Salinger Privacy

  • About
    • About Salinger Privacy
    • Videos, Podcasts and Media Mentions
  • Consulting
    • Our Consulting Services
    • Privacy Impact Assessments
    • Privacy Compliance Reviews
  • Training
    • Overview
    • Training Calendar
    • Public Courses and Workshops
    • In-house Privacy Training and Workshops
    • Online Training
    • Webinars
    • IAPP Certifications
    • Login
  • Privacy Resources
    • Privacy Resources
    • Compliance Kits
    • Resources on key privacy topics
    • Free Handbook
    • Login
  • Who We Are
    • Anna Johnston
    • Melanie Casley
    • Samantha Floreani
    • Andrea Calleia
    • Stephen Wilson
    • Chris Culnane
  • Blog
  • Contact
  • Compliance Kits

Creepiness is in the eye of the beholder

October 15, 2015, Anna Johnston

Share this post

Share this post on twitter Share this post on Linkedin Share this on Facebook

Happy Halloween dear readers! As you carve your pumpkins, decorate your house with plastic spiders and work on your scary costumes, it seems an apposite time to reflect on … creepiness.

Privacy practitioners are often called upon to determine whether or how a particular initiative can comply with privacy law. But often a more compelling and relevant question is: will this project fly, or will it crash and burn?

The answer to both questions is often “it depends”. Privacy principles themselves are fuzzy law, meaning they offer plenty of blank space around “reasonable expectations” and “take reasonable steps” that the practitioner has to fill in. And then even if you do comply with the law, a backlash from your customers or the wider public can bring your project undone faster than you can say “Australia Card”.

So how are we supposed to figure out in advance what will be considered unduly privacy invasive, and what won’t?

A couple of my favourite privacy academics, Omer Tene and Jules Polonetsky, have proposed a Theory of Creepy to help us figure it out. They suggest that creepiness arises when new technology rubs up against social norms. Sometimes social norms shift to accommodate the new technology – but sometimes they don’t, and a consumer backlash ensues.

Tene & Polonetsky have provided examples of the kinds of activities that might be seen as cool – or creepy – depending on the context:

  • Ambient social apps: These take publicly available location data about people and present it to other users, which might end up being regarded as cool (Foursquare) or creepy (Girls Around Me which showed the social media profiles of women physically near the user at any given time; or the Obama app used in the 2012 US election campaign, which plotted voters’ names, age, gender and political leanings on maps of residential areas).
  • Social listening: This involves monitoring customers via social media, and anticipating their needs or responding to their concerns. This kind of intensive surveillance of and approaches to individual customers can be regarded as brilliant best-practice marketing (KLM’s Surprise initiative), or a disastrous cross-over into stalking behaviour (British Airways’ Know Me initiative).
  • Data-driven direct marketing: Using a customer’s history of past purchases to offer suggestions as to what they might like to purchase now, which can be seen as expected business practice (Amazon’s book recommendations), or as so surprising that it becomes the case study in what not to do (Target’s marketing to a teenager it figured out was pregnant before her father did).
  • New products: The failure of Google Glass wearers to anticipate and adhere to social norms led to the creation of a new epithet – Glassholes – and sent the product back to the drawing board.

Their conclusion is that any new project requires a social or ethical value judgment to be made – and that this judgment should not be left to the engineers, marketers or lawyers. As Tene & Polonetsky say: “Companies will not avoid privacy backlash simply by following the law. Privacy law is merely a means to an end. Social values are far more nuanced and fickle”.

In my view, that fickleness is the core of the problem. Humans are not rational or consistent in their responses. Why was British Airways’ social listening deemed creepy, but KLM’s deemed cool? Both involved unexpected online identification and analysis of customers waiting for flights, and then real-world interactions with those customers.  Why do we accept CCTV manned by unseen agents, but not a guy with a camcorder? I don’t have the answer.

As our Associate, Stephen Wilson has written: “The most obvious problem with the Creepy Test is its subjectivity. One person’s ‘creepy’ can be another person’s ‘COOL!!’”.

So, how can we avoid creepiness, if we can’t predict where a new initiative will fall on the cool-to-creepy continuum?

Like Stephen, and unlike Tene & Polonetsky, I still find privacy law to be our best starting point. Yes it is fuzzy law, yes it has ridiculous loopholes. But at their core, privacy principles represent both common sense and good manners: Only collect what you need. Ask the subject for the information directly. Tell them what you’re going to do with it. Don’t go using data in new and surprising ways. Don’t expose the data unnecessarily. Etcetera.

As I have written before, there are pragmatic ways to develop customer trust and protect privacy but maintain your business objectives, and in many ways, the privacy principles themselves point the way.

The value of proposing a ‘creepiness’ test as part of project management is that it might be a useful way to start a conversation with your marketing department, your engineers or even your CEO, if talking about the law tends to send them to sleep. Of course anticipating and reflecting community expectations is also critical to fleshing out your analysis of potential privacy pitfalls. But ultimately, our principles-based privacy law is the best place to start.

Other than on Halloween, better to be cool than creepy.

 

Photograph © Shutterstock

Filed Under: Uncategorized

Recent Posts

  • How to earn your social licence: the role of trust in project design
  • Representative redress required to mop up after asylum seeker data breach
  • Design jam leaves customers in a privacy pickle
  • What’s in store for privacy law in Australia?
  • Location, location, location: online or offline, privacy matters
  • The Data-Sharing Dilemma
  • Putting a price tag on privacy
  • Why privacy is a public good in need of better protection
  • Re-thinking transparency: If notice and consent is broken, what now?
  • Should I download the COVID-Safe app? The privacy pros and cons

Archive

  • 2021
  • 2020
  • 2019
  • 2018
  • 2017
  • 2016
  • 2015

Search

Salinger Privacy we know privacy inside out

Salinger Privacy can help you navigate the complexity of the regulatory environment, and ensure the trust of your customers.

CONTACT US

T: 02 9043 2632
PO Box 1250, Manly NSW 1655
Email Enquiry

© Salinger Consulting Pty Ltd
ABN 84 110 386 537

Our Privacy Policy

Subscribe to our newsletter.

These details will be added to our mailing list to receive the Salinger Privacy eNews and Product News newsletters. You can unsubscribe or adjust your preferences at any time, from the bottom of any newsletter.