cell towers Photo: Shutterstock

The U.S. Supreme Court's decision in Carpenter v. United States requiring warrants for historical cell-site location information is reverberating in state capitals. Some states have taken the lead in updating laws requiring local law enforcement to have a warrant to acquire certain electronic non-content data and placing restrictions on how that data is to be handled. 

Last month, Utah enacted a bill requiring local law enforcement to show probable cause and obtain a search warrant for electronic data transmitted by its owner to a “remote computing service provider” or for an electronic device's stored data or location information.

Location information from a cellphone was the crux of the Carpenter case. The case concerned the FBI's retrieval of cell-site location information through a Section 2703(d) order under the Stored Communications Act. Notably, the standard for law enforcement to obtain a Section 2703(d) order is lower than the probable cause needed for a typical warrant.

“For a long time there was the third-party doctrine that allowed law enforcement to pursue data held by a third party, and there were very few limits about how they were approaching it, but that doctrine really rose before the advance of technology today,” said Kirkland & Ellis partner Christine Payne. “The Carpenter case imposed some limitations on that, saying if you want location data from a cell service provider you have to use a warrant.”

Still, Payne noted the justices' opinions seemed to prefer that legislation, and not courts, address how law enforcement can access and handle certain digital information.

“There is going to be a lot more … of law enforcement seeking some type of data held by a third party, which I think could be addressed piecemeal by the court, but the Supreme Court in Carpenter said it would be much better for legislators to address.”

While the Carpenter case could be a motivating factor for state legislators to create laws imposing warrant requirements for electronic data, other states have enacted similar warrant requirements pre-Carpenter, including California and Virginia in 2015.

The various states that have adapted their laws to a technologically advancing society is in contrast to what's happening on the federal level, which hasn't had a major update to its data collection laws since enacting the Electronic Communications Privacy Act in 1986.

“Ordinarily federal law takes the lead and the states follow,” said former federal Judge Stephen Smith, the program director of the Fourth Amendment & Open Courts at Stanford University's Center for Internet and Society. However, “the state law like California or Utah's law may have an effect on the federal statute.”

Smith singled out Utah's requirements that any collected data “be destroyed in an unrecoverable manner” as soon as “reasonably possibly,” and the ability to exclude a record from trial if the data isn't collected in accordance to the new law, as provisions that go beyond the scope of what was raised in Carpenter.

“We obviously need to have our state laws consistent with Carpenter … [but it] fits the mood of the public that we need more privacy protections when it comes to our digital lives,” he said.

While massive changes aren't expected for companies that collect or transmit electronic data because of this and other similar laws, the Utah law's exemptions for voluntarily disclosing data  should be a procedure companies understand.

Under the law, if companies discover data that “pertain[s] to the commission of” physical abuse or imminent extreme bodily risk, they have to turn it over to authorities.

“One of the major exemptions in the Utah rule is when a provider voluntarily turns over data because the provider has a good-faith belief there is an emergency of physical or sexual violence,” Payne said. “The provider will have to have clear processes in place if they come across that data.”

“Once you receive a request from law enforcement, there's not a lot of time to sit around and ponder constitutional law,” she added. “It's something the provider needs to think about beforehand and react quickly in the legally appropriate way.”