University of Toronto Law Journal

University of Toronto Law Journal 54.2 (2004) 183-225

Toward Strong Privacy:
Values, Markets, Mechanisms, and Institutions^†

James B. Rule
State University of New York, Stony Brook

I Introduction

What trend is more distinctive of our times than the dramatically changing social role of information? What social force promises more far-reaching consequences than continuing innovation in that role?

Among information processes, none are more important than those involving information on specific people. For a vast array of vital social and economic activities, personal data have become an indispensable 'raw material.' For countless government and private organizations, crucial products, services, performances, and responsibilities require finely calculated use of data on the person concerned.

Throughout the world's prosperous societies, it has become increasingly rare to deal with any governmental or private-sector organization without generating and relying upon a database of personal information. In recent years, the private sector has shown the greatest innovation in these respects. Medical care increasingly involves complex, multi-channel flows of information on matters ranging from the patient's medical history and genetic inheritance to his insurance status. Credit and banking require constant accessing of account balances, recent transactions, credit history, and available credit. The sale and use of all forms of insurance are predicated on close assessment of risk and reward, cost and benefit - all requiring analysis of the experience of identifiable individuals. Marketing, in its many forms, involves analytical monitoring of consumers' product choices and advertising susceptibilities.

Most striking of all, the rise of cyberspace has led to new sources and possibilities for appropriation and use of personal information in all these spheres. Frequent and multifarious participation in 'the Net' continues to yield new and non-intuitive ways of knowing who people are, what are their interests and susceptibilities, what they are willing to buy, and how much they can be expected to pay. Needless to say, the personal [End Page 183] data amassed and marshalled in these ways have become both immensely consequential to the people concerned and commensurately valuable to the organizations acquiring them.

Unsurprisingly, these developments have triggered much anxiety over privacy. Everyone understands that today's much-vaunted 'information society' brings with it all sorts of new and distinctive demands for personal data. The question is, What significance should we ascribe to such trends, and what should we hope to do about them? What does protection of privacy values entail in these circumstances - and are such values even worth protecting?

For some commentators, the situation with regard to privacy is so serious as to be almost hopeless.¹ The net loss of people's control over their information, on this view, amounts to a degradation of basic social values. These losses are difficult, if not impossible, to redress, given the technological and social forces driving them. But from other viewpoints, the situation is in some sense hopeless, but not necessarily serious.² On this view, privacy is simply an anachronistic value in a world where the flow of information plays as basic a role as coal and steam did during the Industrial Revolution. Between these two positions one can note nearly every shade of opinion as to the nature and seriousness of recent assaults on privacy values - and an equally heterogeneous array of legal and policy ideas as to appropriate responses.³ If there is one point on which all observers agree, it is the striking contrast between American law and policy in these matters and the approach prevailing in most other liberal democracies.⁴ Canada, the European Union, Australia, and other countries have adopted comprehensive legislation governing commercialization of personal data - and sharply restricting commercial use of personal data, except where expressly approved by the individual. In the United States, by contrast, commercial appropriation of personal data in marketing, credit, insurance, and other industries is largely unrestrained. The industries involved have often found legal protection for their activities under the aegis of 'commercial freedom of expression.' As a result, personal data on American citizens is widely marketed in a variety [End Page 184] of...