Situating Privacy Online

Abstract

Media and research reports point to the issue of privacy as the key to understanding online behaviour and experience. Yet it is well recognized within privacy-advocacy circles that ‘privacy’ is a loose concept encompassing a variety of meanings. In this article we view privacy as mediating between individuals and their online activities, not standing above them, and as being constantly redefined in actual practice. It is necessary to examine, therefore, what individuals are reacting to when asked about online privacy and how it affects their online experience. This article is based on data generated in the Everyday Internet study, a neighbourhood- based, ethnographic project being conducted in Toronto, Canada, that investigates how people integrate online services in their daily lives. We propose that there are three organizing ‘moments’ of online privacy: the moment of sitting in front of the computer, the moment of interaction with it, and the moment after the data has been released.

Keywords:

• privacy
• ethnographic study
• Internet
• practices
• perceptions

Acknowledgments

We appreciate the willingness of our informants to let us into their homes and lives, spending hours with us answering our many questions. Randall Terada of St Christopher House helped us greatly in recruiting many of our informants. We found the suggestions of the anonymous reviewers and journal editors useful in improving the paper. The Social Sciences and Humanities Research Council has supported this research financially.

Notes

Previously presented at the Association of Internet Researchers (AoIR) conference in October 2002.

There is a large literature offering diverse perspectives on privacy. For a legal treatment, see Gellman (1998) or Solove (2002); for a philosophical inquiry, see Schoeman (1984); for a policy-grounded analysis, see Bennett (1992); for a sociological perspective, see Lyon (2001a); and, finally, for a historical view, see (Flaherty 1999).

For more on the subject of fair information practices see, for instance, the Center for Democracy and Technology (http://www.cdt.org/privacy/ guide/basic/fips.html), Junkbusters (http://www.junkbusters.com/ fip.html) or OECD’s report (http://www1.oecd.org/publications/e-book/ 9302011E.pdf).

Directive on the Protection of Personal Data and on the Free Movement of Such Data (Directive 95/46/EC).

For the latest privacy surveys, see: http://www.privacyexchange.org/iss/ surveys/surveys.html.

As Solove (2002) notes, some privacy expectations can also be instigated by the law. For instance, letters became private means of communication only when, in 1877, the US Supreme Court held that letters were protected by the Fourth Amendment. Until that time, letters were seen as insecure and there was no expectation of privacy in personal correspondence.

See: http://www.fis.utoronto.ca/everydayinternet/.

Census data, from 1996, report that, of the 735 people in our selected neighbourhood, there is a fairly even spread in ages: from young children to seniors over seventy years old. More than half have immigrated to Canada, with the largest such group being Portuguese. Demographic data on education and income also support our location choice: of the 620 adults, over a third (225) have a less than grade nine education, and 150 more have completed between nine and thirteen grades. Only seventy-five have a bachelor’s degree or higher. The number earning less than $24,000 per annum (130), which is below the Canadian national average, exceeds the number earning over $65,000 (120).

The first interview consisted of a general discussion of the participant’s online activities. In the second interview, participants were asked to keep a record of their online activities and these were discussed in detail.

We did not specifically ask participants about income, and thus cannot present figures. However, it is clear from talking to participants and, in certain cases from taking note of their houses, that most participants come from middle- and low-income strata, which is consistent with the neighbourhood being studied.

The presence of a fluent speaker of Portuguese and Spanish (AV) on the research team allowed us to accommodate the linguistic needs of participants.

Mainly for financial reasons, Marianna has recently started to rely on public facilities only.

For more on the issue of the blurring of public and private spaces see, for example, Shapiro (1998) and Marx (2001)

Cookies are small text files sent out to the user’s computer when visiting a website. These text files are stored on the computer’s hard drive and help track that user’s browsing activities. Cookies are composed of a unique identifier that identifies that computer to the website that is sending out the cookie.

In November 1999, DoubleClick, an Internet advertisement company, and Abacus Direct, a direct-marketing agency, announced that they were going to merge. Public concern emerged when DoubleClick announced (in February 2000) that it was going to change its privacy policy and start correlating personal information with its cookie identifiers. This information would be gathered in a database of consumer profiles, which would include each user’s name and address, online surfing habits, online purchase history and demographic data. Consumers would be able to ‘opt out’ by going to the company’s website.

Our main concern at the start of the study was that the number of people who claim to be ‘very concerned’ about privacy would be inflated. We expected participants to want to please us by seeming concerned about privacy.

This is not to imply that individual responses to privacy are not important. In ‘A Tack in the shoe: neutralizing and resisting the new surveillance’, Marx (2003) details the significance of individual responses to surveillance.

The individualistic character of privacy has been widely debated in the privacy literature (e.g. Schoeman 1992). Among the attempts to shift the discourse towards a more social approach are that of Raab and Bennett (1998), who argue for a ‘sectoral approach’ to the subject, i.e. the search for identifying patterns among certain social groups.

In Canada, the principal established privacy norms are the Canadian Standards Association (CSA) Model Code (1994) and, since 2001, the Personal Information Protection and Electronic Documents Acts (PIPEDA), which is based explicitly on the CSA Model Code. The authors have not seen any site, including those that the research participants visited, that makes prominent reference to its compliance with these standards.

A notable exception to this statement is the work of the World Wide Web Consortium (W3C) in developing the Platform for Privacy Preferences (P3P). However, this effort so far has had little practical influence on everyday online experiences and faces formidable obstacles in becoming an established part of them.

A look at the privacy literature shows that a number of privacy advocates frequently use the Big Brother metaphor to justify privacy fears in an online world. See, for instance, Davies (1992)