Summary
Highlights
Anita Krug, Dean of Chicago-Kent College of Law, welcomes attendees to the annual Palmer Lecture, honoring Neil Richards with the Roy C. Palmer Civil Liberties Prize. The prize, established by Roy and Susan Palmer, recognizes scholarship exploring the tension between civil liberties and national security. Richards is being honored for his book, "Why Privacy Matters," which examines the regulation of technologies powered by human information.
Professor Richards shares a common conversation he has had with many people, including an Uber driver, about privacy. The prevalent sentiment is that 'privacy is dead' because all information is 'out there,' and people 'have nothing to hide.' He acknowledges the validity of this feeling, citing examples like widespread CCTV, facial recognition technology, intelligence agency surveillance (Snowden revelations), data scandals (Cambridge Analytica), and 'Internet of Things' devices like Amazon Alexa, all of which contribute to a sense of being constantly monitored.
Richards refutes the idea that privacy is dead, instead asserting that 'privacy is up for grabs' and is fundamentally about power. He explains that information equates to power, and human information gives power over human beings. Organizations like the NSA and Facebook understand this, collecting data to influence behavior and preferences. They also maintain secrecy about their operations, demonstrating their understanding of information's power and its impact on public scrutiny.
Richards offers a working definition of privacy: 'the degree to which human information is neither known nor used.' He clarifies that he is focusing on information privacy, particularly concerning human data, and emphasizes that privacy issues involve both the collection and use of information. He stresses that privacy exists on a spectrum, not as a simple public-private dichotomy, and that most information falls into a 'messy middle' requiring nuanced approaches to regulation.
Richards debunks the myth of 'nothing to hide,' arguing that everyone has something they consider private. He uses examples like personal hygiene, sexuality, and health information, as well as the need to confide in trusted individuals like doctors. He highlights that privacy is not about hiding dark secrets but about controlling information to prevent undue influence. Furthermore, privacy is a social value, benefiting everyone in a society where individuals can freely explore their identities without constant scrutiny.
Richards advises against using 'creepiness' as a metric for privacy problems. He argues that 'creepiness' is an unreliable yardstick because it can be both over-inclusive (new things that seem creepy initially can be beneficial, like early railroads or Facebook's news feed) and under-inclusive (problematic issues, like secret algorithms, might not feel creepy). He also points out that 'creepiness' is malleable and can be manipulated by companies, as exemplified by Google's 'creepy line' policy, to desensitize people to privacy intrusions.
Richards addresses the corporate response of offering 'control' through privacy dashboards. He reveals this as an illusion, citing the overwhelming number of settings across various services and the limited choices offered (e.g., users can't opt out of surveillance-based ads entirely). He recounts a personal experience with a cookie banner that demonstrated the impracticality of managing privacy settings, leading to resignation and agreement, thereby completing a 'creepy trap' where individuals are blamed for not protecting their privacy despite insufficient tools.
Richards proposes three values to guide future privacy rules: identity, freedom, and protection. He explains that privacy enables individuals to form and explore their identities free from constant scrutiny, citing how social networks often force unitary identities, stifling development. For freedom, he links privacy to democratic political freedom, noting the chilling effect of pervasive surveillance on behavior and political expression. Finally, for protection, he advocates for a new approach to consumer protection that recognizes the 'situated consumer' – an individual with limited resources and attention, rather than an idealized rational actor.
Richards argues for building trust in digital services, moving beyond the current 'notice and choice' model for consumer protection, which he views as inadequate. He suggests that genuine trust, where companies assure users their data won't be exploited, would lead to more and better information sharing, benefiting both consumers and companies. He concludes that privacy is a fundamental right necessary for human flourishing in the digital world, where information is power, and how that information is controlled determines the 'whole ball game.'
During the Q&A, Richards discusses cultural differences in privacy expectations between countries like the UK and the US, attributing them to varying perceptions of threat and historical contexts. He expresses optimism that society can address current privacy challenges, drawing parallels with how industrialized nations tackled the problems of the Industrial Revolution through new regulations. He emphasizes the need for 'moral imagination' and equipping future legal professionals not just with knowledge of current law, but with the flexibility and ethical understanding to navigate evolving technologies and protect human values.