You're Asking the Wrong Questions About Privacy

Are you the kind of person who brags about your sexual experiences at work? Do you share your income level with everyone around you? Do you openly discuss your children's medical issues with total strangers? Do you discuss your digestive issues the first time you meet someone new?

If you answered "yes" to any of those questions please reach out to me so I know not to share my personal information with you.

Now let's go through those questions again. Does your social media company share your intimate details with their employees and AI systems for "training" purposes? Does your ISP track every website you visit by monitoring your DNS requests? Does your Dr's office share sensitive information about your diagnoses and general health with their "business partners?" Do your utilities, credit card providers, and banks share your financial data with financial data clearing houses around the world, who are then sharing that info with anyone who pays to access it?

If you didn't answer "yes" to all of these you're either not using these services or you're just not aware of what's going on. I'll congratulate you on living off the grid if the former is true, and ask you to spend some more time investigating your own world if it is the later. (of course, the fact that you're reading this at all means the first situation can't be true)

There are a number of factors that have contributed to this sad state of affairs:

• A caveat emptor attitude towards legislating privacy - that's your problem, not the government's.
• The corporate assumption that tailoring every experience to you, specifically, will be both cost effective and appreciated by you.
• The monetization of tracking everything you do to support selling and marketing to you, specifically.
• The subsidization of online services and tools we take for granted but that are actually commercially supported and not freely provided.

While I don't pretend that we'll solve for all of these overnight, it does help to change our frame of reference when it comes to privacy by changing some basic questions or assumptions we make as we interact day-to-day with those who request our data.

Wrong Question: What Information Do You Need From Me?

I know you've asked this out loud at least once or twice. On the other hand, I am willing to bet you've essentially asked this question silently many, many times. I'll even bet that at this point it is just a subconscious idea that no longer even forms as verbal words in your head, you just sigh and acquiesce to the pile of questions you're about to answer about yourself.

• The info that websites wants as you just try to place an order for cleaning products. Your real name, address, your credit card info, your email address, your phone number, and say, wouldn't you love to create an account so we can more easily retain this info on your behalf?
• The form in the doctor's office that wants not only your medical conditions, but your insurance information, social security number, people to contact in an emergency, history of mental illness, substance abuse, full demographic information...all just to check in for a routine physical.
• The natural gas provider wants to run a credit check to make sure you're good for the <checks the fine print> $60/month average bill you'll have monthly.
• The worker at the checkout who wants your phone number for "rewards."
• The website that wants your exact date of birth before showing you content that may be inappropriate for immature viewers - as if maturity is somehow tied to calendar age anyway...

To be more privacy focused I'd recommend re-framing the question to:

How and why will you use this information you are asking for?

One of the things I appreciate about GDPR - the European Union's overarching privacy law - is that it requires companies to tell you why they need your information. For example, that website asking for your date of birth would need to tell you what they're using it for. If they tell you it is to verify that you're over 18 and able to then access their content, fine. But if they suddenly send you a "happy birthday" email without telling you they'd use the information for that, they're violating the law. That simple.

I also find that it turns out many businesses ask for data they don't actually need. For instance, back in the early 2000's I purchased my first home. I had to then contact all my utility providers: phone, gas, electric, and water in order to sign up for service and billing. Each of them wanted my social security number and other sensitive data in order to run a credit check. I asked each of them if there was any other way to sign up for service, and foe each of them there, in fact, was a way that didn't require me handing over significant identifying data to them. I've been enjoying heat, lights, water, and telecommunications ever since.

Wrong Assumption: I Trust You With <Blank,> Surely I Can Trust You With My Private Data

We all do it.

• I trust you with my healthcare, surely I can trust you with my private data.
• I trust you with my money, surely I can trust you with my private data.
• I trust you with my car, surely I can trust you with my private data.

Let's turn that back around, shall we:

• I trust you to protect my data, surely I can trust you to diagnose and treat my appendicitis.
• I trust you to protect my data, surely I can trust you to build my home well.
• I trust you to protect my data, surely I can trust you to fix my car.

But those examples - which I assume are self explanatory - aren't the only reason this is a horrible assumption. Ever read the fine print of those things you actually sign? Every single one of them has some variation of this statement:

We may, at our sole discretion, choose to share your private data with our business partners for reasons that make sense to us, and that we aren't going to take the time to explain to you or get your individual approval for, so just agree now that we can do whatever we want within the bounds of the nearly nonexistent laws on this subject.
Sign here:_________________ Date:____________

What this one line (or the actual contractual language that I have just lampooned) really means is that you aren't just trusting your doctor, your bank, or your mechanic: you're trusting anyone that they choose to also trust with your information. This is literally how credit bureaus get information about you. This is how data brokers get your information. This is how car insurance companies get the information to set your rate in part based on your credit score - assuming your jurisdiction hasn't explicitly outlawed this practice.

The assumption you should be making is this:

You're going to share my data with others. What is the maximum information I'm comfortable letting you share?

Wrong Question: What Do I Have To Hide?

We've all heard this question in some form or another:

• If you're innocent why not cooperate with investigators?
• Isn't the safety of your fellow citizens worth giving up some privacy?
• Isn't keeping kids away from sexual content worth requiring us tracking you online?
• Oh please, what is so special about you that you're worried about Mark Zuckerburg/Elon Musk/ByteDance/Google/etc. knowing about it?

Usually this question is phrased in such a way as to make you feel guilty, or like an outlier if you don't acquiesce to the demand to share data. But the question you should be asking - or ask back to anyone who is trying to pressure into oversharing is this:

What Business Is It Of Yours To Know My Private Information?

Because the truth of the matter is, we all deserve privacy. And we all expect privacy when it comes to our physical lives. Don't believe me? Look around. Why else do so many cars have tinted windows? Why do homes have shades and blinds on the windows? Why aren't all the doors glass?

Wrong Assumption: Data Privacy and Physical Privacy Are Different Things

Unfortunately we've built up this crazy idea that data privacy is somehow different from physical privacy, and I tend to believe this is because we've found socially acceptable ways to monetize private data, while we actually have strong laws about enforcing (at least certain kinds of) physical privacy. Don't believe me? Do this thought exercise: ask your favorite AI/search engine about local laws against filming and distributing private sex acts without the consent of the people being filmed. Then ask it about local laws around selling your online browsing details. Go ahead, I'll wait.

Your specific responses will vary, depending on laws in your particular jurisdiction and the accuracy of your online tools - but that's another topic for another time. What is important here is understanding that we routinely give away our data privacy whether we realize it or not, while jealously guarding physical privacy. But the two aren't actually separate things, they're just part of a single continuum, and are inexorably intertwined. Your email address ties back to you physical address. Your online charges tie back to your bank and your physical address. Your browsing activity ties back to your name, and your name ties back to your physical address, as well as actual GPS coordinates in many cases.

We must break the disconnect that somehow these things are somehow separate.

The Reality Is That We Need Strong Privacy Legislation

This isn't a topic that will be resolved "by the market." Changing our individual behaviors won't be enough. We will need to lobby our lawmakers, demand more of our governments, and recognize that the right to privacy may have been overlooked by lawmakers for whom speedy long distance communication involved a horse and rider, and for whom surveillance meant having someone physically tailing you - it was just so thoroughly assumed that it existed they forgot to mention it. We need to bring privacy to the forefront.