Informational Privacy in the Age of Facebook

On September 29, 2014, the Supreme Court in Vivares v St. Theresa’s College rendered a decision laying down the rules on the extent to which social media users can have a reasonable expectation of privacy when using social networking sites.

The case involved two minors who were graduating high school students of St. Theresa’s College (STC), who in 2012 took photos of themselves wearing only their underwear as they were changing into their swimsuits for a beach party. Other photos taken showed the girls smoking cigarettes and drinking hard liquor while another shows the girls wearing clothes that completely revealed their black bras. These photos were later uploaded by a friend of theirs to her Facebook profile. The photos which were contrary to STC’s Student Handbook alerted other students who reported the photos to a member of STC’s faculty. The students who reported the photos then logged on to their accounts using a school computer, and showed the photos the members of the faculty. They also reported that there was a time when the privacy settings of the photos were once set to “public” and viewable by anyone on Facebook.

Upon further investigation, the STC administration ultimately found that the girls had violated the school’s Student Handbook, and as a penalty, they were not allowed by the school to attend their commencement exercises in March 2012. And though the parents of the two girls were successfully able to obtain a temporary restraining order from the courts allowing the girls to attend their graduation, STC nevertheless still barred the two girls from attending.

Subsequently, the parents filed a petition for a Writ of Habeas Data. A Writ of Habeas Data is a remedy available to any person whose right to privacy in life, liberty or security is violated or threatened by an unlawful act or omission of a public official or employee, or of a private individual or entity engaged in the gathering, collecting or storing of data or information regarding the person, family, home and correspondence of the aggrieved party. It seeks to protect a person’s right to control information regarding oneself (also known as the right to informational privacy), particularly in instances in which such information is being collected through unlawful means in order to achieve unlawful ends.

The theory of the parents was that, the pictures were taken by the two girls for posterity, and uploaded under the setting “Friends Only” where they could have a reasonable expectation of privacy. The photos which they argue to be privately owned and contained in their private Facebook accounts should not have been accessed or reproduced by the school officials without their consent. Such an intrusion into the girl’s private accounts and the reproduction of the photos was thus a violation of their privacy, with the photos even being “broadcasted” as they were attached to a memorandum sent by the school to the courts. On these grounds the parents asked the court for the issuance of the writ of Habeas Data, the surrender of all printed or soft copies of the photos, and that judgment be rendered declaring all information illegally obtained to be in violation of the two girls’ privacy.

In resolving the issue on whether a writ of Habeas Data should be issued, the court noted that it is not sufficient to show a mere violation of a person’s right to informational privacy. To avail the writ, there must be a showing of first, an existence of the right to informational privacy, and second, a showing of an actual or threatened violation of the right to privacy in life, liberty or security. Thus, in order to assess whether the petition should be granted, the court needed to first establish whether a right to informational privacy can exist in the context of online social networks such as Facebook, and second whether STC acted in a way which had threatened to or actually violate the right to privacy in life, liberty or security of the two girls.

The court found that having an expectation of informational privacy is not necessarily incompatible with engaging in cyberspace activities, including those that occur in online social networks. To determine the extent to which a reasonable expectation of privacy exists, the court looked through the privacy settings offered by Facebook, the online social network involved in this case. As the court notes, posts can be visible to either the “public”, “friends of friends”, “friends only”, “only me”, and “custom”. Thus, the expectation of privacy can be limited at the discretion of the user.

Based from the evidence presented, the court concluded that the photos in question were either viewable by the girl’s Facebook friends or the general public at large. If the photos were set to “public”, then no reasonable expectation of privacy can be expected. However, the court also found that even if a post was set to “friends only”, this does not seem to establish a reasonable expectation of privacy. This is because of the nature of online social networks and the tendency for most users to have over a hundred “friends”, with the possibility of “befriending” complete strangers. The court also took into account of the multiplier effect that dramatically increases the visibility of a Facebook post when it is “tagged” or “shared”.

Ultimately, applying these doctrines to the case, the court ruled that even if the photos were set to “friends only”, STC did not violate the privacy of the students since it is the other students who showed the pictures to the School Administrators.

What is interesting?

What is interesting about this decision is that it resolves to respect the extent to which privacy settings offered by a social networking site can be used to control to limit the user’s expectation of privacy. From the decision, it would appear that although setting a post to “public”, “friends of friends”, and “friends only” puts a user in a position where there is no apparent reasonable expectation of privacy. While the settings “only me” and “custom” (when limited to a very select group), can allow a post to be subsumed under the protective zone of privacy.

What is worth noting?

To the public, this case should be notable for its ruling that contrary to what feels intuitive; posts on Facebook when set to “Friends Only” do not appear to establish a reasonable expectation of privacy. As the case itself reminds us, we should be cautious and should exercise sound discretion in controlling the information that we want to disclose online. This is especially so particularly given social networks like Facebook’s penchant for changing its privacy settings ever so often. Since the courts appear to rely upon the privacy settings offered by the Online Social Networks, it is our duty as users of these networks to understand their privacy policies, and to carefully decide just how much of the information we post online we would want everyone else to see.

Read more about the Data Privacy practice at Disini & Disini Law Office

Read more about the Technology and Telecommunications practice at Disini & Disini Law Office