A Location-Based Test for Jurisdiction over Data: The Consequences for Global Online Privacy

U.S. technology companies face growing uncertainty over whether and how they can be compelled to turn foreign-stored user content over to law enforcement officials. In July 2016, the Second Circuit ruled that the government could not require Microsoft to produce user content stored on its server in Ireland because the execution of the government’s warrant constituted an impermissible extraterritorial application of the Stored Communications Act (SCA). But after the Second Circuit declined to rehear Microsoft Corp. v. United States, (formally titled In the Matter of a Warrant to Search a Certain E-Mail Account Controlled and Maintained by Microsoft Corporation, also known as the “Microsoft Ireland” case) en banc in January 2017, the Supreme Court granted the DOJ’s petition for certiorari and heard oral argument on the case in February 2018. Throughout this litigation, other courts have issued orders compelling Google to produce foreign-stored data requested by SCA warrants. Two fundamental questions have divided these courts: (1) whether the physical location of the data at the time it is accessed should determine whether it is within the reach of the SCA, and (2) whether other countries’ data privacy laws and search-and-seizure protections apply. This Article argues that basing government jurisdiction over data on the data’s physical location threatens user privacy. It also creates unworkable and unpredictable results for technology companies by failing to account for the significant differences in how they divide, store and transmit their users’ data around the world. In the context of digital searches, the data location test has two potential effects. First, it will create bottlenecks in the already-burdensome mutual legal assistance system, hindering intergovernmental cooperation on law enforcement investigations. Second, it may embolden foreign governments to circumvent the system by adopting similar, or even more extreme, positions on jurisdiction over data, such as data localization and mandatory encryption backdoor laws. These policies have dangerous consequences for privacy, free expression, and innovation around the world. While some have written about the data location test in Microsoft Ireland in the abstract, this Article takes a step further and considers its role in the rulings conflicting with Microsoft Ireland that have been issued by federal judges over the past two years. It also evaluates several recent legislative and non-legislative proposals to solve the problems arising from the data location test. In particular, this Article highlights the pressing need for Congress to reform the Stored Communications Act, incorporating an alternative test for jurisdiction over user data and provisions that would clarify companies’ data disclosure obligations under conflicting legal regimes. Finally, while much of the literature on this topic focuses solely on legislative proposals rather than the real-world impact of the uncertainty creating a need for statutory reform, this Article focuses on what companies should do while they await a resolution from Congress or the Supreme Court. To that end, this Article offers some practical recommendations for how companies can navigate the issues arising from the data location test, particularly as they make decisions about their global operations and data storage architecture.