1. THE PRIVACY RELATION

‘Privacy’ is a notion that allows of different senses. Here are two examples. First, when talking about ‘privacy’, one can mean ‘informational privacy’: privacy as it relates to information (about oneself). One might desire to have privacy about information regarding one's bank account details or one's sexual orientation. Second, when talking about ‘privacy’, one can mean privacy regarding one's personal domain of living. Even if an intruder, breaking into your house, doesn't pick up any information, the intrusion is still an invasion of one's personal domain of living and thus of one's privacy. In what follows, I am only concerned with informational privacy, or ‘privacy’ for short.

‘Privacy’ is a notion that allows of different uses. One can ‘be private’, ‘lose one's privacy’, ‘have privacy’ or ‘desire to have privacy’. Privacy isn't unique in this regard. Many concepts allow of these different uses. One can, for instance, ‘be justified’, ‘lose one's justification’, ‘have justification’ or ‘desire to have justification’. When analyzing concepts, philosophers usually focus on the ‘having x’ use. Analyzing ‘justification’ normally amounts to analyzing under which conditions a subject ‘has justification’. Analyzing ‘knowledge’ normally amounts to analyzing under which conditions one ‘has knowledge’. In this paper, I will follow this tradition and propose an analysis of ‘having privacy’.

As a first step towards such an analysis, it will be useful to think of having privacy as a relational state. Just like the state of love is a relational state between a person who loves (a ‘lover’) and the object of love (a ‘beloved’), so ‘having privacy’ can be thought of as a relational state as well. ‘Having privacy’ means standing in a particular relation (the privacy relation). Regarding any relation, we can ask (at least) two questions. First, what is the number and nature of the relata of the relation? And second, what is the nature of the relation? In this section, I will focus on the relata of the privacy relation, whereas in the next section, I will focus on the nature of the privacy relation.

I submit that ‘having privacy’ expresses a three-place relation between a subject (S), a set of propositions (P) and a set of individuals (I).Footnote ²S is the subject who has (a certain degree of) privacy. P is composed of those propositions the subject wants to keep private (call the propositions in this set ‘personal propositions’). And I is composed of those individuals with respect to whom S wants to keep the personal propositions private. Shas privacy about Pwith respect to I. To illustrate this with an example, consider John who wants to keep the true proposition that he has spent some time in prison private. But he doesn't want to keep this private to everyone. He only wants to keep it private with respect to certain individuals, for instance, new friends. In what follows, I will make some remarks about the nature of each relatum of the privacy relation.

Starting with the private subject S, here the question arises which types of subject can have privacy. To simplify matters (without over-simplifying and thus compromising the overall argument of this paper), I will for present purposes be working with the idea that all human beings can have privacy, acknowledging that a lot more can – and should – be said about the nature of the private subjects.Footnote ³

As to the set of propositions P, the number of propositions in this set is at least 1; it contains at least one proposition. I will offer two restrictions regarding which propositions can become part of P. A first restriction is that for a proposition to become part of P, it should be a ‘personal proposition’, e.g. a proposition about the subject S. Intuitively, propositions about yesterday's weather, for instance, will not be propositions about which one can coherently be said to have privacy since they are not propositions about the subject. (Answering the question ‘Did it rain yesterday?’ by saying ‘I'm not going to tell you; that is private information!’ – will strike us as rather strange.) But for all propositions that are about a subject S, I would say that they can be (or can become) personal propositions. Some propositions about me (such as the details of my bank account) are, uncontroversially, personal propositions. But consider the proposition that my eyes are brown, or that I was born in Amsterdam. One might initially think that, even though these are propositions about me, I would feel no need to mark them as personal propositions. Yet, in some situations, it might be the case that these propositions could be used to uniquely identify me or could reveal something about me that I would like to have remain hidden. In that sense, I could coherently desire that I have privacy about these types of proposition as well.Footnote ⁴

A second restriction regarding the propositions in P is that they be true. One cannot coherently be said to have privacy regarding falsehoods. Consider, for instance, the following example:

It seems to me that we cannot truthfully attribute that John in fact had privacy with respect to the false proposition that his father was a convicted murderer. John merely thought that he had privacy with respect to this false proposition. But in the end, there was nothing to be private about. Interestingly, it seems to me that concepts related to privacy also don't easily allow for a non-factive reading. One cannot, for instance, keep a falsehood secret (of course, one can think that one is keeping a false proposition secret if one (mistakenly) thinks this proposition to be true). Secrecy has to do with hiding facts. Likewise, one cannot reveal a falsehood (again, one can think that one is revealing a false proposition if one (mistakenly) thinks this proposition to be true). Revelation has to do with revealing facts.Footnote ⁵ Finally, one cannot keep falsehoods confidential (yet again, one can think that one is keeping a false proposition confidential if one (mistakenly) thinks this proposition to be true). Confidentiality has to do with retaining facts. These observations make plausible the idea that privacy is essentially truth-connected as well.

A final remark about the set of propositions is that it can be divided in different domains. Some propositions in P will concern the subject's health, others will concern the subject's sexuality and still others will concern the subject's most personal feelings. One could divide P into these (more specific) domains. For don't we say things like ‘John is private about his health’ or ‘Jill is private about her sexual orientation’?Footnote ⁶ For present purposes, however, I propose not to divide the propositions in P in different domains but let P simply be the collection of all propositions about which S has privacy.

Finally, as to the set of individuals I, the number of individuals in this set is at least 1; it contains at least one individual. Having privacy is related to individuals because one can have privacy about a particular (set of) proposition(s) in relation to one individual and at the same time not have privacy about the same (set of) proposition(s) in relation to another individual. Typically, for instance, one will have privacy about aspects of one's sexuality in relation to one's parents, but not in relation to one's romantic partner. Since whether one has privacy regarding a particular proposition or not depends on which individuals one is considering, the set of individuals constitutes a third relatum of the privacy relation.Footnote ⁷

Much more can be said about each relatum of the privacy relation. I will not do so here. In this section, my aim has merely been to make plausible the idea that the privacy relation is a ternary relation. Now this relational approach to privacy is neutral with respect to the analysis of the concept of privacy. That is to say, the relational approach to privacy doesn't tell you what it means to stand in the privacy relation, but can be combined with various different accounts of privacy. This brings us to our next question: what is the nature of the privacy relation?

2. THE EPISTEMIC ACCOUNT OF PRIVACY

It will prove useful for our discussion to start with an extant account of privacy that has been cast in epistemic terms. It is due to David Matheson who calls this account the ‘broad ignorance theory’:

According to Matheson, BIT ‘renders informational privacy always exclusively a function of (simply) a lack of knowledge on the part of others with respect to personal facts about an individual, and never even partly a function of others’ inability to know those facts through certain means' (259). Matheson deserves credit for being one of the first epistemologists to have formulated an account of privacy in epistemic terms. I do find, however, that one element is missing from BIT: the fact that privacy is a degree concept. If we give this fact proper weight, we will end up with a quite different conception of informational privacy – as I will show below.

That having privacy is a degree concept can be seen from the fact that it allows for degree modification (‘I have a lot of privacy’) and comparative constructions (‘Frieda has more privacy than John about her most intimate feelings’) – both of which are clear indicators that a concept is a degree concept and not an absolute concept.Footnote ⁸

On what do the degrees of privacy depend? They can depend, I think, on several variables: the amount of personal propositions that are (or are not) known by other individuals, and the number of individuals that know a certain personal proposition. The more personal propositions about S are known by a certain individual, the less privacy S has with respect to this individual. The more individuals know a certain personal proposition p about S, the less privacy S has regarding this proposition p. However, if we keep the number of propositions and individuals fixed (and fix them, for conveniences sake, at 1), there remains yet another dimension of degree-flexibility. Even if there is just one personal proposition that I would like to have privacy about with respect to just one individual, there can still be flexibility in the degree of privacy I have regarding this proposition. This dimension has to do with the type of epistemic relation the individual stands in, if any, vis-à-vis the personal proposition in question.

Now there are many different types of epistemic relation. Here is a list of relations between a subject and a proposition, familiar from the epistemological literature (the list is not meant to be exhaustive):

1. (1) A mere belief that P

2. (2) A true belief that P

3. (3) A justified true belief that P

4. (4) A degettierized true belief that P

5. (5) A rational true belief that P

6. (6) A warranted true belief that P

7. (7) Knowledge that P

8. (8) Certainty that P

(1) and (2) express a relation between a subject S and a proposition P. But these relations are not epistemic relations. A mere belief can be false, and falsehoods cannot be known; a mere true belief can be the result of wishful thinking, thus lacking an appropriate connection to the truth and not constituting knowledge. Moreover, as has been noted by many authors, the relations expressed in (1) and (2) are not relevant to having or not having privacy.Footnote ⁹ If (one of) the members of I merely believe a true personal proposition for no good reason, for instance, then we can clearly not speak of a lack of privacy. If one of my personal propositions is that I killed my cat, and if you (being the only one I don't want to know this) happen to believe that I killed my cat on the basis of a mere lucky guess, then it sounds counterintuitive to say that I no longer have privacy regarding this personal proposition with respect to you. You have merely picked up a true belief by accident. This shows that something more than mere true belief is necessary for there to be a lack of privacy. There should also be a good reason for the true belief in question. If you truly believed that I killed my cat on the basis of having seen me kill the animal, then I no longer have privacy regarding this proposition with respect to you.

Now (3)–(7) do express an epistemic relation between a subject S and a proposition P. A justified belief that p is perhaps one of the weakest epistemic relations.Footnote ¹⁰ Certainty that p is one of the strongest epistemic relations. If we combine the idea of degrees of privacy with the idea that there are many epistemic relations that also vary in strength, we end up with the following picture.

On one end of the spectrum, one can have full privacy; here the degree of privacy regarding a set of propositions P cannot be any higher. This means that there isn't even the weakest epistemic relation between the individuals in I and S's personal proposition P that can somehow diminish S's privacy with respect to this proposition.

On the other end of the spectrum, one can have zero privacy; here, the degree of one's privacy regarding a set of propositions P cannot be any lower. This means that the individuals in I stand in the strongest epistemic relation with respect to S's personal propositions in P.

If the degree of privacy can be located anywhere between these two extremes, one's privacy is diminished or advanced (depending on one's point of reference: zero or full). It is diminished if one's privacy is no longer full but has reached a (slightly) lower point because, for instance, someone has acquired a justified true belief about one of one's personal propositions. It is advanced if one's privacy is no longer at zero but is at a (slightly) higher point because, for instance, someone no longer has knowledge of one of one's personal propositions.Footnote ¹¹ The various options of the epistemic account of privacy (EAP) thus are:

Compare full privacy with a room that is completely covered in darkness and zero privacy with a room bathed in light. In the completely dark room, there isn't even the tiniest or weakest intrusion of light. Similarly, in a situation of full privacy there isn't even the tiniest or weakest epistemic intrusion from an individual I into one's private sphere. If the room is bathing in light, there is the strongest form of light-intrusion. Similarly, in a situation of zero privacy, the individual I stands in the strongest epistemic relation towards one's private propositions. The stronger the epistemic intrusions get, the more diminished one's privacy becomes. The weaker the epistemic intrusions are, the more advanced one's privacy is. If the intrusion has reached its maximum, one's privacy has hit zero: the individuals in Iare certain of the personal proposition, and one's private room is bathed in light. If the intrusion is at its minimum, one's privacy is full: the individuals I don't stand in even the weakest epistemic relation vis-à-vis the personal proposition, and one's private room is covered in impenetrable darkness.

Thus, the view on privacy I am proposing says that it would be wrong to maintain, as Matheson does, that only knowledge of personal propositions is capable of diminishing one's privacy. Weaker epistemic states, as well, can diminish one's privacy. Weaker epistemic states do represent some sort of connection to the true proposition. And however weak this connection may be, it can still impact on one's degree of privacy. This view is vindicated by our intuitions about the relationship between privacy and knowledge. Consider, for instance, the following example.Footnote ¹³

In this case, John at least has a true belief regarding the personal proposition – and presumably the true belief even has some justification or rationality. But it certainly is not an instance of knowledge. Yet John's belief diminishes Bill's privacy regarding the proposition in question. John has, I think, some minimal epistemic connection to the true proposition that Bill wants to keep private. And this connection, even though it isn't knowledge, is enough to diminish Bill's privacy – however slightly.Footnote ¹⁴ Note that this kind of example is difficult to handle for accounts of privacy that are cast in terms of knowledge only. For in this type of case, something less than knowledge can impact on one's privacy. Such theories therefore would have to either deny the intuition that one no longer has privacy regarding the proposition in question, or else deny the intuition that John doesn't know the proposition in question. Both options seem unfortunate; on the view of having privacy that I am proposing, however, we can give both intuitions their proper weight.

To close this section, I would like to make three remarks about EAP. First, an interesting consequence of the epistemic account of privacy is that it cannot only explain what it means to have privacy, it can also explain what it means to lose privacy and to regain privacy. If you have privacy regarding proposition P with respect to individual I, you can lose this privacy if the individual stands in some epistemic relation towards P. Yet this situation isn't easily reversible. If the individual stands in an epistemic relation towards P, one cannot easily regain one's privacy. The only way in which one could regain one's privacy is if the individual would forget P or would no longer believe P for some reason or other. This shows that not only the notion of having privacy can be explained in epistemic terms, the notion of losing one's privacy and regaining one's privacy can also be explained in epistemic terms such as forgetting and disbelieving.

Second, it is important to realize that in case the epistemic condition for having privacy hasn't been met (e.g. there is knowledge of a personal proposition), the result isn't necessarily a privacy violation even though it means that S doesn't have privacy about P. Consider John, for whom the proposition that he has twice divorced his current wife is a personal proposition vis-à-vis his friend Bill. Now suppose that John is talking to Frieda about his marital situation and that Bill is approaching them without John and Frieda noticing. Bill cannot help learning of John's marital situation, entirely by accident. Following the definition of having privacy, John no longer has full privacy with respect to Bill regarding his marital situation. This seems the correct result. But note that we cannot say that Bill has violated John's privacy in coming to know this personal proposition. This is important, since it shows that not all cases in which one acquires knowledge of a personal proposition are automatically privacy violations – even though the acquisition of the knowledge in question diminished someone's privacy. It all depends on the method by which the knowledge was acquired.

Third, EAP sits very well with so-called ‘access accounts of privacy’. According to access accounts of privacy, privacy is described in terms of cognitive access to a subject. A clear statement along these lines is from Ruth Gavison: ‘an individual enjoys perfect privacy when he is completely inaccessible to others’ (Gavison Reference Gavison1980: 428). EAP accommodates the intuition that privacy and cognitive access are importantly related. However, EAP cannot be easily combined with ‘control accounts of privacy’. According to control accounts of privacy, privacy is described in terms of the degree to which we can control what others learn about us. Here is Charles Fried for instance, saying that:

EAP doesn't make control of information a condition for having privacy. One might think that this is a drawback of EAP. Yet I think that control of information cannot be a condition for having privacy. Control of one's personal information has to do with protecting the state of having privacy but is not necessary for having privacy itself. Just as the presence of jewels in an open safe doesn't mean that the jewels have actually been stolen (they are merely at risk of being stolen), so a lack of control over personal information doesn't imply that the information has been accessed and one's privacy has been lost (it is merely at risk of being lost).

This is my preferred epistemic account of having privacy. I will now move on to consider, in the next two sections, two objections to it.

3. FIRST OBJECTION: PRIVACY THREATENED

In the first place, one might think that the epistemic account of privacy doesn't suffice for an adequate analysis of having full privacy, as the following example shows:

EAP rules that John has full privacy; the cleaning lady does not stand in even the weakest epistemic relation towards John's personal propositions. Yet intuitively, John's personal information is out in the open. Surely, one might think, he has diminished privacy regarding his personal propositions? In a nearby possible world, John's privacy would have been (partially) lost if his cleaning lady had actually opened the diary and read its contents.

I would reply to this type of objection by saying that, in this case, John's privacy hasn't diminished but is merely threatened.Footnote ¹⁵ John's privacy is still full so long as the cleaning lady hasn't perused his diary. As soon as she has, and has acquired, for instance, knowledge of its contents, John's privacy will have been diminished. But for now, his privacy is merely threatened. (Analogously, suppose that I am mountaineering in a very dangerous area. The risk of falling down and breaking an arm or a leg is very real. But the mere risk of hurting myself doesn't imply that my health has already declined; it is merely threatened. Likewise, the risk of someone accessing your information by itself doesn't diminish your privacy even though it threatens it.)

4. SECOND OBJECTION: PRIVACY AND FALSEHOODS

A second objection to EAP is that it doesn't allow one to have privacy regarding false propositions. Since I have defined privacy in such a way that it is factive, only true propositions can be the subject of having privacy. Yet, consider the following putative counterexample (due to Anita Allen), where ‘W, an eminent writer, keeps a secret diary of interwoven saucy facts and fantasy about his romantic life’ (Allen Reference Allen1988: 21). Someone, S, secretly reads the diary and picks up only false beliefs. In this case, one might argue, W's privacy has been diminished, even though S only believes falsehoods. But EAP leaves no room for this conclusion – and should therefore be rejected.

I would reply by saying, first, that in some sense of ‘privacy’, W's privacy has indeed been diminished. For of course it is a violation of your privacy if someone browses through your diary without your permission. This is a violation of your personal domain (see section 1). I would add, however, that W's privacy in the sense we are currently discussing, i.e. informational privacy, has not been diminished. Take a false proposition about W, e.g. that he is a heavy drinker. B believes that W is a heavy drinker and he believes this on the basis of having read W's diary. Has W's privacy with respect to the false proposition that he is a heavy drinker been diminished? That sounds quite counterintuitive. Since the proposition is false, there is nothing to lose privacy about. (Similarly: if the safe is empty, there is nothing to get stolen.)

Another type of case might be more problematic, however. Suppose that I spread a lot of lies about you in public, one of them being that you are a heavy drinker. In that case, your ‘public persona’ can be seriously damaged, even though the damage is done by mere lies. Is this a case of diminished privacy? If so, EAP leaves no room for this conclusion – and should therefore be rejected. The answer to this question depends on two possible lines of action you can take in the face of these lies. First, you can publicly defend your honor and state that you have never touched a drop of alcohol in your life. Supposing that is indeed the case, my lies have forced you to reveal personal facts – they have, in effect, forced you to give up part of your privacy. If you choose this line of action, even though the lies indirectly diminish your privacy, this doesn't show that they also directly diminish your privacy regarding the proposition that you are a heavy drinker. For, secondly, suppose that you decide to do nothing about my lies. Have I diminished your privacy? I find it very hard to think that I have. To be sure, I have damaged you in some way; perhaps I have damaged your personal integrity or the way you want to be known by other individuals (e.g. as someone who doesn't have an alcohol problem). But this seems different from a damaged state of privacy. I haven't revealed anything about you that you wanted to remain hidden from others. I haven't spoiled a secret. I have only told a lie. So I think that the spreading of falsehoods about an individual does not impact on the individual's privacy. The spreading of falsehoods impacts on the content of one's public persona, on how one wants to project oneself in the public sphere. But this is not a matter of privacy – it is a matter of one's public identity.

5. ENVOI

In this paper, I have taken some steps towards establishing an epistemic account of having informational privacy. I have argued that privacy is a ternary relation between a subject, a (set of) proposition(s) and a (set of) individual(s). I have also argued that privacy should be defined in terms of epistemic relations between a subject and a proposition. A subject S only has full privacy if the individuals do not stand in even the weakest epistemic relation vis-à-vis S's personal propositions. A subject S has no privacy at all if the individuals stand in the strongest epistemic relation vis-à-vis S's personal propositions. More can, and should, be said about the epistemic nature of privacy. What, for instance, is the relationship between ignorance and privacy? Or between context and privacy? I will have to leave answering those questions (and many more) for another occasion.Footnote ¹⁶