Page 45 - Privacy in a Cyber Age Policy and Practice

30 PRIVACY IN A CYBER AGE

51
now uses them. ) Some strong privacy advocates concede that exceptional
conditions exist under which surveillance and other forms of personal
information collection might be justified, but they hold that the onus is on
52
the government to prove such conditions are in place. They furthermore
set a very high bar that must be cleared before they consider an intrusion
to be justified.
Instead, the CAPD and many others hold that not all personal informa-
tion can or should be accorded the same level of protection, and that the
more sensitive the information an agent seeks to collect, the more mea-
sures to protect privacy should be implemented and the higher the public
interest must be before collection of the information is legitimated.
What should determine the sensitivity of a piece of information? Mea-
surements of sensitivity should reflect the values of the society in question.
Some societies, for example, consider expressions of affection or intimacy,
let alone sexual relations, highly sensitive and private matters, while other
societies take a less constricted approach. For instance, Americans con-
sider women’s breasts to be highly private, while many Europeans consider
it acceptable to go bare on the beaches. In another example, some soci-
eties hold that disputes should be resolved in private, while the Mambila
people of Nigeria consider it important to “act within the sight of every-
one” because “[only] witches act secretly, eating behind closed doors or
conducting financial transactions at night . . . [and quarrels] held in public
53
are seen as dangerous since witches may ‘hide’ behind them.” This is not
to say that any particular society’s standards of privacy are superior, merely
that they are affected by the particular normative culture of the given soci-
ety and are a major factor in determining what the legal system considers
sensitive personal information.
In each society, the legislatures and courts operationalize these differ-
ences in the normative standing of different kinds of information. In the
United States, this ranking has been mainly brought about by Congress
enacting piecemeal a series of specific laws. In 2003, for example, Con-
gress enacted the US Health Insurance Portability and Accountability Act
54
of 1996 (HIPAA). This law treats protected health information (PHI) —
the identifying information that would associate an individual with
records of their medical conditions—as highly sensitive, with restrictions
55
on the disclosure of psychotherapy notes being especially tight. The
Department of Health and Human Services’ description of HIPAA’s Pri-
vacy Rule states that HIPAA “creates, for the first time, a floor of national
protections for the privacy of [consumers’] most sensitive information—
health information.” 56
57
Following the Supreme Court’s decision in United States v. Miller,
Congress passed the Right to Financial Privacy Act, which restricted