Personal Privacy in an Information Society. The Limits of Legal Protection: An Overview

07/12/1997

If records about individuals held by third-party record keepers are to be protected against government access, the law must change. In light of the inability of the courts to refashion the application of Constitutional theory, the change must come through legislative action.

VOLUNTARY DISCLOSURE AND COMPULSORY PROCESS

Government access to the account records of depository institutions provides an excellent example of the need for change and illustrates the importance of understanding current standards. In United States v. Miller,21 the Supreme Court reaffirmed the traditional legal standard that customer account records in a bank are not the private papers of the customer. An individual has neither ownership nor possession of such records, reasoned the Court; therefore, the records are simply the "business records of the bank." This line of argument and the precedents which have developed it extend back through the Eighteenth Century.22 The crucial element in this traditional view is that the individual, lacking a "proprietary" interest in a bank's records of his account, has no legal right he can assert to challenge access to those records by government or anyone else.

In California, the legal status of bank account records has been altered. Interpreting a 1972 amendment to the State Constitution, the California Supreme Court ruled that "a depositor has a reasonable expectation [that] the information and documents he furnishes his bank in connection with his account will remain private."23 Because of this legal expectation, the disclosure of bank records to government without "proper legal process" amounts to an illegal search and seizure under California law. Proper legal process, according to the developing judicial interpretation, means that the probable cause standard a search warrant must meet becomes the minimum standard government must establish when seeking to compel the production of bank records. Perhaps more important, government may not request and receive an individual's bank records from the bank without employing legal process, unless, of course, the individual consents.24 Put Simply, California law provides the individual with a "legitimate expectation of privacy," which gives him a protectible legal interest in his bank records and, given that interest, the legal tools to protect his records.

The contrast between the Miller decision and California law highlights two issues: (1) the question of "voluntary" disclosure of information by third-party record keepers, that is, the discretion to disclose to government without the compulsion of legal process; and (2) the necessity of a substantive standard an individual can assert to protect records about him.

However detailed and carefully structured limitations on compulsory disclosure to government may be, as long as government can request and receive information from records about an individual on an informal or voluntary basis, little real protection of personal privacy will be achieved. If a record keeper has the discretion to disclose voluntarily, it will be hard for record keepers, particularly in heavily regulated sectors such as banking, to resist pressures for "voluntary" compliance with government requests for information. Voluntary disclosure of information on individuals held by third parties must be limited if limitations on compelled disclosure are to mean anything.

Limiting voluntary disclosure involves two distinct, though related, steps. One is to require government agencies to use legal process to obtain records and to notify the individual that his records are being sought. This procedural requirement would outlaw informal, clandestine, and undocumented access by a government agency to an individual's record, assisting effective oversight of government activity. The second step in curbing voluntary disclosures is to levy a legally enforceable duty of nondisclosure on record keepers who hold records in which an individual has or should have a legitimate expectation of confidentiality. Where records are not the sort the individual has a right to expect will be held in confidence, there is no persuasive argument for making the record keeper liable, though an argument remains for requiring legal process and notice by the government-the tendency to mount fishing expeditions and groundless investigations can only be tempered by effective oversight which requires documentation of investigative activities. But requirements of legal process and notice alone cannot adequately recognize the individual privacy interest in a record.

The second consideration, which emerges from contrasting California law with the traditional status of bank records, is the need to provide the individual with a legally recognized interest he can assert to protect records about himself when government seeks to acquire them from a third party. Granting the individual such an interest gives him (and the record keeper) a basis for limiting voluntary disclosures of such records and forces government to meet certain criteria in order to obtain them. Without such a protectible interest in his records, an individual given notice, standing, and the right to challenge a government request for his records would have little basis for any real challenge, other than to snipe at the facial validity of a summons or subpoena and to question the government's adherence to the proper procedural path. A grant of such procedural defense does not really recognize the privacy interest of the individual; rather, it would create complexity, delay, and expense for all parties while still leading almost inevitably to disclosure to the government. While the requirement that government use formal process and notify the individual when it seeks his records may provide more effective oversight of government activity, procedure alone gives the individual no tool to protect himself. So if one accepts that an individual's bank records are to some extent his private records, creation of a protectible interest, of a legitimate expectation of confidentiality in those records, is essential.

One must not assume, however, that simply passing a statute that provides an individual with a "legitimate expectation of confidentiality" is enough. As the California experience illustrates, further definition of the interest is necessary. Since the expectation in California is constitutionally mandated, the courts there are employing traditional constitutional protections, such as those provided for private papers in the Fourth Amendment, to define the parameters of the expectation. The Commission, on the other hand, in areas where it believes such an expectation needs to be created, has indicated what the definition of that expectation ought to be. For example, in credit, insurance, and medical record keeping, where the vulnerability to government access is similar, the Commission has recommended that an individual be given a legitimate interest in protecting records about him from unilateral disclosure by the record keeper and, in addition, that he be given a legitimate expectation of confidentiality in such records.

COMPULSORY REPORTING STATUTES

The problems of voluntary disclosure of records and access by government through summons or subpoena do not exhaust the varieties of currently legitimate government access to records about individuals that must be considered in fashioning protections for personal privacy. The number of statutes and regulations that require record keepers to collect, maintain, or report information about certain facets of their relationships with individuals mounts steadily and poses grave long-term dangers. In a few situations, the courts have found such compelled reporting and maintenance of records repugnant to Constitutional strictures on government action. Where a statute requires third-party record keepers, such as financial institutions, to supply information from an individual's records to government, or to maintain certain records for government inspection, however, the courts have not extended the Constitutional protections of the Fourth and Fifth Amendments to those records.25 They are reluctant to do so largely because they still define the reach of individual interest in terms of ownership or possession of a record. This definition also makes courts uncomfortable with extending protection through the self-incrimination standard of the Fifth Amendment, though they have employed that rationale elsewhere to limit government reporting requirements laid directly on the individual.26

As long as there is no limit on government requirements that record keepers routinely report information about an individual, circumscribing voluntary disclosures and creating and defining a legitimate expectation of confidentiality would, in the long run, be a hollow protection for personal privacy. An effective protective umbrella must include limits on the manner and extent of government record keeping and reporting requirements.