What Privacy Now Means to Me

In Fall 2008, I traveled with my family through mainland China and Hong Kong. It was a wonderful trip, providing us with insight into a culture very different from those we have lived with in California, New Hampshire and Minnesota. Not only did we learn about “Asia” but we learned the many differences between China and Hong Kong, Beijing and Shanghai, rural and urban, North and South, and Han and minorities – to name just a few.

In another column, I’ll talk a bit more about my talks at various universities. (These were: University of International Business and Economics in Beijing; East China University of Political Science and Law, Shanghai; Beijing Normal University – Hong Kong Baptist University – United International College; and the University of Hong Kong.)

Perhaps the most striking experience of the entire trip occurred the first day. As we met our guide in Tiananmen Square (天安门广场), dozens of tourists and locals began taking photographs of our nine-year-old son.

Most people asked politely if they could take a picture, while others sneaked their shots without acknowledging their interest.

As the trip continued, shopkeepers and passersby regularly pet my son’s curly hair, asked for pictures or just beamed at us. Others marveled that we traveled with two sons – few individuals in Mainland China dare to violate the one-child policy or enjoy the luxury of siblings.

While I’m sure my son is not nearly as well photographed as Yao Ming of the Houston Rockets, his picture has become quite prominent throughout photo albums and on Baidu (百度 )China’s premiere search engine.

Most importantly, my son enjoyed the attention. We never required him to pose. We also did not give out our names. The lack of physical privacy was balanced by a sense of anonymity so that the photographs were never a cause for any concern. The people taking the photographs were almost always polite and respectful of our privacy. The invitation to pose with them created a new sense of community and belonging that added to our experience.

Talking with some parents about the trip, we have been asked if we were concerned that the attention would encourage predatory behavior. Of course this is a fear that every parent has, but it is a not a statistically significant fear, according to a recent study by The Berkman Center. But like other statistically insignificant fears – airline accidents, for example – the relatively low incidence rate must also be compared to the horrific consequences caused by any incident. As a result, attorneys general from across the country have forced MySpace, Facebook and other sites into “voluntary” efforts to expunge registered sex offenders from their membership rolls.

Since returning to the U.S., I have been assisting companies (and individuals with websites) to update their privacy policies and data practices. Social networks such as MySpace, Facebook and Linked-In have learned the same lessons that we learned on our travels. To provide a reasonable privacy policy, the individuals identified must be comfortable with how their pictures and information are to be shared. At times, this means that anonymity is sufficient to allow posting of pictures. More often, however, it means creating a level of restriction that provides confidence that the material posted is available only for its intended audience.

As a practical matter, website operators must recognize that privacy protection is a matter of trust for the online community created by that site. Failure to maintain that trust will result in a loss of support well before any legal consequences start.

So here are a few of the necessary steps that website owners should consider when posting photographs of individuals or private information about those people. The five key principles recommended by the U.S. Federal Trade Commission are:

1. Take stock. Know what personal information you have in your files and on your computers.

2. Scale down. Keep only what you need for your business (or your website).

3. Lock it. Protect the information that you keep.

4. Pitch it. Properly dispose of what you no longer need.

5. Plan ahead. Create a plan to respond to security incidents.

The FTC guidelines are applicable to every business and every personal website.

Taking Stock: Website owners must know what private information they have accumulated. This means knowing when they have received names, birth dates, addresses, social security numbers, credit card numbers, passwords and other sensitive data.

--     In 45 states, the accidental release of private data (through error or third-party theft) requires a mandatory report regarding the theft of that information to the state’s attorney general and the individuals affected.

--    Efforts are underway to prohibit the use of social security numbers for other forms of identification.

Scale Down and Pitch it: General information and trend data are becoming increasingly valuable as an asset to understand consumer behavior. But the underlying individual information is less valuable to companies who own that information. Particularly if the information held includes data regarding minors, health care, financial services, or other protected information, the obligations to maintain the integrity and security can only be eliminated if the information is properly expunged from the company’s files.

Lock it: Thieves are attracted to vulnerable targets. The information that is publicly available without any authentification should be information for which the entire world should have access. If a site includes personal photographs, dates of birth, social security numbers, passwords, credit card information, unpublished addresses or telephone numbers, or any other form of protected personal information, then the website must be structured so that each page can be viewed only by authorized users.

--   If there are no efforts to restrict a website, then very few of the legal protections for data are available in the event of misuse of that data.

--  Depending on the manner in which the data was gathered, the failure to provide reasonable restrictions may result in liability for the host website.

Plan ahead: The importance of trust in the online community should serve as a sufficient inducement to be forthcoming when security breaches occur. Since there is mandatory reporting regarding the theft or loss of private information, the website operator must know what has been stored, who may have been impacted by any data loss, and how to minimize the risks.

We chose to let my son have his picture taken while we traveled through China. We usually said yes, but occasionally demurred. We also choose where to post our family photographs, where to conduct online business, and who we trust.

So long as the companies and individuals who host the websites we frequent meet the FTC guidelines for protecting my family, I hope we all continue to promote these sites and encourage their use. But to protect all of us, we must be sure to remain selective. The obligation to protect privacy is not restricted to the large social networking sites. Every picture posted creates a choice regarding privacy for those in the photograph.

We learned about many differences in China. The invitations to pose for pictures and become part of a shared experience made for a wonderful journey. In the same way, the role of a website is to invite its users into that shared experience and respect the boundaries the users wish to establish. Without too much effort, every company or personal website can make their privacy practices a tool to build community and trust. Planning ahead, taking stock of the information, and keeping it safe are the simple steps to build a better virtual world.