secondary students online and the expectation of privacy

8/8/2019 Secondary Students Online and the Expectation of Privacy

1/21

LAWPUBL 744 Research paper

Secondary Students Online and theExpectation of Privacy

Simon Bridge

July 21, 2010

Abstract

Secondary School students are experimenting with the boundaries of

social networking in the information age. Their expectations surrounding

the use of the information they publish online in various forms. These

expectations do not always mesh well with actual legal protections. The

law itself struggles to keep up with this rapidly changing, technology-

driven, sphere.

Recent research in the social sciences suggests that there has been a

shift in the expectation of privacy from secrecy to control, lead by the

popular use of online social network sites by teenagers. This leads to a

re-reading of the way privacy laws are understood and used which is not

entirely at odds with historical interpretations.

This paper attempts an examination of the implications of this emerg-ing social phenomenon in the context of compulsory, government funded,

secondary school education in light of existing and emerging law.

Introduction

Ours is a technological age in which students send text messages,create online personal profiles or blogs, download videos or chatonline, using the Internet and other technologies in their everydaylives, for education, social contact and fun - as do teachers. Withinformation and communication technology now widespread it is notsurprising that it and the legal, professional and ethical concerns that

go with it are making their way into schools and classrooms.1

The trickiest legal and technical issues facing school administrators, students,parents and lawmakers, involve privacy. As much as we are in a technologicalage, we are in an information age. The ease of access to information occasionedby widespread information technology also provides more and easier opportuni-ties to become entangled in privacy disputes.

Privacy is the idea that confidential personal information disclosed in a pri-vate place will not be disclosed to third parties, when that disclosure would

1Techno nightmare : legal issues for teachers and schools. Forde L, Stockley R: Teacher;n.202 p.48-51; June/July 2009

1


2/21

LAWPUBL 744: Privacy and Students S. D. Bridge

cause either embarrassment or emotional distress to a person of reasonable sen-

sitivities.Speaking at the Crunchie awards in San Francisco in January (2010), Face-

book Chief Executive Mark Zuckerberg declared the age of privacy to be over2

. He says the rise of social media sites indicate a change in attitudes towardsprivacy issues online and cites his own companies ability to weather privacydisputes with its services intact.

A month earlier, Google Chief Eric Schmidt expressed a similar sentiment3

when interviewed by CNBCs Maria Bartiromo.

If you have something that you dont want anyone to know,maybe you shouldnt be doing it in the first place.

Kinder viewers4 suggest that he misspoke himself, and should have said that

what you shouldnt be doing is broadcasting the information on the Internet.Add to this Sun CEO, Scott McNeallys

You have zero privacy anyway . . . Get over it.5

. . . and Oracle CEO, Larry Ellisons

The privacy youre concerned about is largely an illusion.6

. . . in 1999 and it appears that industry insiders have been observing a decline inthe desire for and thus the expectation of privacy in popular online culture formany years. It appears reasonable to ask if privacy is even relevant in the era ofubiquitous access to information. Perhaps social media companies are justifiedin adopting the position that privacy does not matter to their customers?

Security Guru Bruce Schneier criticized this position for being self servingand just flat wrong7 . He suggests that peoples privacy expectations have notdiminished but changed. Privacy has traditionally meant secrecy, he says, whilethe modern Facebook user considers it to be about control.

His observations are supported by Dana Boydes research into the expecta-tions of teenagers online.

Fundamentally, privacy is about having control over how infor-mation flows8 .

2Johnson, B. (2010) Privacy no longer a social norm, says Facebook founder. GuardianUK, Monday 11 January. available from http://www.guardian.co.uk/technology/2010/jan/11/facebook-privacy

3cited in Tate, R. (2009) Google CEO: Secrets Are for Filthy People. Gawker.com . avail-

able from http://gawker.com/5419271/google-ceo-secrets-are-for-filthy-people4see comments to Tate (2009) (above)5Sprenger P. (1999) Sun on Privacy: Get Over It Wired December 6, 1999 available from

http://www.wired.com/politics/law/news/1999/01/175386in an interview for TV station KPIX in San Francisco (Sept. 21, 2001) cited in Black J.

(Oct. 4, 2001) Dont Make Privacy the Next Victim of Terror. Businessweek. available fromhttp://www.businessweek.com/bwdaily/dnflash/oct2001/nf2001104_7412.htm

7Schneier B. (2010) Google And Facebooks Privacy Il lusion Forbes.com April 6. available from http://www.forbes.com/2010/04/05/google-facebook-twitter-technology-security-10-privacy.html

8Boyd, Dana. (2010) Making Sense of Privacy and Publicity. SXSW. Austin, TX, March13.

2


3/21


Privacy rights are an emerging area of law. Historically it has been a simple

matter to assure privacy. For instance, one retires to a private room such asan office or a phone booth. Social conventions have evolved around privacypractices such as hanging do not disturb on the door-handle or placing a sealon an envelope. Technology has muddied the issues by increasing the ease andopportunity to eavesdrop on private conversation, and make records of them.This could be through wiretaps, microphones, and cameras to Internet databasesavailable online.

In the Internet world, any information is recorded hundreds, if not thou-sands, of times just because of the way computers work. Keeping one or moreof those records is a trivial act. Such wholesale record keeping used to producea mountain of documents that would challenge the most dedicated researcherbut modern computers make searching out information of interest as trivial aprocess as collecting it in the first place.

The easiest method to keep information confidential is not to make the recordin the first place, but this is usually considered to be unreasonably extremein that it is anti-social as it forces a person to be a recluse, and restricts theexercise of fundamental human rights by denying a person medical care, financialassistance, recourse to the justice system and so on. Of particular interest hereis the right to a free public education.

1 United States: Federal Law

The right of privacy is historically restricted to individuals in circumstancesthat a person would reasonably expect to be private. There is no protection for

information that either is a matter of public record or the individual concernedvoluntarily disclosed in a public place. People should be protected by privacywhen they

believe that the conversation is private and can not be heard byothers who are acting in an lawful manner.9

The quoted article is concerned with wiretapping but the basic concept of aprivate conversation could be extended by analogy to include other forms ofcommunication. The main difference with Internet-mediated conversations isthat the record already exists as a matter of course, where wiretapping legisla-tion refers to the creation of the record in the first place.

The debate, therefore, tends to center on what can be done with the record.A recorded conversation, in the above case of a wiretap, may not be admissibleas evidence in criminal proceedings.

United States legal thinking on privacy is founded in the right to be leftalone, as expressed in a dissenting opinion to Olmstead v. U.S. 10 . In thisdissent, Justice Brandeis asserts that this right is

the most comprehensive of rights and the right most valued bycivilized men. To protect that right, every unjustifiable intrusionby the government upon the privacy of the individual, whatever the

9Am.Jur.2d Telecommunications 209 (1974)10277 U.S. 438, 478 (1928)

3


4/21


means employed, must be deemed a violation of the Fourth Amend-

ment. And the use, as evidence in a criminal proceeding, of factsascertained by such intrusion must be deemed a violation of theFifth.

The fourth amendment covers search and seizure while the fifth is the rightto avoid self-incrimination. Law enforcement violated the fourth by seizing, bymaking, a record of the defendants private conversation and the fifth since thedefendants own words were used to incriminate him when he had not waivedhis right to remain silent.

A 1950 majority opinion observed that the right to be left alone

is not confined literally to searches and seizures as such, butextends as well to the orderly taking under compulsion of process11

The decision in Olmstead was eventually reversed in Katz v. United States 12

, explicitly addressing the nature of the right to privacy. The supreme court, inthat case, held that physical intrusion into a private place was not necessary foran invasion of privacy to have taken place and that an invasion of privacy canconstitute a search and seizure under the fourth amendment where a reasonableexpectation of privacy exists.

Justice Black dissented in that case, which essentially involved eavesdroppingone side of a phone conversation by means of a microphone taped to the outsideof a phone booth. Black argued that eavesdropping being around at the timethe Constitution was written, had the makers intended the fourth amendmentto cover it, they would have included the appropriate language.

While it is easy to see how the microphone could be seen as analogous to

pressing ones ear against a wall to listen to a conversation taking place on theother side, it is not so clear how this analogy would apply to the world ofcomputer networks and Internet mediated conversations. This question is leftfor later, when the different kinds of Internet privacy are considered.

An important corollary to the majority decision, though, is that a reasonableexpectation of privacy is to be indicated by the steps taken to assure thatprivacy. In this case, closing the phone booth door and paying a toll. The stepsdo not have to be foolproof or even effective in light of surveillance methods thatmay be used, so long as the belief that the conversation will not be broadcastto World is a sensible one.

1.1 Privacy Torts and Statute

Prosser (1960) identifies, in an article13 on the subject, and repeats in his SecondRestatement of Torts14 (1977), four privacy rights:

intrusion upon the seclusion of another - covers covert acquisition of in-formation without the subjects consent.

appropriation of a persons name or likeness, but it could be right ofpublicity in Restatement (Third) Unfair Competition 46-47 (1995).

11U.S. v. Morton Salt Co., 338 U.S. 632, 651-52 (1949)12389 U.S. 347 (1967)13Privacy, 48 Cal.L.Rev. 383 (1960)14at 652A-652I (1977)

4


5/21


publication of private facts - eg. medical records

publication of true private information that nonetheless place a person ina false light - if the information is false it is defamation, if malicious ornegligent15 it would be a libel.

One may also seek damages under torts not purely related to privacy suchas trespass, emotional distress, or assault.

Criminal statutes appropriate to this paper cover expectation of privacy for:

18 USC 2510 et seq. covers electronic data by wire, which would includewire-sniffing interception of computer network traffic.

18 USC 2702(a) content of e-mail communications

47 USC 605 restricts reproduction of interstate or overseas radio messagesto authorized channels. Could cover wireless Internet/network traffic.

20 USC 1232(g) (Buckeley-Pell Amendment to the Family EducationalRights and Privacy Act) - federal funds refused to school boards who donot keep student data confidential.

Statutes specific to data-handling include:

The Privacy Act of 1974, 5 U.S.C. 552a, Public Law No. 93579, (Dec.31, 1974) establishes a code of fair information practice that governs thecollection, maintenance, use, and dissemination of personally identifiableinformation about individuals that is maintained in systems of records byfederal agencies.

The Computer Matching and Privacy Protection Act of 1988, P.L. 100503, amended the Privacy Act of 1974 by adding protections for the sub-jects of Privacy Act records whose records are used in automated matchingprograms - data-mining.

Because of the emergent nature of privacy law, and its technology sensitivenature, this sort of piecemeal treatment is perhaps inevitable.

1.2 General Privacy Legislation

There is a call for broad legislation in the United States to improve privacy-related control of information. for instance, Solove and Hoofnagle (2006) arguethat

the privacy protections in the United States are riddled with gapsand weak spots. Although most industrialized nations have compre-hensive data protection laws, the United States has maintained asectoral approach where certain industries are covered and othersare not. In particular, emerging companies known as commercialdata brokers have frequently slipped through the cracks of U.S.privacy law.16

15Inc. v. Firestone, 424 U.S. 448 (1976)16Solove, D. & Hoofnagle, C. (2006) A Model Regime of Privacy Protection University of

Illinois Law Review, Vol. 2006, No. 2, 2006 available from http://papers.ssrn.com/sol3/papers.cfm?abstract_id=881294

5


6/21


While the emerging concerns about Internet and electronic privacy tend

to revolve around the actions of private companies, the Bill of Rights and,particularly, the fourth and fifth amendments, was intended to limit governmentintrusions.

The privacy expectations of secondary students will most often involve theirinteractions with the private companies controlling Internet services of concernto Solove and Hoofnagle. The interactions between these companies and edu-cation authorities, who are clearly controlled by the bill of rights, could lead toprivacy actions.

It is worth noting that the private companies themselves do not have a rightto privacy. This is well established, for example, in California Bankers Assn v.Schultz 17 , and U.S. v. Morton Salt Co. 18 . Instead, corporate informationis distributed as a property right. Companies protect their privacy throughlicenses and contracts. Internet-based companies such as Google or Facebooktypically publish their privacy policy on their website.

1.3 Search and Seizure in U.S. Schools

Privacy issues are most likely to come to the attention of the courts as a searchof some description, since that is what the fourth amendment is about . Thus,the way search and seizure works for US public schools is summarized for thispaper.

The fourth amendment provides that private individuals will be free fromunreasonable searches and seizures by the federal government and the fourteenthextends this to state officers (Elkins vs United States 19 ) including public schoolofficials (New Jersey vs T.L.O. 20 ). Thus the Bill of Rights imposes on public

schools, in contrast with private businesses, a minimum restriction on the extentto which they may intrude on the liberty of their charges, which restriction maybe extended by State laws and school district codes of conduct.

The searches need to be reasonable, but not to the extent of requiring awarrant as in the case of searches conducted in pursuit of a criminal investigationby law enforcement officers. From T.L.O. it was observed that requiring awarrant with its concomitant need for probable cause would interfere with theadministrators freedom to maintain order in their schools to an unsupportableextent. The search need only be what any reasonable guardian or tutor woulddo in the circumstances.

In considering a course of action, or policy, the school must balance theinterest of the school against the level of intrusion involved in the search.

1.4 The Balancing Act

As Schools seek to balance their interests with those of their students, there isconsiderable scope for privacy issues to arise. To aid discussion, an example isoffered.

A school has a number of laptops available for loan to needy students whichare not to be removed from campus unless an insurance charge or bond had been

17416 U.S. 21, 65 (1974)18338 U.S. 632, 652 (1950)19364 U.S. 203, 213, 80 S.Ct. 1437, 1441-1432, 4 L.Ed.2d. 1669 (1960)20469 U.S. 325, 336-337, 105 S.Ct. 733, 740, 83 L.Ed.2d 720 (1985)

6


7/21


paid against safe return. All the laptops have software installed to enable them

to be tracked in the event that one is lost or stolen or removed from campuswithout permission. This software includes the capability to remotely activatethe built-in camera and cause it to take a series of still photographs.

A laptop turns up missing in a routine audit and the security program isactivated in the hope of ascertaining its whereabouts. The photographs subse-quently reveal a student, using the laptop at home.

Inside his bedroom, with the door closed and the curtains drawn, the studenthas a clear reasonable expectation of privacy, under the Katz rule (p4), withrespect to being photographed. In addition, laptops with built-in cameras arecommonplace and in normal use one does not expect to find someone lookingthrough it without invitation.

This is a search, but it is an unusual one in that the students bedroomwas not, a priori, the subject of the search. The school switched the cameraon and looked through its lens as a means of ascertaining its location, and, byextension, the location of the computer. It seems reasonable, however, that theschool should have expected that the camera would show some location that theperson in possession of the laptop did not intend to become known to them. Thepossessor has either mistakenly removed the laptop from campus, or has stolenit. (A lost laptop will be turned off, lid closed, under something or otherwiseout of view so the camera either will not function at all or will not return ausable photo otherwise it would not be lost.) Thus the school can expect,by its actions, to intrude on the seclusion of another: the first bullet point fromthe summary of the second restatement of torts (p4).

The situation is analogous to blundering in on someone dressing. There isno intent to invade the private space: it was an accident. In which case social

norms would call for an apology and a hasty exit - no harm done. Furtheraction is unusual, unless the apology is somehow deemed insincere; for instance,if one were to make a habit of blundering in to peoples rooms while they aredressing.

In this situation, the school is making a policy of blundering into rooms thatcontain the laptop and taking photographs of whatever happens to be going onat the time. This is clearly contrary to normal social expectations.

Realistically, the expectation of privacy here must rest on the sensible actsbased on the schools disclosure of this policy. If the student borrowing thelaptop removed it from the campus knowing that the school policy involvedremote access to its camera, perhaps they signed a form which stated this, theschool would likely argue that there was no reasonable expectation of privacy

by that student with respect to that camera. The student has contracted outof their expectation as part of the lease agreement.For such intrusion to count as a violation, the photograph would have to

be used in a manner which would result in either embarrassment or emotionaldistress to a person of reasonable sensitivities. The student could, conceivably,claim emotional distress from the knowledge of the surveillance itself but wewould reasonably expect there to be more to it than that. For instance, if thephotograph were to be used in a disciplinary context and/or if it were to bemade public to the subjects detriment. Schools could protect themselves byensuring that disclosure is to a limited group of people (the Principle and thesecurity professional only, for example) and that any disciplinary actions areconsistent with the standard that the school is acting as a responsible guardian

7


8/21


and tutor.

But we might ask if the policy was reasonable to begin with. After all, wewould not normally put up with school officials randomly dropping in to ourprivate rooms and taking pictures.

In Verona School District v Wayne Acton 21 the US Supreme Court observedthat schools may make reasonable policies concerning their mandate. Indeed,the state, in its role as schoolmaster of children, may exercise a greater degreeof control than it would exercise over free adults. Following Acton , we cansee that the school has a legitimate and immediate concern in recovering itsproperty - the laptop.

If we accept that a search has occurred, then the reasonableness of the searchis judged by balancing the intrusion upon the individuals fourth amendmentinterests against the promotion of legitimate government interests. In Actonthese interests were considered negligible, in part, because the case involvedrandom drug testing as a condition of entry into the schools athletic program(school students have reduced interest with respect to their medical informationand school athletes even less.) Medical information is not at issue in this case,however, it was also observed that the conditions of the search were normalfor related common activities, the search was specific to its objective (drugdetection) and publication limited to a select group.

Following this general argument, while the publication was limited to a selectgroup, third-party covert access to the camera would be an unusual adjunct toactivities related to using a computer and the resulting photograph cannot bespecific to the object of the search (location of the computer) but is general toany activity in view of the camera. This stands in such contrast to Acton thatit does not seem to lend itself easily to a finding of reasonableness.

The immediacy of the schools interest stems from the need to locate thelaptop while it is still recoverable. The idea is presumably to identify the currentpossessor from a photograph of his or her face while they use the computer and,perhaps, from information in the background. The longer before the camera isaccessed, the less likely that the camera will capture a person or place that islocal, and thus easily recognized. Further, if the laptop has been targeted byprofessional thieves, then their must likely first action will be to erase the hard-drive, and thus any security and surveillance software that may be running,rendering the situation moot. (In the last case, it is probably too late by thetime the absence is noted professionals will not switch the laptop on exceptto clean it22 .) However, the interest may not be so immediate as to excludecontacting the last person known to be in possession of the laptop and asking

them what happened to it.This is not a new interest. Schools often make other materials, e.g. text-books, to students in this way, and use established resource management strate-gies to keep track of them. Such school equipment is often lost, damaged, ordefaced by students or others and well-run schools have long established andeffective systems in place to deal with this. The school may feel that a lap-top computer, in contrast to something like a textbook, is a relatively expensivecommodity item with a greater attraction for theft, thus needing increased over-sight.

21515 U.S. 646, 115 S.Ct. 238622fix me: citation needed

8


9/21


The low effectiveness in the event of theft, following from the discussion of

immediacy (above), suggests that any laptop recoverable by means of installedsecurity software is most likely in possession of a student who has innocentlyremoved it from campus by mistake. In this case, there are non-invasive meansavailable to locate and recover the missing laptop. These means are not re-stricted to merely asking the last registered borrower, typical security softwareof the kind under consideration also tracks the computers IP address (its lo-cation in the Internet) and records which ISP account is used to connect tothe Internet all information useful to locating it. Schools are not compelledto follow least-intrusive policies and the existence of less intrusive methods doesnot count against the reasonableness of the search itself. However, in conjunc-tion with the low effectiveness, it must count against the reasonableness of thepolicy that initiated the search in the first place.

The compulsory nature of secondary school education also has a contrastingeffect. In Acton a student objecting to the policy re. urinalysis may simplychoose not to take part in the schools athletics program without further ad-verse effect. If the laptops were provided to needy students so that they couldtake part in a computer-based learning program, perhaps as part of the com-pulsory syllabus, then the students education would arguably be disadvantagedwere they to choose not to borrow one. The alternative would be to providetheir own which, if this were a realistic option, would stand against the stu-dents needy status. The policy risks creating a serveilled class amongstthe student population.

On the balance of above, it does not look reasonable for the school to enacta policy of remote-accessing a laptops camera as a means of addressing itsinterests in this matter. Keeping a register of borrowers along with routine

resource management would non-intrusively track down the laptop in the eventof a student taking it and where this fails, and a theft thus seems likely, thepolice can be involved. Schools can cover their financial interest by insuring thelaptops.

This example is not hypothetical: in November 2009, a Harriton High Schoolsophomore, was confronted with a photo from a school laptop which he had onloan from the school. This was supposed, by the Principal, to be evidence he waspartaking of restricted substances in his home. The case attracted the attentionof the public23 . He and his parents filed federal suit against his school claiminga breach of his fourth amendment right to be free from unreasonable searches.

By the time of writing, the School district has been keen to stress that thecamera is only activated when a laptop has gone missing and that photographs

so obtained are not used as part of a disciplinary process. The school districtis silent on whether the laptop in question was removed from the campus with-out permission or was otherwise considered to be missing. However, they haveacknowledged that parents and students were not informed of these capabilitiesor how they were intended to be used. The school district has publicly apolo-gized for this, satisfying social norms for the blunder but begging the questionof whether the policy itself was reasonable.

The program is administered by a third-party, a security firm hired by theschool to provide this service. The firm makes the photographs available online

23Dan Hardy, Derrick Nunnally, and John Shiffman (February 22, 2010), Philadelphia En-quirer

9


10/21


through a restricted-access website. By itself, this does not seem to breach any

sort of privacy. Discussion around this point centers on the extent to whichparents and students can trust the school or the third party to stay within thepublicly asserted terms of the policy. That the student alleges that a photographwas used in a disciplinary context suggests that the school may make randomchecks of students laptop use as part of the enforcement of its no-tolerancepolicy relating to drug use.

The case generalizes to the situation where information about a student isobtained for one purpose but it is desirable to use it to assist with another.

Note: This is an area of active litigation in the US. I had intended to provide

examples for each of the four torts (above) but the need to submit some text for assess-

ment within a time limit prevent this (for the time being).

1.5 Expectation of PrivacyStudents have an expectation of privacy with respect to US public school offi-cials, in situations where the school does not have an obligation, as a reasonableguardian, to snoop. Even so, students at schools subject to the Buckley-Pellamendment can reasonably expect personal information obtained by the schoolto be kept confidential. (A school may want to reserve its self determinationin this matter and forgo the funds.) Students socially expect control over theirprivate information for which there is little constitutional support.

To properly exercise their rights, students and parents need to be informedof their schools specific policies regarding them. As a responsible guardian andtutor, I would argue that schools have an obligation, with respect to civil rights,to not merely inform, but educate .

2 New Zealand Law

The New Zealand situation is much more detailed, and, in this regard, is morecomparable with the individual state and school board regulations. State schoolsare arms of the central government rather than separate local governments intheir own right and there are no state legislatures to go through.

The key pieces of legislation, the Bill of Rights act (1990) and the Privacy act(1993), are much more recent than the US Bill of rights and Privacy Act, andwere conceived with somewhat different aims in mind. State schools obligationsand powers are laid out in the Education Act (1989), which also conveys theright to a quality free public education. State schools also have to comply with

the Official Information Act (1982) with regard to disclosure of information tothird parties.

In considering NZ law, therefore, I will depart from the historical approach(above) and just consider the appropriate acts as they stand.

2.1 Bill of Rights Act (1990)

Article 17 of International Covenant on Civil and Political Rights (ICCPR)provides that

No one shall be subjected to arbitrary or unlawful interferencewith his privacy, family home or correspondence, nor to unlawful

10


11/21


12/21


Supremacy of Parliament

NZBoRA Section 4 preserves the supremacy of parliament when it says:

No court shall, in relation to any enactment . . . [h]old any provi-sion of the enactment to be impliedly repealed or revoked, or to bein any way invalid or ineffective . . . by reason only that the provisionis inconsistent with any provision of this Bill of Rights.

Which means that statute trumps rights. The only safeguard explicit in theAct is that the Attorney General advises Parliament when a proposed enactmentwould conflict with a right (section 7). Since New Zealand parliament serves fora term of only three years between elections, it is expected that a governmentmaking unpopular laws at odds with social expectations of, for example, civilrights will be quickly replaced.

Even so, it is perhaps reassuring that there is also an act of Parliamentcovering privacy.

2.2 Privacy Act (1993)

New Zealand boasts the kind of broad-spectrum privacy legislation advocatedby Solove and Hoofnagle for the US (p5). It sets up the office of the PrivacyCommissioner to oversee and enforce the NZPA as well as educating the publicand other actors under the act of their rights and obligations regarding infor-mation privacy.

When Bruce Slane was Privacy Commissioner in 1994, he observed:

Privacy is not simply an absence of information about us in theminds of others, it is the control we have of information about our-selves.26

. . . anticipating Dana Boydes findings and Bruce Schneiers observations (p2)by six years. He repeated this observation to the NZ Law Commission 1996.

The NZPA is built around 12 privacy principles covering the collection,storage, accuracy, and use of personal information. School authorities are ex-pected to refer to these principles when considering policies. There are excep-tion, for instance to comply with a criminal investigation, which make themmore a set of strong guidelines than hard-and-fast statements of law. In par-ticular, the Privacy Act is subject to all other acts of Parliament. This meansthat School authorities are expected to comply with their obligations under Ed-

ucation Act and Official Information Act ahead of privacy and must report allexpulsions to the Ministry of Education.The twelve principles can be summarized:

1. only collect information that you need to have

2. get the information from the individual concerned

3. tell the individual what you are doing

26quoted in Davenport W. (2003) The Personal Health Record An address to the 2003Privacy Issues Forum. Available from http://www.privacy.org.nz/assets/Files/51474265.pdf

12


13/21


4. use lawful, fair and reasonable methods to collect information

5. store and transmit information securely

6. give people access to their information

7. deal appropriately with incorrect personal information

8. check for accuracy before use

9. retain information for only as long as necessary

10. use personal information for its purposes

11. limit disclosure of personal information

12. limit use of personal identification numbers

The emphasis in the act is on ideals of openness and honesty with the aimof building trust.

The NZPA has been under review27 by the New Zealand Law Commissionsince 2006. In line with the policy of openness and disclosure which characterizesthe NZPA, this has been done with great attention paid to public participation.At each stage a press release was issued followed by an issues document invitingthe public to provide assistance on particular concerns. After a set time, a reportis compiled outlining recommendations, sometimes involving new legislation, isreleased for public scrutiny.

The first three stages of the four-stage review have been completed and thefinal report (R 113)28 was tabled and released in late February 2010. Stage 4 is

a general review of the Privacy Act 1993 with a view to updating it. The NZLCreleased an issues paper in March 2010, and the final report is expected late in2010. The government will not be considering recommendations from the firstthree stages in the review process until then.

Indications are that privacy continues to be an important right in NZ, withprotections to be clarified and tightened in coming years.

2.3 Balance Revisited

Considering the balancing act example in section 1.4, the information collectedwas the identity of the student in possession of the laptop and the means was byremotely accessing the laptops camera. It is illustrative to see how this situationfits with the privacy principles.

The information was needed to locate the laptop and collected for that pur-pose (principle 1). It was collected from the individual (principle 2) but withouttheir knowledge or permission (the school may want to claim the exception inthis case in that they were investigating a possible breach of the school rules)(principle 3). The information was transmitted as digital data packets over theopen Internet, secure transmission would have involved encrypting the data, itwas stored on a restricted access web-page (principle 5). The student was givenaccess to the information when confronted by the photograph, and was at that

27available from the Law Commission website http://www.lawcom.govt.nz/ProjectGeneral.aspx

28available from http://www.lawcom.govt.nz/ProjectReport.aspx

13


14/21


time provided an opportunity to correct the information and any conclusions

(principle 6-8). After the recovery of the laptop, the photograph is destroyed(principle 9-10). The information was distributed to only a select group (prin-ciple 11) and non-unique identification numbers will have been used to matchborrowed laptops to students: the students name is clearly distinguishable fromthe number on the register by being entered in different columns (principle 12).

Principle 1 is on uncertain ground, though, as there was another way toidentify the current possessor which could be checked in the first instance: theregister of borrowers. The register is totally compliant, as would be the super-vising teachers act of phoning the last known borrower. If that student deniesknowledge of the laptop, then the schools claim of an exception for principle 3is stronger.

Encrypting the kind of data involved would be unusual, but we can give thesecurity program the benefit of the doubt on this one. Principles 6-12 are solidexcept in the case where the school decides to act on other information in thephotograph, such as the suspected drug-taking in the Harrington school case which makes principle 10 tricky.

As in the US case, the biggest concern comes from reasonableness in prin-ciple 4. In addition, since there is no act of parliament affirming the schoolsright to access the laptop camera for the purpose, the actions must follow theNZBoRA in this case, section 21. Given my criticism, on principle 1, that thecollection was not needed (the information is already collected) and the US-stylearguments on what counts as reasonable, this starts to look like an unfair andunreasonable intrusion.

In addition, the policy itself exposes the school to prosecution: it is an offensein NZ to intentionally or recklessly make an intimate visual recording of another

person (being a recording without the knowledge or consent of the subject personand the recording is of a private part of their body in circumstances where thesubject person would reasonably expect privacy). It seems likely that a privacylawyer acting for the school would advise against this sort of exposure.

2.4 Official Information Act (1982)

The NZOIA replaced the Official Secrets Act (1951) in July 1983, marking amove to more openness and public participation in government. The idea was

. . . to make official information more freely available, to providefor proper access by each person to official information relating tothat person, to protect official information to the extent consistent

with the public interest and the preservation of personal privacy,[and] to establish procedures for the achievement of those purposes

State schools in New Zealand are subject to the NZOIA as well as, and aheadof, the privacy act. This means that the school may be obligated to provideinformation it holds as any government body. If a person asks for informationabout themselves, then Principle 6 means the school is obliged to provide it.However, if a person asks for information about a third party, or school facilities,or policies, then the disclosure is covered, instead, by the NZOIA. Under thisAct the school must provide the requested information unless there is a strongreason to refuse. Protecting privacy would be a reason, particularly wherethere is a strong privacy interest for the student, such as conversations with a

14


15/21


school guidance chancellor. However, there is seldom a strong interest in keeping

information from the students parents. Even if there are privacy concerns, theremay be a strong public interest in releasing some information. The school needsto consider which information to release to balance its concerns.

Sometimes people will ask for copies of specific documents which containsinformation about themselves, OK to give them, but also contains references toanother person. In which case the privacy act applies to part of the documentand the NZOIA to the other. It may be possible to redact sensitive informationin a way that does not infringe the privacy of the third party.

2.5 Privacy Torts

Stage two of the Law Commissions review of the Privacy Act 1993 included thequestion of whether specific privacy torts should exist in their own rights or leftto common law. The specific torts mentioned in the issues document closelyfollowed the US second restatement of torts (p4) but, in the final report, it wasleft up to the courts to determine what, if any, torts are appropriate as theycame up.

The recent judgment of Hosking v. Runting in the New Zealand Court ofAppeal, mentioned above as well, has established at a high judicial level thata separate tort of invasion of privacy does indeed form part of the landscape ofthe common law. The tort recognized is that of wrongful publication of privateinformation. Justices Gault and Blanchard stated29 :

The scope of a cause, or causes, of action protecting privacyshould be left to incremental development by future courts.

Effectively echoing the NZ Law Commission report in March 201030. Howeverthe Justices did point out two fundamental requirements a claim for invasion ofprivacy must meet if it is to be successful:

The existence of facts in respect of which there is a reasonable expectationof privacy; and

Publicity given to those private facts that would be considered highlyoffensive to an objective reasonable person.

Whether the reasonable person in question is in the place of the plaintiff orjust a member of society in general, is unclear. In deciding against the plaintiff(denying injunctive relief or damages in the case of photographs of their childrentaken in a public place) suggests that the court is leaning towards the U.S. andconsidering what is generally socially acceptable.

As in the US situation, New Zealanders can also seek to protect their privacyunder other torts such as defamation, trespass, or assault.

2.6 Right to Privacy NZ Schools

This is important as many New Zealanders would consider that children shouldhave special protection in some cases, such as in the distribution of compro-mising images. In particular, children enjoy special legal protections concerning

29Hosking , para 11730R 113, op.cit. see page 13

15


16/21


exposure to materials and media which is socially deemed harmful to them.

Tobacco and alcohol cannot be sold or served to minors, and there is an elab-orate system of radio, television, and motion-picture censorship related to theprotection of children. So, in the name of protecting our children, we routinelyrestrict their ability to exercise their civil rights. Children cannot accept thesame rights as adults. This is also balanced by a reduced liability of children inthe event that something goes wrong.

In Hoskins the court clearly intends that children have no greater or lesserdegree of expectation of privacy in comparison with adults. This is perhapssurprising in light of the generally reduced rights elsewhere but it is logicallyconsistent with the idea that children deserve no less protection than adults(where there is a difference, we expect children to be better protected thanadults) while at the same time considering that restrictions on the freedoms ofadults should also apply no less to children (adults have maximum freedom byright).

The expectation of privacy here was eliminated by venturing out in publicview. Again we see that the expectation depends on the actions taken to ensureit. Deliberately seeking publicity reduces it and seeking seclusion increases it.

In the school, students are in the guardianship of the teacher. Their expec-tation of privacy depends on being informed of the school regulation in thatregard and the obligations placed on the school by the privacy act (and otherstatutes).

Students expectation of privacy is not restricted to confidentiality but alsoincludes the expectation to control over the use of personal information. In thissense, information imparted for one purpose must not show up in another. Thisis probably the most marked difference from the US, where the reliance on courts

usually means that privacy disputes primarily involve a breach of confidentialityand resulting damages (if the information in question is still secret, then whereare the damages?)

In New Zealand, the information need not be confidential for its use in adifferent context to constitute an action worthy of the attention of the PrivacyCommissioner.

For instance a case where a polytech had used a photograph withoutpermission for one of its courses was considered by the Privacy Commission31.The Commission notes that had the photograph been obtained as part of thepolytechs enrolment procedure, then this use would not be compliant with prin-ciple 10 of the NZPA. As it happened, the polytech had sourced the photographfrom an online publication so the use fell under an exemption to P10:

Principle 10(a) allows an agency to use personal information ifan agency believes, on reasonable grounds, that the source of theinformation is a publicly available publication.

Since there were no access restrictions on the website in question it was reason-able for the polytech to assume the photograph was publically available.

This is a bit like if I took your picture from a magazine and started showingit around everybody we both new. You may feel affronted and ob ject: Hey, Ididnt mean for that to happen! The appropriate social result would be for me

31Case Note 212156 [2010] NZPrivCmr 8: Personal information on internet was publiclyavailable

16


17/21


to apologise and stop. This is exactly what happened in this case. The poytech

formally apologised and used someone elses picture for future lessons.

Copyright

Students may seek to control some information online by treating it as a prop-erty. Since copyright regulation is subject to international treaty, there may besome attraction in this. However, the concept copyright covers the expressionof ideas (or information) rather than the facts themselves. It acts by restrictingexpression or use of a work rather than controlling uses of information. Notmuch use for text, but may be of some use controlling the use of images suchas personal photographs placed online on social-network sites such as facebook.

In the New Zealand copyright act, photographs are a creative work auto-matically copyright, all rights reserved, to the creator. A photograph placed on

a website is being published there and it would infringe on the copyright if itwere to be duplicated for use in another place unless explicitly licensed by theowner.

That would cover the photograph, maybe derived works (photoshopped ver-sions say) of it, but the actual information content is not covered. For example,that a photo of one in a revealing outfit is available at a particular URL, or awritten description, is unlikely to be held to be infringing.

There are also important exceptions to copyright prtection in the NZCA asamended in 2003 with regard to educational use. For instance, the image usedby the polytech (above) was almost certainly a copyright work (licenced to theoriginal web-publication it was sourced from) but the polytechs can use it underthe educational exemption.

Commercial entities use non-disclosure agreements and other contracts tocontrol information they consider to be a property. This is not a useful way tointeract with the internet and mostly reinforces confidentiality rather than thedata control the student is interested in.

Searches and Surveillance

Since the US privacy protections so often come up in the context of searches,there can be no fair comparison without a similar look at the way NZ law handlessearch and seizure.

In her general discussion on privacy in schools, distributed through the officeof the Privacy Commissioner, Kathryn Dalzeil observes:

If a school wishes to search a person or their property (eg bags),schools need to be aware that it is a right under the New Zealand Billof Rights Act that a person be secure against unreasonable searchor seizure. Generally, consent is needed. The circumstances mustjustify the search and legal advice should be obtained before a searchis conducted.32

Her observation stems from the fact there is no statutory affirmation of thepower to search granted to teachers in any New Zealand act of Parliament. Thismeans that any search policies and actions taken by the school must comply with

32Dalzeil K. (2009) Privacy in Schools p28

17


18/21


the Bill of Rights. Students objecting to the search can take the matter up with

the Ombudsman with respect to a breach of section 21 of the NZBoRA and/orthe Privacy Commissioner as non-compliance with principle 4 of the NZPA. Thematter may also come up as a tort in the event of harmful publication or aspart of the defense in a criminal prosecution resulting from the search.

That schools may have a power to search does have some support throughthe structure of the Education Act (1989) as a statutory duty placed upon thePrincipal and staff of a public secondary school to provide a high quality ofeducation in a safe environment.33

A statutory duty without the power to carry it out is against the principlesof a free and democratic government. The power rests in sections 72 and 75 ofthe NZEA allied with section 76 placing responsibility of the day-to-day runningof the school in the hands of its Principal.

Thus, the school board has a statutory power to make and enforce rulespursuant to its mandate, vis. education quality and safety. This is analogousto the finding in Cropp v. A Judicial Committee34

Enabling discipline/behavior management programmes is an explicit ex-ample given in the NZPA of a legitimate reason a school may want to collect in-formation in compliance with the first principle. The investigation of breachesof school rules/policies is an explicit example given in the NZPA of an excep-tion to the second principle. This exemption implies that the investigation mayrequire information to be obtained without the consent, or even knowledge, ofthe person under investigation provided that that there is sufficient suspicionthat a breach in regulations has occurred to warrant the investigation.

Principles 7-8 of the NZPA require that schools check information receivedfor accuracy before acting upon it and a search would be a fast way to allay

suspicion in this matter. Asking the student to account for information leadingto the suspicion would also go towards compliance with principle (4) of fairnessin collection.

Thus, a teacher may check the contents of a students bag in order to verifythe accuracy of information already received that there is something to be foundthere which would further indicate a breach of the school rules. The teachershould, in the first instance, ask for permission. If permission is not forthcoming,then the teacher needs to weigh the need to check the accuracy of the informationagainst the likely consequences of doing nothing. This would be similar toweighing the interests of the school against the privacy interests of the student.

The scope of the power to search is, therefore, limited to the schools man-date, and must involve reasonable suspicion or the consent of the student. That

no consent or private bargain can give a public authority more power thanit legitimately possesses35 does not limit this case since the NZPA explicitlycontains exemptions allowing school authorities legitimate power to increase thescope of their inquiries on consent of the subject.

Even so, teachers need to be careful when relying on exceptions that noeffort is spared to comply fully with every principle outside the scope of theexemption. As Dalziel warns:

33Rishworth P. Search and Seizure in Public Schools ch7. Recent Developments in SchoolLaw NZLS, 2004, p92

34[2008] NZSC 4635Wade and Forsythe (2004) Administrative Law 9th ed. p239

18


19/21


The information should not be collected in an unfair way. For ex-

ample, tactics such as frightening or threatening students into givinginformation or misleading students as to the purpose for collectinginformation may well mean that the information collected is notreliable or usable.

Principals and teachers should remember that . . . there is a signif-icant power imbalance between people in authority and students.36

However, school authorities should be secure in their searches if the overrid-ing principle is to protect the student from harm, in keeping with the generallyaccepted and statutory restrictions on a childs exercise of her other civil rights.

As an illustrative example of a common but highly questionable practice a teacher intercepts a note being covertly passed around the class, incitinginattention and off-task behavior, opens it, and reads it aloud to the rest ofthe class before instructing the students to return to work.

If the note was intercepted while it was nominally in view, between students,then the confiscation was without a search. However, reading the note fails tocomply with principle 1, and possibly 4. Disclosing the contents was deliberatelyintended to embarrass the note-passers, and thus knowingly a breach of privacyfor the purpose of correction.

The original purpose of intercepting the note was to remove a distractinginfluence from the class. Once confiscated, the purpose is served. Without anyreasonable suspicion concerning the information content of the note, there wasno need under principle 1 to collect it. Principle 9 requires that the note shouldbe discarded immediately, or kept secure under principle 6 to be returned to thelast possessor after class.

When it implements a network of computers or uses software services providedby another, the school needs to be careful to meet its obligations in terms ofstorage. Since the storage and retrieval locations may be many miles apart (com-puter in Wellington stores the information but computer in Auckland wants it)and the connection hidden by the software interface (distant computers canconnect seamlessly in a variety of ways: engineers consider it a virtue that theuser cannot tell from using the interface where the information is stored) that

it would be easy to accidentally transmit information in an insecure manner.The onus is on the school to make sure that third-parties providing, for in-stance, disk-space storage, do so securely. This includes the continued abilityto access the information and alter it in accordance with principles 6 and 7 aswell as preventing unauthorized access under principle 5. Well run schools canbe expected to routinely encrypt network communication streams and data aswell as implement mandatory access protocols. These would constitute routinenetwork security measures in the industry. However, as far as the student isconcerned, at least at the onset, this is not their problem. The obligations tothe school imposed under the privacy act at least provides a strong expectation

36Dalzeil K. (2009) Privacy in Schools p28

19


20/21


of privacy when it comes to information stored by the school. Reasonableness

of expectation is most likely to arise at the collection and disclosure stages.The lack of case law or statute directly affirming, for instance, any power to

search by schools leaves school authorities on uncertain ground whenever theyattempt to collect any information without consent, particularly when they feelthat their inability to act results in harm to a student or staff member. ThePost Primary Teachers Association continues to lobby for statutory recognitionof this implied power which is actually a common occurrence in schools.

In comparison with the US situation, schools seem to have no clear authorityto conduct suspicion-less searches. This means no metal detectors at the gatesand no random urinalysis of athletes. Routine surveillance may be argued tocontribute to providing a safe environment, but Dalziel warns:

The use of security cameras or CCTV is becoming more common

in schools to address issues such as vandalism and individual safety.Before installing security cameras, the school needs to consider whyit wants to use security cameras and it needs to take professional ad-vice as to whether or not this technology will meet the purpose (egpreventing vandalism). If cameras are installed, schools should dis-play notices about the presence of cameras and schools should haveclear policy guidelines about storage and access to the informationcollected (see principle 5).37

In late February 2010 the NZLC, as a result (see page 13) of stage three ofits review of the NZPA 199338 recommended a new Surveillance Devices Act tofill gaps in the regulation of new forms of surveillance. This new act will morecompletely define a students right to privacy with respect to school surveillance.

Still, Dalziels comments could apply as well to any measures put in placeto ensure a safe electronic environment. For instance, the school will have avalid interest in keeping the schools computers are free from malicious softwareand misuse such as cyber-bullying. The school will want to prevent the schoolnetwork from being used to propagate viruses, pornography, or material thatinfringes on copyright law.

Computers record a great deal of information as part of their normal oper-ation. This information can be made available to scrutiny as part of a securityprogram, which may also collect other information. Dalziels comments on cam-eras should also be applied to each capability of the security program individ-ually. When a student accesses the school network, they need to be informedabout the capabilities and conditions of use. (A common method is to imple-ment access via a captive node being a term of the art to indicate networkaccess which is only permitted through an interface requiring some interaction,typically an acknowledgement that the rules and regulations, displayed, havebeen read and understood.)

If the school security software collects information about school computers,it may also do so from private computers used on the school network. If studentsare not informed of this, then they may have a reasonable expectation of privacyin law as to the contents of their own computers much like the one they enjoyfor their own bag. It may be that their expectation using school computers issimilar to using a school locker.

37Dalzeil K. (2009) Privacy in Schools p3538R 113, op.cit.

20


21/21


Students need to realize that when they use the school computers, or just use

their own computer on the school network, they are entering a walled electronicenvironment under the schools governance much the same way as they entera geographic one when they enter the school gate. Untoward influences arediscouraged from the physical school campus by a wall or fence of some kindmarking the boundary, rules making limitations explicit, and regular patrols.Similarly, the schools electronic campus will receive similar attention.

3 Conclusion

The interaction of civil rights, in particular privacy rights, with regard to com-munications technology is still an area of discussion. Nobody really knows how,if at all, it will all turn out. In spite of public statements to the contrary, pri-

vacy is not a dead issue, and the NZPA shows one way that emerging socialexpectations of privacy as a control issue rather than one of confidentiality orsecrecy, can be addressed in law.

The 21st century will be the age of the computer network. Schools canplay an important role in the emerging social order by providing a model, inmicrocosm, of government interaction with information systems. A lot is writtenabout the need to be informed in relation to civil rights, in schools we need togo further and educate. It is what they are for, after all.

21

secondary students online and the expectation of privacy

Documents