Student Blogger - What Are You Hiding in that Statute?: Canvassing Federal Privacy Law
We live in an age of information, and it’s old hat by now to bemoan our inability to control the ebb and flow of the information formerly known as “private.” Sensing the dissatisfaction of the voting public and perhaps an interest group or two, lawmakers at various levels of government have passed laws that regulate the use and acquisition of the unimaginably massive amount of data that our daily comings and goings generate. Professor Erin Murphy (NYU) presented a paper to the Public Law and Legal Theory workshop that aims to answer several related questions: What does the federal statutory approach to regulating information with regard to law enforcement look like? How does this compare to the Fourth Amendment’s ban on unreasonable search and seizure? Do the courts or Congress regulate private information more effectively?
Most of the federal statutes regulating private information are fairly new and have been passed since the 1970s. There are a huge number of narrow and specific statutes relating to privacy. In no particular order: the Stored Communications Act, the Bank Secrecy Act, the Genetic Information Nondiscrimination Act, the Real ID Act, and Video Privacy Protection Act. These are a few of the twenty or so federal statutes that regulate in some manner the use and acquisition of private information. Professor Murphy explained that no single coherent story seems to explain the passage of these statutes, although many of them were enacted after a triggering event. For example, during Robert Bork’s Senate confirmation hearings his video rental history was released to the press. Bork’s rental list was unremarkable, but shortly thereafter the Video Privacy Protection Act was passed, which imposed civil penalties on video rental providers that released such information. Despite the knee jerk approach to federal privacy law, each of these statutes has a law enforcement exception that permits government officials to access information as part of a criminal investigation. For example the Right to Financial Privacy Act prohibits banks from disclosing customer information to United States officials unless they are conducting “a lawful investigation or official proceeding inquiring into a violation of, or failure to comply with, any criminal or civil statute or any regulation.” 12 USC § 3401(8).
Federal statutes regulating private information have many commonalities despite the seemingly random collection of statutes. In general, these statutes tend to regulate both the acquisition and use of private information. To return to the Right to Financial Privacy Act, the statute prevents government officials from transferring any financial records obtained in accordance with its law enforcement exemption and narrowly circumscribes permissible uses of information that is legitimately acquired. Relatedly, the Cable Communications Policy Act requires destruction of information “no longer necessary for the purpose for which it was collected.” 47 USC § 551(e). The Fourth Amendment by contrast generally permits free use of information that has been lawfully obtained by government investigators.
Striking the right balance between access and restraint in order to provide the appropriate level of protection to private information is a difficult and controversial task. Will the Supreme Court or Congress do a better job? Professor Murphy argues that given the complex and contested nature of the issue there should be cooperation amongst the branches. Each branch has certain comparative advantages and in tandem the Court and Congress will do a better job than if only one or the other took the reins. Legislators can adopt proactive structural remedies that courts cannot. Legislators are also better able to gather systemic information about the collection and dissemination of information in a particular industry. Courts, however, have historically been more attentive to abuses by law enforcement and have more vigorously used the exclusionary rule to deter government officials from conducting unconstitutional searches and seizures. There are fewer interest groups advocating for the privacy concerns of those who will typically be the subject of the various statutory exemptions for criminal investigations. While groups like the Electronic Frontier Foundation do show up to address the privacy concerns held generally, groups such as the National Association of Criminal Defense Lawyers that represent the interests specifically of criminal defendants have been absent when the various federal statutory privacy laws were considered. All of this goes to show that the best solution is for the two branches to work together, and this appears to already have occurred in some areas of privacy law. For example, the Drivers Privacy Protection Act governs the collection and disclosure of personal information gathered by state DMVs. A portion of the statute authorizes a daily $5,000 fine to noncompliant offices, but only if a public official brings a lawsuit.
The commenters pointed out that you can’t tell which branch is better at protecting privacy without some kind of theory about what the optimal level of privacy protection is. Professor Murphy responded that this paper is intended to push past the question of what the right level of privacy protection is and instead focus on the relative differences between the branches in protecting the privacy rights of individuals against intrusion by government officials. Other commenters pointed out that it is difficult or impossible to evaluate Congress’s track record on privacy without considering the panoply of state laws addressing privacy. In some areas, for example trade secret protection, states have acted in a uniform and sufficient manner such that further legislation is currently unnecessary. Professor Murphy responded that there is such a vast and disparate body of state privacy law that it wasn’t possible to consider in any systematic way the impact of state privacy laws and that considerable debate exists over whether the states have led the way, rather than followed the federal lead, in protecting privacy.
All the talk about courts and Congress left me wondering what role our poor executive branch might be playing in this story. The baseline assumption in the discussion seems to be that executive officials are always going to push to the limits of what is allowed by the two other branches. This might very well be the case, but the story might not be so cut and dry. If there is broad political support for the kinds of privacy legislation that Congress has passed in the last forty or so years, why is the President immune from that pressure? There are various ways in which the President could restrain prosecutors, an Executive Order or revision to the United States Attorneys’ Manual being two such mechanisms. Moreover, certain statutes, such as the provision in the DPPA that provides for a daily fine against non-complying DMVs following a suit by a public official, seem to require a fairly prominent role for executive officials.