Chapter 7: Privacy in an Overexposed World
In our overexposed world, is anything private anymore? Currently, the law recognizes as private only information that is completely secret. Information exposed to others is public. Privacy, however, is far more complicated, as it involves a cluster of nuanced expectations of accessibility, confidentiality, and control. If we are to protect privacy today, we need to rethink our understandings of privacy. This chapter is about how to do so.
PRIVACY IN PUBLIC
The Burning Man Festival is held each year in the barrens of the Nevada desert. Tens of thousands of people converge on a vast dusty area far away from the urban world to engage in a spiritual celebration of "radical self-expression." People dance, frolic, parade, act out skits, paint their bodies, sing, and create art. There is a lot of nudity. The festival is named for its concluding ritual, in which a forty-foot effigy of a man is set on fire. The Burning Man Festival has been an annual event since 1986. At first it drew fewer than two dozen people, but it has now grown to more than twenty-five thousand. [1]
In 2002 a website called Voyeur Video began to sell a dozen videos of nude participants at the festival. The videos, priced at $29.95, were peddled along with other classics such as Kinky Nude Beach Day and Springbreak Stripoffs. Voyeur Video fashioned itself not as a pornography company but as "a news company that reports on adult parties where people get naked and naughty." [2]
At the Burning Man festival, participants were allowed to make videos and take pictures, but only with the permission of festival organizers. Voyeur Video sought and was denied permission to videotape the event. [3] The company videotaped the festival anyway. The organizers sued. Among the many causes of actions were the Warren and Brandeis torts of appropriation and public disclosure. Video Voyeur backed down. It agreed to stop selling the videos and to turn them over to the Burning Man organizers.
The Burning Man case, although never fully litigated, raises several important questions about the nature of privacy. If a person is naked at a festival with twenty-five thousand others, how can that person claim privacy? Should the law recognize such claims?
The Law's Binary Understanding of Privacy
A husband and wife were engaged in a romantic embrace near an ice cream stand at a farmer's market. Their photo was snapped, and it appeared in the October 1947 issue of Harpers Bazaar in an article celebrating the splendor of love. The photo was also published in the May 1949 issue of Ladies' Home Journal. Although the photo depicted the couple in a moment of love, the couple wasn't in love with the fact that their intimacy was displayed in national magazines, and they felt humiliated and embarrassed. They sued the magazines for publicly disclosing private facts.
But the court threw out their case because the couple "had voluntarily exposed themselves to public gaze in a pose open to the view of any persons who might then be at or near their place of business." [4] According to the court, "There can be no privacy in that which is already public." The court reasoned that "the photograph did not disclose anything which until then had been private, but rather only extended knowledge of the particular incident to a somewhat larger public than had actually witnessed it at the time of occurrence."
One judge dissented in the case. He noted that "there is no news or educational value whatsoever in the photograph alone" and that a picture with models could readily have been used to illustrate the story. The judge went on to argue:
By plaintiffs doing what they did in view of a tiny fraction of the public, does not mean that they consented to observation by the millions of readers of the defendant's magazine. In effect, the majority holding means that anything anyone does outside of his own home is with consent to the publication thereof, because, under those circumstances he waives his right of privacy even though there is no news value in the event. If such were the case, the blameless exposure of a portion of the naked body of a man or woman in a public place as the result of inefficient buttons, hooks or other clothes-holding devices could be freely photographed and widely published with complete immunity.
The judge has a point. There is a difference between what is captured in the fading memories of only a few people and what is broadcast to a worldwide audience. The law, however, generally holds that once something is exposed to the public, it can no longer be private. Traditionally privacy is viewed in a binary way, dividing the world into two distinct realms, the public and the private. If a person is in a public place, she cannot expect privacy. If information is exposed to the public in any way, it isn't private. According to the Restatement of Torts, one of the most influential documents for courts applying the tort of public disclosure: "There is no liability when the defendant merely gives further publicity to information about the plaintiff which is already public. Thus there is no liability for giving publicity to facts about the plaintiff's life which are matters of public record." [5] As one court ruled, appearing in public "necessarily involves doffing the cloak of privacy which the law protects." [6]
In one case, a husband and wife were arrested in a bar and taken away in handcuffs. A television film crew filmed the arrest. It turned out that the arrest was based on mistaken identity. The couple called the television station and begged that the footage not be broadcast. No such luck. The footage was aired. The couple sued, but the court dismissed the case because the arrest was filmed in public and was "left open to the public eye." [7]
Thus, according to the prevailing view of the law, if you're in public, you're exposing what you're doing to others, and it can't be private. If you really want privacy, you must take refuge in your home.
The Challenge of New Technology

The EarthCam website, displaying a feed from its live Times Square camera. Image courtesy of EarthCam, Inc.
Modern technology poses a severe challenge to the traditional binary understanding of privacy. Today data is gathered about us at every turn. Surveillance cameras are sprouting up everywhere. There are twenty-four-hour surveillance cameras in public linked to websites for anybody to view. Go to EarthCam and click on one of many major cities, such as Washington, D.C.,
Chicago, New York, or Seattle, among others. [8] In New York, for example, you can watch a camera that captures people walking down the sidewalk at 47th Street in Times Square.
Armed with cell phone cameras, everyday people can snap up images, becoming amateur paparazzi. Websites like Flickr allow people to post their photos and share them with the world. [9] Some people are posting a daily stream of photos, obsessively documenting every aspect of their lives. Beyond pictures, people are posting videos on the Internet for the world to watch. On YouTube, the leading video website, people around the globe are viewing more than one hundred million videos per day. On a daily basis, people add more than sixty-five thousand videos to YouTube. [10] Other variations of blogs are emerging, ones devoted primarily to pictures and video. A "moblog" is short for "mobile weblog." [11] Moblogs consist of postings based on what people capture in their mobile devices, such as cell phone cameras. Video blogs, or "vlogs" for short, consist of video feeds. According to one vlogger, everyone can "create media and have a distribution outlet for it that bypasses television and mainstream media." [12]
Today, privacy goes far beyond whether something is exposed to others. What matters most is the nature of the exposure and what is done with the information. There is a difference between casual observation and the more indelible recording of information and images. As the law professor Andrew McClurg points out, captured images have permanence, something fleeting memories lack. People can scrutinize a photo and notice details that they might not otherwise see when observing the scene as it unfolds. [13]
A second difference involves the degree of anonymity we expect in our everyday activities. As one prescient judge wrote, privacy can be "invaded through extensive or exhaustive monitoring and cataloguing of acts normally disconnected and anonymous." [14] We often engage in our daily activities in public expecting to be just a face in the crowd, another ant in the colony. We run into hundreds of strangers every day and don't expect them to know who we are or to care about what we do. We don't expect the clerk at the store to take an interest in what we buy. In other words, we're relatively anonymous in a large part of our lives in public. Identification dramatically alters the equation.
Suppose somebody followed you around in a drug store. The person assiduously scribbled down an inventory of what you bought. Or the person snapped a photo of the products you had in your basket as you were waiting at the checkout counter. Perhaps you wouldn't want the world to know you had bought hemorrhoid cream. Or perhaps you wouldn't be thrilled that others would know about your diarrhea problem or the kind of birth control you used. You bought all these things in public, and you exposed them to other people. Does this mean that you don't expect privacy in what you bought?
A third component of our expectations involves our understanding of context. Although we do things in public, we do them in a particular context before a particular set of people. As the information technology scholar Helen Nissenbaum points out, "it is crucial to know the context -- who is gathering the information, who is analyzing it, who is disseminating it and to whom, the nature of the information, the relationships among the various parties, and even larger institutional and social circumstances." [15] McClurg aptly notes that "a photograph permits dissemination of an image not just to a larger audience, but to different audiences than the subject intended." Moreover, "conduct which would be appropriate for one environment may be inappropriate or embarrassing in another." [16] We tell jokes to our friends we wouldn't tell to our grandmother. We realize that there are different social norms for different situations, and broadcasting matters beyond their original context takes away our ability to judge the situation appropriately.
Fourth, much of our daily lives occurs in realms that are neither purely public nor purely private. Instead, our activities often take place in the twilight between public and private. We used to speak on the phone at home or in closed phone booths, but with cell phones, we now carry out our conversations in a variety of public places. Suppose you're on a train and you have a cell phone conversation with a friend. The person sitting next to you secretly records your conversation and makes the recording available online. Despite the fact you exposed your conversation to people nearby, you didn't expect your conversation to be recorded and made available to the world.
Most of us have moments when we're in public where we would not want a photo taken of us, much less placed on the Internet. Most of us have times when we expose personal information to others but do not expect it to be shared more widely. We frequently have conversations in public that we don't expect to be overheard. When we chat in a restaurant, we don't expect others to be straining to eavesdrop on our discussion above the din of other dinner conversations. At most, we might expect one or two people to hear fragments of what we're saying, but we certainly don't expect to see a transcript of our conversation appear on the Internet.
Thus merely assessing whether information is exposed in public or to others can no longer be adequate to determining whether we should protect it as private. Unless we rethink the binary notion of privacy, new technologies will increasingly invade the enclaves of privacy we enjoy in public. Privacy is a complicated set of norms, expectations, and desires that goes far beyond the simplistic notion that if you're in public, you have no privacy.
Video Voyeurism
In some instances, the law is beginning to advance beyond the simplistic binary view of privacy. The rise of video voyeurism has pushed the law toward a greater recognition of different degrees of privacy. New technology has made video voyeurism easy. Anybody armed with a cell phone camera can quickly snap photos of others in the buff and post them online. In one incident, nude photos of a men's wrestling team at the University of Pennsylvania appeared on a website. One athlete said: "I pulled up the home page and I am looking at myself naked on the Internet. ... It is terrible because I have no control over it." [17]
Another practice is the taking of "upskirt" photos -- pictures taken up women's skirts. More than one hundred websites are devoted to providing upskirt photos or pictures of people showering or undressing. [18] To take these photos, all a person needs is a cell phone camera.
Several states have responded by passing laws with criminal penalties for video voyeurism. [19] Some initial attempts at creating these laws, however, failed because of the binary view of privacy. In one case, two men took upskirt photos of unsuspecting women in a mall. Both were convicted under a Washington video voyeurism statute. The Washington law defined the crime as taking photos "for the purpose of arousing or gratifying the sexual desire of any person" when the photo was taken "in a place where [the victim] would have a reasonable expectation of privacy." [20] The Washington Supreme Court, however, overturned the conviction because "although the Legislature may have intended to cover intrusions of privacy in public places, the plain language of the statute does not accomplish this goal." The court reasoned that "casual surveillance frequently occurs in public. Therefore, public places could not logically constitute locations where a person could reasonably expect to be safe from casual or hostile intrusion or surveillance." [21] The law was later amended to include both public and private places.
In 2004 Congress enacted the Video Voyeurism Prevention Act. [22] Congress criminalized video voyeurism, and it heeded the lesson from the Washington law, explicitly providing that the act would apply "regardless of whether [the victim] is in a public or private area." Unfortunately, Congress's act applies only on federal property, so you're safe from upskirt photos if you're walking in the Capitol Building or on other federal property. But if you're in the local mall, then you better hope that your state has a video voyeurism law, and if it does, that it has made clear that you can expect some level of privacy in public. The example of video voyeurism demonstrates that privacy expectations do not turn solely on place.
Many places aren't purely private or purely public. Suppose you're in a gym locker room and somebody snaps a photo of you undressing and posts it online. Is the locker room a public or a private place? It isn't entirely private, since it is open to other people, and you're undressing in front of many others. But although you're not in seclusion, you can expect that others won't take photos of you. Restrooms, stores, bars, and other places are open to the public, but this doesn't eliminate your expectations of privacy in those places. Expectations of privacy turn on norms. You expect privacy in the gym locker room because the norms are clear that it is inappropriate for others to snap your photo in this context. And in the Nevada desert, the participants of Burning Man have established a set of norms about how others are to use photos.
So we're back to the Burning Man festival. The Burning Man case illustrates that a claim of privacy is not the same as a claim of absolute secrecy. The participants of Burning Man obviously didn't mind being seen nude by other participants. They didn't even mind having their photos taken by others. What they didn't want was their images being exploited by pornographers. All-or-nothing notions of privacy fail to grasp the central difference between fellow festival goers and commercial exploiters for porn. There's a mutual camaraderie among festival goers that isn't shared with the pornographers. The Burning Man participants thus had nuanced expectations of privacy -- about how their information would be used within a limited circle of people.
The Difficulties of Recognizing Privacy in Public
The law should begin to recognize some degree of privacy in public. But there are difficulties with doing so. Suppose you witness an interesting event on the subway and you want to capture it on your cell phone camera to post on your blog. If the people you were photographing on the subway had privacy rights in public, you might need their permission to post the photo. And if they are engaging in a social taboo, they might not be eager to give you permission. Should you be allowed to post the picture anyway?
The abstract hypothetical I suggest above can apply to a number of situations already discussed in this book -- the dog poop girl and the New York City subway flasher. One might ask incredulously: So the dog poop girl engages in a nasty transgression and the law will stop people from taking her picture and exposing her misbehavior? Should the law give the creep who flashes on the subway a right to sue a person who took a photo of him in the act? These are potential implications of a robust recognition of privacy in public. The law need not go this far, but is there a logical stopping point? I've discussed some of the problems with online shaming, so perhaps protecting the dog poop girl or the subway flasher has significant benefits in curtailing the abuse of shaming. One might argue that only people engaged in illegal activities or severe norm violations lack privacy, but who is to judge this? The average person with a cell phone camera? It is difficult to stop shaming unless we protect privacy in public. Doing so doesn't mean absolute protection, just a limit on certain kinds of uses and disclosures. People can still snap pictures and turn them over to the police. People should be deterred, however, from taking matters into their own hands by placing the photos online.
When the law begins to recognize privacy in public, the tricky question is: How much? Would streakers in Times Square still have the right to claim privacy if people posted their photos on the Internet? At some point, what is done in public is indeed public. There are no easy answers, and the resolution will depend upon the norms and expectations in each circumstance. The virtue of the binary view of privacy is clarity. It is an easy rule to apply. Yet the simplicity of this view is its downfall -- it seems far too outmoded given new technology. Therefore, although it will be difficult, it is better to develop and protect a more nuanced notion of privacy.
Accessibility of Information
In 2006 Facebook (a social network website consisting of millions of high school and college students) launched a feature called News Feed that instantly alerted users whenever their friends added information or photos to their profiles. Facebook users constantly update their profiles, adding new text and new images. They might update their roster of friends. The News Feed feature immediately notified all of a person's friends about each new change in that person's profile.
News Feed was met by an enormous outcry from users, who vociferously objected to the extensiveness of the exposure. According to one of the users, "Facebook is becoming the Big Brother of the Internet recording every single move." [23] "It's just so unnecessary," another user complained. "You don't have to know everything your friends do and the changes they make .... It's kind of creepy." [24] As one user expounded: "Before News Feed, yes, you could see the profile, and you could see the pictures, and you could see the comments, and you could see the relationship status, but the users felt that it was just for people who cared, and who wanted to know. But now, all of this information was thrown down the throats of everyone, and it was very strange." [25] Shortly after the change, a protest group called "Students Against Facebook News Feeds" emerged on Facebook. [26] People joined the group in droves. Within days, the number of protesters had swelled to more than seven hundred thousand. [27]
Facebook quickly responded. Mark Zuckerberg, the creator of Facebook, wrote an open letter to Facebook users: "We really messed this one up. When we launched News Feed and Mini-Feed we were trying to provide you with a stream of information about your social world. Instead, we did a bad job of explaining what the news features were and an even worse job of giving you control of them. I'd like to try to correct those errors now." [28]
The Facebook privacy debacle is especially interesting because it had nothing to do with the exposure of new information. No new secrets about Facebook users were being revealed. The information that the users complained about was already available on their profiles -- posted voluntarily by themselves. Instead, all the new system did was alert users to that new information. In other words, the Facebook system was merely making existing information more accessible. Perhaps this explains why Facebook officials were so surprised by the backlash. After all, Facebook users are not a bunch who seem very concerned about their privacy. Why, then, was there such a vehement reaction?
The Facebook change brought users an increased awareness of the privacy dangers of the Internet. Although Facebook users might think it is too quaint to expect all of their secrets to remain in the bag, this doesn't mean that they don't care about privacy. They just see privacy differently. What many of the Facebook users objected to was the increased accessibility of their personal data -- the fact that others would be alerted to every new update to their profiles immediately. Privacy can be violated not just by revealing previously concealed secrets, but by increasing the accessibility to information already available. The desire for privacy is thus much more granular than the current binary model recognizes. Privacy involves degrees, not absolutes. It involves establishing control over personal information, not merely keeping it completely secret. As the computer security expert Bruce Schneier argues: "People are willing to share all sorts of information as long as they are in control. When Facebook unilaterally changed the rules about how personal information was revealed, it reminded people that they weren't in control." [29]
For example, suppose you had a spat with a friend and wanted to eliminate that person from your circle of friends on Facebook. You might not want this change to be announced prominently to all your other friends. You might want the change to be made quietly, where it might be noticed by a few friends, or by no one besides you and the former friend. In other words, you might want some changes to fly under the radar. The binary view of privacy doesn't recognize the wide swath of middle ground between the realms of absolutely public and absolutely private. Increasingly, however, our lives occupy this middle ground. That's why I believe we must abandon the binary view of privacy and develop a more nuanced view.
CONFIDENTIALITY
Aleksey was an ambitious twenty-three-year-old student at Yale University. Desiring to be an investment banker, he applied to UBS, a global financial company. His application, however, was rather unusual. First of all, his resume was rather long -- eleven pages in all. Even more peculiarly, he sent along a seven-minute video of himself entitled "Impossible Is Nothing."
The video begins with Aleksey being interviewed as if he were a famous individual. The interviewer calls Aleksey a "model of personal development and inspiration to many around you," then asks, "How do some people like yourself become very proficient in their fields faster than most?" "Well, thank you," Aleksey replies. "I guess the first thing people need to understand is that success is a mental transformation; it is not an external event."
Throughout the video, with an aloof and serious tone, Aleksey pontificates about his philosophy of success. "Ignore the losers," Aleksey says, "bring your A-game, your determination and your drive to the field, and success will follow you." In other pearls of advice, Aleksey declares that "failure cannot be considered an option," and that "luck doesn't jump into anyone's lap."
The video frequently cuts to scenes demonstrating Aleksey's athletic prowess. He performs a series of rather unusual skills for an investment banker position. Aleksey lifts massive dumbbells, bench presses 495 pounds, serves a 140-mph tennis ball, does an acrobatic ski jump, and concludes by breaking a stack of bricks with a karate chop.
"If you're going to work, work," Aleksey declares. "If you're going to train, train. If you're going to dance, then dance, but do it with passion." The video then cuts to Aleksey dancing with a scantily clad woman to Chayanne's "Solamente Tu Amor." The video concludes with Hans Zimmer's "The Way of the Sword" playing over end credits.
Needless to say, Aleksey wasn't hired by UBS. But his video was forwarded around Wall Street, and it soon wound up on YouTube. In a short time, hundreds of thousands of people had downloaded it. Aleksey sent requests to websites to take the video down, but in vain. [30] Aleksey had become an Internet sensation. One media website in the United Kingdom declared Aleksey's video the "greatest CV ever filmed." [31] The mainstream media pounced on the story. The New York Post called his video a "six-minute ego-mercial." [32] An article in the New York Times declared that Aleksey "may be the most famous investment-banking job applicant in recent memory." [33] Throughout the blogosphere, people accused Aleksey of being a pathological liar, of faking the feats in the video, and of plagiarizing in a book he had self-published. At DealBook, a blog sponsored by the New York Times, [34] commentators to a post by journalist Andrew Sorkin declared:
That kid should be snipped of his degree. It seems reasonably clear that he has lived a life of lies.
Another victim of a self-absorbed, dishonest and Idol-worshipping American culture.
What an insufferable, self-absorbed, arrogant and self-aggrandizing jerk. In other words, a perfect fit for Wall Street.
Aleksey appeared on television media shows to respond to his worldwide mockery. On MSNBC, Aleksey stated in an interview that he was shocked to see his video and resume spread across the Internet. His resume contained his phone number and email address, and he was receiving harassing cell phone calls and thousands of nasty emails. [35] At Harvard students threw an Aleksey theme party, with people dressing up in karate uniforms and dancing attire. [36] The blog Gawker anointed Aleksey with the tide of "pioneer Douchebag." [37] In an interview on ABC's 20/20, Aleksey stated that he thought he had no chance now for a career on Wall Street. "So far," he said, "it's been like going through hell." [38]
Did Aleksey get what he deserved? Perhaps such a pompous person should be put in his place. But at what cost? On Sorkin's DealBook post, other commentators questioned whether it was appropriate for Aleksey's resume and video to be leaked on the Internet:
I am deeply disturbed [that] a resume sent in confidence to a highly respected firm had been made public and that confidence [was] broken. Should we all worry about where [our resumes] end up once sent to the firm of our choice?
Although the kid is obviously a ridiculous egomaniac and not a particularly good liar, the real guilty party here is UBS.
This fellow is being subjected (in Clarence Thomas' immortal words) to a "hightech lynching." Whether or not he embellished or misrepresented anything in his job app or his resume or anything else in his life, it's beyond the pale to have the entire snarky Internet ... pile on him in public.
In all fairness to UBS, the precise story of how the video and resume got leaked is unclear. UBS issued a statement about the matter: "As a firm, UBS obviously respects the privacy of applicants' correspondence and does not circulate job applications and resumes to the public. To the extent that any policy was breached, it will be dealt with appropriately." [39]
Assuming Aleksey's application was leaked by somebody at UBS, is the application really private? One could argue that Aleksey's application was no longer private after he sent it to UBS. However, there is a significant difference between a few employees at UBS having a chuckle over Aleksey's application and the entire world making Aleksey the butt of their jokes. Although the video wasn't completely secret since Aleksey exposed it to some people at UBS, the general public wasn't Aleksey's intended audience. Should the law respect Aleksey's desire to expose his personal information selectively? Or since he revealed his information to others, can he continue to claim that it is private?