Supreme Court puts us on a pro-privacy path for the cyber age

The Supreme Court ruled last week in Carpenter v. U.S., the hotly-anticipated Fourth Amendment case about the privacy of cell phone location records. The Court, led by Chief Justice John Roberts, held that the government must get a warrant based on probable cause before collecting a historical log of an individual’s mobile location records.

{mosads}The Court’s framed its decision as a narrow one, going so far as to list issues not addressed in the case: real time location tracking, so-called “tower dumps,” or conventional surveillance techniques such as security cameras. But the underlying rationale will be applied to new surveillance techniques, and the case will be cited in future disputes over the “third party” doctrine. It should be no surprise then, that the case sparked such a broad range of views — with four separate dissenting opinions, totaling over 80 pages.

The biggest question now is “What’s next for privacy in the United States?”

The answer, in short, is there is a lot of work to be done by advocates, courts, and legislatures. Chief Justice Roberts recognized the need for further development of privacy law implicitly when he listed a few of the yet-to-be decided issues, and Justice Alito recognized more explicitly in his dissent that “some of the greatest threats to individual privacy may come from powerful private companies that collect and sometimes misuse vast quantities of data about the lives of ordinary Americans.”

But while Justice Alito is correct that the Court cannot, by itself, protect individuals against all “looming threat(s) to their privacy,” his concern that the Carpenter decision might “dissuad(e)” Congress from legislating on privacy seems divorced from history. Congress has repeatedly stepped in to establish detailed privacy rules following landmark decisions by the Court (recall Title III, ECPA, and FISA), and there is a clear opportunity to do so post Carpenter.

The Court Recognized That the Fourth Amendment Must Keep Pace with Technology  

As Chief Justice Roberts’ explained in the majority opinion, the central question in Carpenter was “how to apply the Fourth Amendment to a new phenomenon: the ability to chronicle a person’s pas movements through the record of his cell phone signals.” In answering that question, the Court had to reconcile earlier decisions about location tracking and seizure of records held by third parties with the current state of technology and the capabilities of law enforcement.

While the Court acknowledged that “the fact that the individual continuously reveals his location to his wireless carrier implicates the third-party principle of Smith and Miller,” the Court found that “given the unique nature of cell phone location records, the fact that the information is held by a third party does not itself overcome the user’s claim to Fourth Amendment protection.” More broadly, the Court made clear that “(a) person does not surrender all Fourth Amendment protection by venturing into the public sphere.”

Even though the outcome in Carpenter is, as the Court notes, somewhat narrow — requiring a warrant to obtain more than 7 days of cell phone location records — the impact on privacy law could be profound. Indeed, the concerns voiced by Justices Kennedy, Thomas, and Alito in dissent underscore just how broad that impact could be. The core logic of the Court’s decision—which will likely be embraced by other courts and legislatures — is that (1) historical location records are uniquely sensitive, (2) records held by third parties can be subject to Fourth Amendment protection, and (3) society does not expect that law enforcement’s power to “monitor and catalogue” will unilaterally increase without a corresponding increase in constitutional protection.

Justice Kennedy’s dissent complained that location records “are no different from many other kinds of business records” the government believes it can collect already without a warrant (e.g. financial transaction records). And Justice Alito expressed his concern that the decision will interfere with the Government’s use of subpoenas in future cases. But neither can deny the increasing power to surveil enabled by modern technologies.

Both Lower Courts and Congress Need to Address Other Advanced Surveillance Techniques   

The Court’s decision may well be disruptive as Justice Kennedy and Justice Alito allude to in their dissents, but that is because privacy laws have failed to keep pace with changing technologies. Private records are now routinely stored on third party servers and, as a result, the traditional third party doctrine rule would leave huge volumes of sensitive data unprotected. The Court simply acknowledged this problem and provided a new default rule for cell phone location data.

This is similar to what Chief Justice Roberts did in his unanimous majority opinion in Riley v. California: set a new default rule for searches of cell phones — the pre-digital rule was that warrantless searches of any items on a person incident to arrest were permissible, and the Court held in 2013 that similar searches involving cell phones require a warrant. The difference is that the government has a much keener interest in collecting third party records than it had in searching cell phones incident to arrest, and Congress has not taken action to limit third party searches in the “cyber age.”

The fight for privacy will now move forward on two fronts. First, lower courts will need to apply Carpenter in a wide range of cases about advanced surveillance techniques: real time location tracking, license plate readers, body cameras, facial recognition, and secret profiling (to name a few). Second, Congress will be pushed by both privacy advocates and law enforcement to update privacy laws and create new laws to address law enforcement’s use of these advanced surveillance techniques.

Congress should also take the opportunity to address, as Justice Alito noted, the privacy threats posed by private sector data collection. In a post-Carpenter, post-Facebook/Cambridge Analytica, post-Equifax, and post-GDPR world, comprehensive privacy legislation in the United States should be a no brainer.

Alan Butler is senior counsel at the Electronic Privacy Information Center (EPIC) in Washington, DC. EPIC filed a “friend of the court” brief in support of Carpenter.