When is okay to publicly reveal people’s personal information?

A recent query from a reader raised some interesting points about when it’s okay to post things online — and when it’s a violation of privacy. This is a challenging question, and one that might generate a lot of disagreement, so I think it’s worth exploring.

I’ll start with what I’ve developed as general principles, then take a look at how they applied in this reader’s particular case.

Some rules for posting people’s photos or information

We, as participants in the internet, often have the opportunity to find or take other people’s photos, record them on video, or reveal their personal information. What’s fair game to post? Here’s my short list:

• Information about companies that they share with you, or that is publicly available.
• Information about public figures for which they have little expectation of privacy, for example, photos of them in public places, or activities in which they are seeking publicity.
• Photos of people who are approaching or harassing us.
• Photos or videos captured with a proper photo release, or quotes gathered on the record.
• Photos or videos captured in public places, such as a concert.
• Information about private individuals that they have posted in a public place, such as their tweets or Instagram posts, provided those are on public and not private accounts.

Here’s a list of what’s not okay:

• Private information that could be used to harass people, such as their addresses, phone numbers, and emails.
• Information posted on private accounts not intended for sharing outside of friends lists.
• Revealing or nude photos or videos posted without the subject’s permission.
• Private emails.

The rules for journalists are different, as they have the justification of revealing information in the public interest, as well as a formal set of privacy rules that they abide by.

My list is obviously vague and incomplete. My intention is to get you to think about it. Ask yourself this question: if this were your information and you had an expectation of privacy about it, how would you feel if someone posted it?

I’d add one more thing: much of this information can be found through web searches. In my opinion, that is not a justification for spreading it. If I use public records to find your address on a town’s real estate database and then post it online, you could argue that I’m just posting public information. But the existence of the data doesn’t make it morally okay to spread it, especially if the subject of the data would object.

My reader’s query: posting a link to a photo online

Here’s the question I received (I deleted the search terms my correspondent used since I don’t want to spread private information either).

Yesterday, I did something online that was quickly censured by many. Since you’re savvier and smarter about the do’s and don’ts of social media and online etiquette, I’m turning to you to ask: Are my critics right?

On Sunday, the Washington Post ran a story about the backlash that resulted when a woman professor in India, on her private Instagram channel, posted a photo of herself wearing a bikini in her home to point out how that sort of photo could cause an Indian woman to be slut-shamed.

She was slut-shamed and threatened.

The Post did not identify the woman. Nor did it include the photo. 

In 30 seconds, I found the photo and posted it.

Within 30 minutes, six people commented under my post, basically saying, “Shame on you!” and “Was this necessary?” After that, I stopped looking. I’m guessing my comment was removed.

Here’s my position:

1. I did not identify her. I still have no idea what her name is.

2. The photo was in the public domain.

3. I didn’t dox her; the photo turned up by simply entering the most obvious search terms: [search terms deleted]

4. The photo was relevant to understanding what sort of photo could get a woman in trouble.

And for what it’s worth, the day before that, I declined to post such a link below a Date Lab column that had identified the woman dater by her first name only. The article said her name was Piper and she was a professor of international studies. I Googled the most obvious search terms: [search terms deleted]. Bam! The very first search result was her profile page, with a photo that resembled her Date Lab photo, at a local school. But I didn’t post it, because 

1. That would have revealed her full name, something she clearly didn’t want. (Usually, Date Labbers permit their last name to be used; she didn’t.)

2. Even though finding her full name was trivially easy for me and would have been equally easy for anyone, I knew I’d catch hell.

3. Her name wasn’t relevant.

Finally, sometimes the Post withholds the name of a crime suspect…especially (say conservatives, and I agree) when the suspect is a person of color. Often when they withhold the name, a commenter will link to another news article where the suspect is named.

As I see it, the crux of the ethical issue is: 

1. Was my post relevant? If not, shame on me.

2. Did I dox her? If so, shame on me. But I say I didn’t dox her because, again, I did not rely on advanced skills like reverse-image-search.

You have to draw a line, and I’d draw it differently

My response is below. The crux of it is: just because you didn’t do something terrible (doxxing someone, that is, revealing their obscured name or contact information), doesn’t mean that what you did is okay. And just because you can find something in a search doesn’t mean you should link to it and spread it.

Yeah, I think you made a mistake. I understand it, but here’s the way I would think about it.

She posted a photo on her private Instagram account. The fact that it’s discoverable now doesn’t mean you have the freedom to spread it anywhere you want.

Imagine that you had been involved in a controversy regarding photos of you doing something inappropriate (say, giving a Nazi salute as a joke). Your photo was on your private account. Somebody hacked your account, got access to it, and posted it with your name. Now people can find it. How would you feel about people posting it when you wanted it kept secret, and it was taken from you without permission?

You said this in your defense:

1. I did not identify her. I still have no idea what her name is.

>> Revealing her name would have been worse, but that doesn’t mean posting her anonymous photo is harmless.

2. The photo was in the public domain.

>> No, the photo belongs to her. Someone stole it. That makes it publicly accessible, but not public domain. Photos that are on the net are not “in the public domain.” And you don’t have a license to spread a photo unless the original copyright holder — in this case, the professor — gives you permission. Even if you don’t post the photo, posting a link to the photo is implicitly endorsing the people who posted it without permission.

3. I didn’t dox her; the photo turned up by simply entering the most obvious search terms: [search terms deleted]

>> Again, failing to reveal her name and address doesn’t make what you did right — the fact that it appears in a search doesn’t make it right for you to post it on the web site of the Washington Post.

4. The photo was relevant to understanding what sort of photo could get a woman in trouble.

>> The fact that you have a noble justification doesn’t mean that what you did is fine. If I post your Nazi salute photo to show that doing a salute can get you in trouble, that doesn’t change the fact that it was embarassing to you and stolen from you.

Your analogy in [another email the correspondent sent to me] implies that if something is easy to find, you have license to reveal it. But linking to it makes it easier for others to find. You are contributing to the problem.

Sometimes things are easy to find and spread. That’s not the same as the question of whether finding and spreading them is acceptable.

I’m glad you asked — this is not a simple question. And I understand your point of view. I don’t agree with it, which is okay, I hope, since you asked.

A final note on the “public domain”

Public domain has a precise meaning in copyright law. It means that an asset, such as a photo or a book, is no longer (or never was) covered by copyright protection. You can do anything you want with such an asset. For example, government photos and content that are not classified are in the public domain, which is why we’re all free to share the photo of documents at Mar-a-Lago.

There’s another, more colloquial use of the term “public domain,” which is “I found this on the internet so it is public.”

Well, that’s not actually a thing.

If you found something online it could be stolen, private, or published without permission. And just because it’s there, doesn’t make it ethical to link to it or spread it.

An extreme example: if somebody hacks your mobile phone photos and then posts nude pictures from your phone, others do not have the right to post, share, or spread those photos.

If I write an essay and publish it on the website of the Boston Globe, you don’t have the right to copy it and post it somewhere else.

“Online” and “public” are two different things.

So are “legal” and “moral.” It’s certainly legal to post links to the professor’s photos that were posted on site in India. But that doesn’t make it right.

I salute my correspondent for raising the question. There are no easy answers here. Do you think about privacy before you post? And if so, what principles do you use?