CASE LAW Simon Frankel Partner [email protected] Melanie Ramey Law Clerk Covington & Burling LLP, San Francisco Carpenter v. U.S.: What privacy rights do we have over our mobile phone data after all? On 29 November 2017, the U.S Supreme Court heard oral arguments in Carpenter v. U.S. Carpenter focuses on the application of the ‘third-party doctrine’ concerning individuals’ reasonable expectation of privacy in the context of law enforcement access to personal information held by service providers without a warrant. Simon Frankel and Melanie Ramey, Partner and Law Clerk respectively at Covington & Burling LLP, provide an overview of Carpenter, highlight the impact it may have on privacy and outline potential approaches that the Supreme Court may take in its judgement. What expectation of privacy do you of Investigation (‘FBI’) was able to place ‘third-party doctrine.’ This doctrine have in your smartphone, a device that Carpenter’s phone within a half-mile to provides that individuals do not have a has become such a central aspect of two-mile radius of each of the robberies ‘reasonable expectation of privacy,’ a so many people’s lives and livelihoods? as they occurred. Relying on this key requirement for Fourth Amendment Have you consented to a search of your evidence, a jury convicted Carpenter of protections, regarding any information location and other personal information all nine robberies and sentenced him they voluntarily convey to third parties. simply by virtue of carrying around your to more than 115 years imprisonment. mobile phone? These are the central In Carpenter, the issue is whether questions currently before the Supreme Had the FBI surreptitiously collected he had a reasonable expectation of Court in a case touted as one of the most this data from Carpenter in some way, privacy in his mobile phone’s location important privacy cases in decades. it would likely be an unconstitutional information, given that such information search absent a warrant [emphasis was necessarily provided to a third In Carpenter, the Supreme Court added]. For example, in 2012, in U.S. party, his mobile phone carrier. If the is considering Petitioner Thomas v. Jones, the Supreme Court held that fact that his carrier would necessarily Carpenter’s conviction for multiple 28 days of location information secretly possess this information triggers counts of armed robbery. The central gathered by placing a GPS tracker the third-party doctrine, then law issue is whether law enforcement on a suspect’s car without a warrant enforcement ofcers did not need a ofcers violated Carpenter’s Fourth was an unconstitutional search. warrant to obtain this information. Amendment rights against unlawful search and seizure when they collected The third-party doctrine The third-party doctrine is a rule 127 days of his mobile site location The Carpenter case, in contrast, created by the Supreme Court in a pair information without a warrant. Armed touches at the heart of a key Fourth of decisions in the late 1970s. In U.S. with that information, the Federal Bureau Amendment doctrine known as the v. Miller, the Supreme Court found no 14 DATA PROTECTION LEADER Image: Warren Wong / Unsplash.com The Carpenter case touches at the heart of a key Fourth Amendment doctrine known as the ‘third-party doctrine.’ That doctrine provides that individuals do not have a ‘reasonable expectation of privacy,’ a key requirement for Fourth Amendment protections, in any information they voluntarily convey to third parties. A Cecile Park Media Publication | February 2018 15 CASE LAW Based on the briefs, prior case law, and the Justices’ comments during oral arguments on 29 November 2017, the Supreme Court may draw the line between what is still considered private and what is not in one of several ways. continued expectation of privacy in the contents no loss of an expectation of privacy is to ask whether an individual actually of original checks and deposit slips in email content, even if transmitted gave the information at issue to the because (1) they were not confidential by a third party service provider6. third party voluntarily [emphasis added]. communications, but rather negotiable Now, in an era where mobile phones During oral arguments, the Government instruments, and (2) “all the documents and interconnected devices have pointed out that companies often obtained contain only information become ubiquitous, the Supreme require individuals to relinquish certain voluntarily conveyed to the banks Court is considering whether to re- information in the course of obtaining and exposed to their employees in examine this doctrine, and if so, how it a third party’s services, arguing that the ordinary course of business1.” should redraw the line of what is and an individual’s happiness about this is not going to be considered private. exchange should be irrelevant. In Smith v. Maryland, the Supreme Court Carpenter will require the Supreme found the defendant similarly had no Court to decide whether to narrow the As technology progresses, however, expectation of privacy in numbers he third-party doctrine further, whether to the extent to which individuals are dialled into his phone, as by dialling leave the rule as it stands, or whether aware of this exchange, and the extent he “voluntarily conveyed numerical to change the rule more dramatically. to which delivery of information is information to the phone company truly voluntary, becomes less and less and ‘exposed’ that information to its Where will the Supreme Court clear. For example, an amicus brief in equipment in the normal course of draw the line for privacy? the case cited a survey suggesting business,” thereby “assum[ing] the Based on the briefs, prior case law, that ‘a strong majority of Americans risk that the company would reveal and the Justices’ comments during oral do not understand that this [location] the information to the police2.” These arguments, the Supreme Court may draw information is even accessible to, much two cases, decided only three years the line between what is still considered less retained by, service providers.’ apart, created a rule that has become private, and what is not, in one of several Thus, the Justices could foreseeably a cornerstone of legal understanding ways. One approach would be to create a rule distinguishing between of the limits of Fourth Amendment consider the sensitivity of the information information knowingly given and protections, a rule that has so far been at issue. Information such as diagnostic information unwittingly transmitted, left relatively unmarred by nearly test results might fall under the umbrella mirroring the philosophy behind the four decades of subsequent cases of privacy and require a search warrant, third-party doctrine as initially conceived. and technological advancements. while call logs of numbers people dialled into their phones would not be sufciently It is also possible the Supreme Court Exceptions to the third-party doctrine sensitive and so would not. Relying on will draw the line somewhere else. It While the third-party doctrine has the sensitivity of data to determine the could hold that the volume of information remained relatively constant over several level of protection it requires, however, collected is the determinate factor, decades, the Supreme Court has limited would likely create unwieldy and though this seems at least somewhat the bounds of the doctrine to some extent uncertain results; it would be difcult arbitrary and disjointed from any potential by carving out several exceptions. For to create a bright line rule as to what is charge that might be brought. It might example, the Supreme Court found that sensitive enough to merit safeguarding. also turn to the time period over which individuals have a reasonable expectation it is collected, which raises similar of privacy in diagnostic test results3; in During oral arguments, for example, concerns and was highly criticised by luggage placed in an overhead bin on a Carpenter’s counsel and Justice the Justices during oral arguments. bus, despite the possibility of an external Alito disagreed on whether location Another possibility altogether is to inspection by others4; and in hotel rooms information was more sensitive than consider whether an individual has where they are guests, despite the implied financial records, access to which the some kind of vested property interest or express permission for third parties Supreme Court already held did not in the information, a favourite theory to access their rooms5. Significantly, the constitute a search requiring a warrant. of Justice Gorsuch, but one that was Sixth Circuit Court of Appeals found Another line the Justices could draw largely ignored by his colleagues. 16 DATA PROTECTION LEADER Image: Erik Lucatero / Unsplash.com Defining what is and is not private in livelihoods, the more our once-private The Carpenter decision an increasingly connected world lives increasingly rest in third party hands. Regardless of the distinctions the will likely have a Justices make (or don’t make), the The impact of the ruling on profound impact on how Carpenter decision will likely have a law enforcement, companies profound impact on how courts define and Americans’ privacy courts define ‘privacy’ privacy in the modern era. In the The Supreme Court’s ruling in this in the modern era. 1970s when the third-party doctrine case, therefore, will not only impact was created, defining what was and how readily law enforcement ofcers was not private was a simpler matter. can access mobile location information The lines blurred when companies - the accuracy of which the Justices and other outside parties became acknowledge has improved quite involved, but we could at least be sure dramatically in and of itself in the nearly that the property we carried on our a decade since Carpenter’s information person and brought into our homes was first collected - but would also would be free from unwarranted apply to any data that companies government intrusion.