After Alberto Gonzales vs. Google (order, summary), AOL’s publication of user search queries is the second big case which raises issues on the proper handling of user search queries collected by search engiens, and it seems to boost the bill for an Eliminate Warehousing of Consumer Internet Data Act (EWOCID).
The case beautifully demonstrates a couple of basic characteristics of information and their legal relevancy. In the following, I will in a sketchy way try to describe and outline some of them, even if they seem trivial. In doing so, I largely draw upon Jean Nicolas Druey’s seminal work on information law (available only in print and in German).
1. Information (as content) is entirely context-specific
- First, only its context gives information meaning. E.g., the words “cocaine”, “marijuana”, “crack”, “lsd” create the context (more precisely: a super-category) “drugs” by the mere fact that they are in a sequence. And if we know that they are search queries by AOL user # 1234, this tells us something about that person.
- Second, where information is stripped of its context, we strongly tend to make up a context, and we can never be sure whether our image is accurate. Some of you readers may have imagined that our user # 1234 may have a drug problem; others may have thought that the person could be a teacher preparing a class on the subject.
- Third, the context of information is distributed: I like the metaphor of information as an infinite jigsaw where people may have any number of pieces in their hands, bot don’t know what pieces the other persons have. To most of us, even dozens of search queries for user # 1234 are not sufficient to find out who he or she is, even if they contain local information. (That is, we might find out the sex of the user.) But there will be a couple of people who have enough pieces in their hands, including user # 1234’s name, to find out. Unfortunately, the impact of these people seeing user # 1234’s search queries has the potential of being much more unpleasant for that user than would be the case if I found out his real name, because the people who will find out will be his friends or family members.
These characteristics have, among others, the following normative consequences:
- The de-contextualization of information doesn’t necessarily make the information harmless. In the AOL case, even pseudonymity doesn’t prevent attribution of the search queries to a particular individual in every case. European data protection law tries to deal with the issue by defining as “personal data” (i.e., information subject to data protection laws) only data which can be attributed to an individual with reasonable effort. This leaves everything to the context, which seems hardly convincing as a general legal rule.
- False attribution of information to an individual can have the same negative consequences as proper attribution. This puts into question the notion of “personal data” as used in Europe. If, e.g., the mother of 15 year old user # 5678 attributes user # 1234’s search queries on drugs to her son, the latter won’t be able to prove to her that he is not in danger of trying drugs.
- The competence for the decision whether information is relevant – especially: whether the concerned person has an interest in keeping the secret – ought to be distributed: either to the said individual or to a neutral party. Certainly, it is not up to the person who publishes a search query to decide on this, as has happened in the blogosphere (the Crimson Ninja Girl gives an example here).
2. The relevance of information (as content) runs in parallel
Usually, the more relevant – or “interesting” – information is for a receiver, the greater is the interest for the person who wants to keep it secret. User # 1234 certainly wouldn’t mind if his wife knows that he searched for “google.com”, nor would she (ore any of his friends, or a blogger) find this noteworthy. In contrast, if he had typed in “divorce lawyer”, his wife would rightly be alarmed, his friends would react to him, and probably a blogger would mention this, musing about the consequences of AOL’s disclosure for user # 1234’s poor wife …
For this reason, balancing the interests of keeping information secret or disclosing it simply doesn’t work: such an endeavor, if properly conducted, would end in a race to the ceiling of the hall, as between the Great Dictator Hynkel and his colleague Napoloni in the barber’s chairs.
3. Information (as an act or status) is not undoable.
While in the analog world, oblivion mitigates this characteristic, information is particularly “promiscuous” on the internet, likely because the cost for finding and sharing information are so low in cyberspace. Jean Nicolas Druey calls the dissemination of illegally (or unethically) obtained information “information laundering”, analogous to money laundering. This is what happened in the AOL case, where the data have been quickly mirrored multiple times, and many bloggers have extensively cited from the file.
The Crimson Ninja Girl passionately argues that information laundering is ethically objectionable, and I cannot but agree with her. Yet, prohibiting this is not the best idea: First, legal action against the publication of information online, e.g. by seeking an injunction against a content provider, has proven to be counterproductive, as the story of the late German hacker Tron teaches us. Second, I feel in a very general – and probably irrational – way uncomfortable with the law meddling with communication by and amongst individuals.
The issues outlined above seem to be rather “don’ts” than “dos” for lawmakers and courts, and many of the problems seem to be largely unsolved in contemporary information law. Any suggestion is thus more than welcome.
