Citizens of Utah can rest easy that their personal data stored in third-party servers like those of Google or Facebook can no longer obtained by US government agencies except through a search warrant. Utah Governor Gary Herbert signed HB 57 into law March 28, making Utah the leader in electronic data privacy among US states.
Fahmida Y. Rashid tells more about Utah’s new Data Privacy Law in this report from Decipher:
(The bill) prevents, at least for Utah residents, law enforcement officials from obtaining user data from third-party providers such as Google and Facebook just by asking. Currently, email and cloud service providers, social media companies, and other online entities can’t refuse to hand over the data or place restrictions on what the government can do with the information. This includes information on mobile devices such as photographs, email and text messages, and app-related data. Investigators have asked online services for account information such as usernames, IP addresses and login times as well as content provided by the users, such as emails, images, and documents.
“They [government] can access a person’s information so long as the company is willing to share—a loose practice that could easily be abused,”(Libertas Institute Policy Analyst Molly) Davis said.
The Supreme Court originally ruled that consumers have no expectation of privacy when they give their information to third party providers, and narrowed that scope recently by excluding cell phone location data collected by mobile carriers from this category. The Supreme Court also encouraged legislators to pass laws defining what kind of data required a warrant and what didn’t.
With Utah’s privacy law, both state and federal law enforcement officials interested in information about Utah residents would first need to provide a judge with reasons for why they need the information and get a warrant before they can go to the providers for user data. They would need to show how the desired information was necessary for an ongoing investigation.
“If there is a legitimate safety concern requiring access to a person’s data, law enforcement will still be able to obtain a warrant,” Davis said. “Without that warrant requirement in place, private data is left vulnerable to fishing expeditions that are rife for abuse.”
There are exceptions to the bill—the warrant requirement can be skipped in case of an emergency, or if the data involved will be used to commit a felony or misdemeanors involving physical violence, sexual abuse, or dishonesty.
