Since the late nineteenth century, the “right to be let alone” has powerfully captured the instinct that individuals wish to be afforded a zone of privacy, from which they could exclude the prying eyes of others. In their seminal article (“The Right to Privacy” (1890) 4 Harv.L.Rev. 193), Samuel Warren and Louis Brandeis provided substantial justification for the protection of individuals’ private lives, and this is why their proposition has endured as an origin of the normative right to privacy, and the basis for legal protection of individual privacy.

This contention that individuals should be “let alone”, however, has never been a sufficient or comprehensive normative explanation of the right to privacy. As Daniel Solove argued (see e.g. Understanding Privacy (Cambridge, MA 2008)), there is no panacea, no single philosophical justification, for the protection of privacy. Solove conceded the resulting profound difficulty of conceptualising privacy, and posited a taxonomy of privacy, reflecting the “cluster of values” which he took to underpin the right to privacy. And many scholars have added to the vast literature on what privacy is, what it is for and how it is best protected in law.

Normative complexity persists, however, and these remain live issues, especially as information gathering purposes, and means of communication, continuously change and evolve. In the 1890s, Warren and Brandeis were concerned with press intrusion into a private wedding, just as Michael Douglas and Catherine Zeta Jones were in the 1990s. In the 2000s, press behaviour persisted as a significant concern, but we also saw suspicion about state surveillance objectives and tactics merging with suspicion about the reach and conduct of privately run online platforms, which had become a de facto gateway to the Internet. In 2020, in addition to these existing dimensions, we consider whether and how the state should track our health and our movements and interactions with others. The need to evaluate the right to privacy, and privacy laws, has not abated.

Professors Andrea Monti and Raymond Wacks have provided a fresh normative taxonomy for the protection of informational privacy. Their book, Protecting Personal Information: The Right to Privacy Reconsidered, rests upon the recognition that privacy is normatively complex and unsettled, and the boundaries of and justifications for personal information laws are therefore also unsettled. Their endeavour is both to provide a workable catalogue of existing personal information laws and, in undertaking such categorisation, to offer their own vision of the moral importance and proper reach of the right to informational privacy. Such an endeavour will be welcomed by practitioners and scholars of personal information law, regardless of whether they agree with that new vision.

The difficulty of grasping the concept of privacy and, in particular, its normative boundaries, is reflected in the piecemeal and sometimes diverging ways in which different jurisdictions have sought to protect and vindicate this interest through law. Legislative and regulatory approaches differ dramatically in terms of how fine-grained and wide-reaching the protection of personal information is, for example, between the Europe Union (as most fine-grained and wide-reaching), Australia, New Zealand and Canada (as considerably less so), and the US (as even less interventionist). The judicial recognition and interpretation of privacy laws also differs significantly between jurisdictions. Normative complexity has also created challenges in how such divergent privacy laws can usefully be evaluated: according to which moral objectives should we assess the appropriateness and efficacy of the ever growing legal responses to safeguarding personal information? Has the law gone too far in protecting privacy, or has it not gone far enough?

Professors Monti and Wacks have provided answers to these issues by bringing together several ways in which personal information is protected in law, and, in doing so, by redrafting the normative contours of the right to informational privacy. Their own rendition of the normative right to privacy both informs and emanates from their method of categorising and critiquing current laws purporting to protect privacy.

The authors’ normative vision of the right to privacy today is strongly contextualised in the technological and digital realities of contemporary information flows. The reasons for protecting privacy today, according to the authors, is and should be information security (pp. 16–18, 125–28). It is no longer feasible to invoke the broader and amorphous rationalisation and justification of the right “to be let alone”. What matters today is how effectively individuals can choose to share their personal information, and how well they can control the personal information which has been shared (p. 73). This narrowing of the normative right to privacy derives not only from the authors’ advertence to the contextual realities of the twenty-first century. This book also argues that current interpretation of the right to privacy, especially by the US Supreme Court in respect of the Fourth Amendment, and by Strasbourg in respect of the Article 8 right to private and family life (pp. 11–13), has been unworkably and illegitimately broad, and exacerbates the normative ambiguity of privacy, leading to conceptual “fuzziness” and “woolly borders” (p. 126). For the authors, privacy today should involve the straightforward security of personal information, and not the protection of other aspects of an individual's private life, which might, potentially ad infinitum, be attributed to the nineteenth century vision of the right “to be left alone”, or to the doctrinal evolution of ever-expanding European Convention rights. The law of privacy is not improved by treating the concept as a “talisman endowed with magical power” (p. 14).

Some might ask how this more modest and more concretely defined vision of privacy based upon information security accounts for broader or more complex concerns, including those about safeguarding individuals’ intellectual development from undetectable, privacy-invasive pressures to conform (as Neil Richards has argued; see e.g. Intellectual Privacy (Oxford 2015)), and those about safeguarding children's privacy as against parental sharing of their personal information (as this reader has highlighted elsewhere; see “Children's Privacy: The Role of Parental Control and Consent” (2019) 19 H.R.L.Rev. 201). Furthermore, if individuals’ decisions about sexual preferences and reproduction are not within the normative ambit of information security, as the authors suggest (pp. 12–14, 77), then where does that leave individual autonomy as a rationale for privacy, and as reflected in the authors’ allegiance to individual choice over whether to share personal information? Why is choice limited to sharing personal information, and does not also cover making choices about personal matters? Further, if we are faced with the prospect of large-scale and fine-grained governmental surveillance of individuals’ health and everyday movements, which may be used to restrict otherwise protected liberties, we might prefer the single and broad, if complex, moral right to privacy and the wide-reaching and evolving European Convention right to a private and family life. Can a narrower right, to choose whether to share personal information, provide sufficient security for individuals, when their state demands, through law or through the setting of conditions, that they permit such surveillance? These questions demonstrate that the particular vision of privacy presented in this book will add new dimensions and new value to ongoing discussion about the proper purpose and reach of the right to privacy.

Following their moral vision of privacy, the authors develop their normative taxonomy through their cataloguing of current personal information laws. But this is not a dry traversal of all laws purporting to protect informational privacy; instead, their slimmer vision of privacy informs the triaging undertaken in this book as to what sorts of laws really are aimed at protecting privacy, and how and to what extent personal information ought to be protected by law. It will be of particular interest that, in this normatively-informed triaging process, the authors depart from existing privacy literature (and sometimes legal doctrine) to exclude (or at least problematise) certain laws and certain practical concerns from the concept of privacy and objective of protecting privacy, for example: spatial privacy and bodily integrity (p. 42), individuals’ sexual preferences (p. 77), reproductive choices (pp. 12, 14), matters concerning minority protection (p. 78), and the centralised collection and storage of genetic information (pp. 41–50). This is how the authors’ more modest vision of privacy would operate in practice: if such aspects of individuals’ lives were to be protected by law, it would not be on the basis of a right to privacy.

The triaging and cataloguing process adopted in this book involves coupling personal information laws with other interests emanating from the “choice-and-control” vision of privacy proposed by the authors, and evaluating those laws according to those interests: thus, “data protection” (pp. 19–34) interests are distinct from interests in “goods and services” (pp. 51–65), even though we can draw connections between data-protection objectives and consumer protection objectives (as is done, for example, in the EU General Data Protection Regulation (“GDPR”)); the interests of “power” (pp. 35–50) and “memory” (pp. 115–24) are kept separate, even though we might connect the two under a broader principle of autonomy, as control over one's life; and interests affected by “media” practices (pp. 89–114) are distinguished from interests in “freedom” (pp. 66–88), including anonymity in particular (pp. 69–74), even though privacy from the media might be connected with and enveloped by an overarching value of individual liberty. In keeping with the authors’ overall objective of slimming down and constraining the concept of and rationale for privacy, this approach to categorising and assessing personal information laws demands that we eschew the instinct to draw these connections between such laws at too high a level of abstraction: for example, according to theories of individual dignity, autonomy, liberty and security. It also demands that personal information laws be assessed not so much by reference to a single, amorphous right to privacy, but by reference to more specific interests, which direct the law to protect personal information to an extent commensurate with individuals’ entitlement to choice over sharing information, and control over shared information.

Readers who are committed to the more abstract, philosophical underpinnings of a single right to privacy might notice that, even with such a disciplined triaging of personal information laws according to more specific interests and a narrower vision of privacy, overlap and connections are unavoidable: data-protection laws inevitably arise in the context of privacy-intrusive online profiling (pp. 55–58), as well as privacy-intrusive media practices (pp. 111–14). Is it really the case, as the authors argue (pp. 22–23), that the most wide-reaching and most detailed legal instrument for data protection, the GDPR, is not aimed so much at protecting privacy, as it is at liberating information flows? More broadly, some readers might question the viability of a slimmer normative vision of privacy based upon choice and control, given many laws and many practical contexts, including those related to the use of genetic information (pp. 41–44, 83–86, 120–22), and those related to preserving or removing anonymity (pp. 66–74, 120), give rise to the same, if abstract, principles of individual dignity, autonomy, liberty and security, as they inform and delineate the moral right “to be let alone”. Choice over sharing information, and control over shared information, might be more workable, practical rationales for framing and assessing privacy laws, but they might also be conceptually and normatively inseparable from the very principles that make privacy inherently wide-reaching and complex. Nevertheless, the authors remain true to their constrained vision of privacy, and provide a catalogue of personal information laws that accords with that vision. Some readers will doubtless find it more useful, and more normatively convincing, to evaluate informational privacy laws through a narrower normative lens, regardless of incidental overlapping, than to evaluate such laws always by reference to complex, abstract philosophical ideas.

This book concludes with a concrete proposal for law reform in its Appendix. Along with presenting the case for a more modest, modern and concretely defined right to privacy, the authors opt for legislative reform (pp. 129–34; see also p. 127), as opposed to reform through, for example, judicial restraint in interpreting existing privacy laws, or the evolution of precedent to meet modern demands. Their draft Bill would enact two separate torts of intrusion and disclosure, both focused upon their specific concern with security of personal information: wrongful gathering, collection, use and dissemination of personal information. It is notable that the intrusion tort turns not upon the physical invasion of private space, but, true to the authors’ vision of privacy, the obtaining of personal information. Such tortious remedies will be familiar to some jurisdictions, which have liability for intrusion and disclosure already (New Zealand and Canada – albeit in the common law), and which continue to consider (but have not yet acted upon) reform proposals and reports for such statutory torts over several years (for example, Australia). This proposal will add weight to the arguments for both a statutory (as opposed to common law) development of privacy protection, and a more modest (contra-Strasbourg) framing of the legal right to privacy.

Professors Monti and Wacks's work presents a new consolidation of different ways in which the law seeks to protect informational privacy. At the same time it offers a fresh approach to evaluating the objectives and boundaries of both the myriad of personal information laws currently in operation, and the underlying normative right to privacy itself. In presenting a twenty-first-century revision of the question of exactly what it means “to be let alone”, and although not everyone will agree with the particular vision offered here, this book is an important reminder that, while legal fruits ought always to reflect their normative roots, legal rights ought to have clear and practicable boundaries.