“I haven’t done anything wrong, so why should I care what information is collected and shared about me?”

The privacy crisis is about agency. It’s not just a matter of who owns or shares your information, but what they might do with that information and what accountability there is for what they do.

To better understand the privacy/agency dynamic, imagine some scenarios.

Scenario 1: Inadvertent No-Fly Listing

Many people share the same name. You might not have done anything wrong, but have no control over who your name sharers are or what they might do.

What if someone sharing your name did something that resulted in that name being placed on a no-fly list? Each time you travel by air, you would have to prove that you were not that other person—hard to do if you are known by the same name. Here agency has been exercised by parties you neither know nor can control and no reason has to be given for your inclusion on that list. It can take years and thousands of dollars to get off the list that you did nothing to get on.

Scenario 2: Job Prospects Jeopardized

Clinical depression strikes one in six of us. People who report clinical depression and seek treatment have their names entered into a variety of databases: a therapist’s office; a health plan; and a pharmacy. If they purchase their antidepressants with a credit card, that’s one more database. What if someone applied for a job and the human resources staff considered due diligence to include searching one or more of these databases? A match appears. Is it you or someone with whom you share a name? Do they check? Do they consider this information sufficient to consider you a risk and remove your name from the eligibility list? If they do, do they have to tell you? Do you have an opportunity to demonstrate that this is not really you, or that you have been cured? How far back in your history might they go in their search? Do they have a statute of limitations on your psychological history?

A similar disqualification could occur with other medical conditions, e.g., diabetes, epilepsy, partial deafness, a torn ligament or concussion you suffered from high school sports.

Scenario 3: Security Agency Misunderstandings

A student in your home is given an assignment asking them to explore issues of citizenship. The issues include civil disobedience. Placing the term “civil disobedience” into a search engine takes the student to a wide variety of websites. Many of these are news websites describing mild to severe civil disobedience activities. Some are websites that advocate civil disobedience, including how to perform civil disobedience. Each and every search becomes a data point in the search engine database. Either your internet service provider has agreed to share the search information with your government, or your government has agreed to share the search information with other governments, or a foreign government has hacked into either your internet service provider’s database or your government’s database. Now, several governments are aware that someone using your IP address has done searches using sensitive keywords and visited sites that promote civil disobedience. What lists might your IP address now be on? What questions might you be asked when crossing a border?

Scenario 4: Unauthorized Habitation Disclosures

You are online regularly, many hours a day. Then you go on vacation. There is no online activity from your IP address. Your ISP knows no one is home. Your ISP shares its data with your government, and your government with other governments. Many people, none of whom you know, know that you are not home. Some of them may know where you are because your smart phone or tablet computer is logging in remotely. Some of these people are willing to share what they know for a price, or maybe they are being extorted to share what they know. Someone who specializes in break and entry uses this information.

 Scenario 5: Unauthorized Personal Information Disclosures

A social media company keeps tracking data on its users as part of its business model, archiving both personal and metadata. It strips the personal data from its databases (i.e., reporting that an unnamed person from a specific location visited a specific website at a specific time and viewed specific pages) and leases it to other companies who want to use it to design more effective marketing strategies. Your ISP also leases metadata to other companies, as does an online store that you patronize. No one of these databases identifies you, but by cross-referencing, a company that leases all three of these data streams can easily identify you. You may be interested in alternative lifestyles or fringe politics, or researching competing companies in case you need to make a career move at some future time—none of which are illegal or anyone’s business but yours—and now your well-kept secret isn’t secret. What might your friends, employers or co-workers think?

Scenario 6: Prejudicial Airfare Pricing

Your vacation plans often include air travel. When planning your vacation, you use a browser to discover accommodation options and tour choices. The browser tracks your activities, and sells this information to airlines. When you visit the airline website to book your flights, the prices shown may be adjusted according to your other vacation-related researches and bookings. In other words, different browsing histories may result in different price quotes for the same flights.

Privacy is not about having nothing to hide or having done nothing wrong. It is about not needing to hide anything because it isn’t anyone’s business but yours and should be respected as such. It is also very much about agency because information often leads to action, sometimes not in our best interests. We need agency to maintain our privacy rather than others exercising agency based on our private information. This is especially true if governments and companies use our private data—often without our knowledge and consent—to act against our best interests, then hide behind corporate or national security justifications if we make freedom of information requests to discover why or how we might have been treated unfairly.

We need to be protected from those who might seek to harm us. This protection includes not only agents—foreign or domestic—who might see us as an enemy, but also corporations and governments—foreign or domestic—should their agency place us in harm’s way.

A realistic—and possibly unfortunate—response to privacy invasions and harmful uses of agency could be a chill—an abandonment—of online activity. To limit tracking of purchases, people might visit bricks and mortar stores and use cash as often as possible. They might conduct bank transactions in person rather than online or by telephone. They might research vacation transportation and accommodation options online, but make personal visits to travel agents to book them. They might abandon social media, or restrict their activities and disclosures, or seek social media that can provide greater privacy. They might self-censor their web search terms. But how sad is that?

If corporations and governments cannot be trusted to maintain and respect privacy, people will exercise the agency required to respond to the breaches and abuses.

Privacy is complicated, but affects everyone.

What’s your agency?

(The ideas in this post are equally applicable to both Elementary and Secondary classrooms – ed.)