The constitutional protection of information in a digital age.

• Author: Clark, Gerard J.

TABLE OF CONTENTS I. INTRODUCTION II. FIRST AMENDMENT PROTECTION OF INFORMATION A. Recent Case Law B. The National Security Exception C. Statutes and Common-Law Remedies D. Recent Developments E. Summary III. FOURTH AMENDMENT LIMITATIONS ON ACCESS TO DATA A. History B. Newer Technologies C. National Security Cases D. Privacy Statutes E. Recent Developments F. Summary IV. CONCLUSION I. INTRODUCTION

To state the obvious, we live in a world that is awash in information. Discoveries of new scientific information occur daily in the laboratories of the world. The Facebook accounts of millions of teenagers contain information about the love lives of their friends. Google traces the search information of its subscribers. (1) Supermarkets use personalized discount cards to trace the purchasing preferences of their customers. (2) The National Security Agency (NSA) has been building a one-million-square-foot data and supercomputing center in Utah, which is expected to intercept and store much of the world's Internet communication for decryption and analysis. (3) States maintain driver, tax, and voter records. All of these records contain information that can yield profit for some and embarrassment for others.

The First Amendment to the U.S. Constitution dictates access to and dissemination of this information, whereas the Fourth Amendment limits such access and dissemination. Additionally, common-law doctrines of privacy, publicity, and defamation apply to this information, as do copyright, patent, and trademark law. State and federal legislatures race to regulate the collection, storage, and dissemination of this data and information in the public interest. This Article will review recent developments in the constitutional treatment of access to data and information, will comment on an illustrative group of statutory and common-law developments, and will discuss a number of current noteworthy controversies.

2. FIRST AMENDMENT PROTECTION OF INFORMATION

   The First Amendment is often invoked to test the legitimacy of a governmental restriction on the free flow of information in society. For example, early cases from the World War I era involved criminal prosecutions against identified speakers whose messages were claimed to undermine the war effort. (4) In the 1950s, advocates of communism were prosecuted for holding a political philosophy at odds with the legitimacy of the American government. (5)

   More modern First Amendment concerns, however, are less about closing the mouths of dissidents and more about policing legislative and bureaucratic limitations on the movement of information or data. (6) The speakers in these cases may be machines, and the information may be in digital form. Data miners face obstacles in gaining access to the information, while individuals seek to shield their personal information from such data miners.

   1. Recent Case Law

      In Sorrell v. IMS Health Inc., the Supreme Court broke new ground by holding that data miners have a First Amendment right to demand access to data compiled pursuant to a state regulatory program in order to package and sell it for commercial purposes. (7) The Court invalidated a Vermont statute that restricted the sale, disclosure, and use of pharmacy records that reveal the prescribing practices of individual doctors to pharmaceutical manufacturers for marketing purposes. (8) The plaintiffs, three Vermont data miners and an association of pharmaceutical manufacturers that produce brand-name drugs, brought this anticipatory attack to invalidate the statute. (9)

      In 2007, Vermont enacted the Prescription Confidentiality Law (Act 80). (10) Act 80 provided, among other things, that "[a] health insurer, a self-insured employer, an electronic transmission intermediary, a pharmacy, or other similar entity shall not sell, license, or exchange for value regulated records containing prescriber-identifiable information, nor permit the use [of such records] ... for marketing or promoting a prescription drug, unless the prescriber consents...." (11) In addition, Act 80 stated that "[pharmaceutical manufacturers and pharmaceutical marketers shall not use prescriber-identifiable information for marketing or promoting a prescription drug unless the prescriber consents...." (12) The statute contained a number of exceptions for health care research, enforcing compliance with insurance formularies, care-management educational communications sent to patients about their conditions, law enforcement operations, and other purposes provided by law. (13) Moreover, Act 80 authorized funds for an "evidence-based prescription drug education program." (14)

      Act 80 was accompanied by a number of legislative findings. (15) Vermont found, for example, that pharmaceutical marketing program goals are often in conflict with state goals, and that the "marketplace for ideas on medicine safety and effectiveness is frequently one-sided in that brand-name companies invest in expensive pharmaceutical marketing campaigns to doctors." (16) Detailing, in the legislature's view, results in doctors making decisions based on incomplete and biased information. (17) Because Vermont doctors do not have time to research the quickly changing pharmaceutical market, the legislature found that they rely on information provided by pharmaceutical representatives. (18)

      The Court's primary objection to the Vermont statute was that on its face, the law enacted content-based and speaker-based restrictions on the sale, disclosure, and use of prescriber-identifying information. (19) As drafted, the statute disfavors marketing, that is, speech with a particular content and specific speakers--namely pharmaceutical manufacturers. (20) Because the law places these categorical restrictions on speech, the Court applied the intermediate test for commercial speech. (21) In order for a state to sustain such restrictions under the intermediate test, the state must show that the law in question advances substantial government interests, and that the law is directly aimed at achieving such interests. (22)

      Vermont asserted two justifications for Act 80's restrictions on speech. (23) First, it argued that the restrictions were "necessary to protect medical privacy, including physician confidentiality, avoidance of harassment, and the integrity of the doctor-patient relationship." (24) Second, it claimed the restrictions were integral to the objectives of improving public health and reducing healthcare costs. (25) The Court rejected both justifications, thereby validating the data miners' claim to access the records mandated by the statute that contained every physician's prescription practices. (26)

      Although the Court in Sorrell rejected Vermont's interest in protecting the privacy of physician-prescribing practices, other privacy interests and claims have been successful. For instance, the First Amendment protects a speaker from dangers that may eventuate from disclosure of his identity. (27) In NAACP v. Alabama, the Alabama Attorney General issued a demand on the NAACP to reveal the names and addresses of all of its Alabama members and agents. (28) The demand was made in connection with efforts to enforce a statute requiring registration of foreign corporations seeking to do business in Alabama. (29) When the NAACP refused to comply, a state trial court held the association in contempt and fined it $100,000. (30) In an opinion authored by Justice Harlan, the Court recognized that a vital relationship exists between the freedom to associate and the privacy in one's associations, and held that the right to pursue lawful interests privately is constitutionally protected. (31)

      In Doe v. Reed, the petitioners sought to prevent public disclosure of their support for a ballot initiative opposing recognition of gay marriage in the State of Washington. (32) Protect Marriage Washington, the citizens group that sponsored the referendum petition, attempting to revoke a recently enacted statute extending benefits to same-sex marriages, claimed that releasing the names of those who signed the petition violated the First Amendment. (33) The petition included the names and addresses of the signatories, and was submitted to the secretary of state for verification and canvassing to ensure that only lawful signatures were counted. (34) Washington's Public Records Act (PRA) permits private parties to obtain copies of state government documents, and Washington took the position that the PRA encompasses documents submitted in connection with referendum petitions. (35)

      Protect Marriage Washington and certain referendum petition signatories sought an injunction against the release of the petition documents containing individuals' names, alleging fear of "threats, harassment, and reprisals." (36) The Court held that the signatory information on the referendum petition was expressive under the First Amendment. (37) Further, the Court recognized that the PRA was not being used to prohibit speech, but rather was a disclosure requirement. (38) The Court held that "the State's interest in preserving the integrity of the electoral process suffices to defeat the argument that the PRA is unconstitutional with respect to referendum petitions. ..." (39)

      The above-mentioned cases illustrate, unsurprisingly, that the privacy principle embedded in the First Amendment is weak and narrow. Certainly, if disclosure of membership could lead to a lynching, the First Amendment will not mandate the disclosure of an association with a disfavored group. However, the decision in NAACP v. Alabama does not speak to validating unsubstantiated fears that homosexuals will target heterosexuals in the State of Washington. Moreover, the First Amendment forced disclosure in Sorrell. There the claims in favor of nondisclosure at the behest of the State on behalf of prescription writers failed. As discussed infra, the Fourth Amendment typically provides a stronger claim for nondisclosure of such...