Right to privacy

The right to privacy is a fundamental human right firmly grounded in international law. On10 December 1948, the United Nations General Assembly adopted the Universal Declaration of Human Rights (UDHR); while the right to privacy does not appear in the document, Article 12 mentions privacy: Privacy is later codified in successive (hard) international human rights treaties, including the International Covenant on Civil and Political Rights: • No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation. • Everyone has the right to the protection of the law against such interference or attacks. ::—International Covenant on Civil and Political Rights, Article 17 == History ==

The concept of a human "right to privacy" begins when the Latin word ius expanded from meaning "what is fair" to include "a right – an entitlement a person possesses to control or claim something," by the Decretum Gratiani in Bologna, Italy in the 12th century. In the United States, an article in the 15 December 1890, issue of the Harvard Law Review entitled "The Right to Privacy," written by attorney Samuel D. Warren II and future U.S. Supreme Court Justice Louis Brandeis, is often cited as the first explicit finding of a U.S. right to privacy. Warren II and Brandeis wrote that privacy is the "right to be let alone," and focused on protecting individuals. This approach was a response to recent technological developments of the time, such as photography and sensationalist journalism, also known as "yellow journalism." Privacy rights are inherently intertwined with information technology. In his widely cited dissenting opinion in Olmstead v. United States (1928), Brandeis relied on thoughts he developed in the article "The Right to Privacy." == As an individual right ==

Alan Westin believes that new technologies alter the balance between privacy and disclosure and that privacy rights may limit government surveillance to protect democratic processes. Westin defines privacy as "the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others". Westin describes 4 states of privacy: solitude, intimacy, anonymity, and reserve. These states must balance participation against norms: Each individual is continually engaged in a personal adjustment process in which he balances the desire for privacy with the desire for disclosure and communication of themself to others, in light of the environmental conditions and social norms set by the society in which they live. :— Alan Westin, Privacy and Freedom, 1968 Under liberal democratic systems, privacy creates a space separate from political life, and allows personal autonomy, while ensuring democratic freedoms of association and expression. Privacy to individuals is the ability to behave, think, speak, and express ideas without the monitoring or surveillance of someone else. Individuals exercise their freedom of expression through attending political rallies and choosing to hide their identities online by using pseudonyms. David Flaherty believes networked computer databases pose threats to privacy. He develops 'data protection' as an aspect of privacy, which involves "the collection, use, and dissemination of personal information". This concept forms the foundation for fair information practices used by governments globally. Flaherty forwards an idea of privacy as information control, "individuals want to be left alone and to exercise some control over how information about them is used". Marc Rotenberg has described the modern right to privacy as Fair Information Practices: "the rights and responsibilities associated with the collection and use of personal information." Rotenberg emphasizes that the allocation of rights are to the data subject and the responsibilities are assigned to the data collectors because of the transfer of the data and the asymmetry of information concerning data practices. Richard Posner and Lawrence Lessig focus on the economic aspects of personal information control. Posner criticizes privacy for concealing information, which reduces market efficiency. For Posner, employment is selling oneself in the labor market, which he believes is like selling a product. Any 'defect' in the 'product' that is not reported is fraud. For Lessig, privacy breaches online can be regulated through code and law. Lessig claims that "the protection of privacy would be stronger if people conceived of the right as a property right," and that "individuals should be able to control information about themselves". Economic approaches to privacy make communal conceptions of privacy difficult to maintain. Adam D. Moore has argued that privacy, the right to control access to and use of personal information is closely connected to human well-being. He notes that "having the ability and authority to regulate access to and uses of locations, bodies, and personal information, is an essential part of human flourishing" and while "the forms of privacy may be culturally relative . . . the need for privacy is not." == As a collective value and a human right ==

There have been attempts to reframe privacy as a fundamental human right, whose social value is an essential component for the functioning of democratic societies. Priscilla Regan believes that individual concepts of privacy have failed philosophically and in policy. She supports a social value of privacy with three dimensions: shared perceptions, public values, and collective components. Shared ideas about privacy allow freedom of conscience and diversity in thought. Public values guarantee democratic participation, including freedoms of speech and association, and limit government power. Collective elements describe privacy as a collective good that cannot be divided. Regan's goal is to strengthen privacy claims in policy making: "if we did recognize the collective or public-good value of privacy, as well as the common and public value of privacy, those advocating privacy protections would have a stronger basis upon which to argue for its protection". Leslie Regan Shade argues that the human right to privacy is necessary for meaningful democratic participation, and ensures human dignity and autonomy. Privacy depends on norms for how information is distributed, and if this is appropriate. Violations of privacy depend on context. The human right to privacy has precedent in the United Nations Declaration of Human Rights. Shade believes that privacy must be approached from a people-centered perspective, and not through the marketplace. == Privacy laws in different jurisdictions ==

Privacy laws apply to both public and private sector actors. Australia Australia does not have a constitutional right to privacy. However, the Privacy Act 1988 (Cth) provides a degree of protection over an individual's personally identifiable information and its usage by the government and large companies. The Privacy Act also outlines the 13 Australian Privacy Principles. Australia also lacks a tort against invasions of privacy. In the 2001 case of , the High Court of Australia explained that there stood the possibility of "a tort identified as unjustified invasion of privacy", but that this case lacked the facts to establish it. Canada Canadian privacy law is derived from the common law, statutes of the Parliament of Canada and the various provincial legislatures, and the Canadian Charter of Rights and Freedoms. Perhaps ironically, Canada's legal conceptualization of privacy, along with most modern legal Western conceptions of privacy, can be traced back to Warren and Brandeis's "The Right to Privacy" published in the Harvard Law Review in 1890, Holvast states "Almost all authors on privacy start the discussion with the famous article 'The Right to Privacy' of Samuel Warren and Louis Brandeis". China The Constitution is the highest law in China. Privacy rights have been applied throughout China. The Constitution provides direction for all states in China and it further stipulates that "all states must abide by and be held accountable for any violation of the Constitution and the law; the law specifically protects civil rights of a citizen's personal dignity and confidentiality of correspondence." China has a new standard and the first of its kind for the country coming into effect 1 January 2021, the Civil Code is the first of its kind sweeping law replacing all laws covering general provisions, real property, contracts, personality rights, marriage and family, inheritance, tort liability, and supplementary provisions. In many cases raised in the legal system, these rights have been overlooked as the courts have not treated each case with the same legal precedent for each case. China deploys mass surveillance on its population including through the use of closed-circuit television. The 2021 Data Security Law classifies data into different categories and establishes corresponding levels of protection. It imposes significant data localization requirements, in a response to the extraterritorial reach of the United States CLOUD Act or similar foreign laws. The General Data Protection Regulation (GDPR) is an important component of EU privacy law and of human rights law, in particular Article 8(1) of the Charter of Fundamental Rights of the European Union. Under GDPR, data about persons, independent from their citizenship, may only be gathered or processed under specific cases, and with certain conditions. Requirements of data controller parties under the GDPR include keeping records of their processing activities, adopting data protection policies, transparency with data subjects, appointing a Data Protection Officer, and implementing technical safeguards to mitigate security risks. Council of Europe The Council of Europe gathered to discuss the protection of individuals when the Convention Treaty No.108 was created and opened for signature by member states and for accession by non-member States. The Convention closed and was then renamed Convention 108: Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. Convention 108 has undergone 5 ratifications with the last ratification 10 January 1985 officially changing the name to Convention 108+ and providing the summary stating the intent of the treaty as: ''The first binding international instrument which protects the individual against abuses which may accompany the collection and processing of personal data, and which seeks to regulate at the same time the transfrontier flow of personal data. This modernization of Convention 108+ was in progress while the EU data protection rules were developed, the EU data protection rules would be adapted to become the GDPR. India The new data sharing policy of WhatsApp with Facebook after Facebook acquired WhatsApp in 2014 has been challenged in the Supreme Court. The Supreme Court must decide if the right to privacy can be enforced against private entities. The Indian Supreme Court with nine-judge bench under JS Khehar, ruled on 24 August 2017, that the right to privacy is a fundamental right for Indian citizens per Article 21 of the Constitution and additionally under Part III rights. Specifically, the court adopted the three-pronged test required for the encroachment of any Article 21 right – legalityi.e. through an existing law; necessity, in terms of a legitimate state objective and proportionality, that ensures a rational nexus between the object of the invasion and the means adopted to achieve that object. This clarification was crucial to prevent the dilution of the right in the future on the whims and fancies of the government in power. The Court adopted a liberal interpretation of the fundamental rights to meet the challenges posed an increasing digital age. It held that individual liberty must extend to digital spaces and individual autonomy and privacy must be protected. This ruling by the Supreme Court paved the way for decriminalization of homosexuality in India on 6 September 2018, thus legalizing same-sex sexual intercourse between two consenting adults in private. India is the world's biggest democracy and with this ruling, it has joined United States, Canada, South Africa, the European Union, and the UK in recognizing this fundamental right. India's Data Protection law is known as Digital Personal Data Protection Act, 2023. Legal scholars such as Arghya Sengupta have written extensively on the implications of the Supreme Court's recognition of privacy as a fundamental right, through both academic work and contributions at the Vidhi Centre for Legal Policy. Israel In Israel privacy protection is a constitutional basic right and is therefore protected by the Basic Law. Basic Law: the Knesset passed on 12 February 1958, by the Third Knesset. The Twelfth Knesset update to the Basic Law occurred on 17 March 1992. This update added to the law Human Dignity and Liberty by defining: Human freedom in Israel as being the right to leave the country and enter it, as well as the right to privacy and intimacy, refrainment from searches relating to one's private property, body and possessions, and avoidance of violations of the privacy of one's speech, writings and notes. October 2006 Israel established a regulatory authority, the PPA, part of the Ministry of Justice. PPA defined the Privacy Law and associated regulates based on two principles: general right to online privacy and the protection of personal data stored in databases. New Zealand Russia The Constitution of the Russian Federation: Article 45 states: • State protection of human and civil rights and freedoms in the Russian Federation shall be guaranteed. • Everyone shall the right to protect his (her) rights and freedoms by all means not prohibited by law. The Russian Constitution specifically articles 23 and 24, institutes individual citizen the right to privacy. Russia, a member of the Strasbourg Convention, ratified processing of personal data against automatic processing and afterwards adopted a new convention. The new Russian Federal Law No.152-FZ R implemented on 27 July 2006, was updated to cover Personal Data and this law extends privacy to include personal and family secrets. Its main target is to protect individuals' personal data. Privacy entered the forefront of Russian legislature in 2014 when the approach to privacy turned to the goal of protecting privacy of government operations and the people of Russia. The amendments originally modified the Personal Data Law which has since been renamed The Data Localisation Law. The new law requires business operators who collect any information on Russian citizens' must maintain the collected data locally. This means that data transmission, processing, and storage must be in a database in Russia. 1 March 2021, the new amendment came into effect. Consent from the data subject is required if the data operator wants to use the data publicly. United States The Constitution of the United States and the United States Bill of Rights do not explicitly include a right to privacy. In the US, the right of marital privacy was recognized by the Supreme Court in Griswold v. Connecticut, 381 U.S. 479 (1965) as falling within the penumbra of the Bill of Rights. In 1890, Warren and Brandeis drafted an article published in the Harvard Law Review titled "The Right To Privacy" that is often cited as the first implicit finding of a U.S. stance on the right to privacy. leaving the future validity of these decisions uncertain. Legally, the right of privacy is a basic law which includes: • The right of persons to be free from unwarranted publicity • Unwarranted appropriation of one's personality • Publicizing one's private affairs without a legitimate public concern • Wrongful intrusion into one's private activities However, outside of recognized private locations, American law, for the most part, grants next to no privacy for those in public areas. In other words, no verbal or written consent is needed to take photos or videos of those in public areas. This laxness extends to potentially embarrassing situations such as when actress Jennifer Garner bent over to retrieve something from her car and revealed her underwear to create a whale tail. Because the photographer took the photo in a public location, in this case a pumpkin patch, circulating the photo online was a legal act. For the health care sector where medical records are part of an individual's privacy, The Privacy Rule of the Health Insurance Portability and Accountability Act was passed in 1996. This act safeguards medical data of the patient which also includes giving individuals rights over their health information, like getting a copy of their records and seeking correction. Medical anthropologist Khiara Bridges has argued that the US Medicare system requires so much personal disclosure from pregnant women that they effectively do not have privacy rights. CCPA In 2018, California set out to create a policy promoting data protection, the first state in the United States to pursue such protection. The resulting effort is the California Consumer Privacy Act (CCPA), reviewed as a critical juncture where the legal definition of what privacy entails from California lawmakers' perspective. The California Consumer Protection Act is a privacy law protecting the residents of California and their Personal identifying information. The law enacts regulation over all companies regardless of operational geography protecting the six Intentional Acts included in the law. The intentions included in the Act provide California residents with the right to: • Know what personal data is being collected about them. • Know whether their personal data is sold or disclosed and to whom. • Say no to the sale of personal data. • Access their personal data. • Request a business to delete any personal information about a consumer collected from that consumer. • Not be discriminated against for exercising their privacy rights. == Mass surveillance ==

United States Governmental organizations such as the National Security Agency (NSA), CIA, and GCHQ amongst others are authorized to conduct mass surveillance throughout other nations in the world. Programs such as PRISM, MYSTIC, and other operations conducted by NATO-member states are capable of collecting a vast quantity of metadata, internet history, and even actual recordings of phone calls from various countries. Domestic law enforcement at the federal level is conducted by the Federal Bureau of Investigation, so these agencies have never been authorized to collect US data. PRISM has faced criticism for privacy concerns, in that it collects "metadata and communication content." However, scholars have argued that programs like PRISM do more good than harm, in that they protect Americans from foreign threats. After the September 11 attacks, the NSA turned its surveillance apparatus on the US and its citizens. In March 2013, James Clapper, the Director of National Intelligence at the time, testified under oath that the NSA does not "wittingly" collect data on Americans. Clapper later retracted this statement. The US Government's own Privacy and Civil Liberties Oversight Board (PCLOB) reviewed the confidential security documents, and found in 2014 that the program did not have "a single instance involving a threat to the United States in which the program made a concrete difference" in counterterrorism or the disruption of a terrorist attack. China The Chinese government is conducting mass surveillance in Xinjiang province for detention of Muslims. As part of its "Strike Hard Campaign against Violent Terrorism" policy the authorities in China have subjugated 13 million Turkish Muslims to the highest order of restrictions. During the COVID-19 pandemic the Chinese authorities documented the contact information and travel history of every individual and issued red, yellow and green badges/codes for transportation and entering stores. These badges/codes were also sometimes misused to freeze bank accounts and pressurize the protestors who were angry about the severe restrictions. The privacy of these health codes remain unacknowledged and unaddressed. == Journalism ==

It is often claimed, particularly by those in the eye of the media, that their right to privacy is violated when information about their private lives is reported in the press. The point of view of the press, however, is that the general public has a right to know personal information about those with status as a public figure. This distinction is encoded in most legal traditions as an element of freedom of speech. Publication of private facts Publication of private facts speaks of the newsworthiness of private facts according to the law and the protections that private facts have. If a fact has significant newsworthiness to the public, it is protected by law under the freedom of the press. However, even if the fact is true, if it is not newsworthy, it is not necessarily protected. Digital Media Law Project uses examples such as sexual orientation, HIV status, and financial status to show that these can be publicly detrimental to the figure being posted about. show that the publication of a person's home address and full name who is being questioned by the police is valid and "a newsworthy item of legitimate public concern." The last part to consider is whether this could be considered a form of doxxing. With the court upholding the newspaper's right to publish, this is much harder to change in the future. Newsworthiness has much around it that is held up by court rulings and case law. This is not in legislation but is created through the courts, as many other laws and practices are. These are still judged on a case-by-case basis as they are often settled through a lawsuit of some form. While there is a fair amount of case law supporting newsworthiness of subjects, it is hardly comprehensive and, news publications can publish things not covered and defend themselves in court for their right to publish these facts. == Technology ==

Private sector actors can also threaten the right to privacyparticularly technology companies, such as Amazon, Apple, Facebook, Google, and Yahoo that use and collect personal data. These private sector threats are more acute due to AI data processing. In some American jurisdictions, the use of a person's name as a keyword under Google's AdWords for advertising or trade purposes without the person's consent has raised certain personal privacy concerns. The right to privacy and social media content laws have been considered and enacted in several states, such as California's "online erasure" law protecting minors from leaving a digital trail. State laws, such as the CPPA in California, have granted more comprehensive protection. The General Data Protection Regulation has made significant progress to protect privacy from these risks, and it has led to a wave of privacy and data protection laws around the world. Privacy is a major issue in the health care sector with technology becoming an essential component of it. Connecting personal data of patients to internet makes them vulnerable to cyber attacks. There are also concerns about how much data should be stored and who should have access to it. == Protection of minors ==

United Kingdom Laws and courts in the UK uphold the protection of minors in the journalistic space. The Independent Press Standards Organisation (IPSO) in the UK have shown that the usage of footage of a 12-year-old girl being bullied in 2017 can be retroactively taken down due to fears of cyber-bullying and potential harm done to the child in the future. This was after the Mail Online published the video without any attempt to hide the identity of the child. Following the newsworthiness point, it is possible that content like this would be allowed in the United States due to the recentness of the event. In the UK, during the case of Campbell v MGN, Lord Hope stated that the protection of minors will be handled on a case-by-case basis and affected by the child's awareness of the photo and their expectation of privacy. This protects any children under the age of 13 from the collection of their data without their parent's or guardian's permission. This law is the reason why many sites will ask if you are under 13 or require you to be 13 to sign up. While this law is intended to protect preteen children, it fails to protect the information of anyone older than 13, including teenage minors. It also begins to overlap with other privacy protection laws such as the Health Insurance Portability and Accountability Act (HIPAA). == See also ==