The politics of privacy in the criminal justice system: information disclosure, the Fourth Amendment, and statutory law enforcement exemptions.

• Author: Murphy, Erin E.
• Position: I. Statutory Privacy: Methodology and Observations F. Law Enforcement Access Provisions Preference Subpoenas over Warrants, and Regulate Not Just Acquisition but Also Use through Appendix, with footnotes, p. 515-546

6. Law Enforcement Access Provisions Preference Subpoenas over Warrants, and Regulate Not Just Acquisition but Also Use

   Even recognizing that federal statutes do not just fail to safeguard but actually affirmatively undermine the privacy of the poor with regard to law enforcement, the amount of protection they accord to mainstream interests should not be overstated. Law enforcement exemptions in privacy statutes exhibit a wide range of variation. Some impose intricate requirements, while others provide more vaguely defined standards for access. Interestingly, the variation does not seem to follow any intuitive scaling of protections. (130) That is, it is not the case that the areas in which most individuals likely expect the greatest privacy correspond to the strictest statutory standards for access. (131) For example, it has been observed that there are greater protections for cable records than there are for health records. (132)

   Despite wide variation, some general tendencies about law enforcement access can be gleaned. Specifically, with regard to domestic law enforcement access, federal privacy statutes (1) typically allow access pursuant to a standard less than the constitutional default, which is a warrant and probable cause; (2) demonstrate a strong preference for the use of subpoenas, although they often impose additional requirements on the use, transfer, and disposal of information that exceed those mandated by the Constitution; and (3) show a strong preference for advance notice to the individual, when relevant, although they also often contain provisions to delay or circumvent that notice requirement.

   Only two privacy statutes condition access for law enforcement using the traditional requirement of a warrant and probable cause, and both of them are constitutionally required to do so. Specifically, Title III imposes a probable cause and highly particularized warrant standard, (133) and the PPA restricts (beyond constitutional levels) what information law enforcement can seize from the press and when. (134) But these statutes are atypical. Every other federal privacy statute, in contrast, allows disclosures based on a warrant and probable cause, but also permits access upon lesser showings, most commonly a court order or a judicial, grand jury, or administrative subpoena. (135)

   In fact, the statutes demonstrate a near-universal preference for the judicial subpoena as the baseline for access. It might be argued that a number of statutes depart significantly from this general rule, in that they allow access pursuant to an administrative subpoena or request. (136) For instance, the RFPA allows access based only on written request, assuming no more formal process is available. (137) HIPAA likewise provides for an administrative request option, with a lesser standard than that required for subpoenas, orders, or warrants. (138) The DPPA allows disclosure of highly restricted personal information for use by "any court or law enforcement agency[] in carrying out its functions," without specifying whether any legal process is required. (139) FCRA allows access to identifying information (such as name, former and current addresses, and employment history) upon request. (140) COPPA allows collection, use, and disclosure of information of child internet users without parental consent in cases where "to the extent permitted under other provisions of law," doing so "provide[s] information to law enforcement agencies or for an investigation on a matter related to public safety." (141) The Privacy Act permits disclosure for "criminal law enforcement activity if the activity is authorized by law, and if the head ... has made a written request to the agency...." (142)

   But in all of these instances, the disclosure is optional: the entity may disclose the requested information but disclosure is not compelled by law. (143) In order to compel the disclosure of information to law enforcement, the majority of statutes require at minimum a subpoena or court order. (144) Of course, normally one would consider a subpoena a lesser threshold of security than a warrant. Judicial subpoenas are typically issued in connection with an investigation or proceeding, pursuant to statutory or other investigative authority, and are limited only by jurisdictional reach and a requirement that they not be "unreasonable or oppressive." (145) In the federal context, they are commonly issued by grand juries investigating criminal matters; although if a case is pending before a court, the parties may have power to issue subpoenas under the federal rules or, in the case of the criminal defendant, the Sixth Amendment Compulsory Process Clause. (146) Regardless of the issuer, they are typically issued unilaterally, on a showing of mere relevance, and require neither notice to the opposing party nor permission of a court. (147) In general, subpoenas are thus considered fairly permissive and powerful access tools. (148) Similarly, court orders necessitate judicial permission and a pending matter, but are normally available upon only a relevance showing.

   But the reliance on devices other than a warrant requirement may offer greater protection for privacy than appears at first glance. Federal statutes often impose additional procedural protections--such as heightened proof thresholds, advance notice, and use restrictions--that exceed the basic probable cause standard applicable to an ordinary warrant. For example, the CCPA requires that the court order be based upon "clear and convincing evidence that the subject of the information is reasonably suspected of engaging in criminal activity and that the information sought would be material in the case." (149) Like a warrant, a court order must be granted by a neutral magistrate, but the clear and convincing standard exceeds the warrant's probable cause standard, just as the requirement of materiality arguably does. (150) The VPPA requires that court orders be based on probable cause, which would appear to mirror the warrant requirement. (151) The IRS Code requires that, for non-tax-related investigations, the court order mandate disclosure only to federal law enforcement if there is "reasonable cause to believe, based on information believed to be reliable, that a specific criminal act has been committed" as well as "reasonable cause to believe that the return ... may be relevant to a matter relating to the commission of such act," and the return "is sought exclusively for use in a Federal criminal investigation or proceeding concerning such act, and the information ... cannot reasonably be obtained ... from another source." (152) This "last resort" element represents another departure from constitutional practice, which imposes no requirement that law enforcement attempt to obtain information in a less intrusive fashion before seeking a warrant. In short, although "subpoena" or "court order" seems to be the threshold, the proof requirements often track or even exceed those necessary to secure a Fourth Amendment warrant.

   Moreover, with regard to subpoenas, the most common additional requirement is that prior notice be given to the affected individual that the information is sought. Thus, for example, the RFPA, (153) CPPA, (154) VPPA, (155) FERPA, (156) and PPA (157) all require notice of some kind. Of course, notice is particularly significant with regard to these statutes because nearly all of them cover information held by third parties, and thus disclosure could otherwise occur without the knowledge of the affected person. Nevertheless, the notice requirement is not universal. HIPAA, (158) the Privacy Act, (159) and the DPPA (160) lift an otherwise general notice requirement for its authorized law enforcement disclosures, and many of the statutes supply the government with an avenue for requesting a delay of notice or withholding notice altogether. (161)

   The final way in which federal privacy statutes regularly exceed constitutional standards is that they constrain not just the acquisition of material but also its use. For instance, the RFPA strictly regulates the transfer of lawfully obtained financial records, circumscribing their permissible use even in the grand jury and requiring notice to the customer upon transfer. (162) The RFPA's barriers around use and transfer were replicated in subsequent enactments. By way of additional examples, the VPPA provides for destruction of records (163) and encourages "appropriate safeguards against unauthorized disclosure" for any material accessed through compelled disclosure. (164) The DPPA limits resale or redisclosure of lawfully obtained information, mainly for those uses already permitted by statute. (165) FERPA requires written certification from juvenile justice authorities before disclosure, (166) and further allows the institution to deny access to third parties found to be too lax in redisclosing. (167) The CCPA even requires destruction of information if it is "no longer necessary for the purpose for which it was collected and there are no pending requests or orders for access." (168)

   In sum, although privacy statutes at first blush appear to lower the standard for law enforcement access to covered materials by infrequently imposing a warrant or probable cause requirement, in significant respects they offer greater protection from intrusion in that they may raise proof thresholds, require advance notice of disclosure, restrict subsequent transfer or use, and mandate destruction of records.

   In fact, statutory provisions for grand jury, administrative, or judicial subpoenas also afford more protection than does a standard subpoena under the Fourth Amendment because subpoenas in general have been accorded only the barest protection, even when a Fourth Amendment interest is implicated. (169) Moreover, the Supreme Court has defined the "reasonableness" standards for subpoenas broadly, rarely invalidating a law enforcement request. (170)...