Privacy by Design for the Self 2.3A.2

Privacy as Structural Precondition

Traditional Objectivism (TO), practiced in Arc 1, established independence as one of the Seven Virtues — the practice of making decisions from your own assessment of the evidence rather than outsourcing evaluation to social pressure. Open Objectivism (OO), practiced in Arc 2, deepened that independence through fallibilism: the discipline of holding convictions open to correction, which requires the cognitive freedom to revise without external penalty. Both arcs assumed, without explicitly naming it, a structural condition: that the individual has a domain of thought, decision, and self-assessment that is not subject to involuntary observation.

That assumption is no longer structurally guaranteed. The default condition of digital life is exposure. Every search query, purchase, communication, location, biometric reading, and social interaction generates data. That data is collected, aggregated, analyzed, and monetized by entities whose governance the individual typically cannot audit and whose terms the individual cannot meaningfully negotiate. The result is an information environment in which the structural precondition of independence — a domain of sovereignty that belongs to the person — has been eroded not by force but by architecture.

Privacy by design — one of Resilient Objectivism (RO)'s design patterns, constructed in (1.2.4) — addresses this by treating privacy as a structural requirement rather than a preference. The principle, drawn from the asymmetry principle constructed in Phase I, is that institutions must be transparent and persons must be opaque. At the individual level, this translates into a design discipline: organize your data environment so that exposure is a choice, not a default.

Four Disciplines of Personal Privacy

The individual practice of privacy by design operates through four disciplines, each addressing a different mechanism by which sovereignty is eroded.

Minimize. Reduce your data footprint. Every piece of data that exists about you is data that can be accessed, aggregated, leaked, subpoenaed, or monetized. The minimization discipline asks: for each system I use, what data does it collect? Is the collection necessary for the function I am using? Can I achieve the same function with less data exposure? In practice, this means auditing app permissions, disabling telemetry that exceeds functional requirements, using privacy-respecting alternatives where they exist, and declining to provide information that is requested but not required.

Separate. Compartmentalize functions. The aggregation of data across domains — health, finance, work, personal communications, location — creates a composite profile far more revealing than any individual dataset. Compartmentalization means using different accounts, devices, or identities for different functions where feasible. The principle is the same one that governs institutional security design: a breach in one domain should not compromise data held for another. At the individual level, this translates into structural separation — not paranoia, but disciplined architecture.

Encrypt. Protect data at rest and in transit. Encryption is not a technical luxury — it is the structural mechanism that makes the distinction between "data that exists" and "data that is accessible" meaningful. End-to-end encrypted communication ensures that only the intended parties can read the content. Full-disk encryption on devices ensures that a lost or stolen device does not become a data breach. Encrypted backups ensure that recovery mechanisms do not create new exposure points. The practice is not difficult. The difficulty is making it habitual — treating unencrypted transmission or storage of sensitive data as the structural equivalent of leaving a door unlocked.

Selectively disclose. Prove outcomes without exposing identity. This is the applied form of RO's principle that processes should be public by default; persons should be private by default. In practice, selective disclosure means using mechanisms that prove a claim without revealing the underlying data: proving you are over 18 without revealing your birthdate; proving you hold a qualification without revealing your transcript; proving you paid without revealing your balance. The tools for selective disclosure exist — anonymous credentials, attestations, and commitment mechanisms constructed in Phase I (1.2.4). The individual practice is learning to use them where they are available and to demand them where they are not.

The Personal Data Map

The starting tool for individual privacy practice is the personal data map — a structured inventory of your data environment.

The map tracks four dimensions for each significant data relationship: what data exists (the type and sensitivity), where it is held (which institution, service, or device), who can access it (the custodian, its employees, its partners, law enforcement under what conditions), and what would happen if it leaked (the consequence assessment — embarrassment, financial loss, identity theft, professional damage, physical risk).

Most people who complete the Personal Data Map discover two things. First, their data environment is far more exposed than they assumed — they are sharing data with institutions they have forgotten about, through permissions they granted without reading, under terms that have changed since they agreed. Second, the consequence assessment is not uniform — some data relationships carry minimal risk if compromised, while others carry risk that would justify significant effort to reduce.

The map does not prescribe action. It provides the structural visibility that makes rational action possible. Without it, privacy decisions are made on guesswork and anxiety rather than on assessed risk and prioritized response.

Selective Disclosure in Practice

Selective disclosure is the most structurally distinctive of the four disciplines because it changes the default assumption about what proof requires.

The conventional approach to proving a claim about yourself — your age, your qualifications, your creditworthiness, your health status — is to reveal the underlying data. You show your ID, share your transcript, provide your financial statements, submit your medical records. Each act of proof creates an exposure: the verifier now holds data about you that exceeds what the verification required.

Selective disclosure reverses this. Instead of revealing data, you prove a property of the data. An anonymous credential proves you belong to a class (over 18, licensed professional, credit score above a threshold) without revealing your identity. An attestation confirms a fact (this person completed this program, this payment was made) without exposing the details. A commitment mechanism lets you commit to a value (a bid, a vote, an assessment) in a way that is verifiable after the fact without being visible during the process.

The individual practice is twofold. First, use selective disclosure mechanisms where they exist — and they exist more broadly than most people realize, particularly in financial services, professional credentialing, and age verification. Second, demand them where they do not yet exist — when an institution requires more data than a verification should need, that demand is itself a signal about the institution's data practices.

The failure mode of selective disclosure is fatalism — the assumption that you cannot control what you reveal because the systems require full exposure. Many systems do require more data than they should. But more systems than you assume offer options that reduce exposure, and the demand for privacy-respecting alternatives is itself a market signal that shifts institutional behavior over time.

Privacy as the Restraint Principle Applied to the Self

Privacy by design at the individual level is the personal expression of the restraint principle (1.2.3). Restraint, at the systemic level, means limiting scope, surface area, and coupling so that failure stays local and reversible. At the personal level, privacy by design applies the same logic: limit your data exposure so that a breach in one area does not cascade across your entire life.

The connection is structural, not metaphorical. A person whose health data, financial records, professional credentials, personal communications, and location history are all accessible through a single compromised account has no compartmentalization — a breach anywhere is a breach everywhere. A person who has applied the four disciplines — minimize, separate, encrypt, selectively disclose — has designed a personal data architecture that degrades gracefully. A compromise in one domain is contained to that domain. The damage is bounded. The recovery (using the recovery plan from 2.3A.1) addresses the specific breach rather than requiring a comprehensive rebuilding of digital life.

This is privacy as engineering, not privacy as ideology. The standard is not "nothing about me should be known." The standard is: what is known about me is known by my choice, for purposes I understand, under terms I can verify, and with consequences I have assessed.