Last week, the privacy advocates celebrated a decision of the U.S. Supreme Court that concluded police must apply for and obtain a search warrant before tracking and collecting as evidence the ‘customer proprietary nework information” (CPNI, which records the physical location of cell phones) relating to the cell phones of criminal suspects. Carpenter v. United States. Far and wide, privacy advocates rejoiced.
Quite frankly, their joy is inappropriate. Rather than advancing privacy, the majority opinion sets the stage for nearly endless balancing, litigation, and counting of angels dancing on the heads of pins. That outcome is entirely inconsistent with the certainty, precision, and automated governance that the Internet now demands and, in the future, will require to survive and prosper as a global resource.
Humankind will not tolerate deferring the rulemaking on the availability of their digital records to law enforcement to judicial hindsight. In the US, these types of legal questions are resolved after the behavior has already occurred. The totality of cyberspace simply will not bend to the preferences and whims of local judicial standards. Nor will cyberspace tolerate the judges of one nation having much influence on the full global population that relies on the Internet.
On Friday, a law student alerted me to the dissenting opinion of Justice Gorsuch in the Carpenter case. Justice Gorsuch knew he was on the losing side in this case; nevertheless, he articulated a compelling rationale for reaching the same conclusion on a far more stable foundation of reasoning. Now, I am not a Constitutional law scholar by any means. But his argument harks back to the original purpose of the Fourth Amendment to the U.S. Constitution with a vibrancy that actually makes sense for how we continue to craft the rules for the Digital Age.
Do You Own Your Digital Stuff?
Judge Gorsuch explains, “The Fourth Amendment protects ‘the right of the people to be secure in their persons, houses, papers and effects, against unreasonable searches and seizures.’ True to those words and their original understanding, the traditional approach [in determining the protection of the Fourth Amendment] asked if a house, paper or effect was yours under law. No more was needed to trigger the Fourth Amendment.”
His analysis proceeds to point out that, as a practical matter, many of our records, communications, CPNI, e-mail, grocery orders we place with Alexa, and social media posts originate in, and are preserved in, the possession or control of third parties—service providers, software licensors operating in the Cloud, and more. But does their possession of our records change the essential truth that we believe those records to be ours?
Gorsuch surveys numerous prior decisions by the Supreme Court and other US courts in which the property of a suspect is still protected against search and seizures even if that property is in the custody or control of third parties. He logically poses the issue: Within the boundaries of digital space, when does an individual still own their digital records? Does the answer change if those records are required to be created by a third party (such as CPNI data) as a condition of the use of their services or if the possession of those records is merely a temporary condition, such as the digital archiving of a company’s business records with an online records custodian?
Defining Ownership of Digital Property
Judge Gorsuch certainly sees the potential here. He states, “Plainly, customers have substantial legal interests in CPNI, including at least some right to include, exclude, and control its use. Those interests might even rise to the level of a property right. [Emphasis added]”. If we actually had rights of ownership, rather than certain less-inclusive rights to include, exclude, or control certain uses, the entire privacy landscape, and much of the larger global dimensions of cyberspace, would be radically transformed.
Earlier this year, I co-authored an article which I expected would be lost amidst academic jumbles of digital thinking. But, suddenly, I believe the relevancy is worth emphasizing here. The article is titled, “Regulating Data as Property: A New Construct for Moving Forward” available here. Quite separate from personally identifiable information, our research uncovered strong momentum in Europe and in Japan to define and put in place legal frameworks for the ownership of digital information—both PII and all of the rest of the digital records created by industry that are not PII, what we captioned as “industrial data”.
As a general matter, no privacy law affirmatively defines that PII is the property of a data subject-an asset they own as well as have certain rights to control. That status is left unaddressed. Instead, privacy laws describe when the PII may be subject to certain controls or limits a data subject may require, and when the right to require those controls may be waived by consent or otherwise. But the law never clarifies whether the PII is the property of the individual.
But, globally, as our article elaborated, there is no legal framework for defining the ownership of any digital information that is functional. Copyright laws in the US do not go far enough; the Database Directive in the EU only protects those databases built with substantial investment. What Gorsuch has brilliantly framed, with constitutional commitment to original intent, is the simple question: When do we own digital assets as property for which we are legally protected against unconstitutional search and seizure?
That question has to be answered, not just for individual human suspects, but for the global community of humans, companies, and governments. That question has to be answered in order for all of the other valued legal fabrics of our global community to be extended to embracing our digital lives. Until that question is answered in a manner that allows ownership to be defined, and attached to specific data assets with precision and certain, we will be mired in the majority reasoning of Carpenter, which cautions lower courts to avoid “arbitrary power” and be mindful to place obstacles “in the way of a too permeating police surveillance.”
Our article proposes that clear, controlling rules for defining the ownership of digital assets can be built upon the legal constructs that have enabled electronic commerce to thrive. We proposed how that right arises, and suggest when and how that right attaches to specific data through the exercise of technological controls. We may not be right, but until we force the question to the front of our analysis, the future of the Internet will be unstable.
Thank you, Justice Gorsuch, for asking the simple question. Now it is incumbent upon all of us to formulate answers that will sustain and nurture the potential of the Internet to serve humankind.