Virtual Blinds : Finding Online Privacy in Offline Precedents

A person in a building shows a desire for privacy by pulling her blinds shut or closing her curtains. Otherwise, she cannot complain when her neighbor sees her undressing from the window, or when a policeman looks up from the street and sees her marijuana plants. In the online context, can we find an analogy to these privacy blinds? Or is the window legally bare because of the nature of the Internet? This Article argues that by analyzing the privacy given to communications in the offline context, and in particular, by analyzing case law recognizing privacy in an otherwise public place when the individual engages in affirmative efforts to ensure her privacy, the law can find a sensible foundation for recognizing privacy online. This Article proposes a framework that incorporates the following factors in the reasonable expectations of privacy context. First is the existence of a user agreement or employer policy governing the use of the specific communication mechanism or providing for monitoring of that use. Second is the extent to which third parties have access to or protect the communications. Third is the notice given to the user of the user agreement, employer policy, or practice of giving access to or protection from third parties. Finally, the fourth factor is the availability and use of privacy-enhancing controls which increase the likelihood of the communication being protected from disclosure to people other than the chosen recipient(s), including but not limited to (a) passwords, (b) encryption technology, (c) network configuration, and (d) privacy settings limiting disclosure to certain people. Courts can adapt this test to a civil tort or Fourth Amendment context, to employment and non-employment cases, and to statutory privacy claims. It is a logical evolution from the practical factors that courts have looked at in offline cases — like closing doors and securing lockers — and it is consistent with the growing weight of authority that finds a reasonable expectation of privacy in online communications where the Internet user avails herself of privacy-ensuring measures