Don't let technology leave privacy behind

The 4th U.S. Circuit Court of Appeals recently held, en banc, in United States v. Graham that cellphone users do not have a reasonable expectation of privacy in their cellphone location information and that the government therefore does not need a warrant to obtain that information from the user's wireless carrier. Although this is a significant blow to privacy, it is hardly the death knell that some commentators are declaring. The law in California at both the state and federal levels is far more privacy protective, and the 4th Circuit's decision may not be a reliable indication of how the Supreme Court will ultimately rule.

At the outset, it's worth emphasizing the privacy rights at stake. The 4th Circuit in Graham essentially held that the government has a right to collect and keep comprehensive tabs on the whereabouts of the 90 percent of American adults who own cellphones, even when the government lacks any probable cause to suspect wrongdoing. As a matter of common sense and constitutional principles, that simply cannot be correct.

Location surveillance can be astonishingly precise. Wireless carriers typically retain records about the location of cellphones on their networks. Cellular telephones regularly communicate with the carrier's network by sending radio signals to nearby base stations, commonly referred to as cell towers, generating location information with each connection. The precision of the information varies based on a number of factors (including the density and type of towers and the frequency with which the phone connects to the network). In some cases, the data can pinpoint a phone's location to a specific room inside a building.

As a result, access to a cellphone's location information provides a granular accounting of the user's movements. Exposing intimate details about the locations a cellphone user visits necessarily reveals sensitive information about religious, political and romantic affiliations.

The constitutional question under the Fourth Amendment is whether cellphone users have a reasonable expectation of privacy in their cellphone location information. Cellphone usage is a necessary incident of modern life. That being so, it is also entirely reasonable to expect that we would not completely forfeit our privacy simply by participating in society and joining the 90 percent of the population that owns and uses a cellphone.

Nor is this conclusion altered by the fact that cellphone location records are retained by third-party wireless carriers. Under the "third-party doctrine," individuals lack a legitimate expectation of privacy in information voluntarily conveyed to a third party. But there is nothing particularly "voluntary" about a cellphone user's conveyance of location information to a wireless carrier. Connections to the network are triggered not only by user-initiated activities such as placing voice-calls and sending text messages, but also by passively receiving calls and text messages and by data activities that require no user initiation, nor even participation, such as push-mail notifications and software updates. In addition, location information records are kept by carriers to which a user has no direct contractual relationship when, for example, the user "roams" onto a different network.

To be sure, privacy advocates have reason to be concerned. The 4th Circuit has now joined the 5th, 6th and 11th Circuits in concluding that cellphone users relinquish their privacy rights in their whereabouts by using wireless carriers for phone service. This rationale of course has troubling implications for all kinds of digital data retained by third parties, ranging from smart meter data retained by utilities to exercise information retained by health apps. But reports of privacy's death in the digital era have been greatly exaggerated.

The legal landscape in California is radically different. On the federal front, three district judges in the Northern District of California have now held that the government must obtain a warrant for cellphone location information. The 9th Circuit has not yet weighed in on the issue. As long as there is no federal circuit split, the Supreme Court is unlikely to take up the issue. But eventually the issue will reach the high court. And in the past, even when a majority of appellate courts had adopted a cramped view of the Fourth Amendment, the Supreme Court has recognized the need to update the doctrine for the digital era. It did exactly this in both United States. v. Jones and Riley v. California, in which it held that the government must obtain a warrant, respectively, to track a vehicle with a GPS device or to search an arrestee's cellphone.

Moreover, California's constitution contains an express right to privacy that provides greater protection than the Fourth Amendment. In particular, the California Supreme Court has repeatedly rejected the third-party doctrine and safeguarded the privacy of personal information that constitutes a "virtual current biography." And our Legislature recently further solidified these rights by enacting the most comprehensive digital privacy law in the nation, the California Electronic Communications Privacy Act. CalECPA, as the law is called, requires that a California government entity obtain a warrant for all digital content, location information, metadata, and access to devices like cellphones.

Location data reveals a wealth of intimate information about who we are and where we go, information that the government should not be able to amass without probable cause. We cannot allow privacy rights to get left behind, while the law catches up with technology.