Today, lawmakers in 16 states and the District of Columbia announced new legislative efforts designed to protect Americans from intrusion into their personal data by schools, employers or government. The proposed laws focus on a range of issues, such as email and other electronic communications, employees’ use of social media, cell phone trackers and license plate readers. Should these measures pass, it would send a strong signal to other states and Congress that Americans remain concerned about protecting their privacy.
Congress seems unwilling or unable to address these issues. The federal laws governing online privacy date to 1986, five years before the World Wide Web existed. Legislation to update the privacy laws for email and other electronic communications has won strong bipartisan support but has repeatedly stalled.
Although the Supreme Court has issued some important privacy-protective decisions in recent years, such as requiring a warrant to attach a GPS tracker or search a cell phone, it has yet to address the privacy of modern electronic communications like email or cell phone location information. It can take the Court decades to fully appreciate new technology. In the early 20th century, for example, the Court allowed police to listen in on phone calls without a warrant because they were only using “their sense of hearing,” not intruding into a home. It was not until 1967—some 40 years later—that the Court reversed itself and required a warrant for phone taps.
We are in a similar situation today with more modern technology. Under current Supreme Court doctrine, formulated in 1979, there is no Fourth Amendment protection for private communications data, such as email, because users expose that information to “third-party” service providers like Gmail or Microsoft. And some courts have applied this logic to cell phone location data, which users must reveal to phone companies. Nonetheless, that doctrine is nearing its 40th birthday, and it is possible that the Court will have another “telephone moment” in the not-too-distant future.
Until that time comes, states are taking it upon themselves to update privacy laws. Legislatures in Minnesota, New Mexico, New York and Virginia are pushing to require law enforcement to get a warrant to access private data like email, texts, and location information. California’s Electronic Communications Privacy Act, signed in October, is considered a national model.
Illinois and Michigan are introducing legislation that would require a warrant for police to use cell phone trackers—often called “Stingrays”—that mimic cell phone towers and trick nearby phones into revealing private data. Nebraska’s measure would ban their use entirely. Michigan and Nebraska are also introducing bills to set more stringent rules for automated license plate readers, or ALPRs, which can sweep up location information on millions of innocent drivers and send it to a database for long-term retention and data-mining.
Having state legislatures set policy will ensure greater clarity for both residents and police. Courts often confront privacy claims in the context of criminal cases when defendants invoke the Fourth Amendment. But the current constitutional test—whether there is a “reasonable expectation of privacy” in the data acquired by law enforcement—can be vague and difficult to administer. Under this standard, for example, courts have concluded that individuals have little privacy in some of their most cherished activities, even placing inordinate weight on the availability of a specific technology or the wording of a cellphone agreement. Privacy-protective state law can forestall this process by requiring a warrant or other process up front, and by adding more muscle to the constitutional argument that drivers, cell phone owners, and others do not abandon their privacy the moment they step outside.
Today’s announcements offer the chance to guard the privacy of millions of Americans. They should also spur Congress and the courts to create consistent national protections. When states representing nearly one-third of the population take steps to enhance privacy, it sends a strong signal to federal courts and national policymakers that it is time to update our laws and our Constitutional protections for the 21st century.