Source: https://illinoislawreview.org/online/carpenter-v-united-states-begs-for-action/
Timestamp: 2019-04-25 18:44:08+00:00

Document:
the adoption of legislation that clearly defines data privacy protection.
The Court held that “an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through CLSI.”9 The Court stated that CLSI presents “even greater privacy concerns than the GPS monitoring” 10 considered in United States v. Jones11 because of the constant and perfect surveillance that results. “While individuals regularly leave their vehicles, they compulsively carry cell phones with them all the time.”12 The Court discussed the fact that it needs to take account of technology that is already in use as well as that being developed.13 It reiterated Justice Frankfurter’s warning to tread carefully with new technology so as to not “embarrass the future.”14 The Court did not provide a bright-line test for determining the exact reach of the third-party doctrine in future cases.
Next, regarding the advisability of setting aside Smith and Miller and just relying on Katz, Justice Gorsuch was concerned about whether the Katz test would be able to provide much guidance: “We still don’t even know what its ‘reasonable expectation of privacy’ test is.”28 If the Katz test is to be conceived as a normative question, why do judges, rather than legislators, have to determine what society should be prepared to recognize as a legitimate expectation of privacy, he asked.29 He quoted Justice Scalia’s oft-cited observation that “‘reasonable expectations of privacy’ come to bear ‘an uncanny resemblance to those expectations of privacy’ shared by Members of this Court.”30 Justice Gorsuch also criticized the Katz test for producing “often unpredictable—and sometimes unbelievable—jurisprudence.”31 In addition to results of Smith and Miller, he discussed Florida v. Riley,32 where a police helicopter hovering 400 feet above a person’s property invaded no reasonable expectation of privacy, and California v. Greenwood,33 which held that people have no reasonable expectation of privacy in garbage they put out for collection—despite the fact that California state law expressly protected a homeowner’s property rights in discarded trash.
First, the fact that a third party has access to or possession of your papers and effects does not necessarily eliminate your interest in them. . . . Just because you entrust your data—in some cases, your modern day papers and effects—to a third party may not mean you lose any Fourth Amendment protection in its contents.
Second, I doubt that complete ownership or exclusive control of property is always necessary to the assertion of a Fourth Amendment right. . . . At least some of this Court’s decisions have already suggested that use of technology is functionally compelled by the demands of modern life, and in that way the fact that we store data with third parties may amount to a sort of involuntary bailment too.
Most of the challenges faced by the majority opinion in crafting a decision and the concerns about and objections to that decision, as discussed in the various dissenting opinions, are due to the basic flaws in the legal approach now used to provide for data privacy protection. The Carpenter case highlights the problems that plague how we address data privacy protection in our digital world. Three changes, described below, need to take place.
As discussed below, data privacy rules or statutes need to be enacted as positive law. We should no longer have to rely on vague, unstable, and court-dependent notions of privacy. The results of a case should not simply resemble the views of the judge deciding it. Furthermore, as reflected in some of the arguments made in the Carpenter dissents, Fourth Amendment jurisprudence should not be reliant on a reasonable expectation of privacy standard. It is a difficult standard to apply. Certainly, traditional notions of privacy will often be involved in a Fourth Amendment inquiry, but they need not be derived from and dependent upon Katz and its progeny.
Justice Thomas specifically called for a reconsideration of Katz in his dissent,51 and Justice Roberts specifically noted in the majority opinion that neither of the parties had asked for the Court to reconsider Katz in this case.52 Along with my other two suggestions, the decoupling of data privacy from the Fourth Amendment and the passage of data privacy legislation, this would probably become an easy matter. If data privacy were no longer shackled exclusively to the Fourth Amendment and if there were positive law to instruct a court, the Katz test, as reconstructed, could probably become more straight-forward and useful.
The United States finally needs to address data privacy protection in a comprehensive fashion, much like the much-discussed and recently effective General Data Protection Rule (GDPR) of the European Union.53 For far too long, the U.S. has employed a sectoral approach to protecting data privacy. It has not worked. As discussed above, Katz’s reasonable expectation of privacy is, in too many situations, approaching zero. Given the ability of modern technology to collect, aggregate, sort and analyze personal data, there needs to be legislation to regulate the use of that data.
With the GDPR having officially become effective on May 25, 2018, the time is ripe.54 Many companies have already altered their data policies to conform, at least in some ways, to the new requirements. Congress needs to finally address this major issue. As illustrated by the mix of Justices and their opinions regarding privacy, this does not appear to be a politically polarizing issue – people on both sides of the aisle are concerned about data privacy protection.
Law needs to evolve as society and technology change. Congress needs to sit down and pass long overdue comprehensive legislation that addresses all aspects of data privacy protection. Katz and the Fourth Amendment are not capable of doing that by themselves. Legislation, obviously, would provide for much needed regulation for the collection and use of data and would provide the positive law necessary to avoid the inevitable conflicts between and frequent incompatibility of Katz and the Fourth Amendment.
* Ernest L. Baskin, Jr. Distinguished Professor of Computer Science and Law, Stetson School of Business and Economics, Mercer University, Atlanta.
1. 138 S. Ct. 2206 (2018).
3. It is very difficult to define “privacy.” Over the last fifty years or so, the notion of privacy has been intertwined with the Katz case and its test. While privacy has often been described as including personal autonomy and informational privacy, the latter category has dominated much of the discussion in recent years because of the advancements made in digital technology and the effects it has had on everyday life. What I am discussing in this paper is basically called “data protection” in the European Union. In order to distinguish between and avoid confusion with those rules and in order not to be bogged down by all the possible meanings of “privacy” under U.S. law, I will use the terms “data privacy” or “data privacy protection” in this paper.
4. 389 U.S. 347 (1967).
5. 425 U.S. 435 (1976) (holding that a person has no legitimate expectation of privacy once bank records are voluntarily given to a third party: the bank).
6. 442 U.S. 735 (1979) (holding that there was no legitimate expectation in pen register information used to facilitate the making of phone calls because the customer voluntary provided the information to the phone company).
7. See generally Orin S. Kerr, The Case for the Third-Party Doctrine, 107 Mich. L. Rev. 561 (2009); Peter Ormerod and Lawrence J. Trautman, A Descriptive Analysis of the Fourth Amendment and the Third-Party Doctrine in the Digital Age, 28 Albany L. J. Sci. & Tech. 73 (2018).
8. Carpenter v. United States, 138 S. Ct. 2206, 2210 (2018).
9. Id. at 2217. The Court stated in a footnote that it is “sufficient for our purposes today that accessing seven days of CLSI constitutes a Fourth Amendment search. Id. at 2217 n.3.
11. 565 U.S. 400 (2012).
12. Carpenter, 138 S. Ct. at 2218.
15. Id. at 2224 (Kennedy, J., dissenting).
18. Id. at 2235 (Thomas, J., dissenting).
21. Id. at 2247 (Alito, J., dissenting).
23. In Jones, Justice 1Alito had written in a concurring opinion that “I would analyze the question presented in this case by asking whether respondent’s reasonable expectations of privacy were violated by the long-term monitoring of the movements of the vehicle he drove.” 565 U.S. 400, 419 (2012) (Alito, J., concurring). Presumably, his objections to the majority’s handling of the search in this case outweighed his concerns about privacy.
24. Carpenter, 138 S.Ct. at 2246–47. (Alito, J., dissenting).
25. Id. at 2261 (Gorsuch, J., dissenting).
30. Id. (quoting from Minnesota v. Carter, 525 U.S. 83, 97 (1998) (Scalia, J., concurring)).
32. 488 U.S. 445 (1989).
33. 486 U.S. 35 (1988).
34. Carpenter, 138 S. Ct at 2267 (Gorsuch, J., dissenting).
40. 381 U.S. 479 (1965).
42. Carpenter, 138 S. Ct. at 2240 (Thomas, J., dissenting).
43. See, e.g., Daniel J. Solove, Fourth Amendment Pragmatism, 51 B.C. L. Rev. 1511, 1521 (2010).
44. See generally Peter Winn, Katz and the Origins of the “Reasonable Expectation of Privacy” Test, 40 McGeorge L. Rev. 1 (2009).
45. See generally Harvey A. Schneider, Katz v. United States: The Untold Story, 40 McGeorge L. Rev. 13 (2009).
46. Carpenter, 138 S. Ct. at 2235 (Thomas, J., dissenting).
47. Schneider, supra note 45; Winn, supra note 44.
48. Orin S. Kerr, Katz Has Only One Step: The Irrelevance of Subjective Expectations, 82 U. Chi. L. Rev. 113, 116–22 (2015).
49. Shaun B. Spencer, Reasonable Expectations and the Erosion of Privacy, 39 San Diego L. Rev. 843, 869–90 (2002).
50. See Jordan M. Blanke and Janine S. Hiller, Predictability for Privacy in a Data Driven Government, 20 Minn. J. Law Sci. & Tech. (forthcoming 2018), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3152026.
51. . Carpenter, 138 S. Ct. at 2236 (Thomas, J., dissenting).
52. . Id. at 2214 n.1.
53. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/ EC (General Data Protection Regulation), 2016 O.J. (L 119) 1, http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2016:119:FULL&from=EN.
54. California just passed a comprehensive data privacy protection law similar to the GDPR which will take effect on Jan. 1, 2020. California Consumer Privacy Act of 2018, A.B. 375, Reg. Sess. (Cal. 2017–18) (Jun. 28, 2018) at https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375. See Daisuke Wakabayashi, California Passes Sweeping Law to Protect Online Privacy, N.Y. Times (Jun. 28, 2018), .
55. Carpenter, 138 S. Ct. at 2265 (Gorsuch, J., dissenting).
57. Id. at 2261 (Alito, J., dissenting).
58. United States v. Jones, 565 U.S. 400, 427 (2012) (Alito, J., concurring).
Justice Thomas specifically called for a reconsideration of Katz in his dissent,51 and Justice Roberts specifically noted in the majority opinion that neither of the parties had asked for the Court to reconsider Katz in this case.52 Along with my other two suggestions, the decoupling of data privacy from the Fourth Amendment and the passage of data privacy legislation, this would probably become an easy matter. If data privacy were no longer shackled exclusively to the Fourth Amendment and if there were positive law to instruct a court, the Katz test, as reconstructed, could probably more become straight-forward and useful.
24. Carpenter, 138 S. Ct. at 2246–47. (Alito, J., dissenting).

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.