The Need for A Property-Based Approach to Data Privacy

-- By WillPalmer - 06 Mar 2015

Section I: Fourth Amendment Protection Expanded from Physical Places to Include an Individual’s Reasonable Expectation of Privacy

. The Fourth Amendment’s protection against unreasonable searches and seizures of one’s “persons, houses, papers and effects,” is historically grounded in notions of trespass and trespass to chattels. Despite its original focus on physical spaces, the Court expanded the Fourth Amendment’s protections to include a person’s reasonable expectation of privacy in Katz v. U.S., 389 U.S. 347 (1967). This decision was an expansion of the Fourth Amendment’s protections; in finding that a wiretap of a public phone booth violated a person’s reasonable expectation of privacy, it directly overturned Olmstead v. United States, 277 U.S. 438 (1928), which had previously held that wiretaps do not violate the Fourth Amendment because they involve no physical trespass on the target’s property. Katz effectively added a “reasonable expectations” test to the Fourth Amendment, while leaving intact its longstanding protection against government’s physical trespass. Thus, under Katz, unwarranted searches of personal physical spaces and property are per se unreasonable, while other searches are subject to a two-part reasonableness test that considers the individual’s subjective expectation of privacy, as well as whether that expectation was reasonable.

However, in adding a reasonable expectations test to the Fourth Amendment, the Court opened Pandora’s Box, with the net result of significantly limiting the scope of Fourth Amendment protections. Under the third party doctrine, individuals have no reasonable expectation of privacy with regard to information they knowingly share with a third party. By this logic, the Court has applied the reasonable expectations test to hold that neither business records nor metadata (or “addressing information”) are protected by the Fourth Amendment. First, United States v. Miller, 425 U.S. 435 (1976) held that an individual has no reasonable expectation with regard to a bank’s records of her or his accounts, because the bank merely recorded “transactions to which the bank was itself a party.” Id. at 442. Second, Smith v. Maryland, 442 U.S. 734 (1979) held that a person has no reasonable expectation of privacy with regard to the phone numbers, dates, and times at which they make calls from their landline phones, for two reasons. First, the Court found that the person effectively conveyed these facts to the telephone company in the process of using their service to make the call. Id. at 745. Second, since telephone companies regularly make records of the numbers dialed for billing and general business purposes, any person would be reasonably aware that they possess this information and have the power to disclose it. Id. at 742.

Section II: Notions of Property Ownership Shape the Reasonableness Of Expectations of Privacy

Under the standard set by the above cases, the Fourth Amendment is not even implicated by the government’s bulk collection of metadata, because an individual has no claim to ownership to a company’s records of her calls or emails. Recent cases addressing the NSA’s collection of bulk metadata illustrate the underlying assumption that the Fourth Amendment does not apply because individuals do not own or have a claim to the records in question. In ACLU v. Clapper 959 F.Supp.2d 724, 752 (S.D.N.Y. 2013), the court, relying on Smith, denied a Fourth Amendment challenge to the bulk collection of metadata, holding that its protections were inapplicable where the individual does not own the records in question:

“the business records created by Verizon are not ‘Plaintiffs’ call records.’ Those records are created and maintained by the telecommunications provider, not the ACLU [the plaintiff]. Under the Constitution, that distinction is critical, because when a person voluntarily conveys information to a third party, he forfeits his right to privacy in the information.”

As this excerpt suggests, the reasonableness test from Katz was never entirely distinct from notions of the property and ownership that underlay the original conception of the Fourth Amendment as a protection against physical trespass. Much like the Court in Miller and Smith, supra, the court in ACLU v. Clapper held that there was no reasonable expectation of privacy precisely because the individual does not own the data in question.

On appeal, the Second Circuit ultimately decided that the NSA’s bulk collection of metadata exceeded its statutory authority under the Foreign Intelligence Surveillance Act (FISA), and thus declined to rule on the constitutional questions. Nevertheless, the opinion contains dicta addressing the constitutionality of the program. First, the opinion notes that the standard for a court order requesting information under FISA is the same standard that applies to a subpoena duces tecum issued pursuant to a grand jury investigation or a court order: “In adopting § 215, Congress intended to give the government, on the approval of the FISC, broad-ranging investigative powers analogous to those traditionally used in connection with grand jury investigations into possible criminal behavior.” American Civil Liberties Union v. Clapper, No. 14-42-CV, 2015 WL 2097814 at *19 (2d Cir. May 7, 2015). This “relevance standard “is a much lower threshold than that required for a search based on probable cause, and merely requires that there be “reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation.” 50 U.S.C.A. § 1861(b)(2)A). Thus, under this lower standard, “it has long been commonplace for grand juries to subpoena an individual’s telephone records from the individual’s telephone service provider, in the absence of probable cause or a warrant issued by a judge.” American Civil Liberties Union v. Clapper, No. 14-42-CV, 2015 WL 2097814 at*28 (2d Cir. May 7, 2015).

Second, the opinion affirms that the constitutionality of this lower threshold for document requests is predicated on the notion of ownership. The court discussed the government’s argument, upheld by the district court, that the acquisition of these records do not violate the Fourth Amendment, “or even implicate[] its protection at all,” “because the records are not his or hers alone.” Id. at 29 (emphasis added). It is at least worth noting that the court distinguishes bulk collection of metadata from grand jury subpoenas; unlike grand jury subpoenas, where “the determination of relevance is constrained by the subject of the investigation,” in the case of bulk metadata collection, “the government does not even suggest that all of the records sought, or even necessarily any of them, are relevant to any specific defined inquiry.” Id. at 21. Ultimately, the court rejected this broad reading of relevance as incompatible with the powers that § 215 grants. However, the court also suggested that “rules that permit the government to obtain records and other information that consumers have shared with businesses without a warrant seem much more threatening as the extent of such information grows,” citing Justice Sotomayor's concurrence in U.S. v. Jones, 742 S.Ct. 945, 949 (2012), in which she argues essentially the same point.

Section III: The Need for a Statutory Entitlement to One’s Personal Data

Given the ongoing erosion of Fourth Amendment protections at the hands of the “reasonable expectations” test, we need a statutory solution that establishes a personal property interest in certain types of personal information. The precise nature of this property interest is debatable, but without it, any bulk collection of data is going to pass the “reasonable expectations” test, because an individual has no reasonable expectation of privacy with regard to another party’s personal business records. Undoubtedly, the solution must be statutory. As the court noted in American Civil Liberties Union v. Clapper, No. 14-42-CV, 2015 WL 2097814 at *31 (2d Cir. May 7, 2015), “Congress is better positioned than the courts to understand and balance the intricacies and competing concerns involved in protecting our national security, and to pass judgment on the value of the telephone metadata program as a counterterrorism tool.” Precisely what kind of property interest a person has in their personal records can vary depending on how much they reveal, and there is already legislation that exists to provide individuals control over certain types of sensitive data about themselves, such as the Health Insurance Portability and Accountability Act and the Right to Financial Privacy Act. Susan W. Brenner & Leo L. Clark, Fourth Amendment Protection for Shared Privacy Rights in Stored Transaction Data, 14 J.L. & Pol’y 211 (2006).

These may provide some guidance as to the nature and scope of the interest that people should have over their metadata, or GPS data, or any other data whose collection is currently upheld on the basis of the reasonable expectations test, and which has the power to invade an individual’s privacy to the same extent that a search of their home or person would. Without this statutory protection, we will continue to see erosion of the Fourth Amendment, because people have no reasonable expectation of privacy with regard to records to which they have no claim.