By Olumide Babalola
“Privacy is dead, and social media hold the smoking gun.” – Pete Cashmore, Mashable CEO
When my wife – Ajibike – clocked forty in August, we had a stimulating conversation on how one can simultaneously celebrate such remarkable moments on social media and yet realistically control how others access and use one’s personal information (pictures, videos etc) publicly shared on such occasions especially on WhatsApp.
In a recent article on the nature of WhatsApp as a private or public space, I respectfully submitted that the advent of modern technology has changed the conventional meaning of many words. This also includes the meaning and nuances of privacy as a concept as opposed to its associated right. At page 9 of my book – Privacy and data protection law in Nigeria (2021), I emphasised the difference between privacy and right to privacy by likening them to a situation of egg and chicken where privacy is an object and right to privacy is a legal entitlement to that object. Often times, social media users have been confronted with unpleasant scenarios of privacy paradox where they seek to enforce (right to) privacy over contents they happily and voluntarily post on social media into public domain. In this brief article, I answer a major question associated with this everyday reality arising out of the (mis)use of personal information found on social media in relation to (right to) privacy or its expectation thereof.
Do social media users have ‘reasonable expectation of privacy’ over publicly disclosed/shared personal information?
Like privacy itself, the term ‘reasonable expectation of privacy’ is incapable of generally acceptable definition. With the unprecedentedly intrusive nature of technology, reasonable expectation of digital privacy changes with every update or upgrade of social media apps and platforms. Bruce Schneier, the chief security technology officer of BT – a British multinational telecoms company shared same sentiments in his book ‘Schneier on Security’. He argues that “Even if society still has some small expectation of digital privacy, that will change as these and other technologies become ubiquitous. In short, the problem with a normative expectation of privacy is that it changes with perceived threats, technology and large-scale abuses.”
In English privacy law, the concept of reasonable expectation of privacy was introduced by Lord Nicholls in Campbell v MGN [2004] 2 AC 457 (21) that: “Essentially the touchstone of private life is whether in respect of the disclosed facts, the person in question had a reasonable expectation of privacy.” For this purpose, the courts have devised many (I dare say, non-fool proof, subjective and objective) tests and factors to be considered to wit: (a)whether the information can be regarded as private or public (b) whether disclosure of the information would be highly offensive to a reasonable person of ordinary sensibilities (c) attributes of the victim (d) the nature of victim’s activity intruded or violated (e) the place where the event happened (f) extent, nature and purpose of the intrusion (g) absence of consent and whether it was known or could be inferred (f) effect of intrusion on victim (g) manner of storage or communication or publicity. etc. (See N.A. Moreham, ‘Unpacking the reasonable expectation of privacy test’ L.Q.R. 2018, 134(Oct), 651-674).
For social media, the dynamics are significantly different. While users can claim expectation of privacy over certain information shared with a restricted group of friends, such expectation is not absolute because social media is ordinarily designed for many people to access information shared on such platforms. In United States v. Joshua Meregildo & Others No. 11 Cr. 576(WHP), one of the defendants, Colon, a Facebook user shared messages detailing acts of violence and threatened new violent acts to rival gangs. Although his Facebook account had privacy settings restricting his posts to only friends, during investigation when the police had access to his messages through one of his friend’s account, Colon challenged the access as a violation of his right to privacy. In resolving the issue, the district court in New York ruled extensively that:
“A person has a constitutionally protected reasonable expectation of privacy when they have both a subjective expectation of privacy and that expectation is one that society recognizes as reasonable. Generally, people have a reasonable expectation of privacy in the contents of their home computers. But this expectation is not absolute and may be extinguished when a computer user transmits information over the Internet or by e-mail. Facebook and social media generally present novel questions regarding their users’ expectations of privacy. Facebook users may decide to keep their profiles completely private, share them only with “friends” or more expansively with “friends of friends,” or disseminate them to the public at large. Whether the Fourth Amendment precludes the Government from viewing a Facebook user’s profile absent a showing of probable cause depends, inter alia, on the user’s privacy settings. When a social media user disseminates his postings and information to the public, they are not protected by the Fourth Amendment. However, postings using more secure privacy settings reflect the user’s intent to preserve information as private and may be constitutionally protected.”
On Colon’s reasonable expectation of privacy, the district judge, Pauley William held further that:
“Here, Colon maintained a Facebook profile in which he permitted his Facebook “friends” to view a list of all of his other Facebook “friends,” as well as messages and photographs that Colon and others posted to Colon’s profile. The Government viewed Colon’s Facebook profile through the Facebook account of one of Colon’s “friends” who was a cooperating witness. By that means, the Government learned, inter alia, that Colon posted messages regarding prior acts of violence, threatened new violence to rival gang members, and sought to maintain the loyalties of other alleged members of Colon’s gang. Access to Colon’s Facebook profile formed the core of the Government’s evidence of probable cause supporting its application for the search warrant. Where Facebook privacy settings allow viewership of postings by “friends,” the Government may access them through a cooperating witness who is a “friend” without violating the Fourth Amendment. While Colon undoubtedly believed that his Facebook profile would not be shared with law enforcement, he had no justifiable expectation that his “friends” would keep his profile private. And the wider his circle of “friends,” the more likely Colon’s posts would be viewed by someone he never expected to see them. Colon’s legitimate expectation of privacy ended when he disseminated posts to his “friends” because those “friends” were free to use the information however they wanted—including sharing it with the Government. When Colon posted to his Facebook profile and then shared those posts with his “friends,” he did so at his peril. Because Colon surrendered his expectation of privacy, the Government did not violate the Fourth Amendment when it accessed Colon’s Facebook profile through a cooperating witness.”
From the court’s impeccable reasoning, it is logical to conclude that, once a user shares his personal information on social media, even if restricted to a circle of friends, he cannot justify reasonable expectation of privacy especially where he lacks control over his friends’ use of such information. One must however add here that, there may however be exceptional cases where the facts and circumstances can justify such reasonable expectation of privacy.
Mund argues that even where a social media user has reasonable expectation of privacy, such claims will be negated by two exceptions: (a) third party doctrine – where a user ‘invests’ information with a third party (the platform) and then gives consents to be shared with other recipients (other users) and (b) voluntary consent to social media searches. (See Brian Mind ‘Social Media Searches and The Reasonable Expectation of Privacy 19 Yale J. L. & Tech. 238 (2017). Ultimately, it must however be emphasised that social media users would always have reasonable expectation of privacy against the owners/operators of social media platforms especially along the line of published privacy policies/notices on such platforms. Hence, privacy in the context of social media interactions must be distinguished from the notion of secrecy.
Conclusion
Theoretically, one can(not) share certain personal information and retain control over its use by others to a certain extent. However, especially for personal or household processing of personal data, social media users cannot realistically have reasonable control over the use of publicly available personal information even though in the event of misuse they can be entitled to remedies at law. Technically, there are no straight answers to questions of privacy, every case is determined on its peculiar facts even though the principles keep emerging as technology evolves. Finally, even when a user subjectively expects a measure of privacy on personal contents posted on social media, the factors that determine whether such information remain in the private or public spaces are more objective than dependent on the user’s expectations alone.