1.5.2 - Privacy, censorship and online conduct

Censorship, harm and expression

Censorship restricts access to information or its publication. On the Internet, controls may block sites, remove material, filter search results or prevent particular users posting. A government, platform, employer or school can impose controls, but their aims and powers differ. A school filter intended to protect pupils is not the same context as a government blocking criticism of its policies.

Restricting clearly harmful material can protect users, prevent exposure to abuse and make a community usable. Yet a control can also prevent legitimate learning, suppress political criticism or exclude minority perspectives. A filter that blocks a sexual-health information page because it contains a sensitive keyword removes useful information along with the material it was intended to block. Overblocking occurs when a control restricts legitimate material beyond its aim.

The benefit of a control depends on the harm it prevents and whether it reaches the intended content. The cost depends on what legitimate expression it removes and who loses access. A narrowly stated rule, published reasons, context-sensitive review and an appeal route can reduce arbitrary removal. They do not guarantee perfect decisions: context takes time to assess, and users can evade simple filters through changed wording or other services.

Freedom of expression and protection from harm can both matter. A supported judgement explains the proposed restriction, its benefit, its adverse consequence and why its scope or safeguards are justified. Merely saying "the Internet should be free" or "all offensive content should be banned" leaves the difficult boundary unexplained. OCR clarification, printed p16

Monitoring behaviour and privacy

Monitoring records or observes behaviour. CCTV can record movement; GPS can record locations; call logs can reveal contacts and times; email monitoring can reveal communications. The choice of data, detail, duration and access determines the intrusion. Recording a delivery van's position during a shift is different from retaining a driver's location throughout their private evening.

Monitoring can help detect theft, investigate an incident, locate a missing vehicle or identify a worker who needs assistance. It can also reveal routines, private associations or sensitive activities unrelated to the aim. People may change lawful behaviour because they believe they are watched, or lose trust if monitoring is hidden or broader than expected. Recorded information can cause further harm if leaked or misused by someone with access.

Consider GPS for a delivery company. Current vehicle position helps route a nearby driver to an urgent collection. Retaining every driver's movement indefinitely is not necessary merely to know who is nearby now. Limiting collection to work time, retaining only what is justified, restricting access and explaining the purpose can reduce the privacy cost. Some incident evidence may need longer retention; that reason should be specific, rather than an excuse to preserve all journeys forever.

Proportionality asks whether the intrusion is justified by the aim and whether less intrusive measures could achieve it. Ethics is not settled solely by technical capability or an employer's ownership of equipment. Legal permission, transparency, fairness and the impact on people require separate consideration. Do not assume all monitoring is unlawful or all disclosed monitoring is ethically acceptable. ICO: monitoring workers

Analysing information and inferring profiles

Profiling uses information about people to infer or predict characteristics, interests or behaviour. Analysis can combine records collected separately: a purchase, browsing visit and location record may reveal more together than any one alone. An inferred characteristic is a prediction, not a guaranteed fact. Removing a visible name does not necessarily prevent linking the profile back to an account.

A retailer can use purchase patterns to recommend useful goods or plan stock. Customers may gain relevant offers, while the retailer reduces wasted promotions. The same analysis can expose sensitive interests, manipulate a vulnerable customer or support unfair differential treatment. A customer's old purchase made for someone else may produce a mistaken inference about their own needs.

Medical records illustrate the same opportunity and risk. Suitable analysis can identify patterns that help plan services or support research. Identifiable health details are sensitive, so unnecessary access, re-identification or an inaccurate label can harm patients. A useful aggregate result does not justify exposing each patient's record to everyone who wants it. Choosing necessary fields, protecting identities, controlling access and checking the quality of conclusions all matter.