Pierre Trudel

Privacy Protection on the Internet: Risk Management and Networked Normativity

In cyberspace’s present form, particularly with respect to Web 2.0 applications, the conditions in which personal information circulates have changed. The Internet is now encompassing almost all aspects of social life. Yves Poullet observes that the Internet promotes dual globalisation: first, with respect to the international aspect of networks and their convergence and, second, with respect to the fact that all activities are transformed into digital information.1 Given such globalisation,2 simple exegesis of state law will not suffice to describe the legal framework protecting privacy in cyberspace. Despite the global nature of the network, assessments and values are different in the various cultural milieus in which rules apply.3 Some phenomena modulate accepted norms and prevent their application across the network. Such phenomena prevent application of rules that could be taken out of context with respect to the situation or cultural substrate in which they apply. One such phenomenon seems to be legal risk: stakeholders’ assessment of the concrete possibility that a statute or other rule will be applied to their activities explains why, though the Internet is a global network, no one feels complied to obey all pieces of national legislation that could in theory apply.4 Philippe Amblard notes that a characteristic of Internet regulation is that the normative process is multifaceted, which tends to promote the social effectiveness of

La protection de la vie privée dans les réseaux: des paradigmes alarmistes aux garanties effectives

RésuméIl faut actualiser les approches afin de protéger effectivement la vie privée dans les réseaux. Le cadre juridique doit assurer la dévolution des efforts conséquents à l’égard des informations personnelles présentant des enjeux significatifs pour la vie privée. Il faut recentrer le cadre juridique de manière à accroître les garanties de qualité de l’information utilisée pour prendre des décisions. Dans l’univers des réseaux, l’information est persistante et circulante. Tenter d’en empêcher la circulation au cas où elle serait mal utilisée est une approche de plus en plus onéreuse et de moins en moins efficace.Le ciblage défectueux du droit de la protection des données personnelles affaiblit la protection de la vie privée des personnes. Les approches actuelles nient la légitimité de la circulation de certaines informations dans les espaces publics. L’extension indue du principe de finalité porte à privilégier une protection purement formelle des données personnelles en imposant des barrières artificielles et tatillonnes à la circulation de l’information sans gain pour la protection de la vie privée. Devant les rigidités découlant de ces interprétations abusives, tant les administrations que les législateurs ont été amenés à recourir à des expédients comme le développement de pratiques de gestion du consentement et on a multiplié les lois d’exception, affaiblissant ainsi la protection des données personnelles. Pire, on a négligé de rendre plus efficace les règles à l’encontre des pratiques vraiment attentatoires à la vie privée en négligeant l’application effective des lois sur la protection des données.La modernisation effective du droit de la protection des données personnelles passe par une relecture critique des applications qui en a été faite et une évaluation lucide des contextes dans lesquels circulent désormais les informations. Ce serait affaiblir le droit à la vie privée que de se réfugier dans une frileuse défense des mécanismes formalistes hérités des époques antérieures puisque cela accroît les risques d’une protection de plus en plus factice.AbstractActualization of legal approaches are needed to protect effectively the right of privacy. In network environments, data circulates and it is persistent. Trying to prevent misuse by hindering circulation is less and less effective. Legal framework must be reframed in order to improve guarantees of quality of information used to take decisions about individuals. In network universe, information is persistent and circulating. Trying to prevent information circulation just in case that it would be misused is a costly and inefficient approach.Privacy protection is weakened by faulty targeting of privacy law based on approaches prevailing in the 1970s and 1980s. Those approaches deny that it is legitimate for some information to circulate in public spaces, but do not provide effective protection for information truly relevant to privacy. The risk of ending up with a set of rules incompatible with the requirements of government seems sufficiently serious to justify assessment of the current legal framework and approaches that could increase its effectiveness.Given the inflexibility resulting from inappropriate interpretations, both government officials and legislators have had to resort to expedients, such as consent management and legislation establishing exceptions, thereby weakening protection for personal information. Worse, by paying little attention to effective enforcement of privacy legislation in situations where there is great risk of violation, we have failed to strengthen regulations against practices that truly invade privacy.Effective modernization of privacy legislation requires a critical rereading of the legislation’s foundations and how it has been enforced. This demands a lucid evaluation of the contexts in which information circulates. We will only weaken privacy rights if we take refuge in a faint-hearted defence of formal mechanisms inherited from earlier times. If we take that approach, we will increase the risk of ending up with ever more illusory protection.