Individuals have long had the desire but little ability to control the dissemination of information about their health. Law has been a weak instrument for such control, given the articulate and powerful interests that insist upon maintaining and enhancing access to others' personal information, with access to sensitive medical data proving only a sporadic exception. Technology has so far only made exploitation of personal information easier. The evolving federal framework for the protection of medical records likely will make individuals the third-party beneficiaries of flexibly interpreted, ponderously enforced fair information practices created in the shadow of a congressionally mandated networking of sensitive medical data. This networking promises to lower greatly the costs of accessing and using medical data for any number of purposes--including ones not central to health care, such as direct marketing. It is ushering in what some call the "Era of Promiscuous Publication."(1) The danger this era portends is that what is gained in efficiency of health care provision may be lost in erosion of privacy. Privacy advocates could learn a new approach to this problem from an unlikely teacher: publishers of intellectual property--specifically the American music industry.
The music industry until recently feared ruin from the unauthorized swapping and rebroadcasting of high-quality audio reproductions among its customers, a phenomenon enabled by increasingly cheap networks, cheap data storage, and cheap processors--again, the Era of Promiscuous Publication. Despite access to a sympathetic Congress and extensive enforcement resources, the music industry has found recourse to law largely unavailing against this tide of technological progress. The industry is now embarking on a different strategy--changing the technology itself. At the core of the technological response lies the idea of "trusted systems": computer databases of the rights and privileges of specific entities vis-a-vis information, linked to hardware and software that recognize and enforce those rights. If fully deployed, trusted systems could trump the Era of Promiscuous Publication with what I call an "Era of Trusted Privication": one in which a well-enforced technical rights architecture would enable the distribution of information to a large audience--publication--while simultaneously, and according to rules generated by the controller of the information, not releasing it freely into general circulation--privication.
In my view, there is a profound relationship between those who wish to protect intellectual property and those who wish to protect privacy. Their common desire to control the distribution of information, and the music industry's potential success at regaining control through the implementation of trusted systems, offer several lessons to privacy advocates seeking to protect the privacy interests increasingly threatened by the advent of the Era of Promiscuous Publication. I will explore these lessons first by mapping out the problem presented to the music industry by the advent of fast, cheap, and perfect copies, along with the music industry's legal and technological strategies for regaining control. Second, I will describe the similar problem faced by privacy advocates in the arena of medical privacy, the legal solutions that have been and might be attempted, and a hypothetical technological solution that demonstrates the enforcement power of the trusted system. Finally, I will look beyond the enforcement potential of the technological solution to demonstrate how thinking in terms of privication architectures might help negotiate the allocation of rights to medical data to account for the interests of individual "producers" of personal data in ways that need not disparage the legitimate interests of the sophisticated institutional players who wish to consume that data.
THE MUSIC INDUSTRY: A TRAJECTORY OF INTELLECTUAL PROPERTY WORRIES--AND RESPONSES TO THEM--IN A DIGITALLY NETWORKED ENVIRONMENT
A New Problem: Quick Cheap, Perfect Copies
John Perry Barlow threw down the gauntlet to those representing intellectual property interests on February 8, 1996 in "A Declaration of the Independence of Cyberspace":
Your increasingly obsolete information industries would perpetuate themselves by proposing laws, in America and elsewhere, that claim to own speech itself throughout the world. These laws would declare ideas to be another industrial product, no more noble than pig iron. In our world, whatever the human mind may create can be reproduced and distributed infinitely at no cost. The global conveyance of thought no longer requires your factories to accomplish.(2) The information industries did not need Barlow's help to know fear. The initial consumer boom of the World Wide Web in the mid-nineties spurred widespread and grave concern among authors and publishers--and study among commentators--about a loss of intellectual property protection. The Net featured perfect, cheap, anonymous, and quick copying of data; these features and their implications were not lost on wary publishers any more than they were on cyberenthusiasts.(3) As one commentator who identified with the publishers summarized, "[O]n the internet, copying can take place without limits, without visibility, and without cost to the copier; a formula that spells disaster for authors to control use of their works."(4)
In an essay portending massive challenges to copyright law from the Net--if only because merely viewing information online entails, as a technical matter, making a copy of it--David Post retells the story of three eras of publishing, the latest ushered in by the internet:
Era of Monastic Manuscript: Copyright unnecessary to authors or publishers Era of Gutenberg Press: Copyright necessary to authors and publishers Era of Promiscuous Publication: Copyright enforcement doubtful.(5) Before the widespread embrace of the internet, the shape given intellectual property law by Congress and courts had, along with selective public and private enforcement levels; led to a coarse detente among authors, publishers, and consumers of intellectual property.(6) This status quo countenanced some level of possibly illegal copying in the world; after all, no law is perfectly enforced. The situation was tolerable, and some even suggested that copying, legal or not, aided authors. A little copying on the margin could be a form of "try before you buy," a means of building reputation or "mindshare,"(7) or even an efficient means of price discrimination--selling at least one copy of a work to a group of related consumers who would not individually buy it at full price.(8)
The growth of the Net raised the level of copying exponentially, since it made copying so much easier, the possibility of detection, prosecution, and punishment so much more remote, and successive generations of copies as perfectly copyable as originals.(9) Further, few cultural barriers stood in the way of consumers taking advantage of the situation; the norm against copying--especially electronic copying--was and is not as strong, say, as the norm against stealing.(10)
Nowhere is this illustrated so vividly as with the popular music industry. Within the past two years, consumers have gained access to, and begun to embrace, technologies that allow them to copy music sold on compact discs perfectly. (11) The entertainment industry has considered this a mortal threat,(12) one that has become particularly acute with the increasing popularity of "MP3" audio compression, a standard that compresses digital music into a package small enough that users can ship music around the internet without straining their local bandwidth.(13)
The vernacular of music sharing does some justice to the oft-invoked "piracy" label: Thanks to MP3 compression and the software built around it, a single person can obtain a music CD, "rip" its tracks onto her hard drive,(14) and then "burn" them onto a new blank CD, email them to friends, or even set up a "SHOUTcast" station, broadcasting music live to anyone on the Internet who cares to listen.(15) Testifying before Congress in late 1997, the general counsel of the Recording Industry Association of America put it quite starkly and with only slight exaggeration: "Today, one individual, in less time than it takes me to read this testimony, can send a full-length album to more than fifty million Internet users."(16)
The publishing industries initially responded by using their political power to broaden and strengthen the scope and application of legal protections against unauthorized copying of their works. However, as it became clear that the problem would not be overcome by additional difficult-to-enforce legal rules, the music industry turned to technology backed by law as a more promising avenue for redress. An examination of each of these types of responses, legal and technical, yields possible ways that privacy advocates can ultimately benefit from the lessons of the music industry's experience.
Solution 1.0: Buttressing Copyright and Contract
Those who worded about the Net's effect on intellectual property were not idle; as a first step, they called for--and in many cases got--a strengthening of intellectual property laws and public enforcement to counter the sea change in information-sharing abilities wrought by the Net. (17) Some of these provisions were specifically designed to increase penalties for copying using electronic means.(18) The music industry in particular sought to protect itself by making extensive use of the private right of action for federal copyright violations.(19) The existence of this right presumably helps to prevent at least some forms of open, static, and notorious music piracy from taking place through the World Wide Web. Even in a crowded domain name space,(20) no one has dared to reserve, much less place content within, say,
or... .(21) At