CS406: Information Security

The right to privacy is a subjective right, attributed by objective law. The most obvious branch of objective law that attributes the subjective right of privacy is constitutional law, which often contains a section that aims to protects citizens against overly invasive powers of the state. Historically, human rights initially played out in the vertical relationship between state and citizens, not in the horizontal relations between private parties. The industrial revolution of the 19th century gave rise to powerful economic actors whose ability to infringe privacy, freedom of information and non-discrimination increasingly match the powers of the state.

This has led courts to recognise a so-called horizontal effect of constitutional rights such as privacy. This entails that protection against such infringements is a duty of the state, meaning that citizens can sue the state for failing to impose prohibitions to infringe these rights upon powerful players in the private sector. This is called indirect horizontal effect, because it cannot be invoked directly against private parties. Depending on national jurisdiction, courts may also attribute direct horizontal effect, when qualifying a violation of privacy by e.g. a company as a tortuous act in the context of private law. In that case, violation of privacy can be invoked directly against e.g. a private company.

In many states outside the Council of Europe, the Constitution provides the main protection against infringements of the right to privacy. For instance in the US, even though neither the 1787 US Constitution, nor the 1791 Amendments to the US Constitution (known as the Bill of Rights) explicitly refer to a right to privacy. In the course of the 20th century the Supreme Court of the US has nevertheless interpreted various articles of the Bill of Rights as safeguarding an individual right to privacy, notably based on the IV Amendment:

This Amendment protects against:

• "unreasonable searches and seizures" by the police,
• which require "a warrant"
• that may only be issued in the case of probable cause (concrete and objectifiable suspicion) and
• must contain a reasonably detailed description of what may be searched or seized.

We can read these protections in terms of legal conditions and legal effect, by stating that "searches and seizures" by government officials are only lawful if:

• there is probable cause
• a warrant has been issued
• which contains limitations as to what is allowed

As we have already seen in section 2.1.2 and 5.1.2, the question here is (1) whether this right protects against violation of property rights (trespass) or also against violation of reasonable expectations of privacy that do not depend on property and (2) whether search and seizure of e.g. a mobile phone falls within the scope of the IV Amendment, as a phone is neither part of a person, a house, paper or effects.

In the US, constitutional protection of the right to privacy (which is also "read into" other parts of the Bill of Rights) thus depends on national law, rather than international law. This has consequences for its applicability in the case of those who have no legal status in the US, as it may be unclear whether the Bill of Rights even applies to them. Another consequence is that the enforcement of rights against the state is dependent on that same state. In contrast, the European Convention of Human Rights (ECHR) offers a more layered architecture of legal protection, which is at least in part dependent on a European court that is not part of the state against which it aims to protect.