Nothing to Hide, Everything to Lose
The quiet cost of a life fully disclosed
A neighbor meets you at your door, holding an envelope, apologizing profusely. The letter was delivered to her by mistake. The numbers on your two houses are easy to confuse, and she opened it without looking, the way anyone might. By the time she realized it was yours, she had read it.
It is nothing, really. A clinic appointment reminder, or perhaps a tax assessment. Nothing shameful. She hands it over with a small laugh, and you laugh too, and say of course, no harm done.
But that’s not quite true. Walking back inside, you notice it: a faint sense of having been frisked without permission. Not robbed. Just — exposed.
But why should that bother you at all, when there was nothing to hide?
What We Mean When We Say Privacy
We talk about privacy as though it were secrecy; facts we want kept in the dark because they would cost us in the light. On that view, the person with nothing to hide has nothing to protect.
But the unease at the door tells another story. The letter held no secret. What was lost was something more profound: the right to decide who knew it, and when, and on what terms. You would have told your doctor; you might have even told your neighbor yourself, over coffee, in your own words. What you did not get to do was choose. And that, not the disclosure, is what rankles.
Privacy is not a wall around our shameful parts. It is the authorship of our own disclosure; it is the innermost room of what Isaiah Berlin called negative liberty, the area within which a person may act, and simply be, unobserved. It is where a self is assembled before it is exhibited. A person with no such shelter, Hannah Arendt saw, has nowhere to become anyone. This is not simply a modern anxiety. In 1890, alarmed by the new portable camera, the American lawyers Samuel Warren and Louis Brandeis named a right to be let alone, rooted in the dignity of the person. Brandeis, later a Supreme Court Justice, called it the most comprehensive of rights, the one most valued by free people. He saw, earlier than most, that the gravest threats to liberty arrive in the hands of officials certain they are doing good.
What Was Only Ever Temporary
This is the pattern. Not a removal of rights. Small concessions — each one reasonable on its own, each promised to be temporary.
In the summer of 1917, with the Great War in its third year and the treasury drained, Canada’s finance minister rose in Parliament to propose a tax on incomes, calling it a War Tax and suggesting only that it be reviewed once the fighting was over. The country understood it as temporary; the legislation ran to eleven pages. More than a century later it has never been repealed. It has since swollen into thousands of pages and become the single largest source of federal revenue. The United States traveled the same road; an income tax born as a Civil War measure, allowed to lapse, then made permanent by amendment.
There is no scandal in any single step. Wars need to be paid for, after all. But there is a deeply structural lesson. Once a temporary measure has been shown to work, once the capacity becomes something the state relies on, the measure does not go back in the box. The emergency passes. The instrument remains.
Now apply that law to something more intimate than money.
The Capacity That Stays
After 9/11, the United States passed sweeping new surveillance powers within weeks. The laws were written with sunset clauses so the emergency powers would not outlast the emergency itself. But they were renewed anyway, again and again. Under one of them, the National Security Agency came to collect the telephone records of hundreds of millions of Americans — who called whom, when, for how long — sweeping in innocent and suspect alike, and holding all this data indefinitely.
Set rights aside, and ask the question the program was actually sold on. Did it work? Multiple official reviews found the bulk collection had not prevented any attack. The apparatus remained regardless; a tool having been built for a specific purpose became a capacity kept for its own sake. Capacity, once it exists, does not sit idle.
What is different now is the scale of the moment. This is no longer one country, one emergency, one agency. Across democracies on nearly every continent, governments are simultaneously loosening the rules that once separated one record of a person from another — health from tax, tax from border, border from biometric — and are pushing single, permanent digital identities to hold it all together. The stated reasons vary by country: benefit fraud, illegal immigration, bureaucratic efficiency. The architecture is, with striking consistency, the same architecture. And it is rarely built by the state alone. It is built, licensed, and hosted by a small number of private technology firms; the same firms that already hold the most detailed behavioral record of human life ever assembled, because they built the platforms we spend our days on.
The Landlords of the Ledger
Sit with what that combination affords.
A government’s data was historically fragmented by design; a feature, not an oversight. The tax office did not know what the health system knew. That fragmentation was inefficient, and it was also, quietly, a form of protection. No single actor, not even a government official, could see the whole of an individual’s life at once.
A national digital identity dissolves this fragmentation, making every fragment accessible by the same key. But the company holding that key already knows what you search for at midnight, what you buy and return, where your phone rests overnight, whose faces appear beside yours in your photos, what your resting heart rate does when a certain name appears on screen. Then that ledger stops simply being a record of transactions with the state; it becomes a continuously updated model of each individual, held by a private, for-profit, entity that answers to shareholders before it answers to voters, politicians or regulators.
Consider what that model is worth, once assembled. It can price you individually rather than fairly, charging what your desperation, not the market, will bear. It can decide, invisibly, on what to offer and at what price. Because the model knows whether you pick up that steak at the grocery store before putting it back, whether you clicked on that job listing, the loan offer, the flight at that fare. It can predict the argument, the illness, the vulnerability before you have said a word about it, and sell that prediction to whoever will pay for early access to your next decision. None of this requires a villain pulling a lever. It only requires the ledger to exist, and a business model that rewards whoever controls access to it.
The people who built the largest platforms did not set out, for the most part, to build instruments of state power. They set out to hold attention and sell it. But a government building a national identity system rarely has the appetite or the speed to do so from nothing. It turns to the firms that already have the pipes and the engineers. The contract is framed as partnership. What it produces is fusion: the compulsion of the state grafted to the intimacy of the platform. A government gains reach it could never have built. A company gains a client no advertiser can match; one with the power to make its product legally unavoidable.
This is not a hypothetical. Health systems in Britain, for example, handed patient records to outside data firms on emergency contracts during the pandemic that, once in place, were never fully unwound. The data company’s own language for the strategy, in this case, is refreshingly candid: land, and expand. National identity schemes sold as the answer to fraud or immigration have been proposed, resisted, narrowed, and quietly rebuilt in the same countries within a single parliamentary term. The compulsory element is sometimes withdrawn after public outcry, which proves only that policy can move backward as well as forward. The architecture underneath is rarely dismantled. It simply waits for a friendlier season.
And the abuses that follow are not, mostly, committed by tyrants. At the world’s most secretive intelligence agency, the NSA, investigators disclosed a category of misuse with its own grim nickname — love intelligence — analysts who turned the machinery of national surveillance on their own romantic lives. One analyst entered a former girlfriend’s six email addresses into the system on his first day of access. Most cases surfaced only because the analyst confessed or failed a polygraph. The heaviest punishment on record was a paltry two-month cut in pay.
Ordinary police officers have also been found misusing confidential databases to look up partners, neighbors, rivals; licence-plate networks installed to fight car theft have quietly become tools for following the people in an officer’s private life. None of these people were masterminds. They were jealous, curious, ordinary human beings; people with a search bar, holding a key never meant to fit so many doors. The danger of the machine was never primarily that a tyrant would seize it. It is that ordinary human weakness reaches it first, and a business model reaches it second, and neither has to ask permission.
Nothing to Hide
Set against all this is a record we already have, and it does not provide reassurance. In 2023, a police service in Northern Ireland published, by accident, a spreadsheet naming every one of its officers, in a place where many had spent careers concealing that they were police at all. The data reached paramilitary groups within days; officers moved house and lived in fear. The regulator called it the worst breach his office had ever seen, and fined the force a fraction of what the rules allowed, precisely because it was a public body and he did not wish to divert public money from public service. But the damage was done, because the breached data can never be recalled.
The private record is no better, only better funded. A credit bureau lost the financial identities of nearly half the American adult population; the settlement offered a few dollars for each person affected, and no one went to prison. A social network let the data of tens of millions flow to a political consultancy. The regulator’s record-breaking fine landed, and the company’s share price rose that same day, the market reading the penalty, correctly, as simply the cost of doing business.
Underneath the absence of consequence sits a harder fact. The data does not simply sit and wait to be misused. In the ordinary course of business, it is sold; bundled into profiles, fed to ranking and pricing algorithms, licensed onward to firms you have never heard of. You did not ask to be a line item in someone else’s revenue model. But you carry the downside if it goes wrong, and the record above suggests the businesses who benefit carry almost none of the downsides. That asymmetry is the part no privacy policy is written to fix, and no digital identity card is built to disclose.
Which returns us to the argument that ends most conversations before they begin. If you’ve nothing to hide, you’ve nothing to fear. The honest response to this argument is the one you felt at your own front door. Would the person making this excuse be content for their medical file, their bank statements, their late-night searches, to be read by a stranger, or modeled by a company deciding what to charge them for services? They have nothing to hide, and yet they still would not hand it over. The argument redefines what privacy is for; a reward for innocence, rather than the precondition of a self that can change its mind, hold an unpopular thought, make a mistake and outgrow it. The philosopher Immanuel Kant drew a line between things that have a price and things that have dignity. A price means a thing can be exchanged for an equivalent; dignity cannot. Data has a price. A person rendered into data, mined and scored and made visible to systems they cannot see, is being moved from the second category into the first.
The Counter-Argument
On the flip side, there is a counter-argument. People die on waiting lists that better-connected data could shorten. Fraud is money taken from the sick and the old. Borders and security are real responsibilities of government. And the abuses, a fair critic must allow, are the exception, not the rule — caught, named, sometimes punished — while the overwhelming majority of daily queries into these systems are entirely legitimate.
Each part of that argument is true, and none of it should be waved away. But notice what it rests on: the premise that only a system this large, this permanent, this privately built and centrally held, can meet these aims. Illegal work can be checked without a national identity system tied to a corporate ledger. Fraud is already pursued with warrants and targeted audits, not standing access to everyone’s behavior. Narrower tools already exist, are already in use, and are being set aside anyway, which suggests the case for scale was never entirely about the stated goal. Some of it was about convenience, and profit for the firms supplying it.
The rest of the argument assumes something further: that today’s terms of use are tomorrow’s, that safeguards described now will still hold under hands not yet chosen, companies not yet founded, incentives not yet invented. History says otherwise. The temporary tax never left. The program that caught no one was kept for years regardless. You cannot meaningfully consent to uses not yet imagined, on a platform whose whole commercial virtue, to the firm holding it, is that it can be extended to purposes its architects never named aloud.
—
The neighbor at the door did nothing wrong. That was always the point. The injury was not in her actions. It was that, for that moment, you were not the author of your own disclosure. Someone else decided what was known about you, how that information was used and you found out afterward.
A society can be built so that this happens once, by accident, and we can laugh it off. Or it can be built so the moment becomes the permanent condition — lawful, frictionless, well-intentioned, profitable, total — and it becomes no laughing matter. We are being deprived of our privacy in installments, each measure sold as safety or convenience, each promised to be temporary, each a little harder to refuse than the last.
There is a version of this story where it ends differently. In the movie The Dark Knight, Batman builds a system with the power to listen to 30 million phones in the city to locate one criminal. He hands the one person he trusts to operate the machine, the person who objected to such power being concentrated, the key to destroy the machine. When the danger passes, Batman and his colleague keep their word — the machine that could see everything sees nothing again. It is one of the more telling scenes Hollywood has offered about power. It is also entirely fictional. Nowhere in the record we have just walked through — the tax that outlived the war, the metadata program renewed long after it caught no one, the ledger built jointly by governments and the firms that already know us best — does anyone hold the key and choose, unprompted, to destroy it, to not use it.
Lord Acton said it before any of these machines existed: power tends to corrupt, and absolute power corrupts absolutely. The rarer thing — the person, or the company, that having built the absolute power, dismantles it — exists, so far, only on a screen.
So perhaps the question to sit with is not whether you trust the hands that hold your life today. It is whether anything built for your protection has ever, once the danger passed, been quietly handed back. And whether, by the time you think to ask, there will be any door left to close.
© The Good Human Practice | Published every other Thursday
If this resonated, I’d love to have you as a free subscriber — and forward this to a leader who is reflecting on clarity and character in how they make their decisions.
The Good Human Practice is a biweekly reflection on living with purpose, not just profit — written as I try to reconcile what’s happening in the world with what the great traditions teach us, and what I believe it means to live and lead well.
There are no tidy conclusions here. Only honest reflection and contemplation.
The inner work of leadership has a counterpart. If you’re also navigating high-stakes decisions and want frameworks for the outer clarity, I write separately about that in a free Substack newsletter: theuncertaintyedge.com