What hat do you wear in private?

I’ve been studying privacy for about three solid years now and have sat in graduate level classes, read some 300+ research papers, 100’s of blog postings/articles (thanks IAPP – the dailys are awesome). and own/read some 25+ books on privacy (checkout my library), and even follow some great minds in twitter (like @privprof!) ,- so this all totals up to hours and hours (north of 1500 hours) of thought after thought about privacy.

What strikes me as a point of interest is that 99.999% of the content seems to be about the user/consumer/citizen – the person. Not that this is a bad thing – because lets face it – most private information comes from people.  We have contemporary privacy scholars who focus on the legal aspects of privacy like Daniel Solove (if you haven’t read his book “Understanding Privacy” – I highly recommend it!). Software Engineering privacy experts like  Lorrie Cranor who has driven incredible changes in how software, user interfaces, and web tools gather and use privacy related information. Roger Clarke who has looked at privacy statements and privacy impact assessments in-depth. Or Herman Tavani who has shaped much of the theoretical basis for IT Ethics (he has published some excellent research on Privacy & Ethics) And I could go on and on with the list of really great minds.

Recently I have had a few discussions with folks who are privacy experts – in fact a few of them are world-renowned in the academic circles. When I bring up the fact that business has a privacy requirement too – let’s just say I usually get a pretty strong negative response to that. One person even suggested that maybe I’m just working for a business and not really doing research.

Let’s face it – particularly here in the U.S. companies have been very liberal with their controls of their customers (and even just prospects) information. Take the days of the 3×5 warranty card. How is it that a company that sold you a baby carriage needed to know your annual income or your age? All that they need to know (if they need to know anything) is the date it was purchased, where it was purchased, a serial number, and your address.

But … what if we thought about privacy a little bit different? What if we thought of it as if the corporation were a person. For example – a corporation has to worry about the data of their employees, customers, and their own “information”. Their own information could include protected things like intellectual property or more grey area things like temporal or tribal knowledge (e.g. current incentives given to sales to drive sales behavior against a competitor).

Also – has anyone every heard the phrase “it would be like pushing on a rope”. In other words if the discussion/argument/definition is one sided – how do you really move your position forward if there is nothing there to resist the progress? Benjamin Franklin said “Reading makes a full man, meditation a profound man, discourse a clear man.” How can the tension between man and corporation when it comes to privacy be one-sided? It seems valuable to research and understand the privacy privilege, violation, protections, perspective, and purpose from the corporate side of the coin seems to be not only valuable – but a requirement. How can we fully understand where the line needs to be drawn with regard to individual protections if the fight is one-sided?

H. Jeff Smith wrote in his book “Managing Privacy” that corporations only respond to privacy requirements when there is an external event (breach, lawsuit, regulation) – why not choose to find a different – proactive course? One which embraces the needs of the enterprise, assesses it against the needs and rights of the citizen – so that we can find the middle ground? Why constrain our forward movement in the realm of privacy to just the outcome of complaint or the past tense of lost privacy?

And no, my research is not for the corporation or by the corporation. My personal opinion is that corporate America does have too many liberties with our private information and we’re not adequately protected. However my opinion doesn’t count when it comes to research and one of the most interesting ways to study a problem is to reverse it.

/wayne