Frames:
THE RIGHT OF PRIVACY IN FLORIDA IN THE AGE OF TECHNOLOGY AND THE TWENTY-FIRST CENTURY: A NEED FOR PROTECTION FROM PRIVATE AND COMMERCIAL INTRUSION

THE HONORABLE BEN F. OVERTON[*] AND KATHERINE E.GIDDINGS[**]

Copyright © 1997 Florida State University Law Review

I. INTRODUCTION
II. THE CHALLENGE: THE IMPACT OF TECHNOLOGYON OUR PRIVACY
III. THE LAW
A. The Federal Constitutional Right of Privacy
B. The Florida Constitution's Explicit Right of Privacy
1. The Provision's History
2. The Provision Itself
3. The Standard to be Applied
4. Personal Autonomy Cases
5. Disclosure of Personal Information
6. Summation
C. Privacy as a Basis for Tort Action
1. Appropriation
2. Intrusion
3. Public Disclosure of Private Facts
4. False Light in the Public Eye
5. The Privacy Torts in Florida
6. The Privacy Torts and Technological Privacy Invasions
D. Statutory Law
1. Federal Law
2. Florida Law
3. Laws of Other States
4. International Law
IV. SOLUTIONS
A. By Constitutional Amendment
B. By Legislation
C. By Each of Us as Individuals

I. INTRODUCTION

Increasingly, the citizens of this country express concern regarding the need for additional protection under the right of privacy, also known as the "right to be let alone." Recent polls reflect that eighty percent of Americans believe they have lost control over their personal information[1] and that ninety percent favor legislation to provide additional privacy protections.[2] These elevated rates of citizen concern are the direct result of recent sophisticated technological advances, advances which make it both cheap and easy to categorize and to track what was once thought to be private information.[3] To properly examine how to best address these concerns, it is important to understand that Florida is one of the few states in this country to have an express right of privacy in its constitution to protect against government intrusion. Florida's provision provides:

ARTICLE I, SECTION 23. Right of privacy.—Every natural person has the right to be let alone and free from governmental intrusion into his private life except as otherwise provided herein. This section shall not be construed to limit the public's right of access to public records and meetings as provided by law.[4]
Since the provision's adoption in 1980, it has become a significant part of Florida's jurisprudence.

The provision impacts the rights of free press, free speech, and the Florida constitutional and statutory provisions regarding public records and public meetings.[5] It has been used to limit governmental intrusion into both the areas of personal decision-making and the disclosure of private information.[6] All of these interlocking rights and applications have made the right of privacy a true legal chameleon. In the new "age of technology" or "information age" in which we now live, protecting privacy will undoubtedly become even more important to the citizens of this state.

However, it is critical to recognize that this provision protects only against intrusions by the government.[7] It does nothing to protect citizens from intrusions by private or commercial entities. Without question, it is this latter intrusion that will present the greatest privacy challenge in the coming decade and the twenty-first century. As technology develops, more and more methods for assimilating and distributing information will likely become available.[8] As the United States Supreme Court has recognized, an individual's interest in controlling the dissemination of personal information should Snot dissolve simply because that information may be available to the public in some form."[9] Given the current state of technology, as well as the potential for more sophisticated advancements, the time is ripe to consider taking steps that may ensure protection of our privacy into the future. Otherwise, "[p]rivacy as we know it may not exist in the next decade."[10]

To that end, Part II of this Article addresses the concerns and challenges presented to personal privacy in the information age. Part III analyzes the development of federal and Florida constitutional privacy rights as well as civil common law actions for invasion of privacy and statutory protections. Part IV suggests solutions, including a textual addition to Florida's constitutional privacy provision to secure protection from intrusion into private spheres by non-governmental entities.

II. THE CHALLENGE: THE IMPACT OF TECHNOLOGY ON OUR PRIVACY

Who knows about you? What is it that they know? How many "cookies" have you given away today? Technology has made it possible to pry into almost every area of our lives. In his book, 1984, we were warned by George Orwell to watch out for "Big Brother." Today, we are cautioned to look out for "little brother"[11] and "little sister."[12] It is no longer simply intrusion by the government of which we should be wary; it is intrusion by various commercial entities looking to profit from the use of private information as well.

On an almost daily basis, we are confronted with invasions of privacy of which we may be totally unaware. Whenever you use an Automated Teller Machine (ATM) card, purchase something from a store, purchase an airline ticket, rent a movie or hotel room, "surf" the Internet, or simply use a telephone, an electronic record of your activity is generated.[13] All of these activities can be traced and recorded in various databases acting as storage banks of personal information.

For instance, Internet services can now track the "clickstream" of traffic to monitor pages accessed on the Internet.[14] "Cookies" and "mouse droppings" are two methods by which users of the Internet can be traced. Cookies allow an Internet site to store information to a visitor's hard drive so that when the user returns to that site, the site reads the cookie from the hard drive to learn whether the user has previously visited the site.[15] Mouse droppings allow an Internet site to identify who is visiting that site.[16]

Further, through a process called data matching, a compilation of your purchases and activities can be sorted and matched to form a profile on you, listing your personal tastes, buying patterns, and lifestyles.[17] In effect, the information is "digitized, linked, packaged, sold, and re-sold."[18] You can then be targeted by various commercial entities for marketing purposes. As one author has stated, "[y]our name is wanted for databases from the moment you are born: birth is the time to sell to your parents; death is the time to sell to your survivors. The time between the two is the time to sell to you."[19]

Technology has made access to other personal information readily accessible as well. Credit files, driving records,[20] health records, employment files, vehicle registrations,[21] social security information,[22] car rentals, warranty registrations, music club purchases, charitable donations, magazine subscriptions, mail-order catalog purchases, frequent flyer records, detailed financial records, and family structures are also now available.[23] While limited restrictions are placed on the access to some of this information, the information may be obtained with little effort.[24] In his book, Privacy for Sale, Jeffrey Rothfeder outlines in detail just how easy it is to access much of this information.[25] As he explains, for a fee, one can obtain bank records, credit charges, nonpublished numbers, post office boxes, social security earnings, safe deposit boxes, Internal Revenue Service records, and much, much more.[26]

As some in the legal field already know, services such as Westlaw Publishing Group, Inc., will provide access to a seemingly unending amount of personal information. This includes bankruptcy records, lawsuit records, property assessors' records, asset locators, and people finders.[27] In testing this fairly basic database, the following information was obtained on author Justice Overton in less than ten minutes: his full name; the address of his Tallahassee residence; his telephone number; date of birth; and social security number; the same information for his wife; the median income of his neighborhood; the median value of the homes in his neighborhood; the names of ten of his closest neighbors (including their addresses and telephone numbers); and similar information on his condominium in another city. All of the information obtained was correct.

Furthermore, just by surfing the Internet, the authors were able to obtain information from county property appraiser reports detailing property values, square footages, and mortgage values;[28] access credit reports for a fee;[29] obtain telephone numbers and maps of residences for anyone in the country with a published telephone number;[30] and examine, by zip code, who has contributed to federal campaigns.[31]

The possibilities for compiling information are endless. "Smart cards" are being proposed that would contain computer chips with one's health history and other data to assist in emergencies.[32] Microchips containing information identifying pet owners have been placed in household pets.[33] Chips containing health history have, in a few instances, been placed in humans experimentally.[34] "Smart meters" can actually track the type of appliances you use and how often you use them.[35] The continued spread of "automated surveillance systems" will soon mean that every movement on foot and by car may be tracked, day or night.[36] Furthermore, the vast array of electronic communication gadgets with which we outfit ourselves, such as cell phones, portable phones, baby monitors, pagers, personal digital assistants, interactive cable systems, and laptop computers, create other avenues for invasion of our privacy.[37]

Obviously, the age of technology has made our lives easier in many respects. It provides us with useful information at the touch of a button and, for the most part, serves socially useful ends. For example, datamatching can be used to match items such as income tax refund recipients against the names of delinquent borrowers from the student loan programs.[38] It can also provide information regarding the whereabouts of known sexual predators.[39]

However, at some point, the collection of data can become so intrusive that it constitutes what has become known as "data rape."[40] What is to prohibit providing information regarding your personal activities to direct marketers, insurance companies, employers, or credit bureaus? If you rent an erotic "pay-per-view" movie from your satellite dish or cable company, should your employer have access to that information? How much privacy should you expect when you send electronic mail (e-mail) on your employer's computer? Do you have the ability to limit the sale of your personal information by one company to another? Should you have knowledge of the sale so that you can correct erroneous information? How confidential is your medical history and who should have access to that information? As genetic information about individuals becomes identifiable, should that information be available to insurance companies, employers, or even the government?

In essence, it is protection from the secondary use of personal information that poses one of the most difficult challenges. How do we protect against abuse or misuse of personal information collected by an entity for one purpose when that entity sells the information to another entity for one or more unrelated purposes without the consent of the individual about whom that information pertains? Moreover, it is not just commercial entities that are profiting from the sale and exchange of this type of information. During the 1997 legislative session the Legislature contemplated the sale of databases containing public record information for secondary private use.[41] The bill, however, failed to pass the Committee on Governmental Reform & Oversight.

The secondary use of personal information poses many problems for the individual who is the subject of that information. For example, personal information may be incorrect. It is estimated that the level of error in large information databases is between twenty to thirty percent.[42] This is problematic when one considers that this information is considered by employers, businesses, and insurance companies when making employment, credit, and insurance-related decisions. Additionally, inequities may occur when personal information is available for personal use by some but not by others. For instance, in Florida, a state employee's personnel records are public information. The availability of such records can pose a serious problem when, during a divorce, one spouse is employed by the state and the other by a private employer. The privately employed spouse will have ready access to significant personal information that the publicly employed spouse may not.

In the following section, the protection of privacy rights and the law is examined. As discussed below, the concept of privacy protection is a relatively new legal doctrine and currently existing law provides very limited protection in many areas.

III. THE LAW

One of the first references to a right of privacy appeared just a little more than one hundred years ago in Thomas M. Cooley's treatise on the law of torts, wherein Cooley coined the phrase "the right to be let alone."[43] Subsequently, Samuel Warren and Louis Brandeis proposed a right of privacy in an 1890 Harvard Law Review article, written as a result of numerous attacks upon Warren's family in the press.[44] The article traced the roots of the right of privacy back to the common law of England.

However, the privacy protections proposed by Brandeis and Warren were more akin to what is now known as the tort of invasion of privacy.[45] Since the publication of their article, the term "right of privacy" has evolved to encompass three distinct meanings, depending upon the category of privacy law invoked: (1) a federal constitutional right against governmental intrusion; (2) a state constitutional or statutory right against either governmental or private intrusion; and (3) the basis for an invasion of privacy civil action under tort law.[46]

A. The Federal Constitutional Right of Privacy

Although there is no explicit right to privacy in the federal Constitution, the Supreme Court has found a limited, implicit right to privacy in that document. However, it was not until the United States Supreme Court's 1965 decision in Griswold v. Connecticut,[47] that the Court used a substantive due process approach to read an implicit right of privacy into the Constitution to protect a fundamental right.

In Griswold, the Court determined that married couples have the right to use contraceptive devices. In so ruling, the Court noted that the Fourteenth Amendment to the Constitution encompasses various "penumbras" or "zones" of privacy rights, including the First Amendment right to privacy in one's personal associations, the Third Amendment prohibition on the quartering of soldiers in one's home, the Fourth Amendment protections against unreasonable searches and seizures, and the Fifth Amendment privacy right against self-incrimination.[48] The Court then appeared to conclude that, under this collection of rights, there dwells a general right of privacy as well.[49]

Eventually, it became clear that this implicit privacy right protected three types of interests: (1) a person's interest in decisional autonomy on intimate personal matters; [50] (2) an individual's interest in protecting against the disclosure of personal matters;[51] and (3) an individual's interest in being secure from unwarranted governmental surveillance and intrusion.[52]

In matters of personal autonomy, the right of privacy has been limited to a penumbra of rights primarily involving the areas of personal decision making such as marriage, procreation, contraception, family relationships, and the rearing and education of children.[53] Generally, protected autonomy rights may only be restricted if a state establishes a compelling interest for which the restriction is narrowly drawn.[54] The most recent caselaw to generate significant interest in this area is the United States Supreme Court's consideration of a right to "physician-assisted suicide," in which the Court refused to find an open-ended constitutional privacy right to such assistance under either the Equal Protection Clause or the Due Process Clause.[55]

This same penumbra of rights presumably protects against the public disclosure of private matters as well.[56] In providing somewhat superficial protection against disclosure, the Court has balanced the personal right of privacy against the need for governmental intrusion rather than applying a compelling state interest test. The use of this balancing test, however, has provided little, if any, protection in cases brought before the Court.[57] For instance, in Nixon v. Administrator of General Services,[58] the Court determined that limited and controlled disclosure of former President Nixon's presidential papers and tape recordings was not violative of his right to privacy.[59] Likewise, in Whalen v. Roe,[60] after finding sufficient safeguards to protect individual privacy interests, the Court upheld a New York statute that compelled disclosure to the government of names of persons receiving certain prescription drugs.[61] In more recent cases, the Court has discussed an individual's interest in controlling the dissemination of information, but it has done so only in the statutory context of cases involving the Freedom of Information Act.[62]

Additionally, the Court has clarified that the Fourth Amendment protection against certain kinds of unreasonable governmental intrusion is distinct from other types of privacy rights.[63] In specifically distinguishing this right, the Court stated: "[T]he protection of a person's general right to privacy—his right to be let alone by other people—is, like the protection of his property and of his very life, left largely to the law of the individual [s]tates."[64] This holding is extremely important because it grants states the primary responsibility of protecting their citizens against private intrusion. Accordingly, any constitutional protections from intrusions by private persons or commercial entities in the area of informational privacy in this new age of technology will have to come from the states.

B. The Florida Constitution's Explicit Right of Privacy

1. The Provision's History

Given the limitations placed upon the implicit right to privacy against government intrusion contained in the federal Constitution, a few states, including Florida, began placing explicit privacy rights in their state constitutions in order to afford additional protection to their citizens.[65] At the opening of the 1978 Constitution Revision Commission, then Chief Justice Ben F. Overton suggested that the adoption of an explicit right of privacy provision be addressed by the Commission.[66] Subsequently, an amendment securing a right to privacy was drafted, debated, and approved by the 1978 Constitution Revision Commission and placed on the ballot together with a number of other proposed constitutional amendments.[67] The Commission's proposed amendment package was defeated by the people. Nevertheless, interest in the adoption of a privacy provision continued. Two years later, the Legislature, believing that there was still considerable public interest in a privacy provision, enacted a joint resolution to place a privacy provision before the public for a vote.[68] This time the provision was adopted.

2. The Provision Itself

The first sentence of section 23 provides that "[e]very natural person has the right to be let alone and free from governmental intrusion into his private life except as otherwise provided herein."[69] These words provide the courts with specific guidance as to how this provision is to be applied.

First, the provision protects every "natural person." The Florida Supreme Court has concluded that this term extends the provision's protection to all Floridians, even to minors.[70]

Second, for the provision to be applicable, there must be "governmental intrusion." This is crucial to the application of the provision. Confusion exists because some believe that this provision applies to all intrusions against privacy. This language makes it clear that there must be state action before the provision's protections are available. Additionally, this governmental intrusion must be into the "private," not public, life of an individual.

The Florida Supreme Court has determined, however, that an individual is not protected against all governmental intrusion. As the Court stated in the first case in which this provision was interpreted, Florida Board of Bar Examiners Re: Applicant,[71] the rights provided under section 23 are circumscribed and limited by the circumstances under which they are asserted. The court stated that section 23 does not guarantee that there will be no intrusion by government; it simply guarantees against intrusions into areas where an individual has a legitimate reasonable expectation of privacy.[72] For instance, although individuals may possess obscene material in their homes, there is "no legitimate reasonable expectation of privacy in being able to patronize retail establishments for the purpose of purchasing such material."[73] Likewise, the decision to use one's land in a manner contrary to a lawful public environmental policy is not a private act in which one has a legitimate expectation of privacy.[74]

The last portion of the first sentence of the constitutional provision, "except as otherwise provided herein," was added to ensure that there would be no adverse effect on law enforcement by the addition of this amendment. Specifically, the court has recognized that the provision does not modify the search and seizure provision of article I, section 12, of the Florida Constitution, now required to be interpreted in conformity with Supreme Court decisions interpreting the Fourth Amendment.[75]

The final sentence in section 23, stating that the provision is not to be construed to limit Florida's "Sunshine" or open government records and meetings laws, was included to assure that the provision would not be interpreted to limit the existing statutory Sunshine laws.[76] Originally, open records and meeting laws passed by the Legislature did not apply to the judiciary.[77] Nevertheless, the Florida Supreme Court found in Barron v. Florida Freedom Newspapers, Inc.,[78] that a strong presumption of public access to court proceedings and records existed, but concluded that, under certain circumstances, the provision could constitute a basis for disallowing access. Specifically, the court determined that section 23 was applicable where closure of records and proceedings was necessary to avoid substantial injury to innocent third parties, or to avoid substantial injury to a party by disclosure of matters protected by a privacy right not generally inherent in the specific type of civil proceeding sought to be closed.[79] Likewise, in Post-Newsweek Stations, Inc. v. Doe,[80] the court applied this same standard to the disclosure of the names and addresses of individuals contained in a prostitute's client list. The court determined, however, that "[t]he privacy amendment has not been interpreted to protect names and addresses contained in public records," and refused to provide protection to those on the list who were part of the public records of the court proceeding.[81]

In 1992, article I, section 24, was adopted.[82] That provision codified much of the public record and meeting statutes into a constitutional provision and extended government in the sunshine to the records of the judicial branch. Under the exception authority contained in section 24, many of the exceptions to disclosure articulated in Barron and other cases retain protection through Florida Rule of Judicial Administration 2.050.[83] As yet, it has not been determined how the adoption of section 24 will affect cases construing the privacy provision contained in article I, section 23.

3. The Standard to be Applied

The Florida Supreme Court's decision in Winfield v. Division of Pari-Mutuel Wagering[84] set forth the standard to be used in applying section 23. In Winfield, the court stated that the right to privacy under section 23 is "fundamental" and, once implicated, must be evaluated using a compelling state interest standard.[85] The importance of this case cannot be overstated. It clarifies that once an individual has established that government has intruded into a private aspect of the individual's life, government must show that it has a compelling interest to justify the intrusion, and that it has employed the least intrusive means possible to accomplish its objective.[86]

Section 23 has been part of Florida's Constitution for over fifteen years and has generated a significant amount of case law. Essentially, cases construing section 23 can be divided into two categories: those involving personal autonomy and those involving the disclosure of information.

4. Personal Autonomy Cases

Clearly, section 23 has had its greatest effect on Floridians in the area of personal autonomy protection. One of the most important cases under this provision is the decision of In re T.W.,[87] in which the Florida Supreme Court determined that a woman's right to an abortion will be protected under the compelling state interest standard regardless of whether such a right is protected under the Constitution.[88] The court made it clear that even if the Supreme Court were to overrule its decision in Roe v. Wade,[89] which, at the time article 23 was adopted, set forth the principles governing the right to an abortion, the right to an abortion would still be protected under the privacy provision in the Florida Constitution.

Equally as important, section 23 has been read to provide individuals with the right to refuse life-sustaining treatment, including food and water.[90] This is often refered to as a "right to die with dignity."[91] In fact, a Florida district court has determined that a physician who imposes life-sustaining treatment on an individual who has competently rejected such treatment can be held both civilly and criminally liable.[92]

Furthermore, a mother can refuse life-sustaining treatment even if she has small children.[93] Although the court has stated that the right to refuse treatment may be made either orally or in writing, given the inherent difficulties in proving an oral declaration, most individuals today who wish to forego life-sustaining treatment are encouraged to sign "living wills," which provide details, in writing, of their wishes in the face of such circumstances.[94]

However, the Florida Supreme Court recently determined that the right to privacy does not encompass a right to physician-assisted suicide because the state has a compelling interest in protecting life.[95]

5. Disclosure of Personal Information

Although the Florida Supreme Court provides greater protection to individual personal autonomy, it has been somewhat reluctant to do so when the disclosure of personal information is at stake, particularly where the disclosure involves public entities or officials. Prior to the adoption of the privacy amendment, the court was asked to recognize a federal or state right of privacy prohibiting disclosure of personal information contained in applications for high-level government employment.[96] First, the court found that public interest in accessing employment applications to satisfy public accountability outweighed any federal privacy interest.[97] The court then rejected the proposition that Florida's Constitution contained a right of disclosural privacy that would govern these circumstances. [98]

However, even after the adoption of the privacy amendment, the court has been constrained, in light of the specific restriction on public records, to provide protection regarding the disclosure of such information. When such information is not contained in a so-called "public record," the court has been cautious in protecting the disclosure of personal information.

For example, in the City of North Miami v. Kurtz,[99] an individual claimed a constitutional right of privacy protecting her from disclosing whether she was a smoker on a government job application. The government entity involved had a smoke-free workplace and was a self-insurer providing one hundred percent health insurance coverage for its employees.[100] The court held that, under those circumstances, the job applicant did not have a legitimate expectation of privacy regarding the individual's smoking habits, given that individuals divulge such information in almost every area of their lives, such as when renting a car or a motel room, or when being seated in a restaurant.[101]

Likewise, the court determined in Florida Board of Bar Examiners Re: Applicant[102] that the state has a compelling interest in requiring a bar applicant to disclose psychiatric treatment history, and in Winfield v. Division of Pari-Mutuel Wagering[103] that the state has a compelling interest in the need to examine bank records in a pari-mutuel wagering investigation. The court determined in Rasmussen v. South Florida Blood Service, Inc. [104] that confidential donor information concerning an AIDS-tainted blood supply was afforded protection under section 23. Additionally, in Shaktman v. State,[105] the court afforded protection against the use of pen registers[106] without prior judicial approval.

In 1996, the Court was asked in Resha v. Tucker[107] to determine whether a violation of section 23 gives rise to money damages. Although money damages are available in general tort privacy actions,[108] the court declined to reach this issue as it applies to section 23. Thus, the question remains unanswered.

6. Summation

Article I, section 23 affords greater protection from government intrusion than the federal Constitution. The privacy right is explicit, it extends to all aspects of an individual's private life rather than simply extending to some elusive "penumbra" of rights, and it ensures that the state cannot intrude into an individual's private life absent a compelling interest. However, the provision provides no protection from private or commercial intrusion because the present provision is limited to governmental intrusions. As explained previously, we are no longer limited in our privacy concerns to invasions by big brother; the commercial invasions by the private sector may well be the biggest threats to our privacy today.

C. Privacy as a Basis for Tort Action

Many jurisdictions have several methods, not constitutionally based, for bringing civil privacy invasion actions against private individuals and commercial entities. Essentially, there are four types of privacy actions existing in tort litigation separate and apart from the type of privacy at issue under the federal Constitution or article I, section 23 of the Florida Constitution. The four types of privacy actions include: (1) appropriation, involving the unauthorized use of a person's name or likeness; (2) intrusion, involving physical or electronic intrusion into one's private quarters; (3) public disclosure of private facts, involving the dissemination of truthful private information that a reasonable person would find objectionable; and (4) false light in the public eye, involving the publication of facts that place a person in a false light even though the facts themselves may not be defamatory.[109] All of these actions are tied together by the common thread of privacy, but otherwise they have little in common.[110]

1. Appropriation

Appropriation was the first privacy tort recognized by the courts.[111] A plaintiff must show that the defendant appropriated the plaintiff's name or identity for some advantage, usually of a commercial nature.[112] For example, appropriation would occur if a defendant used a plaintiff's name, picture, or other likeness to advertise a defendant's product or to accompany an article sold, without the consent of the plaintiff.[113] To be actionable, the plaintiff must be identifiable, the defendant must appropriate the name or likeness for his or her own advantage, and the appropriation must be without the plaintiff's consent.[114]

2. Intrusion

Intrusion involves "the unreasonable and highly offensive intrusion upon the seclusion of another."[115] An intrusion upon seclusion most accurately represents the right to be left alone.[116] To determine whether an intrusion is actionable, a court must weigh the public interest of releasing the information against the plaintiff's privacy interests.[117] The standard is similar to the constitutional prohibitions against the disclosure of information. Examples of intrusion include the illegal diversion or interception and opening of one's mail, peeping into one's home, the viewing of a department store's changing room by someone of the opposite sex where no adequate notice has been provided, persistent and unwanted telephone calls, wiretapping, or prying into a plaintiff's bank account.[118] To be actionable, the intrusion must be offensive or objectionable to a reasonable person, and the thing intruded upon must be private.[119] Under this tort, a plaintiff can receive damages and/or injunctive relief.[120]

3. Public Disclosure of Private Facts

While closely akin to the tort of defamation, the tort of public disclosure of private facts provides additional relief not normally available through the tort of defamation. For instance, neither truth nor lack of malice is generally a defense to the tort of public disclosure of private facts.[121] The plaintiff must allege that facts were made public that would normally kept hidden from the public eye.[122] Moreover, the facts disclosed must be facts that would be highly offensive to a reasonable person.[123] However, as with the tort of defamation, the court must apply a balancing test and weigh the public interest in having the information made available against the right of privacy.[124]

4. False Light in the Public Eye

False light in the public eye substantially overlaps with the tort of defamation.[125] Generally, an action can be brought for defamation and false light, but recovery can be had only once.[126] The benefit of bringing an action in false light is that the publication must be false but need not be defamatory.[127] To succeed in an action for false light, the plaintiff must prove that the information is false, that there is widespread publication of the information, that the plaintiff is identifiable, and that the information published is highly offensive under the reasonable person standard.[128]

In Time, Inc. v. Hill,[129] the Supreme Court included false light in the constitutional privilege of freedom of the press. Thus, absent a showing that the defendant made the false statements with knowledge of falsity or reckless disregard of the truth, no cause of action will lie.[130]

5. The Privacy Torts in Florida

Florida recognizes the right to sue in tort for the civil wrong of invasion of privacy. In the relatively infamous case of Cason v. Baskin,[131] which involved Marjorie Kinnan Rawlings' book Cross Creek, the Florida Supreme Court held that an action for invasion of the right of privacy was cognizable in Florida.[132] The court, however, emphasized that the right of privacy is limited:

[T]he right of privacy has its limitations. Society also has its rights. The right of the general public to the dissemination of news and information must be protected and conserved. Freedom of speech and of the press must be protected. Section 13 of our Declaration of Rights reads in part as follows: "Every person may fully speak and write his sentiments on all subjects being responsible for the abuse of that right, and no laws shall be passed to restrain or abridge the liberty of speech, or of the press."[133]
In Cason, Zelma Cason sued Rawlings for including Zelma as a character in her book.[134] The court stated that a cause of action would lie if Cason could establish lack of consent and publication of information that would offend a reasonable man.[135] The court also concluded that the information must not be of legitimate public or general interest and that malice was not required.[136] While not specifically identifying the type of tort at issue, the court was clearly addressing the tort of public disclosure of private facts. Since the court issued its decision in Cason, Florida courts have continued to recognize the invasion of privacy torts.[137]

6. The Privacy Torts and Technological Privacy Invasions

Like the constitutional privacy protections, actionable privacy torts rarely involve the type of privacy invasions at issue in the information age. In fact, none of the privacy torts is likely to provide relief for the unauthorized commercial sale or compilation of personal information.

For example, while the tort of intrusion upon seclusion may provide relief in situations where a camera has been placed in a public dressing room,[138] it is unlikely to provide relief to one whose information was taken from a public record or from the voluntary use of a commercial service. Intrusion will not provide relief because the sale or compilation of public information may not be highly offensive or an intrusion into a private matter.

Furthermore, under public disclosure of private facts, the disclosure may be highly offensive but would not qualify as "wide dissemination" because the defendant took the information from a public record or commercial service. Similarly, the disclosure would not qualify under false light in the public eye because, while the information may be false, it has probably not been widely disseminated.

The tort of appropriation might provide more satisfactory relief. Clearly, appropriation evolved to provide protection against the commercial exploitation of one's name or likeness. However, this tort generally provides relief in the area of advertising rather than in the area of data collection and sales.[139]

D. Statutory Law

1. Federal Law

Throughout the last several decades, Congress has enacted a number of laws in an attempt to address invasions of privacy. In 1970, Congress passed the Fair Credit Reporting Act,[140] allowing individuals to inspect and correct their credit records and preventing the disclosure of information to others absent a "legitimate business need."[141] Unfortunately, the exception has almost swallowed the rule; almost anything can be characterized as a legitimate business need. Moreover, credit bureau terminals are now in thousands of sites, including car dealerships, real estate offices, and banks, providing easy access for information resellers.[142] According to one source, no one has ever been prosecuted for illegally obtaining credit reports.[143]

In 1974, Congress passed the Privacy Act,[144] which applies to the protection of federal government records. The Act forbids the federal government from maintaining secret data banks and requires the information collected about U.S. citizens to be kept confidential. However, the Act has been characterized as "horribly botched."[145]

In 1974, Congress passed the Family Education Rights and Privacy Act.[146] The purpose of the Act was to ensure access to education records for students and parents while protecting the privacy of those records.[147]

The Right to Financial Privacy Act[148] was passed in 1978 to prohibit the federal government from examining bank account records without consent or a warrant. Ironically, while tightening federal government access to bank records, the Act purportedly loosened the overall safeguards on bank files.[149]

In 1986, Congress passed the Electronic Communications Privacy Act, prohibiting government and law enforcement from monitoring messages sent via public electronic mail.[150] Like previous privacy acts, this Act contains many exceptions to the general rule forbidding the interception of electronic communication agencies.

The Video Privacy Protection Act of 1988[151] was passed to ban retailers from disclosing the titles of movies rented by customers as a result of the Robert Bork Supreme Court nomination proceedings. However, the Act does not prevent the disclosure of the genre of movies the customer rents.[152]

All of these acts address privacy rights in a fairly piecemeal fashion and all appear to contain a number of exceptions. Additionally, enforcement of these protections is frequently a problem.

Recognizing that further legislation is necessary to provide adequate protection, a number of proposals are currently under consideration. For example, in 1995, the Federal Trade Commission met to examine issues dealing with technology and privacy and has announced that it intends to develop self-regulatory privacy principles for on-line spaces.[153] However, the principles will apparently be voluntary. Furthermore, a number of bills are currently pending before Congress to protect privacy interests,[154] including the Internet Privacy Protection Act of 1997;[155] the Fair Health Information Practices Act of 1997;[156] the Postal Privacy Act of 1997;[157] the Genetic Privacy and Nondiscrimination Act of 1997;[158] and the Commission to Study the Federal Statistical System Act of 1997.[159]

In summary, it is clear that a number of federal laws exist to provide protection in the area of privacy. However, in practice most have not provided much protection.

2. Florida Law

While privacy involving the disclosure of personal information has been at issue on a federal level for some time, Florida has been somewhat less aggressive in this area. The term "privacy" is referenced in at least seventy-two Florida statutory provisions. However, Florida laws provide limited protection because most of the references to privacy are non-substantive, referring simply to protecting the type of personal privacy involved in the taking of a urine test[160] or in the provision of medical care.[161] Additionally, a few, while not specifically referring to the term "privacy," do prohibit the disclosure of certain records. For instance, hospital medical records cannot be released without a patient's consent.[162]

Florida has also codified the common law privacy tort of appropriation.[163] Florida law prohibits the use of one's name or likeness for trade, commercial or advertising purposes. Like the common law tort, the statute is designed to prevent the unauthorized use of a name to directly promote the product or service of the publisher.[164] Because the statute protects the appropriation of private information for the purpose of advertising, the statute will probably not provide any protection for invasions of privacy due to distribution for data matching and marketing purposes. In fact, at least one consumer has attempted to prohibit the sale of personal information by bringing a suit under a similar Virginia statute. [165] Predictably, the suit was unsuccessful.

Additionally, Florida has criminalized wiretapping[166] and telephone harassment.[167] While these statutes may prohibit the monitoring of electronic conversations, they do little to protect against the collection and distribution of information for commercial purposes.

Interestingly, Florida's change of name statute briefly references privacy as a property right.[168] The statutes also reference a right to privacy in deciding whether to register to vote,[169] in creating a taxpayer's bill of rights,[170] and obtaining access to school records.[171] Nevertheless, none of these statutes provide significant protection in the area of privacy. In fact, some statutory provisions specifically protect individuals who provide private information to others. For instance, in the statute governing the cancellation of insurance policies, the statute specifically provides that:

No cause of action in the nature of defamation, invasion of privacy, or negligence shall arise against any person for disclosing personal or privileged information in accordance with this section, nor shall such a cause of action arise against any person for furnishing personal or privileged information to an insurance institution, agent, or insurance-support organization; however, this section shall provide no immunity for disclosing or furnishing false information through gross negligence or with malice or willful intent to injure any person.[172]
Recently, a bill entitled "An act relating to information management"[173] was proposed to allow companies to obtain information belonging to Florida's governmental entities, which the companies could then use for commercial purposes. The bill would have created a new Florida Information Council and would have dramatically changed how the public gains access to electronically formatted information.[174] Because the bill allowed the information to be accessed for a fee based on market rates, the bill would have commercialized public records.[175] Fortunately, the bill died in committee. It reflects, however, the need for added protections against such laws in the future. In sum, Florida laws, both present and proposed, generally provide even less protection than that afforded through federal laws.

3. Laws of Other States

Like Florida, many states have yet to adopt laws to address the protection of informational privacy in the age of technology. While some are considering such laws or have established committees to study the issue, most of the existing or proposed laws are limited to the realm of information collected by governmental agencies. For instance, Wisconsin created a joint committee on information policy to review information management and technology systems, plans, practices, and policies of state and local governments, including the "protection of the personal privacy of individuals who are subjects of data bases of state and local governmental agencies and their provision of access to public records."[176]

Interestingly, since 1977 Californians have been protected by the Information Practices Act,[177] which states:

The Legislature declares that the right to privacy is a personal and fundamental right protected by Section 1 of Article I of the Constitution of California and by the United States Constitution and that all individuals have a right of privacy in information pertaining to them. The Legislature further makes the following findings:

(a) The right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies.

(b) The increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.

(c) In order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits.[178]

Unfortunately, the term "personal information" is defined as "any information that is maintained by an agency."[179] Thus, as in Florida, the provision does not provide relief for personal information collected by non-governmental entities.

Minnesota recently had the opportunity to become the "first [state] in the nation to broadly regulate the use of 'personally identifiable information' via online services."[180] A bill considered by the 1996 Minnesota Legislature would have limited the information online services could collect and would have prohibited the disclosure of that information absent consent of the consumer.[181] The bill was not enacted.

4. International Law

Although attempts at providing information privacy protection in the United States have been relatively piecemeal and somewhat limited, international efforts have been more successful. Europe has developed the European Union Directive on the Protection of Personal Data.[182] This directive will become effective in 1998 and comprises a framework of individual rights and information practices. The directive includes fair information practices, requires data subjects to be given notice of the processing of their personal information and an opportunity to decide how that information will be used, provides the right of access to personal data, and provides for judicial remedies and the right to compensation for violations.[183] Because the directive also places restrictions on the transfer of personal information from European countries to jurisdictions that lack adequate levels of privacy protection, participants in a Federal Trade Commission study have indicated that it may have an adverse effect on the flow of information between the United States and other countries.[184]

The Organization for Economic Cooperation and Development has also developed an internationally recognized set of privacy principles known as the Code of Fair Information Practices.[185] These principles are as follows:

Only the information that is really needed should be collected.

Where possible, it should be collected directly from the individual to whom it pertains (the data subject).

The data subject should be told why the information is needed.

The information should be used only for the intended purpose.

The information should not be used for other (secondary) purposes without the data subject's consent.

Data subjects should be given the opportunity to see their personal information and correct it if it's wrong.[186]

Likewise, the Canadian Standards Association has developed a set of privacy principles that provide guidelines promoting accountability and consent.[187] These guidelines are voluntary and provide no mechanism for enforcement.

However, Quebec has adopted mandatory privacy legislation, making it the first jurisdiction in North America to extend the right of privacy from the public sector to the private sector.[188] Quebec's legislation, an Act Respecting the Protection of Personal Information in the Private Sector, became effective January 1, 1994. The Act applies to almost any type of information, requires clear and understandable opt-out provisions for consumers, and provides investigative and dispute-resolution powers to a commission.[189]

IV. SOLUTIONS

Florida has long been a proponent of government in the sunshine and access to public records.[190] The policy reasons for openness rest in the essential principle that the people have a right to governmental accountability.[191] Thus, information collected and used by the government must be accessible to the public. The Access to Public Records and Meetings provision of the Florida Constitution firmly protects that right of access. Nonetheless, the assurance of adequate governmental accountability and fundamental rights of openness should not force the citizens of Florida to forfeit the protection of their personal information from being used for secondary commercial purposes.

While both federal and international laws may soon force greater recognition of technological privacy concerns, Florida should take the opportunity now to provide its citizens with stronger privacy protections. Clearly, privacy concerns in the age of technology are in their infancy and legislation to protect those concerns is in "an evolutionary state."[192] Equally clear is the fact that informational privacy is not adequately protected. The question is: what can be done?

A. By Constitutional Amendment

First, while our constitution does contain an explicit privacy provision to protect individuals against government intrusion, the provision should be expanded to include the right to be let alone and free from private intrusion. This is an appropriate subject for consideration by Florida's 1998 Constitution Revision Commission. In addressing the 1998 Commission, Justice Overton specifically recommended that the Commission address this issue. However, the authors recognize that crafting an amendment that will provide adequate protection to individuals and yet be flexible enough to accomodate technological advances will present a challenge to the Commission. To that end, the authors suggest that the Commission restructure the current amendment and insert language that will protect individuals against private intrusion. For example:[193]

<BLOCKQUOTE>RIGHT OF PRIVACY.&EMDASH;< R> (a) Every natural person has the right to be let alone and free from governmental intrusion into his or her private life except as otherwise provided herein.

(b) Every natural person has the right to be let alone and free from non-governmental intrusion into his or her private life except as provided by law.

(c) Nothing in Tthis section shall not be construed to limit the public's right of access to public records and meetings as provided by law.

B. By Legislation

Second, protective statutory provisions should be considered by the Legislature. For instance, legislation could be enacted that encompasses the principles set forth in the Code of Fair Information Practices and the Canadian Standards Association's Privacy Principles.[194] At a minimum, legislation should allow consumers to correct and update personally identifiable information, require services to explain how and why they gather information and what information is being gathered, restrict the disclosure of customer-related information to third parties without permission of the customer, and prohibit governmental entities from selling personal information for secondary commercial purposes.

C. By Each of Us as Individuals

Finally, it is important to understand that government alone cannot protect us from ourselves. Each of us has an individual responsibility to do whatever possible to provide the privacy protections that each of us desires. We should know and understand what can be done to protect our privacy. Government, whether by rule, statute, or constitutional provision, cannot do it all. In his book entitled Protect Your Privacy on the Internet,[195] Bryan Pfaffenberger makes many recommendations about what individuals can do. For example, he suggests that Internet users create bulletproof passwords. This can be designed by using the first letters of words in a sentence that is easily remembered and interspersing numbers throughout the letters.[196] Pfaffenberger further recommends that users research the privacy protections provided by their Internet service provider. This information should be made available before making a decision to choose or change a provider.[197] He also suggests the use of software that prevents children from giving out personal and family information to Internet groups and websites.[198] Pfaffenberger urges users to think twice about filling out registration forms, particularly when they do not know how that information is going to be used.[199] He suggests encrypting sensitive files and e-mail, and notes that by mid-1997 the software should be readily available.[200] He adds that users should use software specifically designed to delete unwanted files and browser trails.[201] Pfaffenberger also asks users to consider disabling the cookie trails they leave or to use a cookie-less browser.[202]

Additionally, in their book Who Knows: Safeguarding Your Privacy in a Networked World, authors Ann Cavoukian and Don Tapscott suggest the following "privacy tips":

1. Question why you are asked for information.

2. Give only the minimum information required.

3. Ask why the information is needed.

4. Challenge the sale, rental, or exchange of your personal information to third parties for secondary uses.

5. Ask to be opted-out of a direct mailing list.

6. Beware of special offers.

7. Pay with cash whenever possible.[203]

In sum, each of us should use these and other steps to protect our own private information. Additionally, the passage of a constitutional amendment similar to that proposed here, along with the enactment of appropriate legislation, should create a balance between the legitimate need to obtain personal information and the violative procurement and use of personal information. In closing, we leave the reader with a final thought.

[U]ntil lawmakers make some fundamental changes about who can sell what to whom, it seems unlikely that the tide of personal information washing up on the Internet's shores will be stemmed. And in the process, much of the privacy we've enjoyed because it was simply too inconvenient to invade it will be eroded. Welcome to the information age.[204]