The politics of privacy in America are reactive and sentimental, fired by heart-tugging anecdotes that capture the public imagination. The murder of TV actress Rebecca Schaeffer by an obsessive fan who obtained her address through the department of motor vehicles led Congress to pass the Driver's Privacy Protection Act, which forbids state licensing authorities from releasing the personal information of individuals without their consent. Stories of battery victims being solicited by chiropractors after direct marketers got their addresses from the arrest records of their abusers led California to prohibit police departments from disclosing the addresses of arrested individuals for commercial--but not journalistic or investigative-- purposes. Unlike many European legislatures, however, Congress has refused to pass a comprehensive privacy law that declares, as a general principle, that personal information gathered for one purpose shouldn't be disclosed for another without the explicit consent of the individual concerned. In America, corporate opponents of broad privacy legislation have argued repeatedly, privacy should be legislated one step at a time.
Now some of the same corporate interests have banded together to argue before the Supreme Court that piecemeal privacy laws are unconstitutional because privacy must be legislated broadly or not at all. If the Court agrees, its decisions would threaten the ability of Congress to address threats to privacy on a case-by-case basis, which seems the only approach that is politically feasible in an emotional age.
The history of the Driver's Privacy Protection Act shows how debates over privacy tend to be distorted by maudlin sensationalism. The dppa was promoted as an anti-stalking law after domestic violence advocates insisted that Schaeffer's death was a symptom of a nationwide epidemic of stalking, assault, and murder of women by those who got their home addresses from departments of motor vehicles. In fact, celebrity stalking, although unfortunate, represents an insignificant fraction of the invasions of privacy that result from the multimillion-dollar market in personal information sold by state agencies. After forcing individuals to reveal their social security numbers, addresses, and health information in exchange for a driver's license, greedy states have earned millions by selling the same information to commercial databases. (In the early '90s, New York state made $17 million each year from the information trade; Wisconsin made $8 million.) These databases, in turn, are one of the main sources for direct marketers, private investigators, and journalists who want to locate individuals against their will. If I want to track down someone in California, I can get his social security number and address from a database such as Autotrack. Armed with the number, I can then get his credit history and previous addresses, search for his neighbors, and, through them, find his friends and enemies.
In a legal system that respected the right to privacy, this shameless state traffic in personal information might itself be considered a constitutional violation. But the Supreme Court, over the past few decades, has held that the Fourth Amendment doesn't restrict the government's ability to search or seize private diaries, electronic papers, and computer files. The Court seems unlikely, therefore, to conceive of a state's forcible extraction and exposure of personal information as an unreasonable search or seizure.
This makes Congress's efforts to protect informational privacy especially important. But two of the four circuit courts that have considered the matter have struck down the DPPA as a violation of the Tenth Amendment, which protects states' rights. The Supreme Court has held that Congress can't " commandeer the legislative processes of the States by directly compelling them to enact and enforce a federal regulatory program"; and the Court invoked this principle in 1997 to strike down part of the Brady Bill, which required state law enforcement officials to perform background checks on prospective gun buyers. But, unlike the Brady Bill, the DPPA doesn't command state officials to enforce a federal regulatory program. As Judge Frank Easterbrook observed when he rejected the Tenth Amendment challenge in his powerful opinion for the U.S. Court of Appeals in Chicago: "The Driver's Privacy Protection Act affects states as owners of data, rather than as sovereigns." Instead of commanding the states to regulate private conduct or to enforce federal rights, in other words, Congress is simply ordering state information banks not to release information, in the same way that the Video Privacy Protection Act orders the corner Blockbuster Video outlet not to release video-rental records. Still, there is an ominously vague sentence in the Brady Bill case warning that Congress may not "direct the functioning of the state executive," which the states'-rights justices might invoke to strike down the dppa.
The supreme court has also held that Congress has to act neutrally when it regulates the economic activities of the states and that it can't impose burdens on state agencies that it doesn't also impose on private market participants. This is supposed to discourage Congress from regulating the states without good reason; if forced to distribute economic burdens even-handedly between the public and private sectors, the theory goes, Congress will only act when it's willing to take the political heat. Opponents of the DPPA have urged the Supreme Court to extend this antidiscrimination principle into a general rule that Congress can't protect informational privacy without passing a comprehensive statute that regulates private and public databases at the same time. But Easterbrook rejected this argument, too: " Discrimination against the states is forbidden, but a nondiscriminatory system may take more than one law to implement," he wrote. If the Supreme Court disagrees, that would doom privacy legislation in practice. A comprehensive law would be nearly impossible to enact, and, if it were enacted, direct marketers might challenge it as an even greater intrusion on state sovereignty.
Privacy, in the abstract, has no political constituency; although people claim to support it in theory, they rarely object until their own privacy is violated in practice. At the oral argument before the U.S. Court of Appeals for the Fourth Circuit, one of the appellate judges who voted to strike down the dppa belittled its practical value. Why should people care about the release of their social security numbers? she asked. After all, her own social security number was clearly visible on her driver's license. But the judge wasn't compelled to wear the number tattooed on her forehead, and, if she were, she would feel invaded in the extreme.
Indeed, requiring social security numbers to be entirely public would subvert the promise of new digital technology, which makes it possible for citizens to reveal selective details of their identities without revealing their actual identities. Instead of forcing citizens to display their names, addresses, and health information on a laminated driver's license, state licensing authorities could issue digital certificates that store each piece of identifying information separately. I could use these certificates to tell a website that I'm over 18 years old, a police officer that I'm licensed to drive in Washington, D.C., or a gun store that I'm virtually blind without contact lenses, all without disclosing my name. My actual identity could be kept in escrow by the motor vehicles bureau and revealed to law enforcement only if I'm suspected of committing a serious crime. The disaggregation of identity is an exhilarating possibility in a world where we're often told that none of us can transcend the constraints of race, age, and gender or be judged by what we say rather than who we are. But the possibility of selective identification will be more difficult if state licensing authorities can't be legally compelled to keep ultimate identities and other personal information private.
The states'-rights argument is sufficiently weak that the Court may be persuaded to uphold the DPPA. But the constitutional objections to the California law--which forbids the state to reveal the addresses of arrested individuals for commercial but not for journalistic, political, or investigative purposes--are much stronger. The law was directed against the cottage industry of data banks that have been created to bombard people who have been arrested with direct-mail solicitations from bail-bond firms, lawyers, and therapists. In some states, these solicitations have indeed led to horror stories: in Maryland, for example, a lawyer who got a suspect's address from a data bank offered his services before the arrest warrant had been served, causing the suspect to flee before the police arrived. But is it rational to deny direct marketers addresses that are freely disclosed to journalists? The First Amendment, the Court has long held, doesn't allow states to discriminate against speakers based on the content of their speech. And, in light of new media technologies, it's increasingly hard to distinguish between The Baltimore Sun, which publishes the blocks where arrested crime suspects live, and an electronic newsletter that is targeted at the suspects themselves. As newspaper and magazine delivery in cyberspace is increasingly customized to reflect the preferences of individual readers, who may eventually be charged based on the items they download, the distinction between news gathering and reporting for commercial and noncommercial purposes is evaporating.
Defenders of the California law view it as a restriction on access to information, not as a restriction on speech. States should be free to restrict information to those who promise to use it for noncommercial purposes, the argument goes, in the same way that the National Endowment for the Arts should be free to restrict federal grants to artists it believes will serve the public interest. But for a state to discriminate among the recipients of information based on their promise to use it for tasteful rather than vulgar purposes raises the same troubling First Amendment questions as Mayor Rudolph Giuliani's efforts to discriminate among publicly funded museums in New York City based on their support of what he views as indecent art.
Another case that may be headed for the Supreme Court presents a more fundamental clash between the right to commercial speech and the right to privacy. At the end of August, the U.S. Court of Appeals for the Tenth Circuit struck down a federal rule requiring phone companies to seek customers' permission before using personal billing information--including when, where, and to whom they place calls--in order to target them with ads for unrelated communications services. Restricting AT&T from using billing information that customers voluntarily disclosed, the court held, violated the phone company's First Amendment rights. If this crude reasoning is embraced on a national level, it would become impossible for Congress to enact the very law that opponents of the DPPA insist is the only way of protecting privacy: forbidding businesses, as well as the government, from collecting information for one purpose and then disclosing it for another without the consent of the individual concerned.
The underlying question in all three of these invasion-of- privacy cases is more political than legal: What sort of information can plausibly be considered private even when it is disclosed for limited purposes? It's hard to see the addresses of arrested people in California as private information, especially when they are routinely disclosed to the newspapers and revealed to the world. But, in a civilized society, our telephone records and social security numbers should indeed be protected from global exposure, despite the fact that we're forced to disclose them to the department of motor vehicles or the phone company in order to function as citizens. If the courts refuse to let Congress make these contextual judgments on a case-by-case basis, there is, unfortunately, no political constituency that will clamor for the protection of privacy on a broader scale. Like clean air, privacy is a necessity that no one misses until it's too late.