Authored by Jenn Behrens, Partner and Executive Vice President of Privacy
The conflict between individual privacy and the explosion of the media’s invasion into personal lives was emphasized over the last several months again through several incidents involving celebrities. First, the public witnessed the release of an athlete’s personal medical records on Twitter and national television earlier this summer. Adam Schefter, a reporter for ESPN, tweeted an image of NFL player Jason Pierre-Paul’s medical records in July of 2015. The image showed the medical details of a procedure resultant from an injury that happened during Pierre-Paul’s private time, and provides explicit information about the procedure and associated identifiers. Making the issue worse, there appears to be another record from a different individual highlighted in the publicized image.
Several issues arise with this incident. First and more narrowly construed, there are clear HIPAA (Health Insurance Portability and Accountability Act) violations by someone in the health system releasing Pierre-Paul’s medical records without his consent. HIPAA was codified in 1996, and further updated and enforced by the passage of the HITECH Act (Health Information Technology for Economic and Clinical Health Act) in 2009 and the final omnibus rule in 2013. Pierre-Paul’s injury occurred during his personal time and not during any official exercise or practice related to his NFL position. The medical care to repair the injury happened with a health care provider, which utilized electronic means of processing the protected health information. Schefter did not have the right to receive the information without the consent of Pierre-Paul, and the healthcare organization providing the treatment had neither the obligation nor the right to release any of the protected health information to the media. The healthcare organization is recognized under HIPAA as a “covered entity” with special restrictions about the distribution and disclosure of medical information to people not performing treatment, operations or payment of health services for Pierre-Paul. Investigations into this will proceed and someone will be held accountable for violating Pierre-Paul’s right to medical privacy.
As the summer came to a close last year, basketball’s Michael Jordan offers another disturbing illustration of media in advertisement and marketing overreaching into a celebrity’s privacy. Specifically, a grocery store was accused of using of Jordan’s name for profit by a grocery store chain. In reaction, Jordan stated that “I felt like it was a misuse of my likeness, my name,” illustrating the disruption of the athlete’s privacy for someone else’s profit. The case was brought before a jury with Jordan highlighting that he felt violated on both a personal and professional level. Jordan emphasized that he needs “to protect my likeness, my image – something I value very precisely.” The misuse of Jordan’s likeness in association with this advertisement without his knowledge, much less consent, is another example of an area of privacy that should be protected.
And, just this past weekend, the privacy of celebrities was again violated through the exploitation of their usage of media. Kim Kardashian West’s physical privacy was jeopardized by malicious actors exploiting her digital information represented on one of her social media accounts. Various personalities have commented on whether Kardashian West invited the attack upon herself by using her media account with such frequency or with such fervor, however this places the fault of the attack back on Kardashian West – which smacks of blaming the victim for the actions of the actual criminals. Kardashian West agreed to share certain parts of her life and information with the public via this media technology – but specifically did not consent or authorize access to or rights to know about her private location. Using a social media account is not an open invitation for physical attacks, regardless of how splashy the content.
These privacy invasions of Jason Pierre-Paul, Michael Jordan, and Kim Kardashian West highlight a new era of privacy concerns that may be even more severe and fundamental to a person’s right to personal privacy than in the past. These cases of gross negligence for the boundaries between personal and private information and public information illustrate our lack of social norms in keeping private matters private. The perceived importance of a media story on an individual’s private life outweighed the right for and intention of Pierre-Paul to keep his personal business private and serves as a prime example of how posting personal information and pictures on social media has become a prevalent practice by media and layperson, alike. The immediacy of potential privacy violations has grown overnight. Privacy scholars and practitioners are now scrambling to keep up in providing a framework of standards and practices for modern technological advances. There is a “new era of privacy risks and legal implications due to new ‘instantaneous’ media publications,” of which we all need to be aware.
Or is this such a modern problem? The above quote is from a journal article written by the renowned attorneys Samuel Warren and Louis Brandeis in December 1890. Warren and Brandeis stated that “the individual is entitled to decide whether that which is his shall be given to the public. No other has the right to publish his productions in any form, without his consent,” which commonly became known as the “right to be let alone” (first termed by Judge Cooley). 125 years ago, the attorneys noted, “instantaneous photographs and newspaper enterprise have invaded the sacred precincts of private and domestic life; and numerous mechanical devices threaten to make good the prediction that ‘what is whispered in the closet shall be proclaimed from the house-tops.’” Over a century later, society has failed to subscribe to a framework to which people minding their own business need not worry over strangers minding it too.
In a time when academics and industry leaders in identity management and in the regulation of protecting personally identifiable information are evolving rigorous applications and codes to address data breaches and broken privacy policies, we should not forget to take a step back in understanding the issue. Privacy may be a complex matter, but it does not have to be an over-complicated one. Jason Pierre-Paul had the right to be let alone the day he was injured, the day he received medical care, and each day forward; he had the right to have his medical records remain private until such time as he wished to announce them. Jordan had the right to be consulted and asked for his permission prior to having his image utilized in a media circulation for the profit of another company. Culturally, we need to remember that every individual has the right to privacy and should not fear the media disrespecting that right to privacy. With this in mind, the media should be held accountable on every occasion when that right is violated – just as Warren and Brandeis held the media accountable to a century ago.
So what is the solution? How is this resolved? We have been struggling with this for over a century and have yet to master the issue. I believe the future of privacy management is in remembering that honoring the privacy of both the everyday and the celebrity citizen is neither fancy nor complicated. We need to remind society that protecting privacy does not have to be relegated to the highly regulated industries. Privacy protections can be simple and not ordained by code or statute. Reporters do not get to post private information on Twitter. Companies do not get to use someone’s name or image without their consent. Victims of robbery do not get to blamed for asking for the assault because thieves decided to attack her in the place where she was residing based on posted pictures of their lives on a socially accepted media outlet. Culturally, we can make that shift with little effort. We can prioritize our value of privacy over the invasive intrusion into someone’s life before it becomes more pervasive or insidious, before it becomes even more common than it already is. We need to remind ourselves as often as is necessary that we all have the basic right to privacy.
