The Privacy Lawyer: Privacy Policies and The Patriot Act

Just two months from now, the government has the opportunity to appeal a ruling by a N.Y. Federal District Court judge that strikes down an important provision of the controversial USA Patriot Act. The ruling, which came Sept. 29, was set to go into effect 90 days from that date unless the government solves the constitutional flaws the judge identified.

Few laws have elicited as much emotional and legal reaction as the Patriot Act. Adopted in the early days after the Sept. 11, 2001, attacks, the law includes many provisions sought by law enforcement over the years and gives the government many new rights to scrutinize public behavior. It also overrides many earlier privacy laws, such as allowing the government to collect information about an individual's videotape rentals, financial information, and even his or her Web searches and online practices. While many trust law-enforcement officials not to abuse the law, others believe that it's capable of abuse.

As Americans, the one safeguard that we've always had is to challenge governmental action through the courts. But certain provisions of the Patriot Act preclude judicial scrutiny. U.S.C. 18 Sec. 2709 is a section of the Patriot Act that permits the FBI to demand certain customer records from an Internet service provider or a telecommunications company that are "relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities." These demands are made in a special form of administrative subpoena called a national security letter, or NSL. Once it's formally issued, NSL recipients may not disclose anything about the NSL, including that it was ever even issued.

The American Civil Liberties Union, acting in an advocacy role and as counsel to an ISP plaintiff, brought an action to declare U.S.C. 18 Sec. 2709 unconstitutional under several grounds. These include challenges to the broad subpoena powers under the First, Fourth, and Fifth Amendments to the U.S. Constitution without judicial oversight, as well as challenges of the nondisclosure provision as a prior restraint of speech under the First Amendment.

The decision holds that (1) the restriction on any disclosure about the NSL or its issuance, to anyone, in perpetuity is overbroad and open ended and, as such, violates the First Amendment of the U.S. Constitution, and (2) the NSL recipient's inability to have the NSL reviewed by a court violates the Fourth Amendment to the U.S. Constitution. Because the court held that the restraint subsection under the statute could not be severed from the remainder of the statutory provisions, the entire Sec. 2709 would have to be struck down.

Without this special provision, the FBI would have to obtain a search warrant or court order to access customer records. That in turn requires that the request be presented to a magistrate or judge before being issued. Unique to the NSL is that no prior review is made by any member of the judiciary and that its recipient cannot seek judicial review of the propriety of the NSL, or its scope before complying (or even after compliance, under the gag provision). NSLs are not unique to the USA Patriot Act. They are used in several other national security regulatory schemes.

The judge spent several pages discussing the importance of the environment under which the law was first enacted, in response to the terrorist attacks of Sept. 11. The decision discusses the need to constantly balance governmental efficiencies against fundamental liberties. While recognizing that the balance is rarely easy, the court held that the balance always is stacked in favor of fundamental liberties at the cost of efficiencies. Mindful of the crisis atmosphere and the real risks of terrorism post-Sept. 11, the decision quotes from previous decisions noting that the greatest risk to fundamental liberties comes during times of great crisis. Courts during these times must use enhanced vigilance not to compromise these liberties in the name of expediency.

Solutions could be proposed allowing for a sealed and private judicial proceeding, perhaps, should the NSL recipient seek judicial review. There may be other ways to save the intent of the provision and address the needs of our law-enforcement agencies in the fight against terrorism. But all would require legislative action.

In the meantime, businesses are well advised to review all governmental requests and their reaction to such requests. Once again, if your privacy policy (especially those of telecommunications or Internet-related providers) provides that you will not share personal information about subscribers except through valid legal process (for which they will receive notice, except to the extent prohibited by law) or otherwise in accordance with your privacy policy, the law prohibiting your informing them of any inquiry is key. If the decision is not overturned, you may not be able to rely on the Patriot Act to protect you if you don't inform your subscribers of a governmental inquiry. Make sure your counsel understands the laws and your policies and can guide you when government or anyone else comes knocking.

Parry Aftab is a cyberspace lawyer, specializing in online privacy and security law, and she's also executive director of Wired Safety. She hosts the Web site aftab.com and blogs regularly at theprivacylawyer.blogspot.com.

Article courtesy of InformationWeek