Law, Culture and the Humanities http://lch.sagepub.

com/

Governing Through Privacy: Authoritarian Liberalism, Law, and Privacy Knowledge

Randy K. Lippert and Kevin Walby Law, Culture and the Humanities published online 26 March 2013 DOI: 10.1177/1743872113478530 The online version of this article can be found at: http://lch.sagepub.com/content/early/2013/03/21/1743872113478530

Published by:
http://www.sagepublications.com

On behalf of:
Association for the Study of Law, Culture and the Humanities

Additional services and information for Law, Culture and the Humanities can be found at: Email Alerts: http://lch.sagepub.com/cgi/alerts Subscriptions: http://lch.sagepub.com/subscriptions Reprints: http://www.sagepub.com/journalsReprints.nav Permissions: http://www.sagepub.com/journalsPermissions.nav

>> OnlineFirst Version of Record - Mar 26, 2013 What is This?

Downloaded from pdf.highwire.org by guest on April 26, 2013

478530
2013

LCH0010.1177/1743872113478530Law, Culture and the HumanitiesLippert and Walby

Article

LAW, CULTURE AND THE HUMANITIES

Governing Through Privacy: Authoritarian Liberalism, Law, and Privacy Knowledge*

Randy K. Lippert Kevin Walby

Law, Culture and the Humanities 0(0) 124 The Author(s) 2013 Reprints and permissions: sagepub.co.uk/journalsPermissions.nav DOI: 10.1177/1743872113478530 lch.sagepub.com

University of Windsor, Canada

University of Victoria, Canada

Abstract
In this article, we examine the production of privacy knowledge and uses of privacy law in relation to liberal governmentality. Understanding liberal governmentality remains critical insofar as authoritarian practices and liberalism are intertwined. We argue the birth of privacy studies and the rise of the notion of privacy by design demonstrate a coupling of security and privacy and the embedding of privacy protocol in surveillance technologies consistent with authoritarian liberalism. We illustrate these arguments through analysis of cases pertaining to public camera surveillance and access to information processes (ATIP) in Canada. The growing prevalence of privacy as an object of knowledge and as a means of governance raise questions about its utility as a remedy for surveillance and begins to reveal how authoritarian practices are incorporated within liberalism.

Keywords
Privacy, liberalism, legal governance, governmentality, authoritarianism

I. Introduction
Anyone familiar with Facebook, Twitter and other social media is aware that much of the information now flowing faster and in greater volume is personal. Social media users are likewise mindful of new cultural expectations to manage their privacy settings, a term

Corresponding author: Randy K. Lippert, Department of Sociology & Criminology, University of Windsor, 401 Sunset Avenue, Windsor, Ontario, Canada. Email: lippert@uwindsor.ca *The authors contributed equally to the theoretical and empirical aspects of this article.
Downloaded from pdf.highwire.org by guest on April 26, 2013

Law, Culture and the Humanities 0(0)

revealing that privacy travels with these information flows, but can be independently navigated as never before. Privacy has become something about which there is to be active reflection and manipulation among social media users but also among broader publics and perhaps more significantly among state agencies. For the past thirty-five years, Western states have sought to regulate first public and then private organizations collection, storage, and sharing of personal information.1 Despite privacy being governable via constitutional law, privacy (also called data protection) laws were enacted for the purpose of protecting individual privacy rights.2 By restricting the flow of personal information in public and private domains, privacy laws would seem to occupy a special place within liberal governance or governmentalities.3 Since Foucauldian-inspired governmentality scholarship has devoted much intellectual effort to interrogating liberalism and its traditional fixation on individual freedom,4 and privacy has been described as an element of freedom and a human right under liberalism, it is surprising that more attention has not been paid to the codification of privacy in various laws.5 It is peculiar too that the nature of privacy as an object of knowledge has not garnered more scholarly interest, especially since increased expert knowledge about privacy, including in the social sciences and humanities, has accompanied privacy laws rise. This relative neglect of privacy may well be a consequence of scholars turning their attention to more visible and detrimental authoritarian practices occurring in Western states in recent years. Our primary purpose in this article is to examine privacy and privacy law as an object of knowledge and an instrument of current liberal governance that is tethered to authoritarian practices. Our secondary purpose is to retain a focus on liberal governmentality while demonstrating how practices that are more or less authoritarian can operate within liberalism. We are aware that concerns with privacy may appear trivial in the face of the grave crises of the early 21st century; the gravity of losing control of details about ones person seems incomparable with losing freedom via state detention, a family member in an unjustifiable war or military occupation, or ones livelihood in the Great Recession. Yet, it is in mundane and neglected sites where privacy and privacy law become concerns that potential for authoritarianism among current forms of liberal governmentality may be most insidious and where inquiry is overdue. We situate privacy law and related forms of knowledge in 21st century incarnations of liberal governmentality. We therefore are less interested in the legal governance of privacy and focus instead on governing through privacy and forms of privacy power/knowledge.

1. C. Bennett and C. Raab, The Governance of Privacy (Cambridge, MA: MIT Press, 2006). 2. C. Bennett, The Privacy Commissioner of Canada: Multiple Roles, Diverse Expectations and Structural Dilemmas, Canadian Public Administration 46 (2003), 21842. 3. M. Foucault, On Governmentality, Ideology and Consciousness 6 (1979), 522. 4. N. Rose, Powers of Freedom: Reframing Political Thought (Cambridge: Cambridge University Press, 1999). 5. But see K. Thomas, Beyond the Privacy Principle, Columbia Law Review 92 (1992), 1431516.

Downloaded from pdf.highwire.org by guest on April 26, 2013

Lippert and Walby

We first discuss why empirical study of liberal governmentality remains relevant in the 21st century, despite visible authoritarian practices since 2001 and scholars embrace of the language of exceptionalism to make sense of them. To this end we consider Mitchell Deans Foucault-inspired notion of authoritarian liberalism.6 Authoritarian refers here to governing practices that are despotic, direct (in that participation of the governed is denied or dismissed) and/or coercive.7 Such practices regard subjects capacity for action as subordinate to the expectation of obedience.8 Dean elaborates liberalism as an unstable combination of limited government and a liberal police9 that we argue has purchase for understanding privacy law. With Canada as our empirical focus, we then discuss new forums of privacy knowledge production and the movement of privacy law into new domains through a discursive coupling of security with privacy and the aligned notion of privacy by design. These developments signify that privacy is becoming less a barrier to governmental power and more an instrument of its exercise.10 Rather than merely an antidote to surveillance11 or to securitization, we argue privacy is a set of protocols and technologies through which governance and security are enacted and is inseparable from liberal governmentality. It is necessary to define our terms. By surveillance we mean the focused, systematic, and routine attention to personal details for purposes of influence, management, protection or direction.12 According to this definition, not all surveillance has authoritarian uses but some certainly does. By security we mean attempts to predict and guard against future threats13 while securitization refers to the policies and practices that operate to enact security.14 Finally, privacy denotes the claim of individuals, groups, or institutions to determine for themselves when, how, and to what

6. M. Dean, Liberal Government and Authoritarianism, Economy and Society 31 (2002), 37 61; M. Dean, Governing Societies: Political Perspectives on Domestic and International Rule (Buckingham: Open University Press, 2007). 7. Authoritarian is preferable to illiberal and to any other term that claims liberalism as its anti-thesis since, as we argue, such practices can be incorporated within liberalism. 8. M. Dean, Governmentality: Power and Rule in Modern Society (2nd edn) (London: Sage, 2010), p. 266. 9. Dean, Governing Societies; M. Dean, Power at the Heart of the Present, European Journal of Cultural Studies 13 (2010), 45975. 10. This is of course different from the issue of the weakening of information privacy law in some instances. 11. See F. Stalder, Opinion. Privacy is not the Antidote to Surveillance, Surveillance and Society 1 (2002), 12024. 12. D. Lyon, Surveillance Studies: An Overview (Malden, MA: Polity, 2007), p. 14. 13. M. Valverde, Governing Security, Governing through Security, in R. Daniels, P. Macklem, and K. Roach, eds., The Security of Freedom: Essays on Canadas Anti-Terrorism Bill (Toronto: University of Toronto Press, 2001), p. 85. 14. To the extent that this sense of security is associated with repression by the state, it should be distinguished from Foucaults broader understanding that also includes the notion of citizen or social security. M. Valverde, Questions of Security: a Framework for Research, Theoretical Criminology 15 (2011), 322.

Downloaded from pdf.highwire.org by guest on April 26, 2013

Law, Culture and the Humanities 0(0)

extent information about them is communicated to others.15 This is the dominant liberal understanding of privacy most relevant to our analysis. Drawing from interviews with privacy and surveillance practitioners as well as an analysis of guidelines and policy documents, we illustrate privacy law uses in two disparate sites open-street closed circuit television (CCTV) surveillance and access to information requests and discuss how privacy by design is implicated in both. Our examination of privacy law and privacy knowledge reveals how privacy can enable authoritarian practices and encourage the growth of the security industry and deployment of surveillance technologies.16 Governing open-street CCTV surveillance and access to information through privacy allows authoritarian practices to continue or expand while being based in a discourse of rights, accountability and transparency. Thus, our aim is to reveal the counterintuitive effects of privacy law and how authoritarian practices can operate within liberal governmentality under the rubric of privacy rights.17 We conclude by discussing implications for research on privacy law, privacy knowledge, and liberal governmentality. Our analysis suggests the need to further explore instances of governing through privacy in relation to authoritarian liberalism, including those instances involving deployment of new knowledge and technologies epitomized by privacy by design. The growing pervasiveness of surveillance, including for authoritarian purposes, is made possible through the rise of privacy law and privacy knowledge production consonant with liberal governmentality.

II. Governmentality Studies and Liberalisms Persistent Relevance

In the early 1990s, the point of departure for Foucauldian-inspired scholarship was the recasting of liberalism as a governmentality. Approaching liberalism as a governmental discourse rather than as an ideology represented a move away from state-centered and neo-Marxist theorizing and historical inquiry.18 Analysts then increasingly sought to discern how liberal governmentality shaped governmental practices (understood as a form

15. A. Westin, Privacy and Freedom (New York: Atheneum, 1967), p. 7. 16. Since it is representative of developments in many Western countries, we focus on the Canadian context. 17. On how rights can serve as technologies of governance rather than as a source of freedom, see W. Brown, The Most We Can Hope For . . .: Human Rights and the Politics of Fatalism, The South Atlantic Quarterly 103 (2004), 45163. 18. See, among others, N. Rose and P. Miller, Political Power Beyond the State: Problematics of Government, British Journal of Sociology 43 (1992), 173205; T. Osborne, On Liberalism, Neoliberalism and the Liberal Profession of Medicine, Economy and Society 22 (1993), 34556; A. Barry, T. Osborne, and N. Rose, Foucault and Political Reason: Liberalism, NeoLiberalism, and Rationalities of Government (London: NCL Press, 1996); W. Larner, NeoLiberalism: Policy, Ideology, Governmentality, Studies in Political Economy 63 (2000), 525; W. Walters, Governmentality: Critical Encounters (New York: Routledge, 2012).

Downloaded from pdf.highwire.org by guest on April 26, 2013

Lippert and Walby

of activity aiming to shape, guide or affect the conduct of some person or persons)19 in an array of domains, rather than simply as camouflage for the operations of state and economic organizations. From the outset of this development, liberal governmentality received the lions share of governmentality scholars attention20 including its 19th century classical,21 early to mid-20th century welfare,22 and advanced incarnations of the late 20th century.23 Spanning this work is the idea that liberalism requires governance that transpires indirectly, through rather than by direct coercive means. Thus, Rose discusses liberal governance as working not against but rather through freedom.24 We similarly understand governing through privacy as a constitutive process, with privacy simultaneously being created and integrated into authoritarian (and other) practices rather than only sitting on the surface obscuring such practices or countering them. Operating through rather than by direct coercive means is what Foucault called the frugality of liberal government.25 Liberal governmentality and the notion of governing through26 are therefore closely tied. The classical liberal writings of J.S. Mill27 suggest liberalism always has been linked to privacy, as seen in his contemplation in 1848 about a space in human existence entrenched around, and sacred from authoritative intrusion : the point is where the limit should be placed; how large a province of human life this reserved territory should include (emphasis added). We

19. C. Gordon, Governmental Rationality: An Introduction, in G. Burchell, C. Gordon, and P. Miller, eds., The Foucault Effect: Studies in Governmentality (Chicago, IL: University of Chicago Press, 1991), p. 2. 20. Rose, Powers of Freedom; Osborne, On Liberalism; T. Osborne, Security and Vitality: Drains, Liberalism and Power in the Nineteenth Century, in A. Barry, T. Osborne, and N. Rose, eds., Foucault and Political Reason: Liberalism, Neo-Liberalism, and Rationalities of Government (London: NCL Press, 1996), pp. 99121; M. Valverde, Despotism and Ethical Liberal Governance, Economy and Society 25 (1996), 35772; A. Barry, T. Osborne, and N. Rose, Foucault and Political Reason; S. Ashenden, Reflexive Governance and Child Abuse: Liberal Welfare Rationality and the Cleveland Inquiry, Economy and Society 25 (1996), 6488; P. OMalley, Risk, Uncertainty, and Government (London: Glasshouse Press, 2004); N. Rose, P. OMalley, and M. Valverde, Governmentality, Annual Review of Law and Social Science 2 (2006), 83104. 21. Osborne, On Liberalism. 22. Ashenden, Reflexive Governance and Child Abuse. 23. Rose, Powers of Freedom. 24. Rose, Powers of Freedom, p. 74. 25. M. Foucault, The Birth of Biopolitics: Lecture at the Collge de France, 19781979 (New York: Palgrave Macmillan, 2008), p. 29. 26. J. Simon, Governing Through Crime: How the War on Crime Transformed American Democracy and Created a Culture of Fear (New York: Oxford University Press, 2007); A. Crawford, Governing Through Anti-social Behaviour: Regulatory Challenges to Criminal Justice, British Journal of Criminology 49 (2009), 81031; B. Sokhi-Bulley, Governing (Through) Rights: Statistics as Technologies of Governmentality, Social and Legal Studies 20 (2011), 13955. 27. J. S. Mill, Principles of Political Economy: Collected Works, edited by J. Robson and V. Bladen (Toronto: University of Toronto Press, 1965 [1848]), p. 938.

Downloaded from pdf.highwire.org by guest on April 26, 2013

Law, Culture and the Humanities 0(0)

argue that privacy, this growing province of human life, is becoming a more vital element of liberalisms governing repertoire in the 21st century. Scholarly enthusiasm for refining understandings of liberal governmentality had subsided by the 20th centurys end. Many scholars began to invoke the language of exceptionalism28 to make sense of shifting governance arrangements in the wake of coercive reactions to the events of September 11, 2001 in the United States and to subsequent events in the United Kingdom and Spain. Perhaps deemed no longer relevant in the face of a growing disregard for constitutional rights, a turn to bodily torture by rendition, blanket deployments of remarkably intrusive domestic and transnational surveillance, and military interventions, liberal govermentality was sidelined as the object of scholarship, as liberalisms principles were apparently pushed aside by states in practice. Fomented by Giorgio Agambens writings29 the new language became one of exceptions instead of rationalities.30 Yet, a decade later, the state of exception phrase sometimes seems to be used in ways inconsistent with Agambens own claims.31 When used in a totalizing manner, the concept of exception fails to illuminate specific governmental domains, especially those located beyond the state.32 We argue that more routine, continuous forms of governance, such as applications of privacy law and specialized knowledge, are vital in shaping daily life in Western countries and potentially more insidious because they often remain unacknowledged compared to the sudden symbolic ruptures associated with exceptionalism.33 While consideration of authoritarianism was not a central concern in the above mentioned debates, questions of how liberal governmentality (as opposed to actual liberal democratic regimes) relates to authoritarian governance the dark side of liberalism34 were nonetheless being raised in the governmentality literature35 before interest

28. See, among others, R. Aitken, Notes on the Canadian Exception: Security Certificates in Critical Context, Citizenship Studies 12(4) (2008), 38196; S. Brophy, Lawless Sovereignty: Challenging the State of Exception, Social & Legal Studies 18 (2009), 199220. 29. G. Agamben, State of Exception, K. Attell, trans. (Chicago, IL: University of Chicago Press, 2005); G. Agamben, Homo Sacer: Sovereign Power and Bare Life (Stanford, CA: Stanford University Press, 1998). 30. Dean, Power at the Heart of the Present. 31. Aitken, Notes on the Canadian Exception. 32. Recall that Schmitts (1985) account of the sovereign, upon which Agamben relies, was meant to refer only to the formal political sphere and not routine regulation (or a liberal police) of which we argue privacy law is an example. C. Schmitt, Political Theology: Four Chapters on the Concept of Sovereignty, George D. Schwab, trans. (Cambridge, MA: MIT Press, 1985). 33. R. Lippert and J. Williams, Taking Exception: The Cases of Financial and Urban Governance, Social and Legal Studies 21 (2012), 5172. 34. D. Losurdo, Liberalism: A Counter History (translated by G. Elliot) (New York: Verso, 2011 [2006]). 35. See, for example, P. OMalley, Volatile and Contradictory Punishment, Theoretical Criminology 3 (1999), 17596; B. Hindess, The Liberal Government of Unfreedom, Alternatives 26 (2001), 93111.

Downloaded from pdf.highwire.org by guest on April 26, 2013

Lippert and Walby

in liberalism subsided.36 By interrogating the classical liberal writings of J.S. Mill, for example, Valverde37 showed that using coercive means to achieve liberal ends was presumed acceptable under some conditions and that such means were to operate alongside and within liberalism. This work began to suggest that despotic or sovereign measures were not archaic residue.38 Rather, they were intertwined with liberal governmentality. Exceptionalism acts as a reminder of the persistent potential for authoritarianism, yet studying liberal governmentality does not preclude efforts to understand this potential. Mitchell Dean examines how authoritarian practices and liberalism are intertwined without dismissing exceptional politics. Dean argues an authoritarian liberalism captures the notion that liberalism requires authoritarian or despotic government in a wide variety of instances.39 He delineates this emergent form of liberalism that lies beyond advanced liberalism. Dean argues authoritarian liberalism comprises dimensions of limited government and a liberal police. He writes:
The liberal government of the state encompasses both the constitutionally defined legalpolitical order of limited government and a liberal police established by knowledge of spheres . . . outside this domain, for example, civil society, economy, population and so on. In order to understand the authoritarian potential of liberal government we need to comprehend both aspects (emphasis added).40

We suggest that this notion of a liberal police has been neglected in governmentality studies. By a liberal police Dean means an historically new form of police that employs techniques and agencies located within civil society rather than merely issuing regulations.41 A liberal police seeks to avoid situations in which state agencies are doing too much governing while providing security. Rather, it endeavors to work through the processes of civil society and model its own interventions on the forms of regulation, expectations and values that are already in operation in civil society.42 A liberal police is said to work via an unfolding of the (formally) political sphere into civil society and an enfolding of the regulations of civil society into the political sphere.43 Thus, liberal police operates through both the aspirations and values of political

36. Although see M. Neocleous, Critique of Security (Montreal and Kingston: McGill-Queens University Press, 2008); M. Dillon and J. Reid, The Liberal Way of War: Killing to Make Life Live (London: Routledge, 2009). 37. Valverde, Despotism and Ethical Liberal Governance. 38. These arguments vary in the level of analysis (cf. Valverde, Despotism and Ethical Liberal Governance with OMalley, Volatile and Contradictory Punishment). Also see R. Lippert, Sanctuary, Sovereignty, Sacrifice: Canadian Sanctuary Incidents, Power, and Law (Vancouver: UBC Press, 2006). 39. Dean, Governing Societies, p. 128. 40. Dean, Governing Societies, p. 129. 41. Dean, Governing Societies, p. 112; M. Dubber and M. Valverde, eds., Police and the Liberal State (Palo Alto, CA: Stanford University Press, 2008). 42. Dean, Governing Societies, pp. 11415. 43. Dean, Governing Societies, p. 116.

Downloaded from pdf.highwire.org by guest on April 26, 2013

Law, Culture and the Humanities 0(0)

authorities extending or spreading out into myriad institutions of civil society and the enveloping of existing, uncovered and occasionally fragile elements by a politicallydriven state, sometimes through law. Below we discuss how these processes illuminate governing through privacy law and privacy knowledge.

III. Situating Privacy Law and Knowledge in Liberal Governmentality

Previous accounts of privacy law cover the scope of legislation and rights of citizens.44 Bennett has usefully explored the administration of privacy law.45 Yet privacy as a governance mechanism has not been a focus of previous studies. Below we therefore focus on instances of governing through privacy law and forms of power/knowledge related to privacy. Using Deans distinction between enfolding and unfolding processes, privacy law can be seen to have emerged in several distinctive forms. Privacy and information privacy come under the ambit of several kinds of law in Canada, including constitutional safeguards against unreasonable search and seizure46 (the Canadian Charter of Rights and Freedoms) and provisions stemming from common law, through which new precedents are set by judicial decisions.47 Similar to other Western countries, Canada has broad privacy laws (which are common outside the United States). Below we examine federal and provincial laws pertaining to personal information collection: the Privacy Act, the Personal Information Protection and Electronic Documents Act (PIPEDA)48 and provincial acts. The Privacy Act is a federal law that governs use and collection of personal information by the federal government and also facilitates access to that information. The Privacy Acts application is limited to collection and use of information by state agencies. In contrast, PIPEDA focuses on the use and collection of personal information derived from commercial activities and regulates the private sector. Similar to the federal Privacy Act, every Canadian province has a Freedom of Information and Protection of Privacy Act (FIPPA) or equivalent that restricts collection of personal information by provincial government agencies. In Ontario, there is a Freedom of Information and

44. For example see Bennett and Raab, The Governance of Privacy. 45. Bennett, The Privacy Commissioner of Canada; C. Bennett, The Formation of a Canadian Privacy Policy: the Art and Craft of Lesson-drawing, Canadian Public Administration 33 (1990), 55170. 46. Section 8 of the Charter indicates that Everyone has the right to be secure against unreasonable search and seizure. It is typically used to ensure reasonable expectation of privacy. A person must expect privacy and the expectation must be deemed reasonable. 47. Canadian common law says little about privacy, other than invasion of privacy, for which it may permit civil law suits for damages. M. Johnson, Status Quo Surveillance: The Legal Framework for Camera Surveillance in Canada, in A. Doyle, R. Lippert, and D. Lyon, eds., Eyes Everywhere: The Global Growth of Camera Surveillance (London: Routledge, 2011). 48. Personal Information Protection and Electronic Documents Act S.C. 2000 c. 5 (PIPEDA).

Downloaded from pdf.highwire.org by guest on April 26, 2013

Lippert and Walby

Protection of Privacy Act (FIPPA)49 and a Municipal Freedom of Information and Protection of Privacy Act (MFIPPA).50 These laws pertain to many organizations, including the offices responsible for public video surveillance and access to information that we discuss below; there is no shortage of sites where privacy law is now invoked. Deans elaboration of liberalism as a combination of limited government and a liberal police51 helps us to situate privacy law in liberal governmentality. For example, the constitutional provisions for privacy found in the Canadian Charter and case law pertaining to privacy rights are the terrain of limited government of an order different from privacy laws.52 The Privacy Act and related provincial acts that govern state agencies, however, are prime examples of enfolding through which the regulation of civil society has been enveloped by politics. In the United States and Canada, the history of a privacy movement in civil society has yet to be written. Nonetheless it is clear that it only fully emerged after 1945. In Privacy and Freedom, a major work of its time on privacy cited earlier, Westin writes that there was a growing sensitivity to privacy claims in the press and among national civic groups [and that] statements deploring the erosion of privacy . . . have been issuing steadily from every position along the ideological spectrum that a minimum position in support of privacy is emerging.53 Privacy as a value emerged from the civil rights movement in the United States and the parallel human rights movement in Canada.54 In this sense, a concern about the loss of privacy was drawn from civil society and uploaded into state agencies. State actors were called on to create privacy among those whose conduct they direct as well as for themselves. PIPEDA, however, is an example of unfolding, with politicians promising to ensure privacy of citizens health and lifestyle information among private entities using guidelines that promise to work through rather than over these private agencies.55 Indeed, through PIPEDA the Privacy Commissioner of Canada, as a consequence of any investigations, does not actually have the power to definitively decide anything.56 Instead, any complainant who does not agree with a finding by the Privacy Commissioner must apply to the Federal Court for a hearing (a rare event). PIPEDA and the Privacy Act are

49. Freedom of Information and Protection of Privacy Act R.S.O. 1990, c. F.31 (FIPPA). 50. Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. M.56 (MFIPPA). 51. Dean, Liberal Government and Authoritarianism; Dean, Governing Societies. 52. Johnson, Status Quo Surveillance. 53. Westin, Privacy and Freedom, p. 367. 54. D. Flaherty, Protecting Privacy in Surveillance Societies: The Federal Republic of Germany, Sweden, France, Canada, and the United States (London: University of North Carolina Press, 1989). 55. We suggest that the enfolding of privacy into the Canadian state at the federal level first with the 1977 Human Rights Act and then the 1982 federal Privacy Act has been followed by unfolding of privacy (back) into civil society. Today both processes are occurring in relation to privacy law as a form of a liberal police. Privacy is now a remarkably mobile governmental discourse. 56. M. Geist, Canadian Privacy Laws Ins and Outs, Globe and Mail April 4, p. B13 (2002).

Downloaded from pdf.highwire.org by guest on April 26, 2013

10

Law, Culture and the Humanities 0(0)

based on the ombudsman model intended to circumvent use of the courts. These privacy laws are under-enforced57 and semi-voluntary thus requiring compliance on the part of the governed. They are akin to regulatory licensing58 and regulatory signage59 in that they work indirectly through and depend upon liberal subjects complicity. Both PIPEDA and the Privacy Act are examples of what Dean calls a liberal police since they work through civil society or are modeled on its regulatory practices.

IV.The Birth of Privacy Studies

Because liberalism works through indirect means, production of knowledge and expertise are crucial to its operation.60 As Foucault famously remarked: There is no power relation without the correlative constitution of a field of knowledge, nor any knowledge that does not presuppose and constitute at the same time, power relations.61 Knowledge and governmental power are mutually constitutive, neither eclipses the other, hence his term power-knowledge. Privacy knowledge (or privacy as an object of knowledge) is a relatively new animal in Western jurisprudence, social science, and in the humanities. This nascent field of knowledge encourages and is rendered relevant by the crystallization of information privacy as a regulatory domain.62 Expert privacy knowledge is being produced in law, sociology, communications studies, political science, computer science, history, philosophy and in an interdisciplinary body of work called surveillance studies.63 Some of this knowledge derives from scholars64 debating the social value of privacy and developing privacy as an ethics

57. M. Priest, The Privatization of Regulation: Five Models of Self Regulation, Ottawa Law Review 29 (1997), 233302. 58. R. Levi and M. Valverde, Knowledge on Tap: Police Science and Common Knowledge in the Legal Regulation of Drunkenness, Law and Social Inquiry 26 (2001). 81946. 59. J. Hermer and A. Hunt, Official Graffiti of the Everyday, Law and Society Review 30 (1996), 45580. 60. P. Miller and N. Rose, Governing the Present: Administering Economic, Social and Personal Life (Cambridge: Polity, 2008), pp. 56. 61. M. Foucault, Discipline and Punish: The Birth of the Prison (Harmondsworth: Penguin, 1979), p. 277. 62. Bennett and Raab, The Governance of Privacy, p. xix. 63. This is not to suggest that the surveillance studies literature sees privacy as a remedy for surveillance. Indeed, prominent scholars working in this area (see D. Lyon, Surveillance Society: Monitoring Everyday Life (Buckingham: Open University Press, 2001); J. Rule, Privacy in Peril (Oxford: Oxford University Press, 2007)) have expressed doubt about the value of privacy as a remedy for surveillance and support of privacy may well be limited. That said, the debate over privacy and privacy knowledge has been produced to some extent under the banner of surveillance studies. 64. L. Weinreb, The Right to Privacy, in E. Paul, F. Miller Jr., and J. Paul, eds., The Right to Privacy (Cambridge: Cambridge University Press, 2000); B. Rossler, The Value of Privacy (Cambridge: Polity Press, 2005); V. Steeves, Reclaiming the Social Value of Privacy, in Ian Kerr, ed., Lessons from the Identity Trail (Oxford: Oxford University Press, 2008); B. Goold, Privacy, Identity and Security, in B. Goold and L. Lazarus, eds., Security and Human Rights (Oxford: Hart Publishing, 2007), pp. 4571.
Downloaded from pdf.highwire.org by guest on April 26, 2013

Lippert and Walby

11

that counters state surveillance. Other knowledge is generated outside the academy by private organizations. Below we discuss these new sites of privacy knowledge production in Canada and to a lesser extent internationally. We describe the parameters of agencies, institutes, and venues that give rise to these forms of privacy knowledge that can become tethered to projects of governing through privacy. We are not suggesting all knowledge produced through the means described below is in the service of authoritarianism. To return to Foucault65 certainly not all criminology is focused on how to more effectively incarcerate and punish criminalized populations. Nor are we suggesting that all researchers and scholars involved in these arrangements below are (like Bentham in relation to the panopticon) necessarily ill-intentioned and lacking critical acuity. However, individual intentions are somewhat beside the point since in Foucauldian analyses, as Foucault noted, it is power relations that are intentional and non-subjective.66 From a governmentality perspective these new power-knowledge arrangements demonstrate and permit the coupling of privacy and security, which facilitates authoritarian uses of this knowledge and related technologies. Several forums and sites for the production of privacy knowledge are emerging. For example, in 2007 the Identity, Privacy and Security Institute (IPSI) was established at the University of Toronto.67 One of its five main objectives is To work with policymakers and regulatory agencies to inform their judgment of identity, privacy and security realities with evidence-based considerations of the scientific, ethical, legal and social issues involved. A great deal of IPSI-based research and development is aimed at building privacy into surveillance technologies such as CCTV cameras and body scanners. Three other IPSI objectives also couple privacy with security, a point to which we return below. While surveillance studies allows for critical perspectives that reveal how surveillance can exacerbate inequalities, at least some knowledge produced under this rubric focuses too on perceptions and regulation of privacy. Among the major projects at Queens Universitys surveillance studies centre, for example, has been an international privacy survey, a large scale quantitative effort called the globalization of personal information project.68 This international survey of nine countries sought to explain ordinary citizens responses to increased flows of personal data. The first surveillance studies journal, Surveillance and Society, also housed at Queens, was introduced as a multidisciplinary academic forum in 2002. An examination of its contents over the past decade reveals an empirical focus on issues of privacy regulation, with a recent special issue containing six review articles specifically devoted to it.69 Journals such as Information

65. Foucault, Discipline and Punish. 66. M. Foucault, History of Sexuality (vol. 1) (London: Penguin, 1990), p. 94 67. IPSI About http://www.ipsi.utoronto.ca/about.html (2011). 68. Launched in 2003, the Globalization of Personal Data Project sought to trace effects of new personal data in relation to mobility and globalization. Surveillance Studies Centre http:// www.sscqueens.org (2010). 69. C. Bennett, In Defence of Privacy: the Concept and the Regime, Surveillance and Society 8(4) (2011), 48596.

Downloaded from pdf.highwire.org by guest on April 26, 2013

12

Law, Culture and the Humanities 0(0)

Polity, Information, Communication and Ethics in Society and International Data Privacy Law now regularly produce scholarship about privacy and its regulation. More significant has been the Canadian federal governments Office of the Privacy Commissioners introduction of a major annual research grant program in 2004 through which it has shaped academic research about privacy issues. This Contributions Program is regarded internationally as the foremost privacy research program, which to date has provided over $2 million for more than 65 separate initiatives. Its annual budget is $500,000.70 This program has encouraged research on everything from privacy checkups of organizations to exploration of privacy implications of patient websites and online health record databases.71 These Canadian and international developments have spawned myriad academic books, edited collections, reports, articles and blogs on privacy law and governance. Of course, theorizing about privacy predates emergence of state funding for production of privacy knowledge. Numerous scholars have sought to define and reform the privacy concept.72 But such knowledge production has rapidly advanced in recent years.73 Beyond the academy, civil liberties organizations such as the British Columbia Civil Liberties Association and the American Civil Liberties Union continue to produce knowledge about privacy too. However, in the 2000s there has been an enfolding of this knowledge into state agencies that corresponds to new uses of privacy law revealing the link between knowledge and liberal governance through privacy. In the period during expansion of privacy laws and privacy knowledge production, there has also emerged a new expert, the privacy professional. The International Association of Privacy Professionals (IAPP) was formed in 2000. Claiming almost 7,000 business, government, academic, and advocacy group members in forty-seven nations, its chief objective is to define, promote and improve the privacy profession globally. This forum is for privacy professionals worldwide to learn and share information about information privacy. As with all professional associations, the IAPP offers an

70. Canada Announcement http://www.priv.gc.ca/media/nr-c/2011/an_110214_e.cfm (2011). 71. Canada Contributions Program: Research funded by the OPC Archives http://www.priv. gc.ca/resource/cp/cp_archives_e.cfm#2010-2011 (2011). 72. S. Warren and L. Brandeis, The Right to Privacy, Harvard Law Review 4 (1890), 74101; H. Arendt, The Human Condition (Chicago, IL: University of Chicago Press, 1958); E. Shils, Privacy: Its Constitution and Vicissitudes, Law and Contemporary Problems 31 (1966), 281306. 73. B. McDougall and D. Hansson (eds.), Chinese Concepts of Privacy (Leiden: Brill, 2002); J. Rule, Privacy in Peril (Oxford: Oxford University Press, 2007); H. Tavani, Informational Privacy: Concepts, Theories, and Controversies, in K. Himma and H. Tavani, eds., The Handbook of Information and Computer Ethics (Hoboken, NJ: Wiley, 2008), pp. 13164; D. Solove, Understanding Privacy (Cambridge, MA: Harvard University Press, 2008); H. Nissenbaum, Privacy in Context (Stanford, CA: Stanford University Press, 2010); Bennett, In Defence of Privacy, 48596; T. Allmer, Critical Contribution to Theoretical Foundations of Privacy Studies, Journal of Information, Communication, and Ethics in Society 9 (2011), 83101.

Downloaded from pdf.highwire.org by guest on April 26, 2013

Lippert and Walby

13

accreditation program for privacy professionals that includes training and testing: Achieving an IAPP credential validates your expertise and distinguishes you from others in the field.74 Forming their own associations, these experts now dutifully attend annual meetings on their agencies behalf to learn the latest on privacy enforcement. The Canadian arm of IAPP formed in 2008. IAPP is not a civil liberties or privacy advocacy group and claims not to involve itself in the formal political sphere. Rather, the IAPP is the place where privacy ideas, people and education converge.75 As with Torontos ISP and Queens Surveillance Centre, it has obtained a grant from the Office of the Privacy Commissioner (OPC) Contributions Program to expand what it calls a KnowledgeNet program that brings together privacy and data protection professions for education and networking with peers. IAPP also distributes the Daily dashboard, an electronic bulletin of privacy knowledge gleaned from news headlines about privacy, to 12,000 people.76 This knowledge concerns where privacy presently lies, where it is eroding, and the new places in cyberspace, inside a smartphone, on public streets, or among texts stored in state corridors where it is discovered in relation to surveillance. IAPP is a patent example of unfolding, of political concern about privacy law embedding itself in civil society in an organizational form. Perhaps the epitome of unfolding in relation to privacy is Nymity, a Canadian company formed in 2002 that provides privacy risk assessment tools for corporations that handle personal information. With offices in Toronto, Washington and Brussels, their team of privacy experts assess documents from major corporations (e.g., Kraft, Merck and Microsoft) and state laws and guidelines (such as Canadas PIPEDA), recommending best practices, and standardizing privacy protocol. They also collate and distribute information about privacy benchmarks in state and non-stage organizations. They employ an expert team of privacy lawyers and former chief privacy officers that are [sic.] 100% dedicated to producing the content for Nymitys Research Tools that has been proven to provide customers the information they need to gain the knowledge they want. The scope of this firms knowledge production is significant. Nymity is a global research organization supporting every privacy regime in the world Nymitys team of privacy experts have analyzed over 6,000 documents and 400 privacy laws, codes and standards against the accountability privacy principle.77 Consistent with the spirit of governmentality studies, we analyze these developments regarding privacy knowledge production in relation to enfolding and unfolding to show how these ideas and technologies are used and their effects irrespective of intention. These agencies and institutes are implicated in producing privacy knowledge that makes governing through privacy conceivable.

74. IAPP Privacy Certification https://www.privacyassociation.org/certification/ (2011). 75. IAPP Canada Final Report to the Office of the Privacy Commissioner of Canada https:// www.privacyassociation.org/knowledge_center/iapp_canada_opc_final_report/ (2011), p. 2. 76. IAPP Canada Final Report to the Office of the Privacy Commissioner of Canada. 77. Nymity About Nymity http://www.nymity.com/About_Nymity.aspx (2011).

Downloaded from pdf.highwire.org by guest on April 26, 2013

14

Law, Culture and the Humanities 0(0)

V. Privacy by Design
It is also within these knowledge networks that we encounter a revealing notion now entering circulation: privacy by design (PbD). Here privacy is to be thought-through ahead of time, that is, designed, set, planned. Actively promoted by its inventor, Ontarios current Privacy Commissioner, Ann Cavoukian, PbD involves techniques and technologies that fashion privacy in new spaces and that are sold as commodities. As its proponents avow, PbD may apply to IT systems, accountable business practices, and physical design and networked infrastructure, revealing privacys remarkably wide and growing scope. Here privacy-enhancing technologies (PETs) no longer subtract from security practices but add new realms in which to intervene and merge seamlessly with surveillance. PbD is fostered by interaction among state agencies, privacy knowledge producers, and civil society groups. For instance, at the University of Torontos IPSI, Drs. Kostas Plataniotis and Karl Martin have developed an approach to use of camera surveillance in public places that incorporates PbD. Using cryptographic techniques, software blurs faces and other elements of a digitized image that could be used to identify a person (perhaps best portrayed in Manu Lukschs celebrated 2007 film, Faceless). Ontario Privacy Commissioner Cavoukian has pointed to their research as facilitating a new paradigm in privacy that works in tandem with security. The clearest application of this technology is in commercial spheres such as at shopping malls78 and in transport hubs. Indeed, in public presentations since September 11, 2001, Cavoukian has referred to PbD as security technologies enabling privacy (STEPS) that should be applied in both commercial and state settings. She argues that privacy and security should no longer be opposed to one another, but that security and surveillance technologies can be designed to promote privacy laws. She points to 3-D holographic body scanners used at airports and biometric encryption as examples of STEPS, contending that security and privacy enable one another. This development is not limited to Canada. A resolution for accepting the PbD foundational principles was passed at the international privacy and data protection commissioners annual conference in Jerusalem in October, 2010. This meeting was co-sponsored by the Canadian and Ontario privacy commissioners and officials from European jurisdictions. The first international workshop on Availability, Reliability and Security devoted solely to PbD was held in Vienna in August, 2011. In addition, Germanys Privacy Commissioner has argued that PbD provides a viable means of transforming security technologies,79 noting that Germanys new electronic ID card (which uses digital facial and fingerprint images) incorporates PbD. Weis and colleagues have likewise discussed incorporating security and privacy into radio frequency identification (RFID) technology across Europe and North America.80 RFID tags are used in consumer, traffic,

78. Information and Privacy Commissioner of Ontario White Paper: Anonymous Video Analytics (AVA) Technology and Privacy http://www.ipc.on.ca/images/Resources/AVAwhite6.pdf (2011). 79. P. Scharr, Privacy by Design, Identity in the Information Society 3 (2010), 26774. 80. S. Weis, S. Sarma, R. Rivest, and D. Engels, Security and Privacy Aspects of Low-Cost Radio Frequency Identification Systems, in D. Hutter, et al., eds., Security in Pervasive Computing (Berlin: Springer, 2003).
Downloaded from pdf.highwire.org by guest on April 26, 2013

Lippert and Walby

15

and health contexts and often contain personal information that can be intercepted or hacked. While seemingly a surveillance device that would raise concerns about privacy, proponents of PbD do not have a problem with RFID technology per se as long as PbD is conjoined with it. Nineteenth century liberalisms concern with technologies of security focused upon population as an object of knowledge rather than territory and there existed a tension between liberal order and security.81 Twenty-first century liberal governmentality entails a reconfiguration of privacy as security82 rather than privacy and security as distant ends of a scale. As seen in IPSIs principles noted earlier, the overlap of privacy and security means they can be comfortably discussed in one anothers company. At conferences, the new privacy professionals, public police officials, and private security industry representatives speak the same language and express common concerns and agree that privacy and security can be conjoined in surveillance technologies. Comparing the American Society of Industrial Security (ASIS) (the premier international security association) annual conferences in 2001 and 2011 reveals more education sessions discussing privacy (8) in 2011 than 2001 (0). Privacy and security are now invoked in tandem, such as in a session entitled Managing Privacy and Security. Similarly, the leading IT security magazine can now announce the Ontario Privacy Commissioner as the privacy professional of the year. With privacy by design and concepts such as STEPS, privacy is being set in new virtual and physical spaces while becoming one chief means of propelling security and surveillance projects forward.83 It is in conjunction with this growing knowledge that one can locate the exercise of liberal governmental power through privacy law. Knowledge about privacy serves to reveal spaces where and the means by which conduct can be governed through privacy. This knowledge and these techniques enable specific uses of privacy law, to which we turn next.

VI. Examples of Governing Through Privacy

Below we examine privacy law uses and invocations in two different contexts: openstreet camera surveillance and access to information requests.84 Both are contexts in which privacy was not a consideration before the rise of privacy law; there is a sense in
81. Osborne, Security and Vitality, pp. 101102. 82. Surveillance Camera Awareness Network (SCAN) A Report on Camera Surveillance in Canada: Part One (Surveillance Project, Queens University, Ontario, 2009), pp. 4152. 83. A. Cavoukian, Find Ways to Deliver Both Security and Privacy, Canadian Society for Industrial Security annual meeting, Toronto, May 30, 2011 (2011). 84. To examine uses of privacy law, we analyzed interviews and documents from current research projects on urban surveillance and governance that entail access to information requests, examination of public documents and/or those of civil society organizations, and interviews with representatives of security and privacy industry firms and state officials who oversaw CCTV implementation. We also examined legal decisions and responses to complaints to the Office of the Privacy Commissioner of Canada and to the Office of the Information and Privacy Commissioner of Ontario.

Downloaded from pdf.highwire.org by guest on April 26, 2013

16

Law, Culture and the Humanities 0(0)

which privacy has been only recently installed in open-street public places as well as state documents and become a source of concern. We focus on these examples to demonstrate the counterintuitive effects of privacy law in relation to governing practices. We then discuss the use of privacy by design technologies in these two sites to demonstrate the importance of privacy knowledge production.

1 Privacy Law and Open-street CCTV Surveillance

Open-street CCTV surveillance has been introduced in public spaces across the United Kingdom, the United States, Canada, and elsewhere. Though their purposes vary, police and local business organizations that sometimes fund the camera systems tend to use them in authoritarian efforts to halt forms of public conduct (such as so-called antisocial behavior) by identifying persons and permitting immediate or later police-led criminalizing intervention.85 Civil liberties groups problematize CCTV through privacy discourse and in relation to prevailing liberal sentiments. The resulting privacy problem in relation to open-street CCTV surveillance is based on the notion of individual rights and privacy law as protective of those rights. This was evident in Canadas federal Privacy Commissioners activities in relation to Kelowna, British Columbias experience with CCTV surveillance. In Kelowna, CCTV was deployed by the RCMP (a police service under federal jurisdiction but contracted to many Canadian municipalities) in a public bus hub and in a public park. In the early 2000s the federal Commissioner at the time, George Radwanski, ordered the RCMP to stop monitoring these public spaces and intervened at the level of the Supreme Court of British Columbia.86 However, the Supreme Court dismissed this intervention when it held that the Commissioner was deemed to have no legal capacity to sue and no standing.87 This office has not taken similar direct action against public CCTV in Canada since. Instead, the federal Privacy Commissioner has subsequently introduced guidelines for CCTV use. Most provinces have guidelines as well. While restricting open-street CCTV from gazing into residences and businesses88 thus claiming to preserve privacy, such guidelines have permitted the proliferation of CCTV in public spaces and corresponding image retention by their incorporation into the administration process. In the most in-depth study on the topic, Hier shows how a conciliatory approach by privacy commissioners based on the non-binding privacy guidelines for use of CCTV in public places has facilitated the diffusion of cameras across Canadian cities.89 Indeed, the very

85. A. Doyle, R. Lippert, and D. Lyon (eds.), Eyes Everywhere: The Global Growth of Camera Surveillance (London: Routledge, 2011). 86. S. Hier, Panoptic Dreams: Streetscape Video Surveillance in Canada (Vancouver: UBC Press, 2010). 87. Privacy Commissioner (Canada) v. Canada (Attorney General) et al., 2003 BCSC 862. 88. Access and Privacy Service Alberta Freedom of Information and Protection of Privacy: Guide to Using Surveillance Cameras in Public Areas (Edmonton: Access and Privacy, 2004), p. 4. 89. Hier, Panoptic Dreams.

Downloaded from pdf.highwire.org by guest on April 26, 2013

Lippert and Walby

17

existence of a privacy commission-produced Guide to Using surveillance Cameras in Public Areas as opposed to, for example, a Guide to Ensuring Privacy in Public Areas is revealing of the new overlap between privacy and surveillance/security. Such guidelines stipulate that public or private authorities planning to introduce surveillance cameras complete a privacy impact assessment (PIA). As long as users conduct this PIA and abide by the other stipulations, they comply with privacy guidelines and legislation. These are the privacy rules that enable CCTV use. In this assessment process, security and privacy become virtually indistinguishable; upon submission of a PIA, together with the case for implementing a surveillance system in a particular site, the [d]etails of the security measures to be implemented for a proposed surveillance system may be placed in an appendix so that they can be kept confidential . . . by the Commissioner.90 The privacy commissioner thus becomes responsible for safekeeping security arrangements. The non-binding privacy guidelines published by privacy commissioners have changed the course of public CCTV diffusion, insofar as privacy guidelines have become integrated into the CCTV projects of local police and business organizations. This occurred through collaboration between these organizations and the privacy commissions. As one CCTV implementer described:
[W]e have complied with the privacy guidelines and we have met with the privacy commissioner. Before we even put one camera up we sat with her and we let her review our proposal. We said, you know, are we abiding by the guidelines? Are we doing the right things the right way? . . . Youve got people in the middle saying I dont know that I like cameras everywhere, but You guys got procedures, youve got rules, youre abiding by the privacy [guidelines] (Interview with Ontario CCTV implementer).

Collecting personal information for criminalization purposes can be justified while privacy legislation is invoked, precisely because the latters use is expected to be a form of liberal police and therefore under-enforced and dependent on liberal subjects compliance. Davies has also lamented that this shift has now created a data protection paradigm in which privacy provides a set of rules for surveillance by which to play.91 Police and municipal authorities appropriate privacy laws to collect personal information in public. In our empirical research, we discovered privacy law is used to authorize specific deployments of CCTV as evinced in policy statements on the Internet and in the regulatory signage assembled on the edges of CCTV zones in Canadian cities, which are among the only forms of communication justifying these systems to a broader public. For example, in Hamilton, Ontario, CCTV signage reads: Video Surveillance Area. This area of the City of Hamilton is being monitored by video surveillance for the purpose of law enforcement in accordance with the Municipal Freedom of Information and Protection of Privacy Act. In London, Ontario, signage similarly reads: You have entered an area
90. Access and Privacy Service Alberta Freedom of Information and Protection of Privacy, p. 7. 91. S. Davies, Re-Engineering the Right to Privacy: How Privacy has Been Transformed from a Right to a Commodity, in P. Agre and M. Rotenberg, eds., Technology and Privacy: The New Landscape (Cambridge, MA: The MIT Press, 2001).

Downloaded from pdf.highwire.org by guest on April 26, 2013

18

Law, Culture and the Humanities 0(0)

that may be monitored by Closed Circuit Video Cameras . . . Legal Authority for collection of information is Section 29(1)(g) of the Ontario Municipal Freedom of Information and Protection of Privacy Act (emphases added). For privacy commissions in the United Kingdom and on the European continent, mandatory CCTV signage also has become the regulatory strategy of choice.92 Yet, CCTV signage that invokes privacy law does not only authorize CCTV surveillance; there is a sense in which signage creates privacy where it previously never existed and through which authorities can then govern. Put differently, CCTV signage is less about legitimizing surveillance by covering off the self-evident need for privacy in civil society and more about demarcating privacys depth, resonance, and location in relation to public spaces and flows, and then effectively working through them. CCTV signage presumes liberal subjects with a capacity to choose to enter a CCTV zone in public and once inside encourages these subjects to manage their privacy in relation to a given CCTV program. These programs are, however, closely tied to authoritarian practices; as one CCTV operator related:
The Privacy Commission [said], one of the big things is you dont view inside bars, you dont view inside any of the areas. You look for behaviour on the street and if it involves something thats illegal then Im on the phone right away . . . all I have to do is just say who I am and we have a fairly good working relationship with the police in that if I call they know its serious and they will send somebody out right away.

At the same time, a new generation of CCTV signage is emerging that no longer limits the introduction of privacy in the way that signage affixed to physical infrastructure does. One exemplar of privacy by design and of knowledge production identified above is the work of Drs. A. Clement and J. Ferenbok at the ISPI.93 Using funding from the federal OPC Contributions Program they have developed three camera surveillance signage prototypes that encourage compliance and citizens to look out for and govern their own privacy consistent with privacy legislation in more sophisticated ways (based on location, type of system, storage capacities) than via the older standard signage.94 The technology Clement and Ferenbok have created can alert a citizen (on their mobile phone) entering a CCTV zone. Since it automatically signals subjects to decide what to do about CCTVs presence, it is less time and space dependent and accounts for the mobility of liberal subjects. This effort also illustrates the shifting responsibilities for privacy protection that depend on PbD as well as how PbD diffuses through openstreet CCTV and sometimes authoritarian interventions. These knowledge-dependent

92. Doyle, Lippert, and Lyon (eds.), Eyes Everywhere. 93. A. Clement and J. Ferenbok, Mitigating Asymmetric Visibilities: Towards a Signage Code for Surveillance Camera Networks, in A. Doyle, R. Lippert, and D. Lyon, eds., Eyes Everywhere: The Global Growth of Camera Surveillance (London: Routledge, 2011). We are not suggesting these and/or other producers of these technologies are not well-intentioned or not attempting to prevent authoritarian uses of surveillance technologies in their efforts. 94. Clement and Ferenbok, Mitigating Asymmetric Visibilities, p. 310.

Downloaded from pdf.highwire.org by guest on April 26, 2013

Lippert and Walby

19

developments suggest privacy and PETs and surveillance technologies are integrated as never before.

2 Privacy Law and Access to Information

The notion of privacy is also invoked to govern the release of records under access to information (ATI) and freedom of information (FOI) laws. At the federal level in Canada, the Access to Information Act allows for disclosure of information about state agencies that is not already a public record.95 The prevention of disclosure based on the personal information sections of ATI and FOI law presents barriers to social scientists, lawyers, journalists and activists who use these legal provisions to collect data about authoritarian (and other) state practices. Here we focus on how ATI is governed through privacy and how PbD is becoming embedded in ATI protocol. We are not suggesting the privacy exemption is somehow invalid or without good intention; some redactions protect individuals privacy as we defined it earlier. Rather, we suggest that the availability of these exemptions and technologies can allow authoritarian practices to be systematically hidden. Section 19 of the Access to Information Act pertains to personal information stipulating that the head of a government institution shall refuse to disclose any record requested under this Act that contains personal information as defined in section 3 of the Privacy Act. Section 3 of the Privacy Act defines personal information as information about an identifiable individual that is recorded in any form including (a) information relating to race, national or ethnic origin, colour, religion, age or marital status; (b) information relating to the education or the medical, criminal or employment history of the individual or information relating to financial transactions and so on. The scope of governing through privacy is stunning as there are no less than thirteen of these sub-definitions, with more intricate breakdowns for state employees. Provincial level FOI legislation also contains sections concerning personal information.96 Once a request is made, the response letter from ATI officers about disclosure is not always detailed; it may stipulate that information was exempted due to Section 19 of the Access to Information Act, which invokes the definition of personal information as per the Privacy Act. When this happens, the researcher is not in a position to learn why information has been exempted, only that it has been due to a concern about privacy. ATI

95. K. Walby and M. Larsen, Access to Information and Freedom of Information Requests: Neglected Means of Data Production in the Social Sciences, Qualitative Inquiry 18 (2012), 3142; M. Larsen and K. Walby (eds.), Brokering Access: Power, Politics and Freedom of Information Process in Canada (Vancouver: UBC Press, 2012). 96. For instance, Section 17 of the Alberta Freedom of Information and Protection of Privacy Act states that the head of a public body must refuse to disclose personal information to an applicant if the disclosure would be an unreasonable invasion of a third partys personal privacy. The disclosure is deemed reasonable if the third party has, in the prescribed manner, consented to or requested the disclosure, or if there are compelling circumstances affecting anyones health or safety and written notice of the disclosure is given to the third party.

Downloaded from pdf.highwire.org by guest on April 26, 2013

20

Law, Culture and the Humanities 0(0)

officers can also use Section 19 to exempt portions of documents instead of redacting specific personal information on each page, leaving the researcher to guess what types of documents and correspondence exist. The sub-definitions of personal information pertaining to government employees prevent their identities and offices from becoming known and accountable. For critical researchers in the social sciences and humanities, ATI and FOI is crucial for identifying names and offices of state employees to explore practices of public agencies and relations among public and private organizations that comprise governance cultures. Here privacy becomes a means of preventing release of information about such practices and relations, which precludes researchers from knowing what state agencies are doing, how they are connected, and on whose behalf they operate. The following are several other examples of blanket exemptions being given for ATI at the federal level under Section 19. The first example concerns research on the securitization of Haiti and Canadas involvement in prison building there.97 In a 2009 request for all reports, draft reports, powerpoints, briefing and background material, in the possession of the Canadian International Development Agency related to the construction of prisons in Haiti, Section 19(1) was invoked as a reason for severing some documentation. Although some portions of the document were marked where data were redacted or exempted according to section 19(1), in other places data were exempted with no statement of why or under what section. In this case, privacy exemptions allow state practices and those responsible for making sovereign decisions about the lives of disadvantaged groups and vulnerable populations to remain hidden. A second example concerns research on policing animal rights protesters in Canada.98 In a request to Public Safety and Emergency Preparedness Canada for internal documents and/or briefing material regarding policy measures relating to eco-terrorism, major portions of documentation were exempted. Section 19(1) was also invoked to exempt information in a request to the Canadian Security Intelligence Service pertaining to briefing notes, threat assessments and meeting minutes on environmental extremism. Interviews with the targeted activists about the security and policing practices they experienced suggest that a great deal of material produced by security intelligence and policing agencies was redacted by invoking privacy exemptions. A third example concerns the policing of homeless people by conservation officers in Ottawa and Calgary.99 In these cases, while the information redacted using the privacy exemption might pertain to the individuals being regulated, it may have also truncated the disclosure about the details of these policing efforts. These examples illustrate the introduction of
97. K. Walby and J. Monaghan, Dark Side of the SecurityDevelopment Nexus: Canadas role in the Securitization of Haiti, 20042009, Alternatives 36 (2011), 27387. 98. K. Walby and J. Monaghan, Private Eyes and Public Order: Policing and Surveillance in the Suppression of Animal Rights Activists in Canada Social Movement Studies 10 (2011), 2137. 99. The National Capital Commission, a federal agency involved in regulation of Ottawa parks, exempted portions of the documents using section 19(1). Portions of documents were likewise withheld according to Section 17 of the Alberta Freedom of Information and Protection of Privacy Act by the Alberta Tourism, Parks and Recreation FOIP office that oversees the officers who regulate numerous Calgary parks.

Downloaded from pdf.highwire.org by guest on April 26, 2013

Lippert and Walby

21

privacy in state agencies vis--vis a concern for information management and public awareness of security practices that have authoritarian overtones. Details about how vulnerable or oppositional groups are surveilled, controlled, or imprisoned is hidden in the name of privacy rights. Consistent with 21st century liberal governmentality,100 the privacy of these people is preserved while their freedom is systematically curtailed with no contradiction. The governance of access to information through privacy is carried out by an ATI officer for the government department in question, whose job is to redact the information and apply sections of legislation. A liberal governmentality shapes the practices of ATI officers insofar as they operate under the auspices of balancing individual rights and freedoms. Such petty powers of adjudication and enforcement101 are intertwined with processes of information governance. Redaction of information by applying the privacy exemption is one form of message discipline that occurs in state agencies. These techniques of control conflict with the Access to Information Acts spirit insofar as stringent application of the Acts exemption stipulations prevents disclosure.102 Such practices also raise questions about why privacy stipulations are included, as well as what remains unknown about state agents and agencies when such information is exempted. Exemptions concerning privacy are one way information is controlled, which has repercussions for what can be known about state governing practices, and about the extent to which they are authoritarian. Here privacy law can be used to shore up security practices, representing a site where privacy and security once again become nearly indistinguishable. This occurs in a way that remains consistent with 21st century liberal governmentality whereby liberal rights overlap with techniques of security.103 The typical image of an ATI disclosure is a white page with blacked out sections of redacted text. In Canada, the marker-based production of blacked out texts is becoming outmoded, as state agencies switch to software systems such as ATIP flow and the more advanced AccessPro Case Management. While the rules for redaction are established by law and, at the federal level, Treasury Board regulations, agencies also create in-house policies around best practices and information management software use. The new programs are designed by the Ottawa-based private software company Privasoft: Developing, implementing and administering an effective organization-wide privacy compliance management program requires not only the expertise of privacy specialists, but a framework within which to manage the compliant treatment of information.104 While technological sophistication sounds like an advance over the interpretative discretion of the ATI officer, consistent with PbD, Privasoft experts are producing software geared toward automation and building exemption in, including privacy exemptions.

100. Dean, Power at the Heart of the Present. 101. N. Rose and M. Valverde, Governed By Law?, Social & Legal Studies 7 (1998), 546. 102. A. Roberts, Blacked Out: Government Secrecy In The Information Age (New York: Cambridge University Press, 2006), p. 96. 103. Neocleous, Critique of Security, p. 31. 104. Privasoft Privacy http://www.privasoft.com/site/Solutions/ServiceDelivery.html (2011).

Downloaded from pdf.highwire.org by guest on April 26, 2013

22

Law, Culture and the Humanities 0(0)

This will allow for the real-time management and tracking of all aspects of the ATI process, from filing to the tasking of requests to standardized correspondence to redaction which now appears as blank white space and release package approval. Privasoft also offers tools for managing sensitive requests through amber lighting and red filing.105 An interview with Privasoft representatives reveals the close relationship with Privacy Commissioners in the development of privacy knowledge and technologies:
Representative 1: We dont make judgments; we simply enable people to do their jobs. We talk to the Information and Privacy Commissioners, at conferences, whenever we get a chance. What are you guys thinking about? What is it that youre concerned about now? . . . Does that mean I have to change anything about the way Im doing my job? Representative 2: We also sit shoulder-to-shoulder with the Information Privacy Commissioners at the events that we all go to. I dont know why Im drawing a blank on that the University of Alberta Access and Privacy Conference? They invite us to speak. Were in the same community

As with the example of newer mobile CCTV signage, there is a technological dimension to redaction and exemption based on expert knowledge that is consistent with notions of governmental technology in liberalism.106 Governing information through privacy also intersects with commercial interests that depend upon the marketing and consumption of privacy-related commodities, just like the security industry and culture of which they have become a part. As a Privasoft representative put it:
Canada is a great market because they tend to have all their ATIP shops concentrated. So DND has one ATIP shop, and they probably got 200 people in their ATIP shop, but theyre all here [in Ottawa], theyre all in one place were also doing the same thing for the American market. Theyre introducing their changes for the annual report in May, we start getting calls in August, so we try to be ahead of the game.

While in this case experts in a private firm produce privacy knowledge, the production of expert privacy knowledge in universities includes training about how to use these devices too. For example, at the University of Alberta in Edmonton there are courses aimed at teaching ATI officers how to use these new technologies to redact information and apply privacy exemptions.

VII. Discussion and Conclusions

We have examined privacy law and privacy knowledge production related to liberal governmentality. Most existing literature on privacy focuses on protection of individual rights rather than the counterintuitive forms of governance that accompany privacy law.

105. Amber lighting refers to the tagging of a request or a requester as politically contentious. Red filing refers to requests that are stonewalled by the Ministers Office, who receive a weekly inventory of marked requests. 106. Rose, Powers of Freedom.
Downloaded from pdf.highwire.org by guest on April 26, 2013

Lippert and Walby

23

We have de-coupled privacy from individual rights to show that privacy is not necessarily an antidote to surveillance. Rather, when coupled with security and built in to technology, privacy can enable surveillance for authoritarian purposes. In some instances, privacy and security become almost indistinguishable, including in the work cultures of privacy professionals. For example, privacy enacted through PETs and STEPS constitute and legitimize surveillance and security practices. As privacy law extends governance projects in conjunction with the field of security, privacy advocates and surveillance entrepreneurs have never worked closer together. Privacy law and privacy discourse are not only increasingly adopted in the practices of state agencies and organizations of civil society, they are also becoming the basis upon which private corporations, such as Privasoft and Nymity, are formed. The enfolding and unfolding processes of a liberal police situate privacy law in liberalism insofar as these processes tether civil societys values and regulatory practices to state agencies. We focused on uses of privacy law and guidelines in connection to the diffusion of open-street camera surveillance across Canada. We also used the example of access to information in Canada to discuss how privacy and personal information are invoked when information pertaining to authoritarian practices is sought. The forms of privacy law that we have investigated operate between the two pinnacles of governing too much, backed by limited state resources and little direct intrusion, and governing too little.107 These are only two of many possible examples given the scope of this form of a liberal police, but they nonetheless show that governing through privacy law can have the effect of further embedding authoritarian practices into organizations. We have not commented on the issue of subjectification, also central to governmentality studies, though a discussion of privacy here presents an important avenue for future research. Surveillance fosters individualization, but so too does privacy law. In this latter sense, privacy law is a form of political subjectification requiring liberal subjects to learn how to manage their own privacy in new ways and sites.108 However, as we have argued, understanding these forms of governance entails recognition that they have a technical side that is highly dependent on the expansion of privacy knowledge, expertise, and commodification. One major implication of our argument is that neither privacy law nor liberalism are likely to disappear in the near future. Although there is variation, some scholars and privacy advocates have called for standardization of privacy law to counter the spread of surveillance. Further consideration of this idea must be tempered by a critical understanding of how governing through privacy law is increasingly tethered to surveillance and security within liberalism, even if perhaps especially if we accept Foucaults view that law extends itself illimitably in its responsiveness.109 Such contemplation will require judging the extent to which privacy studies can move beyond the expert and

107. Rose, Powers of Freedom. 108. J. Whitson and K. Haggerty, Identity Theft and the Care of the Virtual Self, Economy and Society 37 (2008), 57294. 109. B. Golder and P. Fitzpatrick, Foucaults Law (New York: Routledge, 2009), p. 71. 110. J. Simon, Beyond the Panopticon: Mass Imprisonment and the Humanities, Law, Culture and the Humanities 6 (2010), 32740.
Downloaded from pdf.highwire.org by guest on April 26, 2013

24

Law, Culture and the Humanities 0(0)

technical knowledge documented here to become informed to a greater extent by a normative and critical edge of the humanities that was once evident in relation to other authoritarian practices.110 Our analysis also begins to reveal how authoritarian practices are incorporated within liberalism through privacy. Our argument thus supplements others accounts of liberal governmentality and what Dean has claimed about authoritarian liberalism. Future empirical research on governing through privacy and on privacy law as a form of liberal police may provide ways of exploring how an inherently unstable authoritarian liberalism is possible in particular sites and discerning the extent to which Deans concept has purchase on our present. If the 20th century was one of individual privacy rights, the 21st century may be one of governing through privacy. Privacy elevates a discourse of rights whilst at times producing conditions for authoritarian practices to occur or expand. The narrower implication of the foregoing argument is a new obligation to inquire further into forms of law and regulation within contemporary liberalism, and how other enfolding and unfolding processes, like those involving privacy, can so easily facilitate practices of securitization.

Downloaded from pdf.highwire.org by guest on April 26, 2013