A quick update about the Facebook governance post I wrote a while ago where I wondered whether disclosing private facts about yourself on your Facebook page would constitute "public disclosure of private facts" and thereby prevent you from claiming invasion of privacy should a friend disclose something they discovered on your semi-private profile:
... American law prevents me from disclosing private facts about Alice that are not news worthy. However, if Alice had disclosed such private facts in a public space (perhaps in front of a large audience), I can pass on the facts to others and even publish them.
But what if Alice discloses her private fact on her Facebook profile? It remains private in the sense that only I and her friends can see it by logging into Facebook’s private service, but it also arguably public in the sense that I and her friends are also an audience. Does it matter how many friends she has? What privacy settings did she have in place?
Through a Slashdot post, I just stumbled across a case that hinged on a very similar fact pattern, Moreno vs. Hanford Setinel. The judge decided that since a teenager wrote a post on her MySpace blog revealing facts she believed (and now regretfully wishes) were private, she could not claim a breach of privacy under the doctrine.
The judge astutely points out that since the teenager's MySpace page and blog were publicly available to "anyone with a computer and Internet connection.", they couldn't be considered private even if she believed her actual audience to be tiny. But this leaves open the question of whether using Facebook's privacy settings would create a particular level of security that would classify the profile and facts as "private."
Obviously details about actions and relationships matter a great deal in determining whether privacy has been breached and whether certain disclosures are public "enough" to negate a plaintiff's privacy claim. But what is still interesting to me, is whether certain technical choices a user can make on Facebook are substantial enough to shift a profile from being public to being private in the eyes of the law.
As Lessig argues, code is law, but in this case, we might be able to see it the other way around: Facebook's code could amount to sufficient law.