Balancing Information Access and Privacy Protection
Legislation that addresses information access and privacy protection (IAPP) must balance the expectation of individual privacy with a public need to access and use information. There is a fundamental tug-of-war between privacy protection and the right "to be let alone" (Warren, 1890, p. 4) with access to information in support of the "right to know". Both privacy and information access are building blocks of what we consider a liberal democracy and legislators must strike a balance between these competing values.
Benjamin Franklin espoused views on the contrast between the desire for individual privacy and natural human curiosity. Franklin wanted personal privacy while at the same time knowledge of others (Franks, 2016, p. 4), illustrating a challenging tension that legislation must attempt to stabilize. In addition, Franklin demonstrated another common privacy trait: he conducted public business in private towards personal benefit. Privacy laws must not only achieve a balance between protection and access, but differentiate between information that should be kept private and information where it is in the public’s best interest to be revealed. The discretionary disclosure rules we have adopted often deal with the determination of which category an information request belongs.
Freedom of information statutes favour an “open by default” approach to information, meaning that information is disclosable except when specified by statute (Franks, 2016, p. 8). This accomplishes two major goals. First, it allows legislation to focus on the subset of situations where information must be protected versus dealing with an every expanding range of data on a case by case basis. Second, it promotes trust in the well-meaning ideals of the legislation, dispelling notions of encouraging secrecy. This allows an individual to examine the specified exceptions to disclosure and gain confidence that where privacy is mandated it is, “on the balance”, in the public best interest.
It is about ensuring a fair balance between the legitimate information needs of the private sector and the essential rights of individuals in a democracy.
-Privacy Commissioner of Canada
Despite the best attempts of legislatures to create comprehensive laws, technological advancements and changing societal expectations mean statutes can be ambiguous in certain scenarios. This situation is exacerbated by the relatively limited resources of an individual to challenge government or organization privacy protection policy and necessitates the role of an independent third-party. This commissioner can investigate instances where violation of privacy laws is suspected, advise the parties involved and help resolve conflict. It is important that the privacy commissioner remains impartial throughout any investigation. A well-defined process with clear objectives, initiation procedures and a mechanism for redress aides in this goal.
Navigating the conflicts between privacy and access highlights an important insight: good access to information laws are built on strong privacy protection laws. It doesn’t appear to be a coincidence that in Canada the Access to Information Act and the Privacy Act came into force at the same time. The Privacy Commissioner of Canada George Radwanski viewed these statutes as “the yin and yang of governmental information policy” (Radwanski 2001); not conflicting statutes but complimentary pieces of legislation. The fundamentals of informed consent, limited data collection and openness to review help in answering the questions raised when building access to information legislation. The balance we seek is achieved not from the surrender to conflicting desires but from accepting mutually beneficial ideals.
Regardless of where we land as a society in terms of what the information privacy landscape looks like, participation in the ongoing process of defining our access and privacy legislation is key. Decisions need to be made from a position of understanding and contemplative thought, not quietly adopted through inattention. In a liberal democracy individuals select their political leaders who then create legislation and appoint judges. We participate in special interest groups targeting information access and privacy protection aspects that are important to us and we need to support the authority of third-party oversight that provides us with recourse for violations to our privacy.
Current trends in online information practices and the proliferation of interconnected data sources suggest that we are less likely to have harsh rules and laws explicitly thrust upon us in a totalitarian fashion and more likely to drift into a similar situation through a lack of participating in the process, oblivious to the erosion of both access and privacy. In this regard access and privacy share the same goal. Implementing IAPP laws may be a balancing act between access and privacy, but the ultimate aim is the preservation of both.