The European Union, Canada, and the United States have each grappled with what counts as fair business practices in relation to information services that collect and package personal information that has ended up in one way or another online. On the open internet, this personal information often originates from two types of online sources: public records like arrests, mugshots, court decisions, and bankruptcy records; and user-generated content hosted on social media platforms and sites. This article argues that personal information that has been exposed to public view — be it by a government institution, another individual or organization, or by the data subject him or herself — should not be considered fair game to any and all subsequent commercial exploitation. The blunt concept of “public” information should be refined to a more nuanced understanding of “publicly accessible” information, where public access can be limited to particular purposes. By focusing on fairness in business dealings in publicly accessible personal information, it should be possible to move beyond a fixation on locating the elusive divide between private and public online information, and instead frame privacy as situated in a three-way balance of interests between the business, the public, and the data subject.
