Another day sees another panic about the loss of “private” data. Today’s problem comes from the sale of a second-hand laptop containing data for a million banking customers; yesterday’s concerned the details of 33,000 people in prison. The personal details of millions of people can be copied to a hand-held device in less than ten minutes. The usual response in these cases is to cluck concernedly and say, “we have to keep personal data much more secure.” Every attempt to make things more complex – requiring more data, drawing on a range of data – can be compromised by error, omission or duplication. For example, biometric data may be difficult to reproduce; but the digital information which is used to represent them is not. There are no procedures which can guarantee the privacy of the data or protect data from loss.
It seems obvious that we can’t stop this kind of data from escaping. What is less obvious is the argument that we shouldn’t. What is so private about our personal data? Identities are not private: they are public. That is part of what having an identity means. Our names, addresses and ages are generally speaking a matter of public record. Birthdates are hardly confidential information: they are publicly celebrated, people advertise major ceremonies, and celebrities have them posted in newspapers). Criminal records are public, in their very nature; no democratic regime conducts its justice in camera. Our identities announce who we are to the world; that is what they are there for.
Something rather strange has happened. Because, in a cashless society, some people are able to defraud the banks, the banks have been attempting to shift the responsibility to their customers – telling them that their identity has been stolen. And increasingly, it seems, people have come to accept that this is true – that somehow, if they admit publicly to their name, their birthday or the details of their bank account, the subsequent confusion of financial institutions are their fault. We have all been told, for example, not to share details of our bank account, because it can be used fraudulently. But anyone who has ever issued a cheque has given at least as much information – the name of the account holder, the number of the account, the bank’s sort code, a copy of the signature and in all probability, because it was common practice until about five years ago, a personal address. The banks routinely use the mother’s maiden name: in many communities, this is a matter of public knowledge, and many public announcements of births, marriages and deaths include them.
For members of the public, there is an argument for ending the presumption of confidentiality on many details. Telephone numbers, addresses and dates of birth are widely available; some details (like credit card numbers and bank details) have traditionally been fully accessible to traders, though that practice has recently been circumscribed with the introduction of chip and pin technology; and there is an argument for saying that some issues, like criminal convictions and tax records, should also be fully public (as they are in some countries). The question that remains is how far there should be a presumption of confidentiality relating to collective data – the compilations of millions of names on electoral registers, benefit and pensions records or lists of customers. The problems that arise here are not so much about the existence of the data, as the uses to which people put them – mass mailings, farming names for marketing, or fraud. Those are the issues that really upset people, and those are the issues we should really be trying to deal with.