that is true requires an understanding of two things. First, personal identifying information does not have to be the pieces of data normally associated with that phrase – social security number, name and address. Any combination of data that can collectively determine who you are will do. Second, statistical analysis and technology capable of making that connection exists today.
1. Personal Identification Does Not Require Your Tax ID
The very concept of privacy is that others should not know what you have done and what you are doing, who you associate with, what your plans are for the future, your personal letters, or what you said in a private conversation on the phone without your willing permission of the force of a subpoena or duly executed warrant. The “you” in that concept means YOU, the person you are at your address. The combination of your name and Tax ID/Social Security Number as “personal identifying information” is applicable to privacy in a narrower sense – your financial and medical data and identity. However, if someone circulates in a social network system that “Mary Smith and her husband had an argument at home last night” that would be a violation of the Smiths’ personal privacy in that the recipients of this information can be reasonably certain which of the thousands of Mary Smiths in the world was involved. That is what I mean when I say that “You” can be uniquely identified without a Tax ID being compromised.
2. Statistical Analysis and Technology are Capable of Identifying Unique Information About You Without Your Tax ID
Let us assume that you are a woman and you have just found out that you are pregnant. You are excited and happy by the possibility, but haven’t had a chance to tell your family yet. You stop at a store on the way home. A few days later you receive a mailer from that store offering special deals on baby products. A coincidence? A mass mailing? No, it isn’t. The store that is capable of doing that is named Target and their ability to pinpoint the unique “You” who is pregnant was reviewed in an article in the New York Times earlier this year.
Target does this using a combination of statistical analysis of buying patterns captured by modern computers that have the speed and storage capacity necessary to identify, store and track every purchase in every store. They have a variety of means of identifying the specific customers. There is also a company in Arkansas that helps retailers with the specific person identification problem. It’s name is Acxiom and it too was featured in the New York Times.
Personal identifying information in the traditional sense (Name, Address and Tax ID) can be readily derived from there via the store’s name brand card, for example. However, smart companies have taken huge strides to protect that data from their own employees and the outside world, and the store systems that link your swiped credit card to the Visa/Mastercard computers are now specifically designed to prevent retaining the full card information for the retailer. There are also data security standards covering the transmission of that information back and forth. But as the Target story illustrates, one can still ascertain that you are the Mary Smith who lives at a specific residence.
Isn’t that enough?
Follow @ethicsbite
EthicsBite™ 