Personal Privacy in an Information Society. Government Access toPersonal Records and "Private Papers"


Discussion of the need to protect individuals from threats to personal privacy often conjures up ominous images of government agents conducting surreptitious investigations and compiling dossiers. Such images come forcefully to mind when one is concerned, as the Commission is, with preventing improper inquiry into and disclosure of records about individuals. While the tendency to equate threats to personal privacy with government action, and government action with clandestine police operations, is understandable, the evidence uncovered in the Commission's inquiry shows that such equations are not necessarily accurate.

The improper collection and use of information about an individual present as difficult problems when private institutions fail to observe the legitimate rights and expectations of the individual as when government fails; but, governmental intrusions on personal privacy have a longer and more dramatic history, both in law and in the public mind. Generous portions of the Bill of Rights were fashioned two centuries ago to assure that Americans would not again suffer the unwarranted intrusions by government which, in John Adams' mind, provided the spark that ignited revolution.1 Protection from government intrusion, as exemplified in the Fourth and Fifth Amendments, has long been the primary public focus of privacy protection.2 The desire to assure for the individual the quiet enjoyment of his home in part justifies such protection; but in equal part, individual rights securing privacy are also intended to safeguard the personal papers and other documentation that can illuminate the associations, interests, attitudes, and beliefs as well as actions of an individual.3 Such information is valuable in a variety of forms of government coercion, ranging from criminal prosecution to less legitimate activities. Indeed, this second aspect of personal privacy is the focus of Fourth Amendment protection, the "search and seizure" standards which never fail to stir public interest and win extensive press coverage when debated in the Supreme Court.

These well publicized elements of Constitutional controversy and national history, perhaps inevitably, tend to focus on problems of law enforcement officers improperly gaining access to one's home or one's private records. Along with this emphasis on invasions of privacy by law enforcement comes a tendency to treat the issues as legal issues rather than policy ones, because, after all, the battleground for resolving those issues has traditionally been the courts. Earlier chapters of this report should dispel the impression that dangers to personal privacy are only products of government action, but the equation of government action with law enforcement activity needs to be tempered and the notion needs to be dispelled that resolving the basic privacy issues raised by government action demands a close attention to legal niceties.

The question of law enforcement, and the peculiar powers and opportunities to acquire information given government for that purpose, raise uniquely sensitive problems. Nonetheless, governments expanding role as regulator and distributor of largess gives it new ways to intrude, creating new privacy protection problems. By opening more avenues for collecting information and more decision-making forums in which it can employ that information, government has enormously broadened its opportunities to embarrass, harass, and injure the individual. These new avenues (and needs) for collecting information, particularly when coupled with applications of modern information technologies, multiply the dangers of official abuse against which the Constitution seeks to protect.4 Recent history reminds us that these are real, not mythical, dangers.

The concern about governmental abuse which underlies traditional protections against government intrusion on personal privacy provides a focal point for exploring the particular balancing of interests which faced the Commission in reaching its recommendations on government access to private records as well as for emphasizing the need not to confine such deliberations within the narrow precincts of law. Though solutions must finally be fashioned into law, the choices made in arriving at such solutions are not mere legal choices; they are fundamental public-policy decisions-social and political value choices of the most basic kind.

The balance to be struck is an old one; it reflects the tension between individual liberty and social order. The sovereign needs information to maintain order; the individual needs to be able to protect his independence and autonomy should the sovereign overreach. The peculiarly American notions of legally limited government and the protections in the Bill of Rights provide broad theoretical standards for reaching a workable balance. But the world has a way of disrupting the particular balance struck in past generations; the theory may remain unaltered but circumstances change, requiring a reworking of the mechanisms which maintained the balance in the past.

Current threats to personal privacy stem largely from changes in the way individuals go about their day-to-day business.5 The Commission's inquiry did discover, however, that some threats are the result of government rewriting the rules of the game without letting the rest of the players know.6 Both circumstances combine to erode the effectiveness of traditional protections for personal privacy and individual liberty.

Traditionally, the records an individual might keep on his daily activities, financial transactions, or net worth were beyond government reach unless the government could establish probable cause to believe a crime had been committed. If government were merely suspicious and wanted to investigate, such records were unavailable. The legal standards that protected them evolved in a world where such records were almost universally in the actual possession of the individual. Reflecting that reality, the law only barred government from seizing records in the possession of the individual.7 As the record compiled by the Commission proves, that world no longer exists. Third parties, institutions or persons other than the individual, now keep a great many records documenting various activities of a particular individual. Indeed, these third parties keep records about the individual he would not ordinarily have kept in the past. Records for life and health insurance, for example, are repositories of highly intimate personal data, financial and familial as well as medical, which were virtually unknown until recent decades.

Financial records, particularly the information retained in demand deposit accounts, provide another instance where the changing patterns of life took the possession of information about himself out of the control of the individual. Of great importance, checking account records present a situation where alterations in record-keeping patterns have been exacerbated by government action. Until recently the account record maintained by one's bank frequently did not include a copy of each individual check, with the payee, date, and often place and reason for drawing the check clearly noted; rather, the record might simply have noted the dollar amounts of transactions and the date of processing by the bank.8 The Bank Secrecy Act of 1970 and the Treasury regulations which give that law effect, however, now require depository institutions to keep copies of the checks an individual uses to draw on the funds in his account .9 The checking account has become an intimate mirror of individual activity in a way it never was before the Bank Secrecy Act.

The existence of records about an individual that are not in his possession poses serious privacy protection problems, especially when government seeks access to those records. Record keepers can, often do, and sometimes must, disclose records about an individual to government without seeking the individual's approval, whether the disclosure is at the request of government or through the initiative of the record keeper; and, frequently no record of the disclosure is ever made. A government request made informally through a personal visit to the record keeper or by a telephone call, for example, may leave no trace in any record. The individual may never know that agents of the government have inspected his records. Except in a limited number of situations, neither the record keeper nor the government is obliged to notify him that his records were opened to government scrutiny. Even if the individual is given notice and documentation of the disclosure, he has no legal right to challenge the propriety of government access to his records, despite the possibility that the government agent might have been on a "fishing expedition." 10

Historically, the courts have justified relatively unrestricted government access to records on individual activity kept by third parties by regarding such information as independent documentation of voluntary transactions between the individual and the record keeper." Coupled with this concept of voluntariness, such records have not been viewed, and until recently rightly so, as the sorts of private records and personal papers that merit special protection because they illuminate an individual's associations, interest, attitudes, and beliefs, as well as actions. The privacy protections that help secure the independence and autonomy of the individual were not considered necessary. Courts and the public were comfortable with a legal standard that protected only records in the possession of the individual.

Today, the law remains unchanged even though new sorts of personal records, created to meet new circumstances, sometimes generated by government requirements, are vulnerable to seizure or inspection by government without the individual being able to intervene. A record keeper may volunteer information about an individual to government; or the Executive branch of government can compel production of such records with little trouble and often without supervision by the judiciary or anyone else.12 Recently, the courts have begun to doubt the assumptions of voluntariness upon which they rest their refusal to extend basic constitutional protections to an individual when government seeks disclosure of records held by a third-party record keeper. Indeed, some judges have taken tentative notice of the realities of contemporary record keeping and the danger that allowing government to acquire such "third party" records might disclose "intimate areas of personal affairs" protected by the Fourth and Fifth Amendments.13

Nonetheless, to wait on the courts to reweave the fabric of law and create protections for the individual is to adopt a policy of uncertain outcome. One cannot be sure the courts will become more flexible. One can be sure, however, that if the courts do extend protections, their efforts will be slow and piecemeal. Yet the society is faced with problems that demand decision and resolution. The world has altered and continues to change with increasing rapidity. As the Commission's study of Electronic Funds Transfer Systems suggests, existing problems with government access to records will be exacerbated by future developments; they will not go away.14  Totay, government has access to the most revealing personal records about an 1n..' iidual; yet the individual has no ability to thwart or even contest such access. Perhaps most important, they are situations in which the individual has no choice but to allow others to maintain records about him. Not to enter into the relationships that generate individually identifiable records would subject the vast majority of Americans to severe economic and social burdens, disrupting the ordinary course of their lives. Think, for instance, of the time and effort necessary to pay all bills in person, not to mention the risk involved in carrying enough cash to transact all personal business.

Further, and of increasing importance, there is little to impede government access to records about individuals held by third parties, particularly records the government requires third parties to keep. In its Depository and Lending Institution hearings, witnesses told the Commission that informal access to bank records, i.e., access without a subpoena or summons, was a favorite tool of government investigators. Indeed, the American Civil Liberties Union submitted testimony originally given before the House Judiciary Committee in July, 1975, which suggested that such informal or "voluntary" disclosure was "the means by which government normally procures access to confidential bank records."15 The Internal Revenue Service testified that banks are usually cooperative in responding to a "friendly" summons.16 Even when banks are somewhat less cooperative, however, little real impediment to government access occurs. Continental Illinois Bank, for example, seeks to notify the individual that his account records have been subpoenaed and does a "four corners" check of the validity of any summons received, 17 but, as explored below in more detail, neither action by the bank gives any real assistance to the individual. And, the extent of concern exhibited by Continental Illinois for its customers is rare.

The Commission's hearings on the record-keeping practices of credit grantors and depository and lending institutions and its survey of credit-card issuers indicate that a large proportion of private-sector financial record keepers lack any policy on government access, not to mention a policy as fair as that of the Continental Illinois Bank.18 In addition, what is labeled "policy" is frequently little more than a grant of discretion-to notify or not, to determine the validity of a subpoena or not-given to an office manager or perhaps someone lower in the hierarchy. Some record keepers even seem to have a policy of not notifying the individual or reviewing the validity of the subpoena. Such lack of policy, however, should not be viewed as unkindly as a first reaction might suggest. As American Express testified in February, 1976, it did not notify customers as a matter of course because it could not see what good it would do.19 Though its position was not particularly well received by the public, American Express was right; notice to the customer does little good. Even if notified, the individual can do little to hinder government access, however illegitimate the purposes or improper the procedures.20 The ground rules need to be changed if any good is to be done.

To effect that change successfully, a brief exploration of the arguments that have prevented the courts from extending constitutional protections for private papers to bank account and similar records will illuminate the range of policy decisions the Commission addressed and the basic choices that must be made.