Against Data Exceptionalism
Total Page:16
File Type:pdf, Size:1020Kb
University of Kentucky UKnowledge Law Faculty Scholarly Articles Law Faculty Publications 4-2016 Against Data Exceptionalism Andrew Keane Woods University of Kentucky, College of Law, [email protected] Follow this and additional works at: https://uknowledge.uky.edu/law_facpub Part of the Internet Law Commons, and the Privacy Law Commons Right click to open a feedback form in a new tab to let us know how this document benefits ou.y Repository Citation Woods, Andrew Keane, "Against Data Exceptionalism" (2016). Law Faculty Scholarly Articles. 593. https://uknowledge.uky.edu/law_facpub/593 This Article is brought to you for free and open access by the Law Faculty Publications at UKnowledge. It has been accepted for inclusion in Law Faculty Scholarly Articles by an authorized administrator of UKnowledge. For more information, please contact [email protected]. Against Data Exceptionalism Notes/Citation Information Andrew Keane Woods, Against Data Exceptionalism, 68 Stan. L. Rev. 729 (2016). This article is available at UKnowledge: https://uknowledge.uky.edu/law_facpub/593 ARTICLE Against Data Exceptionalism Andrew Keane Woods* Abstract. One of the great regulatory challenges of the Internet era-indeed, one of today's most pressing privacy questions-is how to define the limits of government access to personal data stored in the cloud. This is particularly true today because the cloud has gone global, raising a number of questions about the proper reach of one state's authority over cloud-based data. The prevailing response to these questions by scholars, practitioners, and major Internet companies like Google and Facebook has been to argue that data is different. Data is "unterritorial," they argue, and therefore incompatible with existing territorial notions of jurisdiction. This Article challenges this view. The Article argues that the jurisdictional challenges presented by the global cloud are not conceptually as novel as they seem. Despite the technological wizardry of modern life, the "cloud" is actually a network of storage drives bolted to a particular territory, and there is substantial case law suggesting that courts think of data as a physical object. Moreover, even if the cloud were a free-floating ether, data can be thought of as an intangible asset, like money or debt, which flows across borders; courts have been adjudicating such jurisdictional disputes for centuries. These precedents suggest numerous grounds for states to assert jurisdiction over data-not a single test, as major Internet companies claim. After showing that these jurisdictional problems are not unprecedented, the Article draws from these precedents and outlines practical steps that courts, Congress, and the President can take to alleviate jurisdictional conflicts over the cloud. As Microsoft's cross-border dispute with the U.S. Department of Justice works its way through the courts, the President negotiates a treaty with the United Kingdom regarding cross-border access to the cloud, and Congress rewrites the Electronic Communications Privacy Act, finding a grounded approach to addressing this problem-one rooted in longstanding jurisdictional and conflicts principles-has never been more critical. Assistant Professor, University of Kentucky College of Law. The Author thanks Jack Goldsmith, Ryan Goodman, Orin Kerr, Matthew Perault, Jennifer Granick, Tino Cuellar, Jen Daskal, Al Gidari, Nicole Jones, Rick Salgado, Greg Nojeim, Nate Jones, Alex Abdo, Albertina Antognini, Alan Rozenshtein, Peter Swire, Will Baude, Shalev Roisman, as well as members of the legal and policy teams at Google, Facebook, Microsoft, and the Global Network Initiative. The Article benefited from workshops at NYU Law School, Stanford's Center for Philanthropy and Civil Society, the Junior International Law Scholars Association's annual meeting, the Center for Strategic and International Studies, and Harvard's Berkman Center for Internet and Society. The Author is especially grateful to Gail Kent for organizing a meeting with GCHQ, technology firms, and civil society groups at Wilton Park, where this Article first took shape. Against Data Exceptionalism 68 STAN. L. REV. 729 (2016) Table of Contents Introduction ........................................................................................................................................................... 731 T he Problem ................................................................................................................................................ 739 A . Evidence in the G lobal C loud ................................................................................................... 739 B. Jurisdictional C onfusion ............................................................................................................ 745 C . A Broken International System .............................................................................................. 748 D . G overnm ent R esponse ................................................................................................................ 751 II. Is D ata D ifferent? ...................................................................................................................................... 754 A . T he C laim : "Data Is D ifferen t"................................................................................................ 755 B. T he R eality: D ata Is N ot So D ifferent .................................................................................. 756 1. Data as an intangible asset ................................................................................................ 756 a. Intangibility .................................................................................................................. 756 b. Mobility .......................................................................................................................... 758 c. Divisibility and fu n gibility ................................................................................... 759 d. Distance between the asset holder and the asset ....................................... 760 2. Data as a physical asset ...................................................................................................... 760 C. Sum m ary ............................................................................................................................................. 763 III. Jurisdiction over D ata in the C lou d .......................................................................................... ....764 A. Prescriptive Jurisdiction ............................................................................................................ 765 1. Location of the data ............................................................................................................ 766 2. Location of the harm .......................................................................................................... 767 3. C itizenship of the suspect ................................................................................................ 768 4. C itizenship of the victim .................................................................................................. 768 5. C itizenship of the data controller ............................................................................... 769 B. Enforcem ent Jurisdiction .......................................................................................................... 769 C . Integrated A nalysis ........................................................................................................................ 772 IV . C onfl icts of Law s over the C lou d .................................................................................................... 774 A. A Conflicts Approach to Evidence in the Global Cloud ........................................... 774 1. Identifying true confl icts .................................................................................................. 775 2. W eighing state interests ................................................................................................... 776 3. R eciprocity .............................................................................................................................. 778 B. Blocking Statutes ............................................................................................................................779 V . Im plications for Law and Policy ....................................................................................................... 781 A . R eform ing E C PA ........................................................................................................................... 781 B. Interpreting EC PA ......................................................................................................................... 785 C . Im proving M utu al Legal A ssistance .................................................................................... 786 D . T he C ase A gainst a G lobal T reaty ......................................................................................... 787 C onclusion .............................................................................................................................................................. 788 Against Data Exceptionalism 68 STAN. L. REV. 729 (2016) Introduction On December 4, 2013, a magistrate judge in the Southern District of New York issued a search warrant for the contents and