Privacy and Balancing Institutional Power

One of the purposes of privacy is to maintain a balance between individual freedom and institutional dominance. While governments, businesses, and other large institutions may have legitimate needs for information, without privacy protections, they can encroach on the personal space individuals need to flourish. One of the dangers of the information processing power of the computer is that it can be used to upset that balance.

Computer power is available to anyone who can afford it; but it is predominantly large institutions that have the resources to obtain it and many will use it as a means of control. Bureaucracies value efficiency, predictability and uniformity. It makes their jobs easier. And a certain amount of regularity and authority is beneficial to society. But society also needs diversity, freedom, dissent, creativity, even a certain amount of mischief. It hurts society as well as individuals when control is too rigid and all-encompassing.

The most obvious agent of control is government. In the name of security and enforcement of the obligations of citizenship, governments are always on the lookout for those who show abnormal social behavior, as noted earlier. But control is an issue in the private sector as well. Employers now use computers to screen and monitor employees. The employers contend that the monitoring information is needed to make their operations more efficient, to gain more reliable information about employee performance and to hold employees accountable. But many employees experience it as intrusive and controlling.

Many employers also monitor employees' electronic mail and online activity. As far back as 1993, a Macworld survey of companies in a variety of industries found that 21.6 percent of the companies searched employees' computer files, electronic mail and other electronic communications. ¹ Less than 10 years later, a survey by the American Management Association found that the percentage of employers monitoring their employees had almost quadrupled to 78 percent. ²

A frequent target of this monitoring is employee email. Email monitoring is relatively easy for employers, because electronic mail messages are stored as files on computers owned and operated by the company. Normally either the messages are kept on a centralized computer waiting for employees to read them, or they pass through such a computer in transit. In either case the messages can be copied, stored, read and passed on to superiors by a system administrator or automated process. Even if the messages exist only on an employee's desktop computer, they can usually be accessed over a network.

There are a number of reasons why employers might want to monitor employees' email. It might reveal fraud, theft of intellectual property or other illegal activities. For example the software company Borland International used recovered email messages as part of an investigation leading to criminal charges against a former employee for stealing trade secrets. ³ Email monitoring can also alert employers to employee activity that is wasteful, disruptive or against company policy. In 1990, for instance, two employees of Nissan Motor Corp. were fired when supervisors reading their email found they were receiving messages that were "sexually suggestive." ⁴ Companies are increasingly finding it necessary to watch for and regulate emails and other online workplace communications that could be taken as harassing, in order to protect their employees and protect themselves from liability. ⁵ Even when there is no question of wrongdoing, email monitoring can help employers assess employee performance, by showing how employees are spending their time, what they are accomplishing, and so on. Or it can help managers track the progress of a project by seeing what work is being done, what problems have been encountered and what responses have been tried.

Some companies also have more comprehensive monitoring of employees' online activities while they are in the workplace. They track what programs employees use, what Web sites they visit, messages posted on bulletin boards, chat rooms and social networks, and so on. They can even inspect files that are stored on company computers, servers and storage devices. They do this for many of the same reasons they watch email, to find and stop illegal and destructive activity and to assess employees' performance.

Employers generally claim ownership of employee email. They argue that because it is created, transmitted and stored on company systems, generally on company time, they should be able to inspect it. They make similar claims about other online employee communications when they use company-owned computers and the company's network. This has generally been accepted by the courts, as long as employees are informed that they are being monitored and they receive due process before any punitive action is taken. ⁶

There are, however, some serious privacy concerns connected with monitoring employee email. Employees do use it for personal communications, usually with the expectation that it is a private medium. And, as studies show, there are aspects of email that encourage that sense of privacy. The user usually creates the message while working alone on a personal desktop system, using an email account that is password protected. Normally there are few sensible indicators that anyone but the addressee will have access to the message. Indeed, because computers seem so impartial and create a distance between human correspondents, many people find it easier to disclose personal information through the computer than via other media. ⁷ To the user, then, email is not substantially different from telephone calls or personal letters; and in that mentality employers therefore have no more right to monitor email than to eavesdrop on telephone calls or open personal letters. It is generally recognized that the privacy of these more traditional media is protected both legally and morally. Why not email? One could make a similar argument regarding other private online communications and activities.

Another issue is the consent of the employees being monitored. Employers claim that employees know, or should know, that email and other communications are easily accessed and intercepted, and that employers have reason and authority to do so. Therefore by using email on the company system, employees are implicitly assenting to having the email inspected. This argument does not hold up in all cases, however. Some companies do not have a stated policy on monitoring. In the Macworld survey, for example, only 18 percent of the companies surveyed said they have a policy on electronic privacy. ⁸ If a company does not clearly inform employees that all online activity is subject to inspection, they cannot assume that the employees agree to it. Even if there is a stated policy that email will be monitored, the practice is still a threat to the privacy of outside correspondents who send personal email to employees not knowing that it may be read by others.

Finally online monitoring, like the other practices considered in this section, threatens to upset the balance in the relationship between the institution and those that are subject to it. Even employees have rights to a certain measure of privacy and autonomy, which must be balanced against management's legitimate need for information about employee behavior and performance. Shifting employee communication to a system that is much easier for employers to monitor changes the balance. Management now has more access to employees' personal and work lives, which gives management more leverage and control, leaving employees more vulnerable. Granted that a company is not required to provide employees an electronic mail system for personal use, once it is there, especially when employees are required to use it for their work, there must be restraints on management to protect employees from too much intrusion into their personal communications. Nor is it sufficient for management to warn employees to use online communications only for work. Good employees invest their persons in their work, and work relationships are also personal relationships. The two are not so cleanly separable.

It is even more problematic when employers monitor employee activity on social networks and other communication sites, when the activity takes place on the employee's own time and with his or her own equipment. Yet that is a growing practice. A 2012 study by Gartner found that about 10 percent of corporations monitored the postings of employees on Facebook, YouTube and other social media; but they expect that to grow to 60 percent by 2015. ⁹ The companies' main reason for doing this, according to the report, is to find instances of employees posting confidential information online. Businesses have a legitimate interest in protecting confidentiality; and one could make an argument that looking for potential security leaks is justified if the postings are public. However, employers have also been looking into employees' or potential employees' personal activities on social networks to see if they are doing anything that seems unprofessional there, as well as searching for critical remarks employees might be making about the company. This raises some serious privacy issues. As one critic put it, "Actually much of what is discussed [in the Gartner report] is unwarranted snooping in people's personal lives. There is no valid reason for it and companies that engage in such activities should be called out for their unethical activity." Another pointed out that a company could be charged with discrimination if they seem to be basing personnel decisions on personal information involving protected areas such as religion or sexual orientation or attempting to suppress free speech. ¹⁰

Some employers have reportedly even gone so far as to require applicants for employment to submit their login and password information for Facebook and other social networking sites so the company can look at their personal data. This is clearly an invasion of privacy and has provoked a strong reaction from the public, which has been picked up by the government. The state of California, for one, passed a bill banning the practice; and there have been calls for similar legislation at the federal level. ¹¹

Another area where computers give large institutions an advantage over individuals is in the use of massive databases of personal data, as discussed earlier. Banks and insurance companies try to reduce their risks by learning more about potential customers and weeding out those who, because of their history, neighborhood, ethnic ties, economic status or similar factors, seem that they might pose greater than normal risks. This creates a conflict between the companies' self-interest and society's goal of providing equal opportunities for health care, housing, economic advancement and so on to all its citizens. As the companies gain more power through computers to characterize and discriminate among potential clients, society's goals for equity are less well served.

Many of the data gathering and processing techniques noted already, such as matching and compiling dossiers, can be used to identify, investigate and suppress "deviants." Those who do not conform can be singled out, publicized, and pressured or ostracized. In many cases just the knowledge that such control can occur can have an inhibiting effect.

There are other computerized methods that have been developed to exercise social control. One is personal profiling. This goes beyond detecting behavior that is considered dangerous, threatening or expensive and tries to predict it. The idea is that historical data and sometimes presumptive rules are used to build a characterization of an ideal, normal or acceptable subject. Those who differ too much from the norm or fall outside the limits of acceptability are then pressured to conform or excluded from participation.

For example, in Germany data on medical costs were analyzed to build a model of patient behavior that would lead to the lowest costs. When patients did not conform to this model, they were contacted and asked to consult with a doctor about ways of controlling costs. ¹² In a number of countries, including France, Germany and Norway, data on the early childhoods of children who later showed troublesome behavior was studied to identify characteristics of the high risk child. Children who showed these characteristics were then subject to social and medical interventions. ¹³ In the United States, the Internal Revenue Service analyzes samples of tax returns to build a model of the potential tax evader. Returns that fit this model are then selected for audit. ¹⁴

With the increased ability to collect and analyze genetic material and to use it to predict medical and psychological risks, as well as future behavior and other outcomes, this activity could extend into even more sensitive and personal areas. This led the United States in 2008 to pass the Genetic Information Nondiscrimination Act, which prohibits employers and insurers from discriminating against applicants based on genetic characteristics. ¹⁵ Nevertheless, with the growing use of genetic databases, there is still potential for abuse.

In these and similar cases, the objective is to identify and control people who might not fit the norm for a "good" citizen or client. This could prevent harmful, destructive or costly behavior. In some cases it could even be in the best interests of the people who are singled out for special treatment, such as the high risk children. Nevertheless the implications are ominous. These programs are intended to force conformity on the entire population. Everyone is subject to examination; there is no place to hide for someone who chooses to be different. There are the usual objections to using data without permission for purposes other than those for which it was intended. And most distressing of all, people are judged not on anything they have done, but on what a model predicts they might do. At best there could be some evidence that some individuals with similar profiles have caused some problems. At worst these individuals simply don't fit some bureaucrat's idea of a "model" citizen. There is too much room for injustice here. It leaves people who are different, for any number of reasons, vulnerable to discrimination, harassment and exclusion.