The PII Question: How Swartzism Treats Data About People
The objection to any information-liberation doctrine writes itself: if you’re for freeing data, you must be fine with leaking people’s data too. Swartzism answers with a boundary that does not move:
Liberate the world’s knowledge. Defend each person’s life.
Data about the world and data about a person are different kinds of things. They are not both “data.” The doctrine is deliberately asymmetric about them.
The two-column test
Every data project, leak, or archive gets sorted into one of two columns:
| Column | What it is | Swartzism’s rule |
|---|---|---|
| World-data | Dockets, gazettes, scientific literature, corporate registries, government records | Liberate. The public cannot govern what it cannot inspect. |
| Person-data | Names, biometrics, financial records, medical histories, locations, communications | Protect. The holder of this data holds power over the person it describes. |
The first question about any contested dataset is not “should this be public?” — it is “who does this data describe?” The test is not “was this information obtained legally?” — the PACER download was a Terms-of-Service violation, and Swartzism still treats it as justified. The test is: whose data is it, and what does exposing it do to the person it describes?
Why the boundary is load-bearing
The doctrine has no chance without trust. Institutions will always argue that openness is a slippery slope to surveillance. Every time someone calling themselves a “liberator” dumps ordinary people’s data, they prove the institutions right. The boundary is not a policy choice within Swartzism; it is the load-bearing wall of the whole argument. It does not move.
The asymmetry is the point, not an inconsistency: the powerful’s secrets are ours to expose; the weak’s data is theirs to keep. A custodian who hoards knowledge is the enemy. A liberator who leaks lives is worse.
Leaks that fail the test
Consider a leaked customer database: millions of bank records, phone numbers, and addresses dumped to the open internet. The thief may call it “exposure.” Swartzism calls it what it is — the transfer of personal data from one holder to a thousand holders, each of whom can now impersonate, defraud, harass, or sell. 1
A PII leak is not civil disobedience. Civil disobedience targets a structure of power; a PII dump targets the people the structure was already mistreating. It amplifies the harm rather than dismantling the cause. The victims of a bank or Aadhaar-style breach are not the institution — the institution has already been paid to care. The victims are the account holders whose data now circulates as currency in fraud markets.
When a leak of personal data surfaces, the doctrine’s instruction is clear:
- Do not redistribute. Not one row. The data describes persons; propagation is the second harm.
- Work for takedown and remediation. The affected people come first.
- Strike the system that collected and exposed it. Investigate the custodian, the contract, the security failures, the regulator asleep at the switch. That is where the accountability work lives — in the system, not in the rows.
This is not timidity; it is the boundary working as designed. The research targets the leak as an event — who collected it, how it was secured, who failed, who profited. Never the people inside it.
The hard case: accountability data about the powerful
There is one genuinely hard case: official misconduct that is only provable through personal data. A minister’s abuse documented via records that include personal details.
The line has to be drawn per-case. A police officer’s substantiated misconduct finding is a public record about the exercise of public power; publishing it is world-data. 2 The same officer’s home address, family, or financial details are person-data; publishing them is a target painted on a human being. The difference is the difference between the badge and the man. Swartzism holds the line at the badge.
Where release is the only path to accountability, the doctrine permits it only when all four conditions hold:
- Imminence and gravity — the harm being exposed is ongoing or severe;
- Minimality — the least personal data that proves the act;
- Asymmetry — the subject holds power over the people affected;
- Process — a documented proportionality decision by more than one person, reviewable later.
The purpose of these conditions is not to block release. It is to make the release defensible — because an accountability act that harms the innocent discredits the doctrine, not just the act.
The consequence
This is why Swartzism is not “piracy with a sad story attached,” and why it is not naive about power. It takes a side that confuses both the corporate enforcer and the careless “liberator”: knowledge of the world is a commons, and the privacy of persons is absolute — and the two commitments are one doctrine, not two.
That discipline is what lets the practice projects — the police-accountability archive, the hospital registry audit, the exam-tech investigation — do their work without becoming part of the problem they document.
The next stress test: what happens when the two columns collide inside a single system — an Aadhaar, a UPI, a national registry. That is where the doctrine meets Indian DPI, and where it will have to earn its keep.
The text is open for comment — name the line you attack, bring the evidence.
Read the Manifesto How to comment