Privacy, Data Protection and Retention
Lillo-Stenberg v. Norway
Closed Expands Expression
Global Freedom of Expression is an academic initiative and therefore, we encourage you to share and republish excerpts of our content so long as they are not used for commercial purposes and you respect the following policy:
Attribution, copyright, and license information for media used by Global Freedom of Expression is available on our Credits page.
The U.S. Court of Appeals for the Second Circuit reversed an order of the District Court for the Southern District of New York and declined to enforce a search warrant under the Stored Communications Act, which required Microsoft Corporation to access data stored in Dublin, Ireland, finding that this would be an unlawful extraterritorial application of the Act.
Microsoft refused to comply with a warrant requiring it to produce the contents of an individual’s email account, allegedly used in connection with an investigation into narcotics trafficking, on the basis that the information was stored at datacenters based in Ireland.
The Court reasoned that the order was a warrant, not a subpoena, because the private party, Microsoft, in being required to conduct the search and seizure became an agent of the government and the Fourth Amendment’s warrant clause applied to its actions. Further, the Court reasoned that the SCA was not intended to have extraterritorial application and only applied to material located in the U.S. Since the information was located in Dublin and the warrant would require Microsoft to reach out to the Dublin center to obtain it, enforcement of the warrant would constitute an unlawful extraterritorial application of the Act.
Since this ruling there have been a number of cases suggesting the Microsoft decision may be in peril. Most notably, in In re Search Warrant No. 16-960-M-01 to Google, a federal magistrate judge in the Eastern District of Pennsylvania took the opposite approach to the court in Microsoft and rejected Google’s position, holding that “[e]ven though the retrieval of the electronic data by Google from its multiple data centers abroad has the potential for an invasion of privacy, the actual infringement of privacy occurs at the time of disclosure in the United States.”
This case involves a warrant requiring Microsoft to produce the contents of an individual’s email account that it was alleged was being used in furtherance of narcotics trafficking.
Magistrate Judge James C. Francis IV issued the warrant but Microsoft refused to comply because “to comply fully with the warrant, it would need access to customer content that it stores and maintains in Ireland and to import that data into the United States for delivery to federal authorities” [p. 5]. Microsoft filed a motion to quash the warrant which was denied by the Magistrate.
Microsoft appealed to the District Court for the Southern District of New York and Chief Judge Loretta affirmed the Magistrate’s ruling. The Court held Microsoft in civil contempt for failing to comply with the warrant.
This appeal followed.
The Court reversed the ruling on the motion to quash, vacated the contempt, and remanded back to the District Court.
The Court noted the strong presumption against enforcement of U.S. statutes abroad and utilized a two part test to determine whether this warrant was valid. This involved a look into (1) whether the legislature intended the Stored Communications Act (“SCA”) to have extraterritorial application; and if not (2) whether enforcement of this warrant would constitute an unlawful extraterritorial application. The Court easily found that the SCA was not intended to have extraterritorial application as reflected by the words of the statute and conceded by the government during argument. The Court also rejected the government’s argument that the warrant was a hybrid between a warrant and a subpoena, the latter because it was akin to requesting documents and did not require an officer in its execution. This was central to the government’s argument because subpoenas, unlike warrants, may be enforced overseas. However, the Court found that the order in this case was distinguishable as a warrant, because “[w]hen the government compels a private party to assist in conducting a search or seizure, the private party becomes an agent of the government, and the Fourth Amendment’s warrant clause applies in full force to the private party’s actions” [p. 29].
The Court stressed that the SCA’s focus was on user privacy, as was clear from the plain meaning of the text, the procedural provisions of the Act, and in light of the relevant legislative history. It noted that the information was located in Dublin and there was no information as to the citizenship or location of the user. The Government countered that the information could be accessed without law enforcement ever setting foot in Dublin, thereby making the warrant’s application domestic. However, the Court was not convinced, because the information was located in Dublin and would require Microsoft to reach out to the Dublin center to obtain the information. Therefore, because a warrant under the SCA could only concern material located within the boundaries of the U.S. and as the material sought was located outside of the U.S., enforcement of the warrant in this case would constitute an unlawful extraterritorial application of the Act.
Judge Lynch wrote separately to concur in the judgment, agreeing with the judgment but arguing there was a legislative need to review and reconsider the statute as written in light of new technological advancements.
Decision Direction indicates whether the decision expands or contracts expression based on an analysis of the case.
This case expands expression by protecting the freedom of expression of users of electronic communication channels by holding that U.S. authorities can not force service providers to access data stored outside the U.S.
A federal magistrate judge in a later case, In re Search Warrant No. 16-960-M-01 to Google, came to a different result on similar facts and ordered Google to comply with a search warrant to produce foreign-stored emails. It found that “the conduct relevant to the SCA’s focus will occur in the U.S.” even if the data is retrieved from outside the U.S. It said that the searches of electronic data, and therefore, the invasions of privacy, will occur in the U.S. when the FBI reviews the copies of the requested data. In other words, when a network provider is ordered to retrieve information from abroad, that copying of information abroad and sending back to the U.S. does not count as a Fourth Amendment “search” or “seizure” outside the U.S.
Global Perspective demonstrates how the court’s decision was influenced by standards from one or many regions.
Case significance refers to how influential the case is and how its significance changes over time.
As a decision of the Court of Appeals, this decision binds all lower courts.
Let us know if you notice errors or if the case analysis needs revision.