What we've learnt from Google: There is no privacy

Your "Right" to privacy

Here's the thing: you don't actually have a "right" to privacy. The 14th amendment to the Constitution of the United States is often cited thanks to a precedent set when Justice Louis Brandeis claimed that it protects the "right to be left alone." However, it takes some acrobatics of reason to arrive at the conclusion that it inherently protects privacy.

The 1st, 4th, and 5th amendments are sometimes tossed out to support the perceived right of privacy as well. But, the reality is that the very best chance for privacy protection probably falls on the 10th amendment - which grants authority to the individual states for any powers not specifically delegated to the federal government. So, it is possible that your individual state could have measures in place to safeguard privacy.

There are also examples of privacy - or at least the protection of sensitive information - being legislated at a more granular level depending on the industry. The Privacy Act of 1974 prevents the unauthorised disclosure of personal information held by the federal government. The Fair Credit Reporting Act protects information gathered by credit reporting agencies. The Children's Online Privacy Protection Act grants parents authority over what information about their children (age 13 and under) can be collected by websites.

There are various regulatory and industry compliance mandates that require affected organisations to take adequate steps to protect sensitive data. Sarbanes-Oxley (SOX), the Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Act (GLBA), and Payment Card Industry Data Security Standards (PCI-DSS) all have stipulations that obligate organisations to protect data, and impose fines and penalties on those that fail to do so.

All of this suggests that privacy is an important issue, and that there is a societal expectation of privacy. Just remember that your privacy isn't actually guaranteed.

What privacy?

For most people it is the principle of the thing. The concept of privacy and the misguided belief that our privacy is protected or guaranteed cause people to get very defensive about having that privacy violated even though the reality is that the information that is revealed is relatively benign and useless.

I might prefer that the pictures I took of my kids playing in the park, or the fact that I was shopping Amazon for suede blazer not be shared with the general public. But, if it were it wouldn't really matter. Whoever might stumble across such revelations would surely be bored to death.

It may be shady if Google has been tracking my Web surfing habits on my iPhone, but for me - and probably the vast majority of the users in the world - there is nothing Earth-shattering to be learned from that. It may be sneaky if friends of mine joined Path and my contact details were uploaded to Path's servers, but my name and email address are plastered in so many places across the Internet that I have long since surrendered any expectation that the information is a secret.

Even in situations where you have an illusion of privacy, your data is probably not as private as you believe. Facebook, Google, Path, and others have all been guilty of accessing or sharing information in ways not explicitly authorised by users - and those are just the incidents we know about. It's possible, or perhaps even probable, that other entities are also secretly tapping your private data and simply haven't yet been caught.

It's all public

You should just assume that if you post it, share it, access it, or store it online that it's probably going to be seen by some unauthorised party at some point. Maybe it's by a malicious hacker, or perhaps by a trusted entity like Facebook or Google, or it might be by law enforcement or government agencies.

To some extent, you do have some power to protect your own privacy. For starters, you can make sure you understand and implement all of the security and privacy controls at your disposal for the sites and services you use. Next, you can simply choose not to do business with sites or services that violate your trust and breach your privacy.

Even if you take those steps, though, and do everything in your power to enforce the protection of your privacy, you should essentially consider everything online to be public. If you truly don't want certain thoughts, beliefs, personal data, or other information about you to be known to the general public or by any third-parties, you should think twice about whether it should ever be online in the first place.

Again, I am not apologising for Google in any way, or for Path, or for any other entity that might violate the expectation of privacy. I am, however, suggesting that the expectation of privacy itself is optimistic, and that you should not be surprised when you learn that your "private" information isn't quite as private as you thought.

Instead of an expectation of privacy, users should have an expectation that their privacy will be breached eventually. Unless you plan to live some Luddite existence off the grid and simply disconnect from the Internet, this probably won't be the last incident that affects your privacy.