The familiar surveillance scandal has a tidy plot. A powerful tool is misused. The misuse becomes public. The company apologizes, tightens its policies, and promises more oversight. Attention then shifts to whether employees or customers will follow the new rules.
Recent coverage of Flock follows that shape. Reports describe abuses of the company’s camera technology and police misuse of a large camera network. Flock has responded with changes framed around privacy, accountability, security, and transparency; its CEO has apologized for cases in which the technology was abused.
Those responses may matter. But the sequence can make surveillance look like a compliance problem when it is also a design problem. Better rules may reduce improper searches without changing what the system records, how searchable those records are, or how much power accumulates around access to them.
Oscar H. Gandy’s The Panoptic Sort, published in 1993, examines how institutions collect personal information and use it to classify people for different treatment. The title identifies the structure beneath today’s controversy: surveillance is not only the act of watching. It is the creation of records, the control of access to them, and the use of those records to sort people.
After-the-fact accountability
Accountability reforms usually begin downstream. They ask who accessed a system, whether that person had authorization, whether the search served an approved purpose, and what should happen when someone violates policy. Permissions, audits, reporting requirements, and penalties can all make abuse harder or more visible.
This is governance by authorized use. It assumes that the infrastructure may remain in place so long as access is properly managed.
That assumption deserves examination. A safeguard can meaningfully constrain users while leaving the system’s basic reach untouched. Indeed, a highly controlled database may still be a highly expansive database. Good access controls answer who may open the file. They do not necessarily answer why the file exists, how much it contains, how long it remains available, or what new conclusions become possible when it is combined with other records.
The distinction is easy to lose because “privacy” is often used to cover both questions. One concerns misuse: Did someone break the rules? The other concerns exposure: What capabilities did the system create in the first place?
Focusing on misuse places the individual operator at the center of the story. Focusing on design puts the record system there instead.
The significance of the sort
The most suggestive word in Gandy’s title may not be “panoptic” but “sort.” Watching becomes institutionally powerful when observations can be stored, retrieved, compared, and used to place people into categories. A camera sees an event. A record system makes that event available for later judgment.
This changes the privacy question. It is no longer only whether someone was observed in a particular place. It is also whether an observation can travel: from a moment into a record, from one authorized user to another, and from one purpose to a different one. Access control governs parts of that journey. It does not erase the journey’s possibility.
That is why corporate reforms should be assessed on two separate levels. The first is whether they improve accountability inside the existing system. The second is whether they reduce the system’s capacity to collect, preserve, connect, or circulate information. A policy may succeed at the first and do little about the second. Calling both “privacy safeguards” obscures an important choice.
Privacy by design begins earlier. It asks whether every available record should be created, whether availability should be the default, and whether a useful service can operate with less persistent or less widely accessible information. This approach does not wait for abuse to reveal the danger. It treats concentrated informational capability as something that requires justification even when every user follows the rules.
None of this makes accountability measures cosmetic by definition. Stronger controls can prevent harm, establish responsibility, and expose violations that would otherwise remain hidden. The point is narrower: reforming conduct within a surveillance system is not the same as reforming the surveillance system.
The Panoptic Sort is worth resurfacing because its title and documented concerns refuse to let records disappear behind the drama of individual misuse. The durable issue is not merely whether access was improper. It is what becomes possible once observation has been organized into an accessible record—and whether a promise to use that record responsibly is an adequate limit on the power to keep it.