The Secure Times

An online forum of the ABA Section of Antitrust Law's Privacy and Information Security Committee

Leave a comment

Warrantless GPS Tracking is Unconstitutional Government Trespass


st1\:*{behavior:url(#ieooui) }

/* Style Definitions */
{mso-style-name:”Table Normal”;
mso-padding-alt:0in 5.4pt 0in 5.4pt;
font-family:”Times New Roman”;}

In a 9-0 opinion released on Monday, the Supreme Court found that the installation of a Global-Positioning-System (GPS) device on a suspected drug dealer’s car without a current search warrant violated the Fourth Amendment’s prohibition on unreasonable searches. All nine justices agreed on the fundamental Fourth Amendment proposition but differed in their reasoning, leaving uncertain the scope of digital privacy.

The high court heard the case after the D.C. Circuit overturned the conviction of Antoine Jones, a nightclub owner convicted for conspiracy to distribute cocaine. His conviction was primarily based on the 2000 pages of data transmitted from the GPS device agents had secretly planted on Jones’s car for 28 days.

The majority opinion, written by Justice Scalia and joined by Chief Justice Roberts and Justices Kennedy, Thomas, and Sotomayor, emphasized the fact that the Government had physically occupied private property for the purpose of obtaining information. Applying traditional notions of trespass to the Fourth Amendment analysis, the high court stated, "[w]e have no doubt that such a physical intrusion would have been considered a `search’ within the meaning of the Fourth Amendment when it was adopted." While the majority made clear that the trespass test was not the exclusive test, it declined to address to what degree the reasonable expectation of privacy test applied in digital privacy cases not involving a trespass.

A concurrence authored by Justice Alito and joined by Justices Ginsburg, Breyer, and Kagan, criticized the majority’s reliance on the trespass-based rule or what Justice Alito described as “18th century tort law.” Justice Alito would have analyzed the question presented by asking whether Jones’s reasonable expectations of privacy were violated by long-term GPS monitoring. He noted the panoply of new devices operating GPS technology, such as smart phones and other location-based services offered as social tools. In an environment of dramatic technological change, Justice Alito acknowledged that the best solution to privacy concerns may be legislative. In the absence of such guidance, Justice Alito’s concurrence suggests the exclusive application of the reasonable expectation test to all digital privacy cases.

An additional concurring opinion by Justice Sotomayor feared the majority decision would provide little guidance in cases of electronic or other novel modes of surveillance that do not depend on a physical invasion of property. Her concern touched less on the mode of surveillance than on the content of sensitive data collected. Accordingly, Sotomayor suggested a paradigm shift in the way that privacy issues are considered. In her view, the premise that the individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties is ill-suited to the digital age and should be reformed.

At a minimum, this case demonstrates the Supreme Court’s recognition of the need to preserve privacy in an increasingly digital age. Given the majority’s limited holding, however, many questions about digital privacy remain unanswered.

Leave a comment

Supreme Court Strikes Down Vermont Prescription Privacy Law

In Sorrell v. IMS the U.S. Supreme Court stroke down yesterday (by a vote of 6-3) Vermont’s 2007 Prescription Confidentiality Law, which had made it illegal for pharmacies and similar entities to sell prescriber-identifying information, without the prescriber’s consent. The court had heard oral arguments in April.

Subject to certain exceptions, such as health care research, this information could not have been be sold or disclosed by pharmacies for marketing purposes. The law, Vt. Stat. Ann., Tit. 18, §4631 (Supp. 2010), states that:

“A health insurer, a self-insured employer, an electronic transmission intermediary, a pharmacy, or other similar entity shall not sell, license, or exchange for value regulated records containing prescriber-identifiable information, nor permit the use of regulated records containing prescriber-identifiable information for marketing or promoting a prescription drug, unless the prescriber consents . . . . Pharmaceutical manufacturers and pharmaceutical marketers shall not use prescriber-identifiable information for marketing or promoting a prescription drug unless the prescriber consents . . . .”

Pharmacies receive prescriber-identifying information when processing prescriptions, and many of them then sell this information to data-mining companies, which use this information to write marketing reports. These reports are leased to pharmaceutical manufacturers, and used for marketing research, leading to increased sales.

The case involved two consolidated suits, one brought by Vermont data-miners, the other by an association of pharmaceutical manufacturers, all contending that the Vermont law violated their First Amendment rights, as speech helping pharmaceutical marketing is speech protected by the First Amendment. The United States District Court for the District of Vermont had denied them relief, but the Second Circuit reversed, holding that the Vermont law violated the First Amendment by burdening the speech of pharmaceutical marketers and data mining companies without an adequate justification.

The state of Vermont had argued that the law is merely a commercial regulation, and thus heightened judicial scrutiny is unwarranted. But the Supreme Court was not convinced, noting that the law “imposes more than an incidental burden on protected expression. Both on its face and in its practical operation, Vermont’s law imposes a burden based on the content of speech and the identity of the speaker.” Since Vermont’s law enacts content- and speaker-based restrictions on the sale, disclosure, and use of prescriber-identifying information, this statute…

disfavors marketing, that is, speech with a particular content. More than that, the statute disfavors specific speakers, namely pharmaceutical manufacturers. As a result of these content- and speaker-based rules, detailers cannot obtain prescriber-identifying information, even though the information may be purchased or acquired by other speakers with diverse purposes and viewpoints.”

The state of Vermont had also argued that physicians have a “reasonable expectation” that their prescriber-identifying information “will not be used for purposes other than . . . filling and processing” prescriptions. The Supreme Court was not convinced by this argument either as the Vermont law does not completely serve that interest. The Vermont law allows pharmacies to share prescriber-identifying information with anyone unless this person then allows the information to be used for marketing. However, researchers, journalists, even the State itself, may use the information, and this “does not in itself advance confidentiality interests” remarked the Supreme Court, noting that…

[p]erhaps the State could have addressed physician confidentiality through “a more coherent policy.” For instance, the State might have advanced its asserted privacy interest by allowing the information’s sale or disclosure in only a few narrow and well-justified circumstances.. A statute of that type would present quite a different case than the one presented here. But the State did not enact a statute with that purpose or design. Instead, Vermont made prescriber-identifying information available to almost limitless audience. The explicit structure of the statute allows the information to be studied and used by all but a narrow class of disfavored speakers….

Vermont has given its doctors a contrived choice: Either consent, which will allow your prescriber-identifying information to be disseminated and used without constraint; or, withhold consent, which will allow your information to be used by those speakers whose message the State supports. [The Vermont law] may offer a limited degree of privacy, but only on terms favorable to the speech the State prefers.”

Justice Breyer wrote a dissenting opinion, with whom Justice Ginsburg and Justice Kagan joined. In his view, the Vermont statute only adversely affects speech in one way, as it prevents pharmaceutical and data-mining companies to access data that could help pharmaceutical companies create better sales messages. Justice Breyer wrote: ”In my view, this effect on expression is inextricably related to a lawful governmental effort to regulate a commercial enterprise.”

Leave a comment

Supreme Court Hears Oral Arguments in Data Mining Case

Today, the Supreme Court heard oral arguments in Sorrel v. IMS.  At issue was a Vermont law that banned the selling and buying of prescription information without a doctor’s consent. The law also requires that doctors fill out a form as part of their license renewal application that indicates whether they agree to have their prescription information sold for marketing purposes.  The Second Circuit previously held this law was an impermissible restriction upon commercial speech, and therefore unconstitutional.

At oral arguments, it was clear that the Justices viewed this case as one concerning commercial speech.  In response to Vermont’s arguments, Justice Kennedy stated Vermont was “regulating speech,” and Justices Kennedy, Scalia, and Chief Justice Roberts all suggested that Vermont was attempting to limit drug companies’ speech only because the speech was effective in selling their products.  Although privacy observers have suggested that the ruling will have a large impact on both data mining companies and consumers, only at the end of arguments did at least some of the Justices appear open to allowing states some ability to regulate data-mining that threatened privacy. 

The Court is expected to issue a decision before recessing for the summer.  The transcript of today’s arguments is available here

Leave a comment

Supreme Court Grants Certiorari in Case Challenging Vermont’s Prescription Confidentiality Law

On January 7, 2010, the U.S. Supreme Court granted the petition for writ of certiorari filed by the State of Vermont seeking to overturn the decision from the Second Circuit which held that Vermont’s prescription confidentiality law was unconstitutional. 

The section of the Vermont law at issue in the appeal, codified at 18 V.S.A. § 4631, prohibits the sale, license, or exchange for value of prescriber-identifiable data for marketing or promoting a prescription drug unless the prescriber consents.  The Vermont legislature passed the law in 2007, intending to protect public health, to protect prescriber privacy, and to reduce health care costs.

The law was challenged by companies, commonly referred to as “data miners,” which purchase information regarding prescriptions from pharmacies, including the prescriber’s name and address, the name, dosage, and quantity of the drug, the date and place the prescription is filled, and the patient’s age and gender.  The data miners aggregate this information and sell it to pharmaceutical research and manufacturing companies to assist in their marketing efforts to prescribing physicians.  The law was also challenged by the Pharmaceutical Research and Manufacturers of America.  

The Second Circuit overturned the district court’s decision, 631 F. Supp. 2d 434 (D. Vt. 2009), upholding the Vermont law as a constitutional restriction of commercial speech.  The Second Circuit determined that the Vermont law did not pass intermediate scrutiny under Central Hudson Gas & Elec. Corp. v. Pub. Serv. Comm’n, 447 U.S. 557 (1980) because the Vermont law did not “advance the state’s interests in public health and reducing costs in a direct and material way” and there were less speech-restrictive means which Vermont could have used. 

The Second Circuit’s decision created a split with the First Circuit, which had previously upheld similar laws from New Hampshire (IMS Health Inc. v. Ayotte, 550 F.3d 42 (2008)) and Maine (IMS Health Inc. v. Mills, 616 F.3d 7 (2010)).

According to a statement from Vermont Attorney General, the case, Sorrell v. IMS Health Inc., No. 10-779, will likely be argued in April of this year and decided before the end of the Court’s term in June.


Leave a comment

Will corporations be recognized as having a right to privacy?


The U.S. Supreme Court agreed on September 28, 2010, to review whether Exemption 7(C) of the Freedom of Information Act (FOIA), protecting “personal privacy,” protects not only the privacy of individuals, but also the privacy of corporate entities. The case is Federal Communications Commission v. AT&T, Inc. Docket No. 09-1279.

The facts of the case are as follows. AT&T had provided equipment and services to a federal program administered by the Federal Communications Commission (FCC) geared at increasing schools’ access to advanced telecommunications technology. AT&T found out in 2004 that it may have overcharged the Government for some work, and voluntarily reported that fact to the FCC. The FCC Enforcement Bureau (Bureau) then conducted an investigation. As part of this investigation, AT&T produced various documents to the Bureau. In April 2005, a trade association representing some of AT&T’s competitors submitted a FOIA request for documents in this investigation file. AT&T submitted an objection to disclosure, arguing that FOIA’s exemptions prohibited disclosure.

FOIA, U.S.C. § 552, was enacted by Congress in 1966 in order to improve public access to information controlled by federal agencies. Congress wanted FOIA to reflect "a general philosophy of full agency disclosure unless information is exempted under clearly delineated statutory language." S.Rep. No. 89-813, at 3 (1965). Indeed, there are nine enumerated statutory exemptions allowing an agency to withhold documents responsive to a FOIA request. One of these exemptions is codified at § 552(b)(7)(C) (Exemption 7(C)): FOIA does not apply to “records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information could reasonably be expected to constitute an unwarranted invasion of personal privacy.”

FOIA does not define “personal,” but “person” is defined by the Administrative Procedure Act (APA), 5 U.S.C. § 551(2), as “includ[ing] an individual, partnership, corporation, association, or public or private organization other than an agency.” The FOIA was enacted as an amendment to the APA, so it can be argued that this definition applies to FOIA as well.

The Bureau issued a letter-ruling in August 2005, rejecting AT&T’s argument that Exemption 7 (C) prohibited disclosure because corporations lack “personal privacy.” AT&T asked the FCC to review this ruling, and in October 2008 the FCC issued an order compelling disclosure, arguing that Exemption 7 (C) does not apply to corporations. AT&T then filed a petition to review the FCC’s order, arguing that an incorrect interpretation of Exemption 7 (C) prevented a corporation to claim a personal privacy interest.

The Third Circuit reviewed the FCC’s order, and granted AT&T’s petition for review on September 22, 2009, and remanded for further agency proceedings. The Court held that FOIA “unambiguously indicates that a corporation may have a “personal privacy” interest within the meaning of Exemption 7 (C).“ The Third Circuit reasoned that Exemption 7(F) of FOIA prohibits disclosure of information that, if released, “could reasonably be expected to endanger the life or physical safety of any individual”(emphasis in the Third Circuit decision), thus indicating that Congress wanted only human beings to benefit from Exemption 7(F). Since Congress did not use the same language in Exemption 7 (C), it indicates that Congress wanted it to have a broader protective scope. Also, it reasoned that “personal” is the adjectival form of “person” and that “it would be very odd indeed for an adjectival form of a defined term not to refer back to that defined term.”

The FCC and the Government petitioned the Supreme Court for a writ of certiorari, and the Supreme Court granted it on September 28.

The Government argued in the petition that “the law ordinarily protects personal privacy to safeguard human dignity and preserve individual autonomy,” and “such concepts do not comfortably extend to a corporation.” The Third Circuit noted in footnote 5 of the ruling that “corporations, like human beings, face public embarrassment, harassment, and stigma “if they are involved in law enforcement investigations.” The government shunned “this attempted personification of an entity.”

However, in Citizen United v. Federal Election Commission, 558 U.S. 50 (2010), the Supreme Court held corporations cannot be prevented by the government to spend money in order to support or to denounce a political candidate, as corporate spending is a form of political speech. The Supreme Court cited the precedent of First Nat. Bank of Boston v. Bellotti, 435 U. S. 765 (1978), to state that “the First Amendment does not allow political speech restrictions based on a speaker’s corporate identity.” Will corporations now have a right to privacy? 

The government also argued that if the APA defines “person” as including public organizations other than a federal government agency, state, local, foreign governments and governmental components would then be given a right to privacy, and thus federal agencies answering a FOIA request may have to balance the public interest in disclosure against the privacy interests of corporations and governments. This may jeopardize public disclosure of government records. Indeed, Public Citizen, the Electronic Frontier Foundation and other nonprofit organizations have filed a brief of Amici Curiae, stating that the Third Circuit’s decision undermines the core purpose of the FOIA, and would prevent that records concerning government oversight of industry would be available to the public.  Once again, the delicate balance between the right of privacy, if there is such a right for corporations, and freedom of information, will have to be assessed by the Supreme Court.