Whose risk and wellbeing? Three perspectives of online privacy in relation to children and young people’s wellbeing

Introduction

During the course of applied research into the challenges of providing integrated government services to support children and young people (CYP) at risk, a school principal recounted an incident involving an attempted suicide by a pupil at the school (Balnaves and Luca, 2006). The student, who had recently arrived at the school, attempted to take his own life during an excursion. Although he had a documented history of mental health issues and suicide ideation, this was not communicated to the school – in part because of concerns about privacy in sharing his case history. This meant that critical information was not shared with staff at his new school that would have drawn attention to the young man’s suicidal tendency. Sometimes, the privacy of CYP is accorded more importance than their overall wellbeing. Discussions about the rights of CYP typically privilege their right to protection from harm over other rights, such as rights to provision and participation (Third and Collin, 2016); however, deeper investigation reveals something more complex at play.

This article examines this complexity by first examining the macro-perspective of policy and governance; that is, the challenges arising from efforts by governments to mitigate breaches of privacy through regulation of online access to, and the shaping of, CYP’s digital practices. The second part explores how schools and service providers at the meso-level face difficult challenges in sharing information about CYP. Third, the attitudes of CYP are sometimes at odds with, or absent from, widely held assumptions about what is in their best interests and beneficial to their wellbeing and development. A corollary of this is who determines what is in their best interests and the role that CYP play in this determination. Therefore, the next part of this discussion draws on perspectives of privacy derived from CYP themselves at the micro-level on giving and withholding personal information online, its theft and potential impact disclosure of private online information that may impact the individual’s ‘digital footprint’ later in life. Finally, wider implications in relation to datafication and dataveillance are explored.

In recent decades, human governance and related policy discourses have been characterised by concerns with risk (Beck, 1992) and with human responsibility ‘attached to risk’ (Lupton, 2006: 12). Seen to be ‘at risk’ and ‘as risk’, CYP are often a target of risk-factor analyses shaping these discourses (Black and Walsh, 2015).

This risk-factor approach analyses their current behaviours and circumstances to predict and mitigate potential problems (France et al., 2010) in relation to both themselves and to others. But ‘[a]wareness of Internet risks and the presence of risk-taking’ can be a positive basis for self-development of CYP in areas such as media literacy (Buckingham, 2004: 12). At a broader level, recent research suggests that a shift from risk to resilience is taking place in broader policy and practice. This shift presents a way forward to ensuring that the work of policy-makers, educators, service providers and non-government actors are more aligned to the lived experiences of young people. It entails moving from deficit assumptions about youth ‘at-risk’ and ‘as risky to others’ to a more nuanced understanding of CYP as learning, living within and shaped by social ecologies of resilience in which their agency can shape policy and practice. But particular challenges persist in the sharing of information at the meso-level, as will be discussed below.

Context of this research

This article reflects on two discreet research projects. The first was the Smart Communities Research Project (Kabir and Balnaves, 2006; Scott, 2005), which involved applied research into the challenges and opportunities for government services and schools to support CYP at risk. Quantitative and qualitative fieldwork was conducted into the communication patterns and information sharing by schools and service providers about CYP. The second project, also funded by Australian Research Council, was the Young People, Technology and Wellbeing Research Facility, which sought qualitative evidence of how CYP conceptualise risk and how they negotiate this in their everyday online activities. Participant names have been replaced with pseudonyms. A third strand of research is an examination of policy development in the areas of CYP’s online activities, with a particular focus on cybersafety policy during the last decade. This combined research provides three discrete but intersecting insights into the challenges of fostering awareness of and protecting privacy in relation to the wellbeing of CYP.

Macro-level policy and strategies to address privacy concerns

In Australia, policy has five features salient to this discussion. First, a turning point took place in 2012 when the Gillard government (2010–2013) moved away from taking a ‘walled approach’ to Internet access by ceasing development of a national Internet filter. Collin recognised ‘this is a major shift from blocking or filtering to an emphasis on skills to recognise, respond, and most importantly seek help when [children are] having negative experiences online’ (cited in Palmer, 2013). Second, multi-sectoral approaches have been pursued through programmes involving the collaboration with industry, community, consumer organisations and schools to raise awareness about how people can protect their personal information online (e.g. Australian Government, 2016; SOSO, 2013). Other government approaches have sought to persuade greater industry engagement through the adoption of codes and other protective measures (e.g. Prime Minister of Australia, 2013). Third, cybersafety initiatives have tended to focus on aspects of technology usage, such as security, privacy through community- and individually-based responses. The federal government through the Office of the eSafety Commissioner, for example, produced resources and a framework for schools to compose individual school and community-specific approaches (Australian Government, 2018).

These multi-stakeholder efforts to improve aspects of cybersafety, such as privacy, have typically targeted social ecologies made up of various interconnected actors, forces and discourses surrounding CYP, ranging from government to schools, parents, service providers and peers. The concept of how social-ecological contexts shape child development has been used to inform the development of broader indicators of children’s wellbeing. In addressing child health, it has been argued that

it is important to appreciate the contexts in which children live their lives – the family, the school, and the community – and the interaction between them. These settings are inter-related and interdependent. They are set within a wider social, economic, cultural and political context. Changes in one context have the capacity to influence changes in others … Because of the complexity of the relationships between children, families and communities this system has been described as an ‘ecological’ system. (Zubrick et al., 2000: 11)

Fourth, policies and strategies to address concerns about the privacy of CYP have traditionally been imbued with discourses that strongly associate risk with CYP – discourses which continue to prevail in other areas of youth policy and practice (Collin et al., 2015). There are two manifestations of this association. The first is ‘youth at risk’. In health policy, for example, risk factors comprise ‘Those characteristics, variables or hazards that, if present for a given individual, make it more likely that this individual, rather than someone selected at random from the general population, will develop a disorder or adverse outcome’ (Zubrick et al., 2000: viii). Policy discourses of cybersafety typically seek to ‘protect’ security and safety in ways that position CYP as vulnerable, careless or lacking awareness, and who are unable to exercise sufficient judgement required to manoeuvre and navigate online threats such as privacy breaches. It treats them as in need of education about, and protection from, threats to their privacy, safety and wellbeing. The second dimension is ‘youth as risk’, which positions young people and their online practices as the sources or causes of risk. The digital practices of CYP are as treated as sites of containment and control, in need of correction and protection (Hartley, 2010).

Finally, a fifth and related feature of policy discourse is a double taxonomy of autonomy and control. While policy has recognised the importance of actors at the community level, regulatory guidelines seeking to control behaviours and activities online continue to prevail alongside a greater focus on building resilience. This focus on regulating online behaviour (Third and Collin, 2016) features logics of risk and responsibilisation seeking to govern CYP’s online identities and practices at local and individual levels. Following on from above, most of these approaches feature a deficit emphasis on risks and ‘online dangers’ rather than the positive uses and benefits of technology. In addition, there has arguably been a subtle shift away from policy seeking to mitigate risk through centralised control to resilience developed at the level of individuals and their communities. This is consistent with other scholarship: Livingstone et al. (2015) have argued that controlling online activities and access is delimited and more emphasis needs to be placed on resilient ‘coping responses’, such as self-regulation.

The assumption of recent policy in general that risks are calculable and manageable appears to be giving way, to some extent, to a ‘logic of resilience’, which ‘doesn’t require some all-seeing government agency that seeks to know and regulate everything in a territory but nor does it seek to devolve all responsibilities to isolated, autonomous individualised subjects’; rather, ‘strategies of resilience seek to make use of the natural capacities of living human beings to come to terms with adversity when they are a part of supportive networks of community affiliation’ (Rose, 2014). Resilience is socially embedded (Ungar, 2011) and grows through caring relationships, opportunities ‘to participate, to take and be given responsibility for others, and to contribute to their communities’ (Rose and Lentzos, 2015: 17–18). This can be seen in the orientation of policy related to privacy away from walled approaches described above to community-level responses within their social ecologies. But such approaches continue to face challenges of governance and implementation at the meso-level of sharing information, which returns us to the troubling story at the beginning of this article.

Where the rubber hits the road: meso-level challenges in schools

During the Smart Communities Research Project, 28 interviews and one focus group discussion were conducted with teachers and other service providers involved in the identification and sharing of information about children at risk. Fifty semi-structured questions and a brief Likert-type test were used to guide this exploratory and mainly qualitative research (Scott, 2005). This article will draw from two schools identified for research that experienced daily challenges in addressing the needs of ‘at-risk’ CYP: one school was located east of the Australian city of Perth; the other was situated to the north of the city. Both routinely had high proportions of ‘at risk’ students and relied on external actors and support networks to address issues of student wellbeing. Interviewees included two school principals and school personnel including psychologists, nurses and pastoral care coordinators. Managers and caseworkers from agencies such as the Department of Community Development, Department of Justice, Centrelink and the Police were also interviewed.

Interviews explored privacy challenges arising from the storage and sharing of information between service providers about CYP at risk. Information about individuals deemed to be at risk was often difficult to obtain and disseminate due to legal issues of privacy and confidentiality. Interviewees in the study reported a lack of information about what support services were available to CYP at risk, and specifically to whom at-risk individuals could be referred. The data suggested persistent challenges related to a lack of clear governance frameworks between the schools and service providers that inhibited communication between support agencies, schools and other individuals seeking to support CYP at risk. These in turn prevented the effective sharing of information and services about those CYP. Informal communication modes of communication instead played a central role (e.g. through word of mouth). Information was not stored and written communication was often avoided. In part, this was due to confidentiality and privacy concerns.

Individuals, such as school management and brokers, drove informal communication between stakeholders and agencies. In the absence of a clearly defined systemic approach, the professional judgements of these individuals were critical in terms of what to disclose, when to disclose it and to whom. Whether confidentiality took primacy over information sharing differed, depending on the actor or agency. For example, one government department’s internal governance framework considered confidentiality a priority over the sharing of information. A few interviewees also indicated that sharing information could also work against the professional standing of the individual service providers, who saw themselves as being legally at risk.

Definitions of what constituted a child or young person at risk also differed widely among agencies and personnel, ranging from dropping out of school and self-harm, to the harm of others (e.g. domestic violence). Calculations of risk ran two ways – both in relation to service providers and CYP – in that sharing of information could be risky either to the information provider, the person associated with the information or both. Legal matters of privacy and confidentiality required service providers to get approval to act and obtain support in addressing at-risk individuals. Designed to mitigate risk to providers, the schools and their students, such legal requirements were seen to inhibit the capacity of the schools and providers to work in what they saw as the best interests of CYP. Consequently, some CYP slipped through the cracks, such as the case of attempted suicide described at the start of this article. The young student had barely arrived at the school when during a school excursion, as one interviewee recalled,

suddenly this very alienated kid started to jump under a bus, a moving bus so the kid had to be restrained. The cops … arrived because … people … were alarmed at these grown-ups manhandling a kid and what had happened is that DCD [Department of Community Development] had dropped him into the program but hadn’t told us that this kid had suicide tendencies. (Cited in Balnaves and Luca, 2006: 49)

Better sharing of knowledge might have prevented the attempted suicide occurring. It highlights an example of when these systems of information sharing break down, ultimately failing to work in the best interests of the young person’s wellbeing. A key factor at the heart of this is a ‘tension between privacy as a negative right and collaborative helping as a positive right’ (Kabir and Balnaves, 2006). A school health nurse interviewed during the course of research placed high value of confidentiality in relation to the Privacy Act, giving the personal example of a refusing to provide information to police about a sexually abused client because he or she was a minor and ‘very vulnerable’. The nurse was cautious, asking

where [is the minor’s information] going, where is it leading? Who wants to know? Where will it be stored? What will be the outcomes in the future for this kid? As a 14 year old, if they’re reckless and get into things, you know, do they get a black record against them by the time they’re 19? What will that information be used for if it’s disclosed? (Cited in Kabir and Balnaves, 2006)

In the case of the young man who attempted suicide, the principal developed informal mechanisms such as purchasing a mobile phone for use by a local policeman who was seen by the principal to be best placed to provide him with key information about young people at risk in that community. This was done discreetly as it potentially contravened the law but was seen to be a necessary work-around in a community that had a high proportion of CYP at risk to themselves and, at times, others.

How young people navigate boundaries at the micro-level

CYP’s attitudes, knowledge and capabilities in relation to navigating risks are often peripheral or absent from informing efforts to protect their wellbeing. This leads us to the second research project, which provides insight into CYP’s attitudes to online privacy.

During the Young People, Technology and Wellbeing Research Facility, ethnographic data were collected during interviews and focus groups with CYP (n = 68) between 2011 and 2014 in the Australian states of Victoria and New South Wales, as well as a biographical narrative methodology (Wengraf, 2001) to ask 12- to 18-year-olds to imagine how technology affects them in the present and future.

Haley, a vivacious 12-year-old interviewee residing in an outer-Melbourne suburb, was by her own admission a social creature: ‘Well I love being social … all day’. After school, she was constantly connected, using an array of applications to connect to peers and areas of interest. Her ‘iPod’s like my best friend so I don’t ever want to leave it’. While Haley made some distinctions between the type and value of mediated and unmediated interactions – for example, ‘when you’re talking face-to-face you can be honest with the person and be truthful’ – there appeared to be few boundaries between online and offline worlds. They were intersecting and equally as real, meaningful and mutually constituted (Lind, 2013; Rheingold, 2006).

Like many participants in the study, Haley demonstrated keen awareness of the risks to privacy while online, learning about the risks and opportunities of digital media through exploration and experimentation with the technology – to ‘fool around until I get what’s supposed to be happening and how to actually work on it’. Haley used an avatar to represent herself as a precaution against unwanted and potentially predatory interactions. She exhibited a high level of media literacy to navigate the potentially harmful dimensions of online life; for example, she checked the profiles of other users to ascertain if they were what she considered to be legitimate. If the user, for example, ‘is 20 years old’ then she exercised caution. Haley relied more on email rather than text messaging because she was wary of the dangers of personal information being compromised: ‘I don’t want to give anything because if someone hacks my account or does something to try and get my personal information or tries to hurt my feelings’. Another 14-year-old male demonstrated similar awareness:

there are people out there who can try to steal accounts and passwords … You should not try to befriend people you have not met or talken [sic] to because: There are sexual predators out there, hackers and cyber-bullies.

The evidence suggests that while CYP demonstrate awareness of these kinds of privacy concerns, they show lesser degrees of engagement with the implications of their digital footprint (Australian Communications and Media Authority (ACMA), 2013) and its potential impact on personal reputation and future employment. But an awareness of digital footprints emerged during the study. Another 17-year-old participant, Rick, expressed no concerns about unwanted online interactions, but like Haley, he took precautions nevertheless. His online profile was managed so that it did not include information that might jeopardise future job or other applications: ‘I’ve got all my settings on, like, private so no one can actually access my profile unless they’re friends with me … There’s nothing on there that I’m worried about anyway’. Other participants exhibited this awareness and digital competence. ‘To quote someone online’, one focus group participant said, ‘that embarrassing video of you dancing is going to last longer than the pyramids of Giza’. Awareness of reputational damage was highlighted during focus group discussions:

A girl that used to be in my school … sent nudes [via Facebook] to her boyfriend at the time … They had a fight and he went and posted all her photos all over Facebook so everyone saw … this has haunted her at all her other schools now

to which she reportedly moved three times as a result of that reputational damage.

Deficit approaches by adults to privacy arguably respond to perceptions of risk in excessive ways that overstate privacy concerns. For example, Green et al. (2011) found that like Rick, 83% of CYP in Australia are likely to have their profiles set to private or partially private. This echoes findings in the United States. While American teenagers are ‘sharing more information about themselves on social media sites than they have in the past … they are also taking a variety of technical and non-technical steps to manage the privacy of that information’ (Madden et al., 2013).

This is not to diminish certain very real risks – particularly for children. For example, Australian research found that children as young as 8 are sharing photos with strangers and arranging to meet them. In all, 89% of 8- to 9-year-olds and 87% of 10- to 11-year-olds shared their password (or passcode) with someone else (ACMA, 2013). PEW research in the United States has also found that despite taking privacy-protective actions, ‘teen social media users do not express a high level of concern about third-parties (such as businesses or advertisers) accessing their data; just 9 per cent say they are “very” concerned’ (Madden et al., 2013).

Turning back to the macro-perspective, something deeper is also going on here as modern notions of what constitutes public and private are being reconfigured, if not manipulated, by powerful forces seeking to exploit the datafication of people’s lives. Information storage has advanced exponentially since the Smart Communities Research Project took place. Today, as large volumes of private data are being collected by government and corporate actors, the ‘dataveillance or the monitoring and evaluation of children by themselves or others … may include recording and assessing details of their appearance, growth, development, health, social relationships, moods, behaviour, educational achievements and other features’ (Lupton and Williamson, 2017: 781). Such surveillance challenges ‘modernist assumptions about the individual subject as essentially functioning in private unless they step, as a deliberate act, into the public realm’ (Livingstone and Third, 2017: 665). This raises significant questions about rights to provision, protection and participation; ‘researchers along with policy-makers and the public are now debating whether “the digital age” is enhancing or undermining children’s rights, with current controversies centring on children’s right to privacy online as offline …’ (Livingstone, 2016: 5).

In Lupton and Williamson’s (2017: 871) assessment, children are configured as ‘algorithmic assemblages’ for the benefit of state and commerce, with their agency reduced to responding to ‘choice among pre-set options, based on both personal and algorithmic calculations generally far from grounded in the child’s best interests. Children become ever more spoken for rather than speaking subjects’ (Livingstone and Third, 2017: 665).

CYP’s voices are underutilised in shaping privacy policy and practice. More inclusive approaches to these challenges and opportunities are needed that entail a shift from risk to resilience (Third, 2014) derived from the social ecologies of young people, including peers and educators. In confronting the contemporary challenges of privacy, risk-averse governments and service providers perhaps need to develop resilience themselves based on a more nuanced and inclusive understanding of the wellbeing, attitudes and practices of CYP. As Livingstone and Third (2017) suggest, ‘The key question confronting the policy and practice community is thus, “How can we foster children’s protection from harm online while simultaneously empowering them to maximize the opportunities of the digital age?”’ (p. 666). Answering this requires active and critical attention to participation, as well as provision and protection in relation to controlling CYP’s data. At the same time, critical pedagogy and media literacy are needed to raise awareness in CYP of, and develop responses to, navigating issues of privacy online, such as the effects of dataveillance.

Conclusion

This discussion has sought to explore the interconnected challenges arising in relation to online privacy through macro-, meso- and micro-perspectives, ranging from policy-makers to practitioners in school communities and especially CYP themselves. Where it is not uncommon to see a disconnect of the macro- and meso-levels from the micro-level of CYP’s experiences, this article has attempted to connect these by using a social-ecological lens. It is acknowledged that the benefits to learning, individual and social development of online participation must be weighed against potential and real harms. At the meso-level of schools, where ‘the rubber hits the road’, challenges persist in relation to the practical and legal constraints experienced by schools and service providers in sharing information necessary to respond to CYP at risk. But a case can be made for a better understanding and alignment of macro-, meso- and micro-perspectives of privacy in relation to CYP.