Hello!! below is a case study that needs to be examined and analyzed using the contextual integrity framework.
Read and watch the following:
CBS News. (2018, Apr 27). Privacy concerns after public genealogy database used to ID “Golden State Killer” suspect. Available at
https://www.cbsnews.com/news/privacy-concerns-after-public-genealogy-database-used-to-id-golden-state-killer-suspect/
Van Ness, L. (2020, Feb 20). DNA databases are boon to police but menace to privacy, critics say [blog post]. Pew Charitable Trusts Stateline. Available at
https://www.pewtrusts.org/en/research-and-analysis/blogs/stateline/2020/02/20/dna-databases-are-boon-to-police-but-menace-to-privacy-critics-say
Using the contextual integrity framework, analyze the issues surrounding the use of genetic data in this case. Be sure to identifyall of the elements of the contextual integrity framework and discuss how they apply in this case.
Using the links above which is the case being analyzed and the readings I provided to back up the contextual integrity framework will help support the argument made.
The elements in the contextual integrity framework are: CONTEXT, NORMS, ACTORS, ATTRIBUTES, AND TRANSMISSION PRINCIPLES. Make sure that all of these are talked about and discussed throughout the case study. (again I have provided additional readings that help explains the contextual integrity framework and should be used in the case study)
7
Contexts, Informational Norms, Actors,
Attributes, and Transmission Principles
O
BSERVING HOW PRIVACY NORMS VARY ACROSS AND WITHIN
social groups, some critics have concluded that privacy is at best
a c ulturally r elative p redilection r ather t han a u niversal h uman v alue. T he
framework of contextual integrity begins with the same observation, but draws
a different conclusion; there is, indeed, great complexity and variability in the
privacy c onstraints p eople e xpect to h old over t he flow o f i nformation, b ut
these e xpectations a re s ystematically r elated to c haracteristics o f t he bac kground social situation. Once these characteristics are factored into an account of privacy expectations (hereafter referred to as norms of information
flow), the law-like character of these privacy expectations, or norms, is much
more evident. Variability in norms, in other words, is far from idiosyncratic or
arbitrary. The heart of the framework of contextual integrity is an elaboration
of i ts ke y c onstruct: c ontext-relative i nformational n orms. C ontext-relative
informational n orms f unction de scriptively w hen t hey e xpress en trenched
expectations governing the flows of personal information, but they are also a
key vehicle for elaborating the prescriptive (or normative) component of the
framework of contextual integrity. In this chapter I introduce key notions of a
context and an informational norm and elucidate the descriptive component
of the framework of contextual integrity.
In the course of people’s lives we act and transact not simply as individuals
in an undifferentiated social world, but as individuals acting and transacting
in certain capacities as we move through, in, and out of a plurality of distinct
129
130
The Framework of Contextual Integrity
social contexts. By contexts, I mean structured social settings with characteristics t hat have e volved over t ime (sometimes long periods of t ime) a nd a re
subject to a h ost of causes and contingencies of purpose, place, culture, historical accident, and more. Familiar to those of us living in modern industrial
societies are contexts of health care, education, employment, religion, family,
and the commercial marketplace. In these contexts we act and interact with
others, individually and collectively, as coworkers, professionals, clients, teachers, students, citizens, family members, club members, congregants, and neighbors. We relax with family, commune with neighbors, go to work, seek medical
care, a ttend s chool a nd r eligious s er vices, v isit f riends, c onsult w ith ps ychiatrists, hire lawyers, cast votes, and go shopping, banking, dancing, and to
concerts.
I am not inventing the idea of a social context. Instead, I rely on a robust
intuition r igorously d eveloped i n s ocial t heory a nd ph ilosophy t hat p eople
engage w ith o ne a nother n ot si mply a s h uman to h uman b ut i n c apacities
structured by social spheres. Inspired by various goals and specialized concerns, this idea has spawned a host of formal accounts populating a range of
academic fields, i ncluding socia l t heory, socia l psychology, sociology, socia l
philosophy, a nd p olitical s cience. I nfluential ac counts a re a ssociated w ith
leading figures i n s ociology, f rom founders of t he field s uch a s Talcott Pa rsons, E rving G offman, a nd Ma x W eber ( who c oined t he ter m “ spheres o f
value” f or t his p urpose), to c ontemporary s cholars o f i nstitutional t heory,
including Paul DiMaggio and Walter Powell, whose account of institutions as
“a pattern of regularized conduct” (Martin 2003, 40) captures aspects of the
basic i ntuition. I n i nstitutional f rameworks, suc h a s ma rriage a nd pa renthood, actors’ expectations of each other are set out in rules and social mores
that do not just stem from individuals.
Pierre Bourdieu’s field theory is another highly developed account of structured s ocial s ettings d efined b y a s et o f c onstructs t hat a re c onsonant w ith
those I have informally associated with contexts. Bourdieu, a French philosopher and social theorist who emerged to prominence in the latter half of the
twentieth century, was preoccupied with hierarchy and the uneven distribution of power within what he called social fields, “familiar divisions of action
[divided] i nto self-contained realms of endeavor” (Martin 2003, 23; see a lso
Bourdieu 1984). Social fields a re d ifferentiated, s tructured s ocial s ystems i n
which i ndividuals a re de fined by t heir p osition i n t he field. A lthough fields
are a utonomous, t hey c an b e a ffected by outside events in ways that vary
Contexts, Norms, Actors, Attributes, and Principles
131
according to t he i nternal l ogic o f e ach field. I ndividuals i n t heir r espective
positions have unequal possession of and access to t he species of capital valued i n t heir r espective fields. G overned b y a n i nternal “ law” t hat r egulates
their ac tions a nd p ractices, s ocial a gents a re a rrayed i n de eply en trenched
power relationships within fields. Although agents may engage in antagonistic or competitive relationships w ith one a nother, t hey a re a lso, a s players,
bound b y t he r ules o f t he fields. A s s ociologist J ohn L evi Ma rtin w rites,
“What is at stake in a chess, tennis, or sumo tournament is not simply which
individual w ill be t he w inner, but what kind of chess, tennis, or sumo (and
hence what kinds of players) will dominate the field in the future” (2003, 23).
In the course of developing these general ideas, Bourdieu paid considerable
attention to the professional fields of law and journalism, as well as photography, l iterature, a nd ac ademia, a s he shaped h is ideas on t he constitutive
theoretical constructs.
Social phi los o phers proffering accounts of social ontology have also defi ned a family of constructs analogous in function to t hose associated with
fields a nd i nstitutions. I n t he a nalytic t radition, R aimo T uemelo, J ohn
Searle, Ma rgaret Gi lbert, a nd S eumas M iller ac count f or t he s ocial w orld
and the activities of human agents within it not only in terms of their individual or shared properties as human beings, but in terms of their properties as social actors, in social roles, and within social structures, be they
“fields,” “institutions,” or “contexts” (Searle 1995; Miller 2001). So robust are
these paradigmatic social spheres in the ways even ordinary people conceptualize their lives that leading psychologists Roger Schank and Robert Abelson ( 1977) p ostulated t he e xistence o f c ognitive s tructures, o r k nowledge
representations of stereotyped actions such as eating at a restaurant, which
they called “scripts.” The elements of these scripts include paradigmatic actors (e.g.. waiters), activities (e.g., reading a men u, ordering), t ypical environments ( e.g., r estaurants), a nd s equences ( e.g., o rder-eat-pay). A nother
influential work that assumes social differentiation is the political phi losopher Michael Walzer’s theory of justice, which posits that there are distinct
social spheres—politics, workplace, ma rketplace, family, state, school, a nd
so forth—defi ned by distinctive social goods with special meanings distributed in t heir respective s pheres a ccording to di stinctive s ets of principles
(Walzer 1984).
In t he C ontinental t radition, T heodore R . S chatzki p osits “practices” a s
basic building blocks of s ocial order: “ Social orders . . . are a rrangements of
132
The Framework of Contextual Integrity
people and of the artifacts, organisms, and things through which they coexist,
in which t hese entities relate a nd possess identity a nd meaning. To say t hat
orders are established within practices is to say that arrangements—their relations, identities, and meanings—are determined there” (2001, 53). According
to Schatzki, practices are constellations of activities constituted by a p ool of
understandings, constituent actions, and practitioners (identities, roles); a set
of rules that “enjoin or school in par ticular actions”; and “a mix of teleology
and affectivity” (p. 51). Schatzki’s teleology is reminiscent of the more familiar
values, or ends, and a ffectivity of beliefs about t he constellation of activities
that w ill b ring t hose en ds a bout. H e w rites, “ In su m, a p ractice i s a s et o f
doings and sayings organized by a pool of understandings, a set of rules, and
a teleoaffective structure. . . . that can change over time in response to contingent e vents. Bu t i t i s b y v irtue o f e xpressing c ertain u nderstandings, r ules,
ends, projects, beliefs, and emotions (etc.) that behaviors form an organized
manifold” (p. 53).
Contexts
Contexts are structured social settings characterized by canonical activities,
roles, r elationships, p ower s tructures, n orms (or r ules), a nd i nternal v alues
(goals, ends, purposes). I have not fully adopted any one of the standard theories a s a f ramework f or t he i ntuitive n otion o f a c ontext, t hough a ll sha re
a remarkably si milar a rray o f ke y t heses a nd c haracteristics, s tarting w ith
the basic i dea t hat s ocial l ife c omprises s tructured, d ifferentiated spheres,
whether l abeled a nd t heorized a s “ fields,” “ institutions,” “ structured s ocial
systems,” “spheres,” “social structures,” “practices,” or “contexts.” Further, although contexts a re t uned sp ecifically to t he t ask o f f raming a r esponse to
socio-technical systems and practices that have radically altered information
flows, most of t heir key characteristics c an be roughly matched w ith corresponding characteristics of their more formally developed counterparts. The
idea of c anonical ac tivities, for example, corresponds to i nstitution t heory’s
patterns of regularized c onduct, S chank a nd Ab elson’s s tereotyped ac tions,
and Schatziki’s practices; the idea of roles corresponds to Bourdieu’s positions
and s everal of t he philosophers’ s ocial ac tors a nd s ocial rol es; p ower s tructures c orrespond to B ourdieu’s h ierarchies a nd en trenched p ower r elationships; contextual norms correspond to D iMaggio and Powell’s rules and social mores, Bourdieu’s internal law, and Schatzki’s sets of rules; and internal
Contexts, Norms, Actors, Attributes, and Principles
133
values correspond to Bourdieu’s capital, Walzer’s social goods, and Schatzki’s
ends or teleology.
Of mos t i mmediate r elevance to t he de velopment o f t he f ramework o f
contextual integrity are the constructs of roles, activities, norms, and values,
each briefly explained below.
Roles. Contexts incorporate assemblages of roles. By t his I me an typical or
paradigmatic capacities in which people act in contexts. Teachers, physicians,
lawyers, s tore ma nagers, s tudents, p rincipals, c ongregants, r abbis, v oters,
cashiers, consumers, receptionists, journalists, waiters, patients, and clients
are among some of the most familiar roles.
Activities. C ontexts a re pa rtly c onstituted b y t he c anonical ac tivities a nd
practices in which people, in roles, engage. Examples include browsing goods
in a s tore, si nging h ymns i n c hurch, c ompleting h omework a ssignments,
lecturing in a classroom, conducting and undergoing physical examinations,
writing r eports, en tering a v ote a t a p olling s tation, a nd i nterviewing job
applicants.
Norms. Behavior-guiding norms prescribe and proscribe acceptable actions
and practices. Some of them define t he relationships a mong roles a nd, i n
this w ay, th e p ower s tructures th at c haracterize m any f amiliar s ocial
contexts. Consider how the various elements interact in the case of a grade
school, w hich f unctions i n a n e ducational c ontext. A ttending t he g rade
school are children in the role of students, taught by adults in the role of
teachers, managed by an adult in the role of a principal. Schools also usually
include administrative staff, clerical workers, and janitors, and are overseen
by a d istrict su perintendent. N orms p rescribe t hat te achers e xpound o n
subjects in the curriculum and prepare report cards; students pay attention,
write notes, ask questions, complete homework assignments, and take tests;
the principal keeps a c lose eye on things and sometimes disciplines unruly
students o r l ackadaisical te achers. I n o ther e ducational c ontexts, suc h a s
universities, t he a ssemblages o f rol es, ac tivities, a nd n orms a re si milar,
though not identical. Academic departments, for example, include chairs,
tenured f aculty, a ssistant p rofessors, s tudents, a nd ad ministrators w ho
engage i n t ypical ac tivities a nd i nteractions. N orms de fine t he dut ies,
obligations, prerogatives, a nd privileges associated w ith pa rticular roles, as
well as acceptable and unacceptable behaviors. (Much more is said about
norms below.)
134
The Framework of Contextual Integrity
Values. Ma ny o f t he c anonical ac tivities o f a c ontext a re o riented a round
values—sometimes mo re apt ly c alled g oals, p urposes, o r en ds; t hat i s, t he
objectives around which a context is oriented, something akin to S chatzki’s
“teleology.” Values are crucial, defining features of contexts. Imagine visitors
from Ma rs l anding o n E arth a t a s chool, u niversity, o r, f or t hat ma tter, a
hospital, with instructions to report to their leaders back home all they have
learned a bout l ife o n E arth. L ike a ll g ood e thnographers, t hey ma ke
extensive sightings a nd recordings, take copious notes on a ll of t he hustle
and bustle, enga ge i n s ensitive c onversation w ith e arthlings, a nd obs erve
roles, regularities, a nd r ules, but t hey w ill b e m issing s omething c rucial i n
their reports on these contexts unless they have grasped the set of ends, values,
and objectives around which these contexts are oriented; in sum, the teleology of education or health care. They would be unable to understand or
properly e xplain w hat th ey h ave o bserved wi thout a ppreciating th at th e
purposes of educational contexts include transmitting knowledge, knowhow, and, arguably, social values to a society’s young; imparting training; and,
sometimes, p reparing s tudents f or o ccupations b eyond s chool. T hey w ould
need to have grasped that among the values of health care are alleviating
physical suffering, curing illness, and promoting the health of individuals
as well as collectives. Although settling on a definitive a nd complete l ist of
contextual v alues i s neither si mple nor noncontentious, t he c entral p oint i s
that c ontextual roles, ac tivities, practices, a nd norms ma ke s ense l argely i n
relation to contextual teleology, including goals, purposes, and ends.
To simplify usage, hereafter I generally use the term values or contextual values to refer to this cluster of teleological notions.
Contexts a re not for mally d efined c onstructs, b ut, a s mentioned e arlier,
are intended as a bstract representations of s ocial s tructures e xperienced in
daily life. In saying what contexts are and itemizing their key characteristics I
should n ot b e t aken a s s tipulating t hat c ontexts, b y de finition or necessity,
take a par ticu lar form. Rather, I a m attempting to create a generalized snapshot of a context based on attributes observed across concrete instances, ultimately testable in the real world. In other words, the activity of fleshing out
the details of particular types of contexts, such as education or health care, is
more an exercise of discovery than of definition. Because contexts are essentially rooted in specific times and places, their concrete character in a g iven
society, reflected in roles, practices, norms, and values, is likely to be shaped
Contexts, Norms, Actors, Attributes, and Principles
135
uniquely by t hat society i n relation to t he a rrangement of other contexts i n
that society as well as to its culture, history, politics, and economics, and even
to p hysical a nd na tural c ontingencies (e.g., w ar, f amine, a nd e arthquakes).
Disparities across societies, cultures, and historical periods may manifest in
differences between contexts of the same type (e.g., differences in characteristics of educational contexts across societies), or perhaps even divergent contextual structures. It is therefore worth discerning how similar the constellation of contexts (educational, political, familial, etc.) is across societies. Such
questions, however, lie outside the purview of this book, belonging rather in
the territory of anthropologists and other empirical social scientists.
Even within a given society, there can be great variability in how key characteristics manifest across contexts. One dimension of variability is how finely
articulated these characteristics are. Certain contexts are articulated in great
detail, f or e xample, v oting s tations, c ourtrooms, a nd h ighly r itualized s ettings such as church ser vices. In t hese contexts t he roles, actions, a nd practices are thickly specific a nd guided, in detail, by a rich set of norms. In the
context o f a p olling s tation d uring demo cratic el ections, rol es a re c learly
specified, and what one says and does in that context is constrained by law,
regulation, and possibly local custom. In contrast, contexts such as business
meetings or open-air markets may be relatively sparsely and incompletely (or
partially) specified. Accordingly, although certain roles are specified, no one
is surprised to encounter great variation in others; likewise, what people say
and do and what transactions are performed are somewhat, but far from fully,
constrained. At a cocktail party in the United States circa 2009, f or instance,
the norms of propriety generally demand that guests arrive more or less at the
appointed time and be fully clothed (perhaps, more specifically, in “cocktail
attire”), that they eat and drink in the appropriately polite manner, and that
they thank the hosts upon departure. Within these sparse requirements, the
scope of action is quite open-ended. Variation we may encounter in individual i nstances i s n ot a lways a r esult o f o pen-ended, pa rtial, o r i ncomplete
specification. I t ma y r eflect c ontention w ithin a s ociety o ver t he s tructural
characteristics of a g iven c ontext. I n t he c ontext of s exual relations, for e xample, h istorically t here ha s b een s trong d isagreement a bout t he legitimate
presence of marketplace norms, leading some members of a g iven society to
eschew the buying and selling of sex, while others deem it acceptable.
Another difference among contexts is in the degree to which they are institutionalized or recognized formally and explicitly. Law is one such mechanism,
136
The Framework of Contextual Integrity
important for according formal sanction as well as imposing explicit governance over a c ontext. There a lso are mechanisms for institutionalizing contexts, or fragments of contexts, such as the rules of a professional society, club,
or religious community. There can be interactions among these mechanisms;
laws setting out a ba sic f ramework for certain t ypes of contexts, such as for
corporations or profe ssions, a re f urther fleshed out by r ules or professional
codes applying to par ticu lar corporation or professional societies, which may
specify officeholders (roles), goals, practices, and norms of acceptable or expected behavior. There may be a further amalgam of elements that are explicitly a nd o fficially s anctioned w ith others t hat a re only t acitly a nd g radually
incorporated into the contexts. In my view, many persistent specific disagreements over the nature and extent of the right to privacy are the result of this
par ticular form of variability across contexts. Defenders of one position a re
prepared to ac cept only t hose elements (roles, ac tivities, norms, a nd values)
that are explicitly recognized in the law of privacy, whereas others accept as
legitimate constraints that originate from a broader array of sources, including customary expectations, art, literature, ethics, and even etiquette.
It i s u seful to h ighlight p ossible r elationships a mong a nd b etween c ontexts. One of these is nesting. The example discussed earlier of a grade school
context i s nested w ithin t he more general e ducation c ontext. Referring to a
high school is further specification within the nested contexts of grade school;
an i nner-city h igh s chool, mo re s o; a nd a pa r ticu lar h igh s chool, s ay t he
Washington Irving High School in Manhattan, even more. The education
context a lso i ncludes u niversities a nd t heir d istinctive substructures, which
may, again, be further specified down to individual instances, as in “the context of New York University” with its par ticu lar rules and traditions overlaid
upon the more generalized education elements. The implications for privacy
of such nesting might be that the governing norms of the commercial marketplace may be differentiated from richer, more specific norms for food markets,
and even more differentiated for an individual store.
Contexts may overlap and possibly conflict with one another. What does
this mean? In the course of daily life, people regularly find themselves negotiating multiple contexts, sometimes simultaneously. A mother takes her children shopping, a physician is called to treat a friend’s medical condition, a job
applicant is interviewed by her uncle, and one has friends who also are workplace colleagues. Observing that practices do n ot exist in isolation from one
another, S chatzki s ays t his about how t hey may be formally a nd i nformally
Contexts, Norms, Actors, Attributes, and Principles
137
interwoven: “ Arrangements e stablished ac ross p ractices, s ay, f arming a nd
commercial ones, interact and thus form an arrangement at, say, the general
store; or when chains of action pass through different practices, for example,
those of farming, commerce, cooking, and state surveillance, and thereby set
up arrangements that embrace farmers, shop owners, spouses, and Internal
Revenue Ser vice officers” (2001, 53–54).
Overlaps need not necessarily involve conflicts. Thus, a community health
center may collaborate w ith school aut horities to promote health a nd nutrition w ithin s chools. It is not so much that contexts themselves conflict as
that, occasionally, when and where they overlap the norms from one context
prescribe actions that are proscribed by the norms of an overlapping context.
In such instances, actors face tough choices: the uncle is inclined to offer the
job to his niece out of love and a sense of family loyalty but is also disposed to
select a nother c andidate w ith more relevant work experience; t he physician
might be inclined to warn a patient sternly to refrain from patently unhealthful eating habits but as a f riend is reluctant to adopt such intrusive paternalism about lifestyle choices.
Even though careful consideration of the details in specific contexts may
favor o ne ac tion o ver t he o ther, t here ma y b e n o g eneral s olutions to t hese
general types of conflicts and it may be that some are simply intractable. Collisions among contexts giving rise to conflicts do not, in themselves, refute the
context-based s tructure o f s ocial l ife a ny mo re t han v alue c onflicts, a s d iscussed by Isaiah Berlin, constitute a refutation of values pluralism. Although
some of the conflicts we face can be clarified and even resolved by adopting
sound strategies (too many to enumerate here), others are simply entrenched
in t he world a s we k now it, n ot n ecessarily a f ault of t heory but one of t he
challenges of living. Numerous conflicts, as they arise regularly in relation to
privacy, will be discussed later at greater length.
Norms
Norms may be construed in a variety of ways, but because they are central to
the account of contextual integrity, it is necessary to specify my understanding here before defining the concept of a context-relative informational norm.
Like many other interesting and contentious concepts, the idea of a n orm is
rich with intuitive meanings drawn from popular usage in lived experience. At
the s ame t ime, it ha s provoked c onsiderable i nterest i n applied a nd s cholarly
138
The Framework of Contextual Integrity
investigations in law, philosophy, and the social sciences, where scholars and
practitioners have attempted to i mbue it w ith greater rigor. To attempt comprehensive coverage of the range of works would be both a presumptuous and
impractical u ndertaking f or t his b ook; i nstead I s trive f or a n i nterpretation
that is as close as possible to a natural one, disambiguated and made somewhat
more precise through the insights of a small selection of relevant scholarship.
One p oint o f d isambiguation i s c hoosing b etween t wo rob ust i nterpretations of the term. According to one, norms are part of the larger category of
rules t hat prescribe, ma ndate, or require t hat certain ac tions be performed;
according to the other, norms are used merely descriptively to refer to behavioral regularities, habits, or common practices, with no underlying expectation or prescription. T he a mbiguity is described i n t his way by philosopher
Cristina Bicchieri:
Still, the term social norm may refer to two very different things. One is what
people commonly do in certain situations or what constitutes ‘normal’ behavior. T he ot her i s w hat p eople b elieve o ught to b e do ne, w hat i s s ocially ap proved or disapproved. The first may be dubbed descriptive norms, the latter
injunctive norms. . . . Conformity to a de scriptive norm does not i nvolve a n
obligation or mutual expectations. . . . It is important to notice that the behavioral regularities we call descriptive norms are supported by unilateral expectations. Though we expect others to follow the norm, we do not feel any pressure to follow it ourselves. (2000, 156)
I ado pt here a s a def ault t he p rescriptive i nterpretation, w hat B icchieri
calls injunctive, highlighting the thematic link between norms and the normative i nstead of t he l ink Bicchieri a sserts between norms a nd t he normal.
Although this is not the place to launch a full defense of this choice, the normative me aning s trikes me a s dominant, a s one i s ha rd pressed to t hink of
actual situations in which at least some hint of prescription is not lurking behind the term norm, even in situations in which it is used ostensibly to refer
merely to normal practice. I also tend toward the normative sense of the term
because it links this work with dominant interpretations adopted in general
canonical works on norms by philosophers and legal theorists such as H. L. A.
Hart and Joseph Raz (Hart 1961; Raz 1975; Richardson 1990; Miller 2001). Accordingly, when I say that an action or practice is norm-governed, I mean not
only that most people generally follow it but they do so because they believe
they ought to. Furthermore, I adopt the anatomy of norms that Raz adapted
Contexts, Norms, Actors, Attributes, and Principles
139
from Georg Henrik von Wright (1963, chap. 5; Raz 1975, 50), attributing four
key elements to norms: (1) a prescriptive “ought” element; (2) a norm subject—
one upon whom the obligation expressed in the norm falls; (3) a norm act—
the ac tion p rescribed i n t he n orm; a nd (4) a c ondition o f app lication—the
circumstances in which the norm act is prescribed for the norm subject.
Even w ith t he focus na rrowed to p rescriptive norms, g reat variability i n
norm types remains. One dimension of variability that is relevant to contextual integrity is the degree to which norms are explicitly expressed in a given
society, ranging from those that are only implicitly understood and accepted,
to t hose t hat are explicitly formulated a nd sanctioned by authoritative individuals and institutions, to those that are explicit, formal, and enforced, such
as norms embedded in formal legal systems. Seumas Miller, a social philosopher, is interested in a par ticular class of norms he calls social norms, distinguished f rom t he o thers i n t hat t hey a re n either e xplicitly e xpressed n or
enforced: “They are not, qua social norms, explicitly formulated; nor do they,
qua s ocial n orms, ema nate f rom a ny f ormal a uthority o r ha ve a ny f ormal
sanctions attached to them” (2001, 123). Context-relative informational norms,
discussed below, can have all of the above.
Another d imension of v ariability recognized i n t he philosophical l iterature, beyond formal expression and official sanction, is in norm type. Familiar i nstances of norm t ypes a re moral norms, proscribing ac tivities suc h a s
lying, inflicting physical ha rm, a nd s tealing; s ocial c onventions of e tiquette
proscribing actions such as interrupting others while they are talking, walking u nclothed i n p ublic p laces, a nd add ressing n obility w ith i nappropriate
familiarity; a nd r ules or procedures i n formal committee meetings, such a s
Robert’s Rules. Norms also vary in their degree of seriousness, from those
that, as Raz has remarked, relate to “fundamental features of human societies
and human life” to those that “like many rules of etiquette, are of little importance a nd c arry l ittle weight” (1975, 51). Fu rther, norms may vary according
to their h istorical le gacy, u niversality, a nd s ource of or igination. R eligious
norms, f or e xample, ma y ha ve a n i mpressive h eritage b ut l imited r ange o f
applicability versus newfangled fads, which may be w idespread but fleeting.
Some norms originate as the imperatives of authority figures (or institutions),
while others seem to have evolved along with cultures, histories, and political
traditions, and, in fact, are partly constitutive of them.
One final general point, relevant to the framework of contextual integrity,
is t hat t he n orms t hat g uide our l ives a re, for t he mos t pa rt, emb edded i n
140
The Framework of Contextual Integrity
systems. As Raz notes, “certain groups of norms are more than haphazard assemblages of norms. Normative systems are understood to have some kind of
unity” (1975, 9). Rules of a game, laws of a country, bylaws of an association or
club, principles in a code of professional ethics, and contextual norms are all
cases of normative systems. To f ully appreciate and find norms t hat are elements of normative systems compelling, one needs to c onsider them against
the backdrop of the system itself. Otherwise, in isolation, they might appear
arbitrary or even dubious. Certain rules of the road, for example, make sense
only holistically: directives such as “stop on red” and “drive on the right” are
arbitrary on their own but function integrally in relation to “go on green” and,
more g enerally, t he c omplex s ocio-technical s ystem o f road s, v ehicles, a nd
drivers. Norms proscribing ma rital i nfidelity t hat s eem i mmediately robu st
draw their import from the broader meaning of family and the institution of
marriage in a g iven society. And norms guiding professional conduct might
seem positively unethical except in relation to the broader functioning of the
profession in society.
Context- Relative Informational Norms
and Contextual Integrity
Given t he m yriad n orms t hat g overn ac tivities a nd p ractices w ithin a nd
across contexts, consider those that are specifically concerned with the flow of
personal i nformation—transmission, communication, t ransfer, d istribution,
and d issemination—from o ne pa rty to a nother, o r o thers. I w ill c all t hese
informational norms when speaking of them within individual contexts and
context-relative informational norms when referring to them generally. Contextual integ rity is d efined i n ter ms o f i nformational n orms: i t i s p reserved
when i nformational n orms a re r espected a nd v iolated w hen i nformational
norms a re b reached. T he f ramework o f c ontextual i ntegrity ma intains t hat
the indignation, protest, discomfit, and resistance to technology-based information systems and practices, as discussed in Part I, invariably can be traced
to breaches of context-relative informational norms. Accordingly, contextual
integrity is proposed as a benchmark for privacy.
The Structure of Context-Relative Informational Norms
Context-relative informational norms are characterized by four key pa rameters: contexts, actors, attributes, and transmission principles. Generally, they
Contexts, Norms, Actors, Attributes, and Principles
141
prescribe, for a g iven context, t he t ypes of i nformation, t he pa rties who a re
the subjects of the information as well as those who are sending and receiving
it, a nd t he principles u nder which t his i nformation is t ransmitted. I n other
words, informational norms regulate the flow of information of certain types
about an information subject from one actor (acting in a pa r ticu lar capacity,
or role) to another or others (acting in a par ticular capacity or role) according
to par tic ular transmission principles.
Contexts
As discussed above, contexts are the backdrop for informational norms. It is
crucial to bear in mind, particularly because it is so easy to forget when one
enters t he f raught ter ritory of privacy, t hat i nformational norms a re a lways
elements of a context-based system of informational norms as well as contextbased normative systems, generally. Further, according to Raz’s adaptation of
von Wright’s anatomy of norms, contexts are what he would call t he condition of application, or t he circumstances i n which a n ac t is prescribed for a
subject. T he c o-constitutive r elationship b etween i nformational n orms a nd
contexts is conveyed with the term context-relative information norms (hereafter frequently abbreviated to informational norms).
As a brief aside, connecting back to the discussions in chapters 5 and 6, the
public/private dichotomy can be understood as a cruder version of contextual
integrity, p ostulating o nly t wo c ontexts w ith di stinct s ets o f inf ormational
norms for each—privacy constraints in the private, anything goes in the public. The framework of contextual integrity, by contrast, postulates a multiplicity of social contexts, each with a d istinctive set of rules governing information flows.
Actors
Informational norms have three placeholders for actors: senders of information, recipients of information, and information subjects. Sender and receiver
placeholders might be fi lled respectively by single individuals, multiple individuals, or even collectives such as organizations, committees, and so forth.
(Other terms, including parties and agents, will be used to refer to those communicating, t ransmitting, sha ring, o r s ending i nformation a s w ell a s t hose
receiving it.) For the subject placeholder, I w ill only be seriously considering
single individuals, though in many instances, the subject and sender of information will be one and the same. In specifying an informational norm, it
is c rucial to i dentify t he c ontextual rol es o f a ll t hree ac tors to t he e xtent
142
The Framework of Contextual Integrity
possible; that is, the capacities in which each are acting. In a healthcare context, for example, there are numerous informational norms prescribing information sha ring practices w here t he subjects a nd s enders a re patients t hemselves, a nd where t he recipients a re physicians. We might express t his more
formally by saying senders/subjects are acting in their capacity as patients
seeking medical attention, and recipients are acting in their capacity as physicians. O ther n orms app ly i n c ases w here t he r ecipients a re r eceptionists,
bookkeepers, nurses, and so forth. In healthcare contexts there are informational norms governing the transmission of information about patients from
physicians, a s s enders, to o ther r ecipients (such a s me dical s tudents u nder
their tutelage, fellow practitioners, insurance companies, and their spouses).
In r equiring t hat ac tors’ rol es a re f ully sp ecified a s a def ault c ondition,
the framework of contextual integrity provides a more expressive medium for
highlighting v ariables t hat a re r elevant to p rivacy. A ctors’ rol es a re a mong
those critical variables that affect people’s rich and complex sensibilities over
whether privacy ha s b een v iolated or properly respected. O ther attempts to
articulate p rivacy p rinciples g o awry b ecause t hey n eglect o r u nder-specify
actors’ roles in explicating both policies and the problematic scenario under
consideration. As a result, we are called to adjudicate incompletely specified
situations because rarely, if ever, is the flow of information prohibited, or required, i n a w ay u nconditioned by t he c apacities i n w hich s ender, subjects,
and recipients are acting. In structuring informational norms with placeholders f or ac tors, t he f ramework o f c ontextual i ntegrity a ffir ms intuitions that
the capacities in which actors function are crucial to t he moral legitimacy of
certain flows of information. This holds true even when it appears that it does
not—as when people remark that certain information is secret when they usually mean it is secret in relation to some actors, or constrained by a par ticular
principle of transmission rather than absolutely. Usually, when we mind that
information about us is shared, we mind not simply that it is being shared but
that it is shared in the wrong ways and with inappropriate others. Although
most of the time these requirements are tacit and the states of all pa rameters
need not be tediously spelled out, in controversial cases, elliptical expressions
of people’s expectations can be taken too literally and serve as sources of common misunderstandings.
The relevance of actors to whether a particular system or practice violates
privacy is often implicit in our reactions even if not systematically theorized.
Among the exceptions, James Rachels’s account of the value of privacy cited
Contexts, Norms, Actors, Attributes, and Principles
143
in C hapter 4 ma kes t his c onnection e xplicitly: “ businessman to em ployee,
minister to c ongregant, do ctor to pat ient, husband to w ife, pa rent to c hild,
and so on. In each case, t he sort of relationship t hat people have to o ne a nother involves a c onception of how it is appropriate for them to b ehave with
each other, and what is more, a conception of the kind and degree of knowledge concerning one another which it is appropriate for them to have” (1975,
71). Just as contexts generalize the dichotomy of realms to a r ich multiplicity,
the notion of people acting in capacities generalizes a dichotomy of actors; it
is relevant to know whether the actors are government or private, and in what
capacity they act, among an innumerable number of possibilities.
Attributes (Information Types)
In t he pa ssage quoted above, R achels a ffirms t he critical relevance of ac tors
to a sense that privacy has been violated. Another pa rameter of equal importance is the nature of the information in question: not only who it was about,
and to whom and from whom it was shared, but what it was about; or, as Rachels
puts it, the “kind and degree of knowledge” (1975, 71) . The framework of contextual i ntegrity i ncorporates attributes or type or nature of i nformation
(terms I will use interchangeably) as another key pa rameter in informational
norms. (A technical term with similar meaning is data field.) In a healthcare
context, for example, strictures on i nformation flow vary according to rol es
and to t he t ype o f i nformation i n que stion, w hether i t b e pa tients’ me dical
conditions, t heir a ttire, t heir add resses a nd p hone n umbers, t he na me a nd
code number of t heir health i nsurance c arrier, or t he ba lances on t heir accounts. Here, to o, a nalysis i n ter ms o f c ontextual i ntegrity i s a r adical b ut
clearly essential generalization of approaches that assume a private/public dichotomy of information. These approaches also recognize the importance of
information types, but only two types; analysis in terms of contextual integrity, in principle, recognizes an indefinite array of possibilities.
Informational norms render certain attributes appropriate or inappropriate in certain contexts, under certain conditions. For example, norms determine it appropriate for physicians in a h ealthcare context to quer y their patients on t he condition of t heir bodies, but i n t he workplace context for t he
boss to do the same thing would usually be inappropriate (an exception could
be made f or circumstances such as the coach of a p rofessional football team
inquiring about a player’s heart condition). To friends, we confide details of romantic entanglements (our own and those of others); to the bank and creditors,
144
The Framework of Contextual Integrity
we disclose details of our financial standing (earnings, loan payments); with
professors, students discuss their grades; at work we discuss performance goals
and salaries—all generally appropriate attributes in these contexts.
Recognizing t he i mport of i nformation t ype, some, like t heorist Charles
Fried, have strung it along a single continuous dimension of more to less intimate, more to less sensitive; others, as mentioned above, have split it into dichotomies of personal versus nonpersonal (or public), highly sensitive versus
not sensitive, a nd so on. In contrast w ith t hese approaches, appropriateness
is not one-dimensional nor is it binary. For example, it is not simply that one
discusses intimate matters with friends and impersonal matters with, say, coworkers, because in many societies it is inappropriate to d iscuss salaries and
financial standing with close friends but appropriate to do so with one’s boss
and o ne’s ba nker. T he f actors de termining app ropriateness a re si multaneously variable. Consider t hat friends are t ypically aware of each other’s religious affi liations, w hile suc h i nformation i s off l imits i n a job i nterview o r
workplace (at l east, i n t he U nited St ates). I nformation a bout a n app licant’s
marital status is inappropriate for a job i nterview in t he present-day United
States, but quite appropriate in the context of courtship. Physicians are familiar w ith me dical c onditions but would hesitate to delv e i nto either t he religious affil iation or financial standing of their patients.
Those who may be expecting a p recise definition of i nformation t ype or
attribute will be disappointed, for I rely throughout on an intuitive sense, assuming that it is as adequate for the explication of contextual integrity as for
many important practices and policies successfully managed in society with
nothing more. One need look no further than the endless forms we complete,
the menus we select from, the shopping lists we compile, the genres of music
we listen to, the movies we watch, the books we read, and the terms we submit
to search engines to grasp how at ease we are with information types and attributes. Our daily lives are organized, and complex political and institutional
functions are managed, by means of myriad information schemes that require
at l east a n u nderstanding o f sp oken l anguage, t hough ob viously t here a re
times when expert or specialized knowledge is important. In highly circumscribed contexts, such as an organization wishing to automate a spectrum of
its business processes, a top-down, finite taxonomy of attributes may be useful; f or e xample, t he I nternal Re venue S er vice o r t he U .S. C ensus Bu reau
might seek to automate policies for the finite data fields extracted from their
forms. In general, this is not only unnecessary but might even be inimical to
Contexts, Norms, Actors, Attributes, and Principles
145
the idea of contexts a s evolving structures a nd t he ac tivities, ac tors, norms,
values, a nd attributes comprising t hem evolving si multaneously. In general,
attribute schemes will have co-evolved with contexts and not be readily accessible to fi xed and finite repre sen tations.
Transmission Principles
A transmission principle is a constraint on the flow (distribution, dissemination, t ransmission) o f i nformation f rom pa rty to pa rty i n a c ontext. T he
transmission p rinciple pa rameter i n i nformational n orms e xpresses ter ms
and conditions under which such transfers ought (or ought not) to occur. The
idea of a t ransmission principle may b e t he mos t d istinguishing element of
the framework of contextual integrity; although what it denotes is plain to
see, it usually goes unnoticed.
How t ransmission pr inciples f unction i s pr obably mo st e ffectively conveyed through illustrations. One of the most salient is confidentiality, stipulating that the party receiving information is prohibited from sharing it with
others. Other familiar instances include reciprocity, by which I mean a principle determining that information flows bidirectionally; dessert, determining t hat a n ac tor de serves to r eceive i nformation; en titlement ( similar to
dessert), determining that one party is entitled to know something; compulsion, determining that one party (often, t he information subject himself ) is
compelled o r ma ndated to r eveal i nformation to a nother; a nd n eed, de termining t hat o ne pa rty n eeds to k now i nformation o f a pa r ticu lar k ind. A
transmission p rinciple m ight de termine t hat i nformation m ust b e sha red
voluntarily, o r c onsensually; i t ma y r equire t he k nowledge o f t he sub ject
(“notice”), or only her permission (“consent”), or both. Transmission principles may a llow for commercial exchanges of information bought, sold, bartered, o r l eased i n ac cordance w ith t he r ules o f a c ompetitive f ree ma rket.
The list is probably indefinite, particularly if we allow for nuanced and complicating variations.
Transmission p rinciples a re b ut o ne o f t he pa rameters emb edded i n a n
informational norm, in a given context, covarying with the other pa rameters
of actors and attributes. Imagine these as juggling balls in the air, moving in
sync: contexts, subjects, senders, receivers, information types, and transmission principles. Again, examples drawn from familiar experiences might help
clarify this. In the context of friendship, we almost always expect information
to be shared voluntarily. One chooses to share information with one’s friend,
146
The Framework of Contextual Integrity
though friends often draw conclusions about one another on the basis of what
each says and does. Although the type of information shared in friendship is
wide-ranging, t here a re generally certain locally relative (probably a lso agerelative) p rohibitions. F riends sha re i nformation r eciprocally, g enerally a ssuming that what they say to each other will be held in confidence. Although,
in t he c ontext of f riendship, s ome de parture f rom t hese norms i s generally
allowable (as w hen f riends c oax i nformation f rom e ach other), s traying to o
far may be viewed as a breach. Ferreting out information about a friend from
third parties, peeking in a diary, or divulging to others information shared in
friendship are actions that not only may be judged as betrayals, but call into
question the very nature of the relationship.
Contrast the configuration of transmission principles in health care with
those of friendship. True, as with friendship, strict confidentiality is thought
to g overn t he flow o f i nformation to t he p hysician a bout pa st a nd p resent
physical a ilments, but unlike in f riendship, t he subject’s discretion does not
reign su preme. I nstead, s omething c loser to t he p hysician’s ma ndate de termines the flow, in the sense that a physician might reasonably condition care
on the fullness of the patient’s information disclosure. This does not apply to
all information, however, but information the physician deems necessary for
delivering a sound diagnosis and competent care by standards of the profession. Another difference is that the flow is unidirectional (i.e., not reciprocal);
physicians a re n ot e xpected to sha re i nformation a bout t heir p hysical a ilments, or much personal information at all, with patients.
A further point of difference between the contexts of friendship and health
care is that many of the informational norms in the latter are formally codified, either through law or codes of professional conduct (in the United States
and most other countries), and complex rules stipulate such matters as when
a patients’ explicit consent is required for t ransmission a nd how t he flow of
information is affected by the nature of the ailment in question (for an example, s ee t he H ealth I nsurance P ortability a nd A ccountability A ct o f 1996).
Rules also govern the set of appropriate recipients, for example, caregivers are
obliged to t ransmit information about incidents of food poisoning or highly
infectious diseases to public health officials; law enforcement agents are entitled to i nformation a bout g unshot w ounds; me dical i nsurance c ompanies,
under t he c urrent r egime, a re entitled to k now w hat c ategories o f a ilments
patients a re t reated f or, a nd s o o n. De spite t he e xistence o f t hese c omplex
rules, t here a re still open a nd controversial issues; for example, what t rans-
Contexts, Norms, Actors, Attributes, and Principles
147
mission principles ought to govern the flow of various categories of information to d rug c ompanies, a nd w hether p eople a re en titled to k now t he H IV
status of their sexual partners.
A few more illustrations may be useful for fi lling out and elucidating the
range of possible transmission principles and the way they function in familiar scenarios. In transactions between customers and mail-order companies,
customers are required to provide, at the very least, information necessary to
pay (e.g., credit card information) and to r eceive the goods (e.g., a sh ipping
address). A lthough t he job o f law enforcement might be easier were t he investigation of c riminal ac tivity a llowed to p roceed w ith no restrictions, t his
context is governed by a rigorous set of rules governing how officers conduct
themselves, w hat t hey a re a nd a re not a llowed to a sk c itizens a nd su spects,
and how they may and may not transmit this information thereafter. Further,
although arresting officers a re c onstrained i n w hat t hey a re a nd a re not a llowed to a sk at various stages, suspects, though compelled to a nswer certain
questions, are free to volunteer information beyond this. The admissibility of
information as e vidence in c ourt, d efining a nother t ransmission pr inciple,
would need to be addressed on a case-by-case basis guided not only by policy
but t he d iscretion o f t he p residing j udge. C ourtrooms a re g enerally t ightly
rule-governed. Even the Fift h Amendment may be understood as defining a
transmission principle: suspects themselves may not be forced to provide selfincriminating evidence although this evidence presumably may be obtained
by other (legal) means.
Control Versus Access
It is worthwhile revisiting the persistent, irresolvable disagreement discussed
in Part II over whether a right to privacy is a right to control versus a right to
limit or constrain access to information by others. The framework of contextual integrity reveals why we do not need to choose between them; instead, it
recognizes a place for each. The idea that privacy implies a limitation of access
by o thers o verlaps, g enerally, w ith t he i dea o f a n i nformational n orm. T he
former focuses on diminishment of access; the latter includes diminishment
of access as one way information flow might be governed (though it may govern the flow of information in other ways). Informational norms are generally
far richer in specifying not only when access is diminished but, as we have seen,
allow one to specify about what, about whom, and against whom. Philosopher
148
The Framework of Contextual Integrity
Jeffrey Rei man (1995), w e recall, offers some of this specificity when he requires that access not be at the discretion of others.
Control, too, remains important in the framework of contextual integrity,
as one of t he t ransmission principles. W hereas ma ny dominant accounts of
privacy identify the right to privacy as a right to control, in the framework of
contextual integrity, as we have seen, it is but one among many possible transmission principles, which in turn are but one of the pa rameters determining
whether informational norms have been respected. Accordingly, whether or
not control is appropriate depends on the context, the t ypes of information,
the subject, sender, and recipient.
Contextual Integrity as a Decision Heuristic
Motivating this book is the challenge of socio-technical systems and practices
that ha ve r adically a ltered t he flow o f i nformation i n s ocieties a nd t hereby
affected institutions, power structures, relationships, and more. Conceptions
of privacy that have served adequately until now are, in my view, unable to
adapt to t he new landscape, not quite able to conform to t he ebb a nd flow of
anxieties t hat t hese systems a nd practices provoke. In proposing contextual
integrity as an alternative conception of information privacy I am not as concerned w ith c apturing t he f ull me aning o f p rivacy b ut w ith p recisely a nd
systematically c haracterizing t he na ture o f t hese r adical a lterations. M ost
importantly, I a m i nterested i n add ressing t he que stion o f w hen a nd w hy
some of these alterations provoke legitimate anxiety, protest, and resistance.
In applying contextual integrity to this question I call on it to serve as a decision heuristic, a framework for determining, detecting, or recognizing when a
violation has occurred. Contextual integrity, in t his capacity, not only helps
predict when an activity or practice is likely to arouse protest, indignation, or
resistance, it helps explain and pinpoint the sources of objection.
Before and After Change, Establish and Compare
How does the framework of contextual integrity guide an assessment of, say, a
problematic new practice resulting from the deployment of a novel technical
device or system? Clearly, the question that needs asking is: Does the practice
in que stion v iolate c ontext-relative i nformational n orms? A nswering i t r equires that a comparison be drawn between entrenched practice and the novel
practice. A lthough t here ma y, o f c ourse, b e a h ost o f w ays i n w hich n ovel
Contexts, Norms, Actors, Attributes, and Principles
149
practices a lter t he status quo, t he f ramework of contextual integrity focuses
our assessment on the key parameters of context, actors, attributes, and transmission principles.
Establish the prevailing context. In order to a scertain what norms prevail,
one m ust de termine t he p revailing s ocial c ontext. S ome c ases a re c lear
enough—a grade school in an educational context; a hospital in a healthcare
context; a department store in a commercial marketplace. But others might
take a l ittle work a nd e ven t hen, t he practice u nder c onsideration m ight
occupy a z one of overlap or confl ict, or might be in zones of a c ontext
for which norms are incomplete. These hard cases need not be obscure or
mysterious: Sh ould o ne tel l o ne’s f riend h er sp ouse i s ha ving a n a ffair?
Should one tell one’s boss her spouse is having an affair? Should a hospital
share injury records with police officers? Should a parent read a child’s blog
postings? A spects o f t he f ramework de veloped i n t he n ext c hapter offer
ways to address some of these ambiguities but, for now, we merely register
them a s proble matic, not s pecifically for c ontextual i ntegrity but for a ny
attempt at modeling social systems and nuances of social experience.
Establish key act ors. A scertain w hether t he n ew p ractice b rings a bout
changes in who receives information (recipient), whom the information
is about (subject), or who transmits the information (sender). One of the
most common, yet under acknowledged changes brought about by newly
deployed information systems is an enlarged set of recipients. In the case
of t he E -ZPass road -toll s ystem, f or e xample, r ecipients o f i nformation
may now i nclude system ma nagement companies a nd state departments
of motor vehicles.
Ascertain w hat at tributes ar e affected. A scertain w hether t he c hanges
affect t he t ypes o f i nformation t ransmitted f rom s enders to r ecipients.
Swipe cards, for example, not only control entry to and egress from many
university b uildings a nd r esidence ha lls, b ut a lso t ransmit a nd l og t he
times of entry and egress.
Establish changes in principles of transmission. New practices may entail a
revision in the principles governing the transmission of information from
one party to another. Currently, in the northeastern United States, drivers
are o ffered a c hoice b etween c ash a nd E -ZPass, a nd t hus ma y c hoose
whether toll passage information is shared with officials. Were cash lanes
150
The Framework of Contextual Integrity
phased out entirely, the principle would shift to o ne in which drivers are
mandated to transmit information.
Red flag. I f t he n ew p ractice g enerates c hanges i n ac tors, a ttributes, o r
transmission p rinciples, t he p ractice i s flagged a s v iolating en trenched
informational norms and constitutes a prima facie violation of contextual
integrity.
Descriptive Validity of Contextual Integrity
I ha ve offered t he f ramework o f c ontextual i ntegrity a s a mo del f or u nderstanding and predicting reactions to alterations in information practices, particularly those caused by the deployment of information technology. Contextual integrity is offered as a benchmark for privacy, yielding assessments that
reflect c ommon s entiment a nd map w ell o nto j udgments t hat p rivacy ha s
been violated. Here, and in the two chapters following, I build a case for this
claim, a rguing n ot o nly t hat c ontextual i ntegrity i s a s ound me tric f or de scribing and predicting common reactions but that the framework, expanded
to i nclude a n ormative c omponent, s erves w ell a s a p rescriptive g uide. T he
normative c omponent i s de veloped a nd d iscussed i n C hapter 8. I n t he r est
of this chapter I offer what I am able to in the form of empirical support—
serendipitous controlled studies and surveys. For the most part, however, the
clearest support for the framework of contextual integrity, discussed here, in
Chapter 8, and mainly in Chapter 9, is its effective analysis of the puzzles and
problems discussed in Chapter 6, of the divisive socio-technical systems and
practices discussed in Part I, a nd its general compatibility with a w ide range
of cases, findings, and progressive privacy regulation.
Empirical Findings: A Study of Privacy Preferences
Most existing privacy surveys and polls are of limited relevance because the
way t hey f rame t heir que stions do es n ot a llow f or a c orrespondence to b e
drawn between answers and t he key pa rameters of informational norms. In
my view, this is one reason for the discontinuity between people’s actions and
survey results, not because people do not care about privacy, as privacy skeptics have charged, but because our ac tions a re finely modulated to t he variables. Questions in surveys that do not fi x these variables explicitly are, thus,
highly a mbiguous. A lthough t here ha ve, to d ate, b een n o em pirical s tudies
explicitly guided by the framework of contextual integrity, ideas emerging in
Contexts, Norms, Actors, Attributes, and Principles
151
the field o f h uman-computer i nteraction ( known a lso a s co mputer-human
interaction) a re s trongly c ompatible w ith it. Dourish a nd A nderson, for e xample, conceptualize privacy in terms of what they call “collective information p ractice . . . ways i n w hich s ocial ac tion i s su stained a nd r eproduced
through t he f ormulation a nd flow of information,” (2006, 323) and assert
that “flows of information . . . serve as markers of social boundaries, providing a means to negotiate, demonstrate, and sustain patterns of identity, membership, and affi liation in social groups” (p. 322).
There i s o ne c ontrolled s tudy t hat a ffirms t he c omplex a nd s ometimes
subtle dependencies between privacy judgments and a variety of factors partly
corresponding to t he variables in informational norms (Olson, Grudin, a nd
Horvitz 2005). The investigators sought to show that people’s privacy preferences do not re flect a si mple de sire to c ontrol a nd w ithhold i nformation,
but rather exhibit shift ing and finely tuned tendencies to share and withhold.
Conducted in two phases, the study began with a pilot survey of eighty-three
subjects who were asked to describe situations in which they had been reluctant to sha re i nformation a nd r easons f or t heir r eluctance. I n t he s econd
phase, a d ifferent set of subjects were asked to complete a large grid, indicating on a five-point scale how comfortable they were sharing information of a
particular type, drawing on findings from the pilot. The matrix did not simply ask how comfortable, but how comfortable to sha re with specific others,
acting in certain roles. This study, therefore, avoided much of the ambiguity
rife in privacy surveys.
Respondents were h ighly d iscriminating i n t heir reports, a nd si milar to
one another in how their judgments were affected by circumstances, types of
information, and recipients, affirming that the degree of comfort people experience w hen sha ring i nformation i s a f unction o f s everal f actors a nd n ot
simply one, such as control or sensitivity of information. Information types or
attributes included age, marital status, health status, opinions, salary, Social
Security n umbers, r eligious a ffi liations, a nd p hone n umber; a nd r ecipients
included family members, telemarketers, and coworkers. Individual variability was overshadowed by striking similarities in the degree to which information t ypes a nd r ecipient rol es were p redictive o f t he r espondents’ l evel o f
comfort in sharing information. This should put to rest the frequent insinuation t hat p rivacy p references a re p ersonal a nd i diosyncratic. A lthough e xplicit men tion w as n ot made o f c ontexts a nd t ransmission p rinciples, t hey
were implicit in the questionnaires through the presentation of highly scripted
152
The Framework of Contextual Integrity
recipient types, such as spouse, manager, and corporate lawyer. Differences in
reported comfort levels between the case when a manager gains access to information “ex officio” and when the manager receives the same information
but this time in trust, suggests that context—workplace versus friendship—
also affects judgments (Olson, Grudin, and Horvitz 2004, 2005).
Although most polls do not contextualize their questions, those that implicitly invoke context do reveal sensitivity to it in people’s responses. For example, most people consider it legitimate for lending i nstitutions a nd credit
card companies to ga in access to app licants’ credit histories; for automobile
insurance c ompanies to ga in ac cess to d riving r ecords; a nd f or p rospective
employers to ga in ac cess to a n applicant’s c riminal h istory (though only i n
cases where an applicant initiates the transaction) (see Louis Harris & Associates and Westin 1990, 1992).
In the following brief accounts of three well-known events, I demonstrate
how the framework of contextual integrity, by enabling structured analysis of
information flows, helps to clarify and guide normative evaluations.
Case One: The Clinton-Lewinsky Scandal
During the period from January 1998 through February 1999, lurid details of
the Clinton-Lewinsky affair preoccupied the population and the popular media in the United States and beyond. As part of a broader investigation, which
need not concern us here, President Clinton came under fire for lying about a
sexual l iaison w ith M onica L ewinsky, w ho had s erved a s a W hite House
intern in 1995. The case stimulated public discussion about what rights to secrecy public figures have i n t he de tails of p ersonal i ntimacies. Neither t his,
however, nor the primary narrative of the Clinton-Lewinsky affair is our central concern. I nstead, we focus attention on t he peripheral d rama featuring
Lewinsky and Linda Tripp. Tripp was a f ormer White House employee who
befriended Lewinsky in 1996 while both worked at the Pentagon. Lewinsky
confided details of her relationship with President Clinton to Tripp, as well as
her feelings for h im. For a lmost t hree months (October 2 to De cember 22),
Tripp secretly recorded phone conversations with Lewinsky, turning the tapes
over both to Kenneth Starr, the independent counsel leading an investigation
into C linton’s rol e i n a r eal e state v enture i n A rkansas, a nd to l awyers f or
Paula Jones, who had ac cused Clinton of violating her federal civil rights by
making crude sexual advances while she was a state employee and he the governor of Arkansas.
Contexts, Norms, Actors, Attributes, and Principles
153
The Clinton-Lewinsky case evoked wide-ranging reactions for and against,
but the reaction to Linda Tripp was virtually uniform in its distaste. Months
after the dust had settled, Tripp made several attempts to restore her reputation, explaining that she had acted in the name of truth, that she had sought to
protect her children, and even that she had acted in Lewinsky’s best interests.
Whether there is truth in these explanations and whether they excuse her behavior are questions open to debate. That she betrayed a friendship seems to be
an irrevocable judgment readily modeled in the framework of contextual integrity. Considering the interactions of Tripp with Lewinsky in the context of
friendship, Tripp’s ac tions v iolate a t l east t wo i nformational n orms: first,
recording intimate phone conversations without asking or even informing Lewinsky a nd, s econd, t ransmitting t hese recordings to o thers. Even i f, on ba lance, more good than harm came of Tripp’s actions, they violated informational
norms of friendship by transgressing transmission principles of knowledge,
consent, and confidentiality, and mark her as traitorous to the friendship.
Case Two: The Gramm-Leach-Bliley Act
In 2 001 t he I ndividual Ref erence S er vices Gro up, I nc. ( IRSG), a n onprofit
trade a ssociation r epresenting i nformation i ndustry c ompanies, a nd T rans
Union L LC, o ne o f t he l argest c redit r eporting a gencies, sue d t he F ederal
Trade C ommission ( FTC). I RSG a nd T rans Union c ontended t hat F TCformulated rules were both unlawful and unconstitutional. Specifically, these
rules regulated t he s tatus a nd u se of c redit headers. T he d ispute originated
with t he Gr amm-Leach-Bliley A ct o f 1999 ( GLBA), w hich c reated a n ew
framework for t he financial sector a llowing financial ser vice providers (e.g.,
banks, i nsurance c ompanies, a nd s ecurities firms) g reater flexibility than
existed before in pursuing mergers, affi liations, and competitive offerings. But
because such mergers, abetted by powerful computerization and communications technologies, could result in the pooling of vast repositories of customer
and consumer information, the GLBA included a proviso to protect the security a nd c onfidentiality of what it called “nonpublic personal information.”
With t he stated purpose of g uaranteeing more comprehensive financial privacy t han had e ver b efore b een enac ted by C ongress, t he F TC w as c harged
with implementing this requirement in a set of rules (hereafter Rules), which
it did in Spring 2000 ( FTC 2000 ; also see IRSG v. FTC 2001, 11).
The f ramework o f c ontextual i ntegrity r eveals c onsiderable w isdom i n
several aspects of the court’s decision, and by implication, in the relevant FTC
154
The Framework of Contextual Integrity
Rules. Here I d iscuss a f ew illustrative points, referring interested readers to
the full cases (FTC 2000 ; Trans Union v. FTC 2001; IRSG v. FTC 2001). One
major source of contention was how the category of “nonpublic personal information” (NPI), which falls under the purview of the Rules, was to b e defined. The FTC determined that this category included any information that a
consumer provides to a financial i nstitution to ob tain a financial ser vice or
product, a ny i nformation a bout a c onsumer t hat results f rom a t ransaction
involving a financial p roduct o r s er vice, o r i nformation t he i nstitution ob tains about a c onsumer in connection with providing a financial product or
ser vice to that consumer (FTC 2000 , 17).
The IRSG and Trans Union faulted the FTC for an overbroad definition,
extending well beyond the class of “personally identifiable financial information” originally covered by the Fair Credit Reporting Act (FCRA 1992), considered the predecessor of GLBA. They contended that the FTC’s definition of
information within the scope of the GLBA included not only strictly financial
information, but identifying information, such as name, address, Social Security number, a nd telephone number, w hich a re t he items i ncluded i n c redit
headers (named so because they are typically printed at the top of a credit report). GLBA rules required financial institutions to provide notice to consumers prior to transmitting covered information to others, and to permit them to
opt out (subject to certain exceptions). This meant that credit header information, which previously had been freely sold (for such purposes as target marketing), was now subject to G LBA requirements. Trans Union and the IRSG
argued, among other things, that financial privacy rules should govern only
intrinsically financial information, which, according to standard usage, is information pertaining to matters of money, credit, and monetary receipts and
expenditures (IRSG v. F TC 2001, 26). T hey a lso a rgued t hat t he F TC Rules
amounted to a violation of their First Amendment rights to free speech.
The court decided in favor of the FTC that its Rules neither contravened
the me aning o f t he G LBA n or a bridged F irst A mendment r ights o f f ree
speech. For our purposes, however, the punch line is in the court’s reasoning.
By refusing to ba se t he w ay i nformation i s t reated on its b eing intrinsically
anything—financial versus merely identifying—the court was not swayed by
arguments on t he other side t hat s ought to me asure t he p otential ha rms of
freely t ransmitting N PI. It focused, r ather, on t he F TC’s r ationale t hat “any
information should be considered financial information if it is requested by a
financial institution for the purpose of providing a financial service or product”
Contexts, Norms, Actors, Attributes, and Principles
155
(FTC 2000). T he court r uled t hat even when t he i nformation i n question is
“otherwise publicly available,” restriction should apply because,
in draft ing t he GL B Act, C ongress re cognized t hat t he s tatus of pa r ticu lar
types of information may vary according to t he context in which it is used.
Information u sed i n o r der ived f rom a fi nancial c ontext i s no npublic p ersonal i nformation u nder ( number) 6809 (4)(C)(i); t he s ame i nformation i n
another context, however, may not b e N PI. T hus, it is t he context i n which
information is disclosed—rather than the intrinsic nature of the information
itself—that determines whether information falls within the GLB Act. (IRSG
v. FTC 2001, 27)
A r inging en dorsement o f c ontextual i ntegrity, a lthough t he c ourt w as n ot
to know.
Without s triving, t he c ourt f ollowed s ome o f t he s teps o f t he de cision
heuristic for contextual integrity, stressing that the self-same information warrants d ivergent t reatment, de pending o n c ontext a nd t he rol es o f sub jects
transmitting and receiving this information. Expressing this in the language
of contextual integrity, the court effectively decided that in a financial context
all information about clients (subjects) emerging from a financial transaction
(information type), transmitted to agents of the relevant financial firm (recipients and senders) or to third parties (recipients), is subject to the transmission principles prescribed in the GLBA (confidentiality, notice, consent, etc.)
as interpreted by the FTC in its Rules (informational norms). I would quibble
only w ith a sma ll detail of t he court’s a nalysis. For t he court to a rrive at its
decision—in my view, the correct one—it needed to f ocus on the type of information i n que stion. I n t he f ramework o f c ontextual i ntegrity, t he r esult
falls out more easily because t he f ramework i ncludes t he add itional d imension of transmission principle. Name and address are still name and address.
The difference is that in a financial context, the transmission of name and address from financial firms to others is governed by FTC Rules.
The worldview of contextual i ntegrity is a lso strongly compatible w ith a
par ticular f ragment o f t he c ourt’s r easoning de aling w ith f ree sp eech. T he
court’s first step was to relegate credit headers to t he category of commercial
speech, w arranting w eaker F irst A mendment p rotection. S econd, i t de termined, c ontrary t o t he p laintiffs’ c hallenge, t hat t he F TC R ules do s erve a
public interest in preventing harm. The twist here is what the court regards as
harm: interestingly, a harm does not require evidence of familiar consequences
156
The Framework of Contextual Integrity
of use and disclosure such as identity theft, b ut “use a nd d isclosure o f t hat
information without the consent of the consumer” (IRSG v. FTC 2001, 55). In
the language of contextual integrity, the court has recognized that information subjects in financial contexts have a right emanating from informational
norms embodied in valid FTC Rules. In particular, these Rules prescribe an
obligation on financial institutions to obtain express consent from subjects, in
order f or t hem to d isclose N PI to t hird pa rties. A ccordingly, i f a financial
institution t ransmits i nformation i n v iolation of t his norm, no matter what
other c onsequences ma y flow, t he c ourt r ecognizes t he ha rm to sub jects o f
having had this right violated (IRSG v. FTC 2001).
Case Three: PIPEDA and Privacy of Medical Prescriptions
Whereas the court’s defense of FTC Rules demonstrated an impressive sensitivity to the effects of contexts on the meaning and significance of information, t he Privacy Commissioner of Canada seemed stifled by a r igid dichotomy in his reasoning about physicians’ privacy in relation to prescriptions. In
June 2001, physicians in Canada filed a complaint with the Privacy Commissioner, G eorge R adwanski, a gainst I MS H ealth C anada c harging t hat i t
violated s ection 12 o f t he P ersonal I nformation P rotection a nd E lectronic
Documents Act (PIPEDA) by selling information about their prescribing habits a nd d isclosing i nformation ac ross b orders w ithout t heir c onsent. IM S
gathers detailed information about individual prescriptions from pharmacies,
matching it with the prescribing physicians’ names, although gathering only
basic demographics about patients. IMS transmits this information to its data
processing c enter i n Philadelphia w here it produces v arious c ustomized i nformation products for pharmaceutical companies, including ProMap, which
tracks monthly prescribing activities of physicians who have attended events
sponsored by participating pharmaceutical companies.
Radwanski did not support the physicians’ complaint. Reasoning that because prescription-writing habits do not constitute information about a physician b ut mer ely i nformation associated wi th th e p hysician, th ey d o n ot
constitute personal information a nd a re not, t herefore, covered by PIPEDA.
Radwanski c oncludes, “Accordingly, I find t hat pre scription i nformation—
whether in the form of an individual prescription or in the form of patterns
discerned from a number of prescriptions—is not personal information about
the physician” (Radwanski 2003). If not question-begging, this reasoning is
quite bizarre, asking readers to go along with the notion that “it (prescription
Contexts, Norms, Actors, Attributes, and Principles
157
writing habits) d iscloses little or nothing about t he physician as a n individual” but something “once removed.” Because I know too little about the details
of P IPEDA a nd o f t his c ase, m y c omments a bout R adwanski’s a nalysis a nd
conclusion d o not qu estion h is c ompetence. I t i s qu ite p ossible R adwanski’s
argument was forced by highly specific definitions of “personal information.”
The problem I see stems from a framework of reasoning that builds a complex set of rules atop the highly dubious distinction between personal information and information “once removed” when there is so much more we can
draw from in this case, for example, what we know about the role and responsibility of physicians in society; the system of prescriptions for certain families of drugs; and the intricate interdependencies that exist among physicians,
patients, pharmacies, and pharmaceutical companies. The framework of contextual integrity invites this type of analysis. It is quite possible that the conclusion reached would be the same as Radwanski’s, but it would be grounded
in a solid grasp of what is at stake in this case, not on an artificial distinction
between information about a person and information associated with a person.
In the next two chapters I will elaborate on the rich dependencies that exist between expectations about t he flow of i nformation a nd details of social
systems in which these flows occur.
9
Privacy Rights in Context:
Applying the Framework
T
HE CENTRAL THESIS OF THE FRAMEWORK OF CONTEXTUAL
integrity is that what bothers people, what we see as dangerous,
threatening, d isturbing, a nd a nnoying, w hat ma kes u s i ndignant, r esistant,
unsettled, and outraged in our experience of contemporary systems and practices of information gathering, aggregation, analysis, and dissemination is not
that they diminish our control and pierce our secrecy, but that they transgress
context-relative informational norms. These norms preserve the integrity of the
social contexts in which we live our lives, and they support and promote the
ends, purposes, and values around which these contexts are oriented. In this
chapter I d iscuss whether and how well contextual integrity addresses issues
that other theories cannot, whether it avoids some of their pitfalls and blind
alleys, w hether i t a llays s ome o f t he c ynic’s j ibes, a nd, mos t i mportantly,
whether it sheds light on daily encounters with systems and practices that individually diminish privacy and, considered in aggregate, imply that privacy
might be a quaintly old-fashioned value with no place in this so-called information age.
Puzzles, Paradoxes, and Trade- Offs
Privacy skeptics’ arguments, reviewed in Chapter 6, que stioned t he seriousness of people’s commitment to privacy when their observed behaviors regularly c ontradict e xpressed c oncerns a nd g ive l ittle e vidence t hat t hey sha re
186
Privacy Rights in Context
187
the advocate’s position on privacy as among the rarefied class of fundamental
human values. Although several plausible rebuttals considered in that chapter
undermine the skeptic’s argument, the framework of contextual integrity also
challenges it. If a r ight to privacy is a r ight to context- appropriate flows, and
not to secrecy or to control over information about oneself, there is no paradox in caring deeply about privacy and, at the same time, eagerly sharing information as long as the sharing and withholding conform with the principled
conditions prescribed by governing contextual norms. With this conception
in mind, one can simply pick through and explain most, if not all, of the skeptics’ examples of actions that purportedly contradict people’s expressed preferences for privacy.
In a si milar way, historical and cultural variability is no longer a p uzzle
requiring explanation, but an expected consequence of general cultural and
historical variation due to internal factors and the imprints left from external
contingencies. Unsurprisingly, e quivalent s ocial c ontexts m ay h ave e volved
along different paths, and may have assumed diverse characteristics in their
basic institutions, functions, and practices, even if they subscribe to a similar
cluster o f v alues, en ds, a nd p urposes. Suc h d iversity i s c lear, f or e xample,
in family, c hild r earing, e ducation, em ployment, r eligion, c ommerce, a nd
health c are. N orms su pporting t hese pa tterns, i ncluding i nformational
norms, reflect this diversity accordingly. For example, the absolute prohibition on disclosure of medical information, embodied in the Hippocratic
Oath, u ndergoes t ransformation i n present d ay me dical c ontexts governed
by s cience-based me dicine a nd t hird-party p ayment s chemes; i n c ultures
with strong extended family or clan ties, informational norms governing
family contexts may be different from those in cultures with nuclear family
structures; and salaries are less guarded from friends and colleagues in socialist l eaning c ountries suc h a s Sweden. E ntrenched i nformational n orms
reveal not only the activities and practices that are likely to provoke privacy
concerns but potentially may constitute a r ich source of insight into the social and political archeology (Introna 2000) of par ticu lar social contexts in
par tic u lar societies.
The framework of contextual integrity also provides a way through many
of the intractable trade-offs that appeared an inevitable outcome of the functional approaches discussed in chapters 4 a nd 6. Because the point of departure is a commitment to appropriate flow and not to secrecy and control over
information, many of t he conflicts simply do not materialize. Consider, for
188
The Framework of Contextual Integrity
instance, the scrutiny of air travelers that has become routine, including backroom profi ling, close monitoring, and tracking as travelers pass through various a irport c heckpoints. O ne w ay to de scribe t hese s orts o f si tuations i s a s
a trade-off between privacy and some other value; in this case, safety or security. Bu ilt i nto suc h de scriptions, h owever, i s a n a ssumption t hat p rivacy
means secrecy or control, which must be partially relinquished in favor of the
other value or values. With the requirement of privacy as contextual integrity,
the right in question is appropriate flow; that is, norm-governed flow of information that has been calibrated with features of the surrounding social landscape, i ncluding i mportant mo ral, p olitical, a nd c ontext-based en ds, p urposes, and values, as discussed in the previous two chapters.
The escalating level of scrutiny for travelers, though it increases the flow of
certain types of information to v arious officials, does not necessarily constitute a v iolation of privacy understood as contextual integrity. Following t he
steps of the contextual integrity (CI) decision heuristic, the new flows of information effected by new regimes of airport security may, indeed, lead to a
prima facie judgment that contextual integrity has been violated. In pursuing
the analysis further, however, it is possible that these new flows are embraced
as preferable to the old if they are seen as more effective at achieving values,
such as safety, security, and efficient movement through the system, that might
credibly be high among the aims of a t ransportation context. If the opposite
determination is reached—that the values, ends, and purposes are less effectively achieved by the new systems and practices—then we may truly say that
the new system violates contextual integrity, but we will have learned quite a
lot about what is at stake in pushing forward with the systems and practices in
question.
The case of increased scrutiny at airports turns out to b e particularly interesting in light of results from the “International Surveillance and Privacy
Opinion Survey,” a nine-country, comprehensive survey of peoples’ views on
and understanding of surveillance and global information sharing. The study,
which spanned four years and included almost 10,000 r espondents, incorporated results from public opinion polls, questionnaires, and qualitative focus
groups on a range of topics from national identification cards to closed-circuit
television (CCTV), terrorism, and control over personal information (Zureik
2006; Zu reik e t a l. 2008). O ne pa rticularly i nteresting finding w as h ow r espondents answered one of the questions in the section of the survey devoted
to a ir t ravel. To t he que stion, “ To w hat e xtent i s yo ur p rivacy r espected b y
Privacy Rights in Context
189
airport and customs officials when traveling by airplane?” the majority of respondents reported feeling that their privacy is “completely,” “a lot,” or “somewhat” respected by airport officials, with only between 2 and 18 percent (varying ac cording to c ountry) f eeling t hat i t i s n ot r espected a t a ll. U nder t he
conception of privacy as control over information or degree of access to it,
this is a curious finding. In an environment where we identify ourselves several times, have our luggage X-rayed, have the contents of our purses scrutinized, are forced to remove jackets, shoes, and belts, and have our bodies examined and patted down, the answer to this question should be a resounding
“not respected!” In light of contextual integrity, however, the finding is not in
the least surprising.
Finally, p rivacy i n p ublic, a p roblem f or a j ustificatory f ramework t hat
presumes a p rivate/public d ichotomy, p oses n o pa r ticu lar d ifficulty for the
framework o f c ontextual i ntegrity. A s d iscussed i n C hapter 6, t he p roblem
arises w hen p olicies g overning s ystems a nd p ractices a ssume t hat o nly t he
private warrants privacy protection and for the rest, anything goes. According to t he contextual integrity framework, because all information flows are
norm-governed i n s ome w ay, t here si mply i s n o s etting i n w hich a bl anket
“anything goes” prevails.
Reevaluating Socio- technical Systems and Practices
in Light of Contextual Integrity
The f ramework o f c ontextual i ntegrity i s i ntended a s a de scriptive to ol,
systematically ac counting f or p eople’s r eactions to t he m yriad te chnical
systems radically affecting the flows of personal information. But it is also intended as a framework for evaluating these systems from a moral and political
point of view. It is time to circle back to the systems introduced in Part I to see
contextual integrity in action. After all, the impetus behind its development
was t he i nnumerable te chnology-based s ystems a nd practices i n w hich privacy app ears to b e a c asualty, y et c annot e asily b e a nalyzed b y p reeminent
accounts of privacy. I have argued that this failure is not so much because
these theories fail to recognize its importance, but because they do not recognize t he c rucial s ocial de terminants—embracing o r r esisting t hese s ystems
and practices—of people’s reactions. The framework of contextual integrity is
an account of these social determinants (not a f ull-blown theory of privacy)
used to explain when and why people resist and react with anxiety to certain
190
The Framework of Contextual Integrity
systems and practices and why these reactions are justified in a subset of these
situations.
The t hree ke y el ements o f t he f ramework—explanation, e valuation, a nd
prescription—are recapped below.
Explanation. C ontextual i ntegrity f unctions a s a me tric t hat i s s ensitive
to meaningful c hanges a ffecting p eople’s r eactions to n ew s ystems o r
practices. Merely revealing these changes can constitute a decisive rebuttal
to an initial response frequently offered b y t hose s eeking to j ustify t he
system, namely, that no significant change relevant to privacy has occurred.
By c ontrast, I ha ve su ggested t hat a n ew s ystem o r p ractice sh ould b e
examined in light of context-relative informational norms that might have
been b reached. Do ing s o r equires a scertaining t he g overning c ontext,
whether key roles (sender, recipient, subject) have been affected, whether
there have been changes i n t he t ypes of i nformation or attributes t ransmitted, a nd w hether t he ter ms u nder w hich i nformation flows violate
relevant t ransmission p rinciples. A ny o f t hese w ould b e su fficient to
trigger resistance, and, conversely, protest and resistance are often reliable
indicators that informational norms have been breached.
Evaluation. In some instances, recognizing that change has occurred and
pinpointing its source might be all that is needed to resolve a controversy,
or at least to clarify what is at stake. In others, however, revealing that
practices violate entrenched norms serves mainly to sharpen the sources
of controversy. An evaluation is then required, comparing altered flows
in relation to those that were previously entrenched. Although there is
no si mple recipe, t he f ramework of contextual i ntegrity, a s developed
in this boo k, a ttributes a n i mportant r ole t o co ntextual va lues (g oals
or purposes). In some cases, when attainment of contextual values is
obstructed or diminished by an alteration in flow, the alteration is judged
problematic a gainst a lternatives t hat do n ot ha ve t he s ame del eterious
effects. Other systems that create conflicts among general moral or political values, including informational harms, justice, security, trust, unfair
discrimination, t hreats to a utonomy a nd l iberty, r econfigurations of
power, efficiency, s ecurity, a nd sp eech, ma y n eed to b e c onfronted a nd
settled i n l ight o f c ontextual v alues. C onfronting a nd s ettling c onflicts
involves (b orrowing t erminology fr om W alzer 1984) e stablishing t he
meaning or si gnificance of respective values in light of contextual ends
Privacy Rights in Context
191
and purposes. A possibility that I mentioned only in passing in Chapter 8
bears repetition. New flows of information might not register with any of
the entrenched informational norms because the context into which they
are introduced might be incomplete (i.e., have no pre-existing guiding
norms in relation to the new practices; see the discussion in Chapter 7).
When new technologies are the enablers of such systems and practices,
they may facilitate activities that were previously inconceivable. In
such cases, the strategies developed to co mparatively evaluate new with
entrenched p ractices c an a lso g uide a n e valuation o f n ew s ystems a nd
practices.
Prescription. In light of contextual integrity, an evaluation that finds a
given s ystem o r p ractice t o b e m orally o r p olitically p roblematic, in my
view, is grounds for resistance and protest, for challenge, and for advocating
redesign or even abandonment. If special circumstances are so compelling
as to override this prescription, the burden of proof falls heavily upon the
shoulders o f p roponents. T hese b roader c onsiderations o f p ractice f all
outside this book’s purview, though some attention will be paid to them in
the Conclusion.
Monitoring and Tracking
A co mmon j ustification of t echnology-based mon itoring a nd t racking s ystems is that they are both more efficient and efficacious without an added cost
to p rivacy. J ustifications o f t hese k inds ha ve b een offered f or C CTV v ideo
surveillance of public parks, vehicle safety communications systems that include identifiers, roadside license-plate recognition systems, radio frequency
identification (RFID)–enabled passports, and, no doubt, many other technologies. Their proponents claim that these systems do not increase privacy incursions because these are public places and no new information is involved,
and pointing out the sharp increases in the number of such systems (e.g., surveillance cameras covering public spaces in London or New York [Farmer and
Mann 2003]) is powerless against such defenses because numbers, in themselves, do not count (Taurek 1977).
The C I heuristic, however, reveals add itional d imensions of c hange, enabling the discovery of innumerable alterations in information flows, including
some that violate entrenched practices in ways that matter to contextual integrity. Such alterations are unsurprising, as monitoring and tracking systems
excel a t ca pturing inf ormation in r eal tim e w ith in creasingly s ophisticated
192
The Framework of Contextual Integrity
lenses and microphones, have vast storage and processing capacities enhanced
by t he ado ption o f s tandardized f ormats, a nd a re c ontinuously i mproving
their communications media, all of which enable accessibility to a broad array
of recipients for a b road a rray of uses. T hese a ffordances (Norman 2002) of
advanced systems draw attention to some of the ways in which we might expect informational norms to b e transgressed. A f ew of these are highlighted
below in regard to the examples discussed in Part I.
CCTV. In the familiar instance of a typical city park fitted out with CCTV,
one immediate casualty is reciprocity, a transmission principle generally governing visual access. In CCTV setups, even when the cameras are fairly evident, not only are the viewers of video feeds invisible to surveillance subjects,
the subjects are generally ignorant of whether live feeds are being v iewed at
all. Furthermore, depending on the details of the setup, the images gathered
by C CTV s ystems ma y b e e asily t ransmitted el sewhere a nd w idely d istributed, certainly well beyond the immediate passersby we expect to see and notice us in a public park.
Some CCTV systems may alter the type of information transmitted to recipients by allowing authorities to string together images captured across
time and space. Information types could be further affected by biometrically
enhanced C CTV, suc h a s a s ystem w ith f acial r ecognition c apability. Suc h
enhancements raise similar worries to those characterized by critics of license
plate recognition systems as a “stalker effect” (Evans-Pugh 2006). These variations amount to alterations in the type of information flowing to the authorities s taffing t he C CTV s ystems i n que stion b ecause a uthorities n ow ha ve
continuous i mage f eeds o f p otentially i dentifiable i ndividuals r ather th an
momentary g lances t hey ma y ha ve had i n si tu. A nother a spect o f a C CTV
setup that may result in further breaches of entrenched norms is not informing p eople a bout i ts p resence; h idden c ameras me an t hat t he t ransmission
principle of notice (subjects normally are aware when others see them) is no
longer in play. There are many other details of a s etup that may have correspondingly diverse effects on contextual integrity, such as whether images are
stored and for how long, and whether they are freely distributed among government offices and under what conditions.
The CI heuristic a lso h ighlights why neither t he descriptive defense (asserting t hat t he s ystem brings about no sig nificant change) nor t he normative
defense (that there is no expectation not to be seen when one is out and about
Privacy Rights in Context
193
on a public street) of the Street View utility in Google Maps are sound. In this
case, b reaches o f i nformational n orms i nclude a lmost a ll t hose men tioned
above in relation to video surveillance (types of information, recipients, and
transmission principles) as well as t he posting to a n ew venue, t he Internet.
Accordingly, St reet Vie w c learly t ransgresses re asonable e xpectations of
people on public sidewalks if one understands reasonable expectations to b e
defined as expectations shaped by entrenched informational norms.
RFID. The framework of contextual integrity raises many of the same concerns in commentaries on RFID technologies. It also highlights a point made
earlier in our discussions of caller ID and data mining, that violations resulting from its uses are not inherent in the general technology itself, but depend
on the context of use and to w hat extent its deployment affects the range of
information recipients, the t ypes of information transmitted, and the principles governing transmission. Problems a nticipated by advocacy organizations a nd i ndividual a nalysts i nclude t he p ossibility o f c overt o r h idden
transceivers, l ong-term t racking, a nd u nauthorized i nterception o f sig nals
between t ag and a uthorized r eaders. E ven w hen s ystems a re f unctioning
normally, a s s tated a nd i ntended, t he r esulting a lterations i n i nformation
flows ma y t ransgress en trenched n orms. F amiliar a rguments t hat n othing
has c hanged, o r n othing r elevant to p rivacy ha s c hanged, a re a s h ollow
sounding here as elsewhere.
These general observations indicate likely t rouble spots but in my v iew,
action or policy guiding evaluation needs to be ultimately grounded in particu lar contexts. When evaluating the E-ZPass system, for example, the context ha s a ltered f rom t he entrenched i nformation flows i nvolving a h uman
toll operator glancing at a c ar or even a c ar’s license plate as it drives by to
signals from transponders attached to vehicle windshields picked up by transceivers at R FID-enabled tol l plazas. It is worth stressing t hat t he constellation of departures from entrenched flows is as much a f unction of the overarching socio-technical system as it is of the RFID technology, as it is of the
system that determines whether RFID-enabled toll plazas are linked with a
cash-based or anonymized back end, rather than with identifiable credit card
payment schemes, and can be tailored to mitigate many flow patterns judged
undesirable.
In commercial marketing contexts, critics have been able to ro use attention and worry among consumers over the prospect of RFID tags embedded
194
The Framework of Contextual Integrity
in consumer items by pointing out the potential for merchants and third parties to monitor consumers not only at point of sale but beyond, both outside
their premises and within, as in repeat visits to the same store or cooperating
branches. They have suggested a set of principles of fair information practices
for R FID s ystems, building upon t he p ositive c onsensus su rrounding t hose
introduced in the historic 1973 report, Records, Computers, and the Rights of
Citizens (U.S. Department of Health, Education and Welfare 1973; Garfinkel
2002b; C onsumers A gainst Su permarket P rivacy I nvasion a nd N umbering,
et al. 2003). These principles refer to…