On October 16, 2017, the United States Supreme Court granted the Justice Department’s petition for a writ of certiorari and will hear an appeal from a Second Circuit decision barring the government from accessing user data stored overseas by Microsoft.   As previously suggested, this case brought under the Stored Communications Act (“SCA”) has significant implications for transnational companies who maintain or store data outside the US.

By way of background, the Second Circuit ruled that data stored overseas was not subject to the SCA – which typically allows the government to access the contents of stored communications – including emails, that are more than 180 days old, using a subpoena, court order, or warrant.  Ultimately, the Court of Appeals agreed with Microsoft’s position that absent congressional authorization statutes such as the SCA are presumed to have no extraterritorial effect and given the lack of such statutory authorization, the warrant should have been quashed.

Given that there were a flurry of amicus briefs filed – as well as an animated government brief suggesting that the Second Circuit’s decision was “highly detrimental” to criminal law enforcement, it will be interesting to see which argument the Court ultimately adopts.  Microsoft certainly fought an aggressive PR battle opposing Supreme Court review – seeking instead that its lobbying firms wage war in Congress.  In fact, Microsoft suggests in a blog post that the momentum for a legislative solution continues in Congress despite the Court taking on the case.

In keeping with the Halloween season, Microsoft’s Chief Legal Officer tries to scare up some support for a legislative solution:  “If U.S. law enforcement can obtain the emails of foreigners stored outside the United States, what’s to stop the government of another country from getting your emails even though they are located in the United States?”

Even though his analogy obviously falls flat, the Court’s docket – between this Microsoft case and the SCA location data case previously taken up by the Court in June, may very well ultimately generate a scary result for one or more advocacy groups located on the privacy continuum.

UPDATE:  April 18, 2018

Turns out the Supreme Court will not be deciding this case after all.  On April 17, 2018, the U.S. Supreme Court dismissed U.S. v. Microsoft, ruling that the recently enacted Clarifying Lawful Overseas Use of Data Act (CLOUD Act) that was passed as part of the Omnibus budget act rendered the case moot.   Not completely happy with the result, Microsoft blogged that the “journey continues”.  Despite a thoughtful presentation on the topic, Microsoft does not really state what makes for a successful conclusion to that journey.

On June 5, 2017, the Supreme Court agreed to decide whether the government needs a probable cause warrant before accessing a suspect’s cell phone location history.  Timothy Carpenter was found guilty of aiding and abetting a series of armed robberies but challenged his conviction on the grounds that the cell location data collected pursuant to a court order issued under the Stored Communications Act (“SCA”) required that the government show probable cause rather than merely the SCA’s “reasonable grounds” for believing the records were relevant to an ongoing investigation.

In a split decision, the Sixth Circuit ruled in April 2016 that given the cell phone location data in the case ranged from half-mile to two-mile in distance it did not fall under the Fourth Amendment’s search protections.  Moreover, according to the Sixth Circuit, no probable cause warrant was necessary given that cell location data points are business records subject to the SCA and reveal nothing about the actual content of communications.  Id. at 7. On behalf of Carpenter – the person who “organized most of the robberies and often supplied the guns”, the ACLU filed a Petition for Certiorari asking: “Whether the warrantless seizure and search of historical cell phone records revealing the location and movements of a cell phone user over the course of 127 days is permitted by the Fourth Amendment.”

Apparently looking to push the Supreme Court into making a technology-forward decision, the ACLU points out how data collection methods have improved since the 2011 arrest of Carpenter.  See e.g., Petition at 7 (“Although in this case MetroPCS provided only information identifying Carpenter’s cell site and sector at the start and end of his calls, service providers increasingly retain more granular historical location data, including for text messages and data connections. . . .Location precision is also increasing as service providers deploy millions of “small cells,” “which cover a very specific area, such as one floor of a building, the waiting room of an office, or a single home.””).

This case is noteworthy given that SCA law enforcement actions can sometimes impact future civil matters.  For example, on July 14, 2016, the Second Circuit ruled that the government could not force Microsoft to comply with a search warrant based on the SCA when that warrant required an extraterritorial search and seizure of data stored in Microsoft’s data center in Ireland.  In that case, probable cause was actually set forth in the warrant.  Nevertheless, the Court’s ruling, namely that the SCA-based warrant lacked extraterritorial effect, may allow for the quashing of future SCA civil subpoenas on similar grounds.

It is not clear how far the Supreme Court will reach when deciding the Carpenter case or whether language in the Court’s future decision might mold cases far afield from armed robberies in the Midwest.  Nevertheless, coupled with other cases such as the 2012 case of United States v. Jones where the Supreme Court first took a look at how the Fourth Amendment applies to police use of GPS technology, there may soon coalesce strong judicial guidance for digital marketers.   As recognized by Justice Sotomayor in United States v. Jones:

it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties.  This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks…Perhaps, as JUSTICE ALITO notes, some people may find the tradeoff of privacy for convenience worthwhile, or come to accept this diminution of privacy as inevitable, post, at 10, and perhaps not.

The United States v. Carpenter case may offer Justice Sotomayor a new and expanded platform for her 2012 dicta.  Digital marketers take note.

On March 2, 2017, Věra Jourová – the Justice on the European Commission tasked with “Consumers and Gender Equality” recently raised a vague concern as to whether the Privacy Shield could withstand President Trump’s recent immigration executive order.  She said “If there is a significant change, we will suspend”.  This minimalist threat, however, seems more like an attempt to play up her visit to the White House in late March.

Privacy Shield is the data-transfer agreement negotiated by the United States and the European Union in February 2016 that is now relied upon by many international firms transferring and maintaining personal data between the EU and US.   Given that it was a court challenge that ultimately gave rise to Privacy Shield, it will always be subject to threat from legal action.  In fact, the ACLU and Human Rights Watch has already tried to stir the pot by sending a letter to the EU Commission after Trump’s recent executive action on immigration.  It is not clear why the American Civil Liberties Union would care about the privacy rights of those in the EU but that is left for a separate discussion.

To nip all of this in the bud, on February 22, 2017, Acting Federal Trade Commission Chairman Maureen Ohlhausen previously said that the immigration order would not in any way affect the FTC’s enforcement of the Privacy Shield given that order does not impact commercial activity.  To that end, Commissioner Jourová also previously said she was “not worried” but remained vigilant regarding the order.

There are lawyers who believe that Privacy Shield may be in play due to the President’s activities.  For example,  Aaron Tantleff of Foley & Lardner LLP is reported as saying “certain actions being taken by this administration could lead to the suspension of Privacy Shield. We may leave the EU Commission and Parliament with no choice.”  Such vague missives may be good at percolating new business but do not represent a pragmatic perspective regarding Privacy Shield’s real threat.

Given the now entrenched nature of Privacy Shield and the vested interest EU and US business interests have in its continued implementation, it appears only another judicial blow based on the lack of data security will derail it – requiring the same sort of EU court ruling based on NSA data collection that ultimately cut down the predecessor Safe Harbor rules in the first place.  Simply put, until the new Administration’s activities adversely impact the security of personal data by mass collecting data or forcing companies to compromise data security features there is not much to worry about.