Introduction
A police drone peers through a second-story apartment window to inspect whether an armed robbery suspect is there.
Facebook withholds advertising for financial services from older users and female users.
A consumer is tricked into sharing more personal information than they intended.
A family living in a predominantly Asian American neighborhood is charged a higher price for SAT test preparation.
Farm robots outfitted with cameras and data processors collect and crunch data to optimize farming.
A pregnancy-tracking app grants pregnant users’ employers a royalty-free license to mine their de-identified personal information.
A renter is denied an apartment after the screening company’s automated background check system incorrectly pulls in criminal records for women with different middle names, races, and birth dates.
Each of these scenarios, and countless others, have been recognized as problems involving “privacy.” Are they? This vibrant, interdisciplinary field with decades of history possesses no real sense of what constitutes a privacy problem and what does not. Though these scenarios implicate different values and arise from different contexts, none would be out of place at a privacy law conference. Yet other types of information-based harms—TikTok users sharing a fake screenshot of a nonexistent CNN headline suggesting that climate change is seasonal,
for example—would be out of place. Why? No one can say.
Throughout the twentieth century, scholars sought to define and distinguish the concept of privacy. A parade of articles and books, from The Right to Privacy onward, offered varying definitions for this elusive idea.
Privacy amounts to a right “to be let alone,”
these works argued, or “the control we have over information about ourselves.”
Privacy involves access to the self or self-determination.
Over one hundred years of debating solitude
yielded no universally agreed-upon definition. But that did little to deter privacy scholars from trying.
At the turn of the millennium, a new voice arose that would come to shape the field of American privacy scholarship for decades. In a series of articles and books, Professor Daniel J. Solove dismissed attempts to define privacy as invariably over- or underinclusive.
Embracing a pragmatism similar to that of Justice Oliver Wendell Holmes, Jr.,
Solove exhorted the field to abandon the quixotic quest to attach a single definition to privacy.
In its place, Solove offered a taxonomy of “the specific activities that pose privacy problems,” a loosely correlated set of concerns and concepts that have come to be associated with privacy in its many forms.
The taxonomizing of privacy was not without precedent. Professor William Prosser famously distilled four privacy torts from decades of case law,
and Professor Alan Westin compiled a taxonomy of privacy attitudes.
Nor has the taxonomy of privacy entirely evaded critique.
But Solove’s specific rejection of privacy conceptualization in favor of a taxonomic approach continues to exert a profound influence on the shape of contemporary privacy scholarship. As Professor Woodrow Hartzog recently explained, abandoning definition in favor of taxonomy helped breathe new life into the field.
Unburdened by a need to define privacy, the past two decades have seen a Cambrian explosion in the arguments and issues at the heart of mainstream privacy scholarship.
This Essay argues that the long-dominant social-taxonomic approach to privacy and privacy law is no longer serving the field. There are several important reasons why. First, social recognition alone is not—and never has been—a sufficient criterion for what counts as a privacy problem. Instead of comparing an information-based harm to a set definition of a privacy harm, the taxonomic approach asks whether the right people or institutions—typically courts, public officials, and established scholars—talk about the harm as involving privacy.
In and of itself, this approach raises critical questions about authority, legitimacy, and whose voices should be heard and valued when it comes to identifying new privacy harms.
The social-taxonomic approach also omits, and arguably impedes, the development of a sophisticated framework for interrogating the tension between the various values under the privacy umbrella. For example, many free speech scholars see privacy as an impediment to self-expression.
Other scholars in the critical tradition have explored how privacy is deployed as cover for subordination.
And a decade or more of work in algorithmic accountability illustrates the tension between privacy and antidiscrimination or fairness.
Yet this expansive, criteria-free approach to privacy has come to fold in information-based threats to self-expression, antisubordination, and fairness as core privacy concerns.
The result is a proliferation of vexing “privacy–privacy tradeoffs”
with little hope of reconciliation.
Situating privacy law within the broader structure of information-based power has become a critical task for scholars and policymakers alike. American privacy law scholarship has yet to even reconcile the basic distinction between privacy and data protection,
let alone the new modes of information governance that European and other societies are exploring today.
Distinguishing privacy from data protection, content moderation, or antidiscrimination law would shed light on the precise goals societies are trying to meet, the range of approaches that exist to meet them, and the institutions best suited to address these issues. The FTC, for example, may be better positioned to address violations of information privacy, whereas the DOJ Civil Rights Division is better versed in antidiscrimination law. But to this day, the European Union has not recognized any American federal agency as a data-protection authority, in part because our information governance goals are imprecise and scattered haphazardly across various institutions and agencies. As a result, only recently have the United States and the European Union agreed on a privacy framework to share data.
It is imperative that we try to understand what work the concept of privacy is doing in today’s complex information environment. As it happens, some of the leading and emerging lights in privacy law scholarship are beginning to disentangle privacy from other information-based values, reminding the field just what we are experts in.
The time has come to leverage this literature in service of a new direction for the field.
The Essay proceeds as follows. Part I traces the efforts of twentieth-century privacy scholars to define our subject matter, culminating in Solove’s intervention in the early 2000s, and acknowledges the generative role of privacy’s taxonomy paradigm. Part II argues that social recognition has always been a flawed means by which to distinguish privacy and that privacy as taxonomy stands in the way of identifying, reconciling, and distinguishing privacy harms in a diverse and complex information environment. Section II.A discusses information-based harms that privacy law was late to recognize, such as information-based discrimination and algorithmic manipulation. Section II.B discusses unresolved tensions between and among privacy and other values.
Part III outlines a post-taxonomy research agenda for privacy law, one that decouples classification from social recognition, foregrounds the role of reflexivity, and begins to answer the deep question of just what work privacy is doing in the context of information-based harms. Misinformation, hate speech, bias, data sovereignty, labor extraction, and many other contemporary concerns implicate or involve privacy but sound in different values altogether. By uncritically broadening the concept of privacy, most Americans are missing out on a global conversation around data protection, information governance, and harm mitigation. Only by distinguishing privacy can privacy law reach its full potential as a discipline and a body of law.