Page 48 - Privacy in a Cyber Age Policy and Practice

MORE COHERENT, LESS SUBJECTIVE, AND OPERATIONAL 33

This element of cybernation can be operationalized, as a first order of
approximation, by determining whether or not the information is stored
or instantly erased. As a second order of approximation, if information is
stored, the degree of cybernation can be approximated by determining the
length of time the information is kept.
In regard to the collation of information about the same person, espe-
cially when building dossiers is involved, the risk to privacy increases when
information collected and stored by one agent is combined or linked with
information collected and stored by other agents. For example, some civil
rights advocates much prefer state or regional databases to federal ones,
not taking into account that these local databases are often linked to each
other and thus in effect act like one central database. Although the volume
of information in each state or local database may well be lower than the
amount stored in a national database, that the state and local databases are
linked to each other means that those who have access to them have access
to the same amount of information that would be gathered in a national
database. Many civil rights advocates would also be greatly concerned if
the FBI amassed information on most Americans, including those who
have not been charged with any crime or are under any suspicion—but
they pay less mind to data brokers who keep such information and sell
69
access to the FBI. The law must adapt to these technological develop-
ments, treat all linked databases as if they were one, and impose limits on
collection accordingly.
The risk to privacy is also lower when personal information is merely
stored and collated than when the same information is analyzed to fer-
ret out other information and draw conclusions about the person not
revealed by the raw data. For first approximation purposes, this dimen-
sion can be operationalized by considering whether such analysis is car-
ried out at all; that is, analysis is contrasted with the mere use of raw
information. Additional measurements are needed to establish how much
and what kinds of new information are gained through analyses. In par-
ticular, it is essential that when the collection and use of sensitive infor-
mation is banned, so too should analysis that is used to divine the same
information from insensitive information be banned. It seems that no
such bans are yet in place. They are clearly needed because without them
limits on collecting and cybernating sensitive information face the grave
danger of being eroded.
Finally, risks to privacy are fewer when information collected by one
party such as a hospital or the IRS, even information that has been ana-
lyzed or compiled into dossiers, is inaccessible to other parties or is only
made available to other parties under special circumstances. The Federal
Privacy Act of 1974, for instance, limits the conditions and the degree to