Privacy and Social Media Activity

Consider two examples of using someone’s social media profile “against” them.

First Example. I know you through several mutual acquaintances. You have overheard that I’m looking to invest in the local restaurant industry. You corner me at a party and pitch me your plan to start a fancy new restaurant. However, I have formed a negative opinion of you because of your brash behavior on social media. Frequent, gratuitous use of profanity, references to alcohol consumption, and unrestrained emotional outbursts have given me an impression of your personality, and I don’t care for what I see. I politely decline to bankroll your business, even though I fully intend to break into the restaurant industry when the right opportunity comes along.

Second Example. I’m a bank, and you come to me for a small business loan for your restaurant idea. The bank’s corporate home office has come up with a “social media score” based on some predictive modeling. I’m not sure how the model works, and I don’t know what a “bad score” means. All I know is that certain social media behaviors in certain combination are useful for predicting loan repayment rates. (In fact, even the data scientists who built the predictive model don’t know for sure what features of your online behavior are driving the results. It’s a very “black box”, data-goes-in-predictions-come-out sort of process. But the predictions are accurate even when tested on new data not used to build the model.)  After reviewing your score, I decide that you are a bad risk. I don’t approve your loan.

Does the second example seem worse than the first? Does it seem like a worse invasion of your privacy for the bank to turn you down than for your acquaintance to do the same? I think most people have an intuitive aversion to the second example but not the first, but it’s not clear why there is a difference. In both cases someone is judging your credit-worthiness based on information they can obtain about you. You might say that the first case is more acceptable because someone is judging someone else as a person; the second case is unacceptable because a computer algorithm, incapable of making a nuanced judgement of your character, is rating you based on easily obtainable data. But I think this intuition actually gets it backwards. The impersonal algorithm is more predictive and is making a more disciplined, better validated  estimate of your default likelihood; the human is the one who is being capricious.

Or perhaps the bank has an obligation to give you a loan because it’s a bank, but the human is making a private investment decision and can deny an investment on a whim. But this isn’t right because the bank has an obligation to its account-holders and investors to reject high-risk loans. If your friend who rejected your restaurant idea also has a savings account at the bank where you applied for the business load, he’d expect the bank to show the same judgment that he showed in person. The bank is just an intermediary for a bunch of small private investors. It can make riskier loans than its account-holders would make individually because of its size and risk-pooling effects, but it should have the same objective estimates of loan risk as its individual account holders would have if they were fully informed. As an intermediary it should be saying, “I should do what my investors would do if they knew what I know.” If the bank acquires an obligation to approve loans by nature of being a bank, it must also acquire an equivalent obligation to disapprove bad loans. 

I think that some people are just creeped out by the idea of someone doing data-mining on their social media profile. They imagine that an expletive-filled rant or unflattering pic from the wrong party will ruin a job opportunity or loan application. But it’s helpful to think about what a person would do with the same information. Lots of people see your social media posts and form judgments about you based on these, and I dare say most of these judgments are probably pretty accurate. Even the negative ones. I think you really can make a judgment about someone’s temperament, intelligence, and maturity by looking at their social media posts. (Clearly this can go wrong, too, I’m just saying that it’s more accurate than your “Don’t judge me!” impulse allows for.) If all this information meaningfully informs your friends as they form judgments about you, why should it suddenly become irrelevant when judging your credit risk or suitability for some particular job? People like to think they have an unrestrained right to privacy, but they don’t. Someone starting a long-term relationship with you, as a friend, lover, banker, employer, employee, landlord, or tenant, has a right to know what kind of risk they are taking on board. We like to think we have the right to present an edited profile to the world when it suits us, but if all that nasty stuff is relevant to predicting your future behavior, people who deal with you have a right to know about it.

Imagine you are trying to hire a nanny to watch your child, and applicants insist that you make your hiring decision based on edited reports of their personal histories. You would want all available, relevant information to assess the risk this person poses to your child. I'll bet you'd snoop. I'll bet you'd Google these candidates and check their Facebook profiles if they aren't private. In fact, I'll bet you'd snoop for a decision with far lower stakes than the hiring of a nanny, or for that matter the approval of a loan or approving a tenant to rent one of your properties. And if you found something incriminating, I'm guessing you wouldn't feel bad about your snooping. 

So what do we do with these battling intuitions? Should we close our eyes and pretend pertinent information doesn't exist? Or should we use all relevant information in important decision making? Whatever we do, we should have some kind of meaningful definition of "privacy" when discussing privacy concerns. It's hard to assert that a "right" exists, such as the right to privacy, if we aren't all clear on what exactly that right means.

Edit: Don't take any of this me advocating for some official government policy for or against privacy rights. Consider the possibility that the privacy genie might be out of the bottle, and perhaps there's nothing that government can do about it.