Public posts, Privacy and Ownership

Like many people interested in data ethics, I feel a deep disquiet about data-scraping of public social media posts.

I used to think that I could explain this by arguing for a presumed default copyright status drawn from the intentions of social media users. TL;DR this is probably CC-BY-NC-ND, with classes of exemptions to ND (e.g. if someone makes a joke they are generally happy for it to become a meme, but if they say something about themselves, ND holds) and BY (e.g. if researchers are looking for patterns such as certain terms appearing more frequently at specific times or in a specific region). But I am now inclined to think that introducing copyright concepts makes people immediately think it is a legal issue not an ethical one. For all I care, the sort of inferred default copyright I am talking about may not be legally enforceable in any, let alone most, jurisdictions. The point was not to bring laws and regulations to bear, but to help people understand what is ethically acceptable.

In this post I want to explore whether the formulation in terms of copyright reflects a deeper ethical point about ownership and privacy. After all, copyright is a way of saying that others have some, but not other, permissions to use your material, and to own something is just to have certain rights to use it in some ways but not others. When someone makes a public social media post (like this one!), they still own it in the sense of retaining some rights, but they have given other rights to its use to anyone who should come across it.¹

Private vs Public Property
I live near a military barracks which abuts a common - called a 'stray' around here - i.e. land which is publicly owned and to which any member of the public has considerable rights of access and usage. On the fence separating these two spaces, the Ministry of Defence has erected signs saying 'Private land - No access'. This is false but effective. It is false because the land is just as much publicly owned as the common. But for all that the rights of access and usage are very different: the common is for all to enjoy (and freemen of the city to graze their livestock on), the barracks land requires permission to enter and further permissions for specific uses. Similarly for other public property, such as government buildings or even presidential palaces.

The sign is effective because we tend to assume that the owner of private property has the right to exclude anyone else from using it. We associate private property with absolute ownership. And thus we also assume that the general public can only have rights of access and usage, as opposed to permissions granted at the discretion of the owner, if the property is publicly owned.

While there have been centuries of legislation giving ever greater rights to owners of private property, we can see that absolute ownership of private property is in fact limited in some small ways. Take a trivial but significant example: if a car is parked on a public street, anyone may lean against it to steady themselves or tie their shoelaces. So long as they don't do any damage, and don't restrict the owner's ability to exercise their rights (e.g. by refusing to move when the owner wants to drive the car away), then the rights of ownership of private property to not extend to prohibiting that use.²

Similarly, and whatever the MoD sign makers might think, there can be general rights of access to privately owned land. In England this is usually limited to defined public footpaths, but in many countries in Europe and other continents, and even within the UK in Scotland, there is a general right to access land for leisure purposes so long as no harm is done or inconvenience caused.

So when it comes to property, there is not a sharp dichotomy between public and private. It is neither the case that owners of private property have exclusive use in all respects nor that owners of public property (us!) cannot have their rights of usage restricted.

Privacy and control
Many theorists of privacy are attracted to the idea that the core of the concept of the right to privacy is the right to control information about yourself, in particular, to control who knows it. Let's grant this and explore the consequences. Three consequences almost everyone seems to accept are:

1. If the state requires some information about a person to be made publicly available (e.g. court records), then that person has no right to exert control with respect to who knows that information.
2. If a third party makes some information about a person publicly available, they have lost their privacy with respect to that information because they have lost control of who knows it (though they may be able to claim redress and even attempt to reclaim their privacy).
3. If someone voluntarily and knowingly makes some information about themselves publicly available, they have given up their privacy with respect to that information because they have given up control of who knows it.

The so-called 'right to be forgotten', i.e. to have information about oneself removed from search engine results, is a limitation upon the first, but it is not clear that this is about controlling who knows but how that information is presented and given salience by search engines. The second is also complicated because while the privacy is lost, we may think that other people ought to 'look the other way' and try to avoid coming to know those things, by avoiding the outlets through which it is made public. Thus if we find out that a person has had intimate photographs stolen and made public, we ought to respect their (now lost) privacy and take some care to avoid encountering them.

I want to focus on the third, which few have challenged or sought to nuance. (3) is the ethical basis for data-scraping practices: if you have put some information online for anyone to know, then you have made it public and any private rights over it have been given up.

But we can see from our discussion of public and private property, that this appeals to a false public/private dichotomy. Think again of the case where information - such as intimate photographs - has been made public against the subject's wishes. In such a case there is an obligation to respect that person's privacy. We understand that ethically this is information they should be able to control who knows, and thus, assuming they do not want us to know it, we should try to avoid it and certainly not in any way use it. We certainly have no rights to use it for our own ends. It is 'public' but it is also 'private' and ethically, we should respect it as private rather than exploit or otherwise use it as public. This is a bit like finding money someone has dropped on the street: while nothing stops us from using it for our own ends, we ought to respect the fact that someone else owns it and has not given us permission to use it.³

So what of the third consequence, where the information has been made public knowingly and voluntarily, perhaps by being shared on a public social media channel? It is obviously public but that does not entail that it is not also, in some ethically relevant sense, private, nor that we have unlimited rights to use it as we wish.

The privacy of public posts
If the direction of my argument is right, that a public social media post makes information publicly available does not necessarily remove all ethically relevant senses in which it is private.⁴

It is true that when someone posts something publicly on social media they have lost control over who knows it. But relinquishing control over something is not the same as giving permission to use it. Going back to private property: if I leave my car with the keys in it, I have lost control over who drives it, but I certainly have not given permission for anyone who wants to drive it away. Closer to informational privacy, if I leave my personal diary where someone can read it, I have not given permission for it to be read.

Control is an exercise of power, whether it is controlling who drives my car or who knows my business. Not everyone has equal power, sometimes because they lack the knowledge to exercise available control, sometimes because they are open to exploitation by the more powerful. None of these differences in power to control what is known about themselves affects the right to privacy.

We should distinguish two sub-cases of (3):
i. the person who makes some private information public because they do not fully understand their action or have been manipulated (e.g. through dark patterns and coercive consent);
ii. the person who willingly and knowingly makes that private information public.

In the first sub-case I hope it is obvious that we should respect their privacy. What that amounts to may be context sensitive but there are clear cases of privacy violations long before we get to data-scraping or use of the information by bad actors, namely trolling strangers about personal posts. Just because anyone can read/see the public post, the subject has not given permission for anyone to comment or respond in any way they like and doing so fails to respect their privacy. This kind of troll is encroaching on matters that are none of their business. The lack of permission makes such actions unethical.⁵

This last point also applies in the second sub-case. Someone who willingly and knowingly publicly posts a family photo may be unwise, and possibly naïve about the motives of other people, but they did not give permission for that information to be used in any way that anyone who finds it wishes. The most likely motive behind most public media posts of private information is pride, and the use they want others to make of it is probably to approve, compliment and envy. People who don't want to use the personal information in those ways still have the knowledge, but they don't have permission to use that knowledge in other ways.

Concluding philosophical observation
I noted above that many theorists of the right to privacy focus on the right to control who knows things about you. Sometimes they ground this in an interest, namely the interest in how you appear to others. I think that interest and the right to privacy come apart in various ways, but that hasn't been my topic here.

If these reflections point in the right direction, then the core of our right to privacy is not limited to control of what other people know. We can lose control of who knows something about us and still maintain some privacy rights: others may be limited in what they have permission to do with that knowledge.

I suspect this has been obscured by the focus on examples of personal information where merely knowing that about someone will lead to judgement about them or their character. For example, if you know someone's income, then you will be inclined to judge their behaviour as mean or generous, their work as overpaid or underpaid. But these judgements are things we do with the knowledge and it is possible to not make them. So in so far as the concern for privacy is a concern to control what others know, that presupposes that they will find some actions - such as judging - irresistible. And that explains why someone might share private information with people they trust not to judge them like that, but not with others.

The most fundamental aspect of the right to privacy is ownership rights over personal information. Privacy is the right to control what others do with your personal information, just as private property is the right to control what others do with your property. Both have limitations. Both can be achieved by restricting access. But neither boils down to the right to restrict access, and thus neither is entirely given up when access is not restricted.