We write about data breaches and privacy issues all the time. We are desensitized in some ways to the fact that our privacy may have been, or will be, compromised and, quite frankly, many people now distrust some of the very companies with which they shared their information. California led the way regarding privacy legislation with the California Consumer Privacy Act of 2018 (CCPA). Washington, Massachusetts and Rhode Island are a few of the states with pending legislation to address data privacy issues, and we recently wrote about the possibility of federal privacy legislation.
This week we spotlight the state of Utah, where the Governor this week signed legislation designed to protect private electronic data stored and held by third parties, such as wireless providers, email, or search engine data, from government access without a warrant. Among other things the bill:
- Requires the issuance of a search warrant to obtain certain electronic information or data;
- addresses notification that electronic information or data was obtained;
- provides for transmission of electronic information or data to a remote computing service, including restrictions on government entities;
- provides that the individual who transmits electronic information or data is the presumed owner of the electronic information or data; and
- provides for the exclusion of electronic information or data obtained without a warrant.
The legislation is designed to add protections to individuals’ electronic data that is entrusted to third parties. Why is this important? It’s no secret that technology has developed far faster than legal doctrines, statutes and regulations. What happens when law enforcement wants access to cell phone location data? It is data that is in the hands of a third party. Do we have an expectation of privacy regarding this information?
Currently, we rely on the Supreme Court’s ruling in Carpenter v. United States, in which the Court acknowledged that cell phone personal location information maintained by a third party does not fit neatly under existing precedents. The Court’s ruling was narrow; that is, that the cell phone location records and the Government’s acquisition of those records was a Fourth Amendment search, and in this case, the Government did not obtain a warrant for the cell phone location records and the mechanism the Government used to obtain the records was not permissible.
Utah is now the first state to pass legislation that will require law enforcement to obtain a search warrant for electronic information or data held by a third party.