Adding Privacy to the Constitution

Legislation can't keep up with the myriad ways technology allows our personal info to be misused. Only an amendment can protect Americans

By David H. Holtzman

Supreme Court Justice Louis D. Brandeis described privacy as the right "to be left alone." In subsequent decisions throughout the 20th century, the judiciary expanded this definition in limited ways, mostly based on the Fourth Amendment. But the primary fight for privacy doesn't take place in the courts. Congress has been the battlefield.

Americans generally think of the the legislative branch as the champion of privacy issues, but it has been, and will forever be, powerless to do so in a meaningful and pervasive way. The reason: technology.


  Legislation moves in a linear process. It has its own pace and tempo, and God help whoever tries to rush it. Newcomers to Washington are astonished by how much time it takes to craft, draft, and pass a bill. It can be years.

The pace of technological innovation is geometric. Actual research also takes years, but most of the high-tech advances that affect our lives are changes to existing products -- innovations not inventions. The legislative machinery of Congress cannot keep up with the tempo of those innovations.

Examples of this abound. For more than a century, patrons of the U.S. Postal Service have enjoyed the benefit of laws protect them from fraud and mail tampering. However, e-mail users don't have that same shield -- and probably never will. This same problem exists today for land lines and cell phones, and almost certainly will apply equally to emerging technologies like voice over IP (VOIP).

So why can't an enlightened future Congress just pass bills remedying this deficiency? They can, but all it would take is a tweak of the target technology to emasculate most such laws. Legislation is only effective when narrowly drafted, targeting a specific, well-understood problem. The judicial system abhors ambiguity -- legal vagueness equates with legal impotence.


  The government's current approach consists of industry self-regulation through trade groups like TrustE or by voluntary use of privacy policies. All you have to do is read the newspapers to see that that approach is not working. In the first half of 2005, half a dozen major privacy breaches have already taken place.

Recently, Citigroup (C ) disclosed that it lost a box of computer tapes containing financial information of almost 4 million customers. Lapses also occurred this year at Time Warner (TWX ), Lexis/Nexis, Bank of America (BAC ), and the credit bureau ChoicePoint (CPS ), which unknowingly sold 145,000 customer records to a criminal enterprise.

The difficulty in legally protecting identity data is that it's so darn useful. Institutions find personal information critical for several reasons. Industry needs to convert customers into demographic categories for targeted direct marketing. The government wants to prevent another terrorist attack like September 11. Doing so requires a technique called predictive intelligence. This kind of data-mining requires huge amounts of seemingly trivial information on everyone, citizens and visitors alike, including travel, buying habits, and social-communication patterns.


  The needs of commercial interests and national security are antithetical to a citizen's desire to be left alone. It's naïve to expect either institution to voluntarily respect personal boundaries. It's unlikely that Congress will ever pass significant legislation curtailing the information-gathering efforts of either group because of the implied threats of economic disaster or terrorist attack.

The solution is to guarantee the right to privacy to all citizens by amending the Constitution, which has no such safeguard today. In fact, the word privacy is never mentioned in the document, even in an amendment.

Why do we need additional Constitutional protection for privacy? America has a long history of protecting intangible principles that are important to us, like freedom of speech, religion, and the press. We do this by incorporating these values into our holiest secular document -- the U.S. Constitution. This permits the courts to decide what's contextually appropriate.


  The lack of a Constitutional mention of privacy relegates its defense to lawyers and legislators who are free to define it in any way that suits them and their constituents. It might be nearly impossible to jump all the required hurdles in Congress and the states' legislatures to make this addition to the Constitution happen, but these days people are campaigning for amendments for far less important issues.

Absent a Constitutional change, I know what's going to happen. The scandals and violations will accumulate until privacy becomes a national joke and enters the popular culture -- i.e., when The Daily Show host Jon Stewart starts talking about it on TV. At that point, the vox populi will be screaming loudly enough for even Congress to hear.

But it will be too late because, by then, we'll have multibillion-dollar industries like advertising, direct marketing, and defense contracting as dependent on invasive personal information as a dung beetle is on -- well, dung.

Holtzman is the former CTO of Network Solutions and the editor of, a blog that explores social changes brought about by information technology

Before it's here, it's on the Bloomberg Terminal.