Legal Implications of Data Collection at Airports (2021)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

22    ACRP LRD 42 be identified for follow-up processing. As the health- While many of these systems can be used without collecting check screening is being conducted, ­passengers are and retaining PII, some require collection of some of the most provided with notice by the screening agent. That sensitive PII information. Those systems involve not only the ­notice should specify consent and access process as actions of airports and airport stakeholders, but frequently the well as information on access and redress. actions of contracted vendors. Additionally, the products and b. Choice/Consent: The consent of passengers to the services used to implement these programs may involve data health screening can be implied by their continuation collection (or attempted data collection) by third-party entities. with the passenger journey process. Given the ­senility All these practices raise a host of legal concerns, which need to of this data collection relating to health informa- be addressed. tion, airports may wish to consider an opt-out pro- cess for passengers allowing for screening objectives IV. DEVELOPMENTS IN FEDERAL to be accomplished in a different fashion. Passengers CONSTITUTIONAL PROTECTIONS and employees provide consent to screening prior to The U.S. Supreme Court has grappled with privacy issues gaining access to sterile areas beyond the screening since the 1970s, addressing it in several different contexts. Most ­checkpoint. often, these cases involve the Fourth Amendment, but First and c. Access/Participation: Programs providing health Fourteenth Amendment issues have also arisen.82 Consistently screening need to establish programs for individuals throughout these cases, both conservative and liberal justices to access records retained health screening subjects, have expressed concern over the effects of technology on pri- especially those from the EU and California, are af- vacy. The Court’s concerns have frequently centered on the forded the right to request their data be removed from government’s compilation of large databases and the ability of a health-check system. advanc­ing computer technology to analyze them. While review d. Integrity/Security: HHS OCR has established data of data and privacy has largely been limited to govern­mental integrity and security protocols. For vendors per- rather than private use, the issues raised by the Court and the forming these functions, best practices in data secu- legal analysis offered in the decisions provide insights into a rity must be assured through contracting as well as range of legal issues confronting airports and private stake­ through audits. Audit support can be found through holders in the use of data. the HHS OCR. Detailed provisions need to be made to address potential data breaches of sensitive health- A. Carpenter and the Contours of Privacy related information. e. Enforcement/Redress: Audit capabilities and rights Protections should be addressed in internal policies as well as in In June 2018, the U.S. Supreme Court in the case of contracts with vendors. Health-related data collection ­ arpenter v. United States83 issued an opinion that significantly C has federally mandated procedures for enforcement expanded privacy protections under the Fourth Amendment. and redress. There may be additional state law provi- In C­ arpenter, the Court concluded that cell site location in- sions concerning the collection of health-related data. formation (CSLI) that tracked a cellphone’s whereabouts over Both federal and state requirements should also be an extended period was an unreasonable search and seizure. considered and accounted for with respect to poten- Addressing the individual’s informational privacy interest in tial data breach occurrences, particularly ones involv- this data, the Court set aside the long-established “third-party ing sensitive PII involving health-related information. rule.”84 This rule gave the government easier access to business records, like phone records and financial records, retained by F. Conclusion third parties under the logic that the third-party possession of The five use cases illustrate more than approaches and solu- that data diminished or destroyed individual privacy. Carpenter tions for specific challenges. They also cover the primary areas rejected that notion and ushered in an era where the Court rec- of privacy data used in airports today, while referencing a vari- ety of other privacy data types and uses. PPA use case analysis 82   General applicability of the First and Fourth Amendments to activ- addressed video analytic use as well as cellphone tracking. The ities in airports is well documented. See e.g., Regulations Affecting the Security/Biometrics use case covered the biometric use prac- Exercise of First Amendment Activities at Airports, Nat’l Acads. of Scis., tices in support of check-in, screening, arrivals, and boarding. Eng’g, & Med. (2015); The Fourth Amendment and Airports, Nat’l The ALPR use case examined both the administrative purpose Acads. of Scis., Eng’g, & Med. (2016), https://doi.org/10.17226/23500. of managing the commercial curb as well as law enforcement 83   Carpenter v. U.S., 138 S. Ct. 2206 (2018). purposes. The airport digital marketplace use case covered web- 84  The contours of the “third part rule” were established in two Court decisions. See U.S. v. Miller, 425 U.S. 435 (1976) (concerning sites, apps, Wi-Fi, as well as a CRM system. Lastly, the Health access to banking records); Smith v. Md., 442 U.S. 735 (1979) (concern- Checks use case addressed thermal imaging for detecting pas- ing phone company records registering the incoming and outgoing sengers or employees who are exhibiting a fever. Each use case calls). In these cases, the Court concluded that, despite some privacy poses a unique set of legal considerations. interest on the part of the individual, a warrant was not required to access these third-party business records. 

ACRP LRD 42   23 ognizes a right to informational privacy protectable under the v. United States90 and Riley v. California,91 the Court observed Fourth Amendment. that protection of privacy had to be a focus in the face of technol- Chief Justice Roberts’ majority opinion noted the near ubiq- ogy innovations. The central aim of the Framers was “’to place uitous adoption of cell phones and the acceptance of the ­cellular obstacles in the way of a too permeating police surveillance.’”92 network systems that enables the devices to work. The Chief Against this general backdrop of Fourth Amendment analy- ­Justice also discussed the abundance of data created though sis, the Court went on to examine the implications of govern- ­cellular service systems.85 In its legal analysis, the ­majority began ment access to CSLI without a warrant. While previous caselaw by noting that one of the principal functions of the Fourth had affirmed the ability of law enforcement to conduct surveil- Amendment was to “safeguard the privacy and secu­rity of indi­ lance of an individual’s movements using sensory enhancing viduals from arbitrary invasion by government.”86 The Court technology like beepers,93 advancements in technology, like then discussed the evolution of Fourth Amendment juris­ global position systems (GPS), raised serious questions of easily prudence from a purely property-based concept, where trespass conducted extensive pervasive surveillance.94 was required before a Fourth Amendment violation could be Looking to the two concurring opinions of five Justices in established, to a focus on a reasonable person’s expectations. Jones,95 the Court acknowledged the fact that technology devel- The expanded focus of the Fourth Amendment protects an indi­ opments in the fields of surveillance and tracking raise signifi- vidual’s expectations of privacy that “society is prepared to ac- cant and legitimate privacy concerns. The amount of location cept as reasonable.”87 Citing its 2012 decision in Jones v. United data acquired and processed by government using modern States,88 the Court observed that claims of trespass as well as a technology raises the specter of persistent mass surveillance, claim of a reasonable expectation of privacy can provide a basis inconsistent with Fourth Amendment protections. The Court for Fourth Amendment challenge to government action.89 went on to conclude that, like the GPS data that raised concerns The Court went on to make a general observation regarding in Jones, the CSLI data raised similar possibilities of tracking the the effect of technology on the privacy rights originally secured whole of a person’s movements such that the Court concluded by the Fourth Amendment. Referring to prior decisions in Kyllo it gives rise to reasonable expectations of privacy. Thus, access- ing that data constituted a search cognizable under the Fourth Amendment. The Carpenter decision offers many lessons on the Court’s 85   Cell phones continuously send signals looking for available cell perceptions of data privacy. Of course, the opinion has direct sites so that voice communication and data transfers can occur. The applicability to any airport law enforcement use of CSLI for in- record of these transmissions creates the CSLI, which allows for vestigative purposes. However, beyond that, the opinion should the plotting of the general location of a cellphone at specific times. The closer together the cell sites are the more accurate the location. serve as a cautionary tale for airports looking to collect data 86    Carpenter v. U.S., 138 S. Ct. 2206, 2213 (2018) (citing Camara v. either directly from individuals or through third parties. The Mun. Cty. Ct. of City & Ctv. of S.F., 387 U.S. 523, 528 (1967)). ­Carpenter decision evidences deep concern over the need to 87   Carpenter v. U.S., 138 S. Ct. 2206, 2208 (2018) (citing Smith v. control and limit government use data, particularly the prolif- Md., 442 U.S. 735, 740 (1979)). eration of data that characterizes life in the digital age. Of sig- 88   565 U.S. 400 (2012). nificance is the fact that the Court was willing to set aside long- 89  In Jones, the Court reviewed actions of the FBI, which had standing precedent concerning privacy interests in data held by implanted a GPS tracking device on the defendant’s vehicle and tracked third parties to extend privacy protections. The history of the its movements for a period of 28 days. This surveillance was undertaken Court’s focus on this issue demonstrates a willingness to rethink without a warrant. The majority opinion, joined by four justices, con- cluded that the actions of the FBI in trespassing upon the vehicle to government use of established informational tools to ensure plant the GPS device constituted a violation of the fourth amendment. protection of privacy, even where any specific data may have no Four other justices in a concurring opinion authored by Justice Alito, significant privacy protections at the time of collection. concluded that it was not the trespass but rather the government’s actions of tracking the vehicle for 28 days that constituted a violation of the Fourth Amendment because the defendant has a reasonable expec- tation of privacy in his location over a prolonged period of time. Those Justices suggested that because GPS technology had so significantly changed the ability of government to surveil individuals allowing for the easy collection of location data over lengthy periods of time, impos- sible through traditional human surveillance techniques, the use of GPS tracking without a warrant violated privacy protections of the Fourth 90 533 U.S. 27 (2001) (use of thermal imaging technology on a resi- Amendment. In a separate concurring opinion, Justice Sotomayor indi- dence is a search requiring a warrant). cated she found the arguments of both the majority and the concurring 91   573 U.S. 373 (2014) (storage capacity of cellphones generally pro- justices to be persuasive that both a trespass and expectation of privacy hibits search of such devices incident to arrest absent a warrant). could serve as a basis in that case for a claim of a Fourth Amendment 92   Carpenter v. U.S., 138 S. Ct. 2206, 2214 (2018) (quoting U.S. v. De violation. However, because she found the trespass basis narrower, she Ri, 332 U.S. 581, 595 (1948)). joined in the majority opinion. Thus, while there were in fact five jus- tices (a majority) who felt the aggregation of location data over the 93   U.S. v. Knotts, 460 U.S. 276 (1983). 28 days constituted a violation of the Fourth Amendment, that was not 94   Jones, supra, note 88. the controlling precedent of the case. 95   Id. 

24    ACRP LRD 42 B. Recurrent Themes in Supreme Court’s Privacy tional surveillance for any extended period of time was difficult Analysis and costly and therefore rarely undertaken. The surveillance at issue in this case—constant monitoring of the location of a Several themes have continually arisen in opinions where vehicle for four weeks—would have required a large team of the Court has wrestled with informational data privacy. These agents, multiple vehicles, and perhaps aerial assistance. Only an themes include: investigation of unusual importance could have justified such an expenditure of law enforcement resources. Devices like the • The danger of government data aggregation and chang- one used in the present case, however, make long-term moni- ing privacy characteristics; toring relatively easy and cheap.100 • The absence of a comprehensive approach to privacy pro- The significance of this line of analysis regarding aggre- tection; gated data is that while at the time of collection, information • The need for legislative protections in the face of emerg- may have had no privacy protections, or more limited privacy ing technology; and protections, additional protections may be required once data is • The changing privacy expectations in response to emerg- aggregated. As noted above, this analysis articulated in Whelan, ing technology. ­Reporters Committee, and Jones appears to have been adopted in ­ ajority opinion in Carpenter. This concern over aggrega- the m These themes demonstrate the Court’s evolving conception tion of data in government hands should be a consideration of of privacy protections that change as technology develops revo- airports in their decision about collecting and compiling data lutionizes aspects of people’s daily lives. on individuals. 1. Data Aggregation 2. Absence of a Comprehensive Approach Starting with its decision in Whelan in the late 1970s, the One case highlighting the vagaries of U.S. protection for in- Court in dicta expressed concern over government possession formational privacy is the 2011 decision of the U.S. Supreme of large aggregations of personal data: Court in NASA v. Nelson,101 In Nelson, the Court addressed A final word about issues we have not decided. We are not unaware the issue of personal privacy with respect to background in- of the threat to privacy implicit in the accumulation of vast amounts vestigations for government contractors. The Court ultimately of personal information in computerized data banks or other massive government files.96 affirmed the actions of NASA in conducting the background checks, concluding that consistent protections existed under the The Court went on to note that while protection against un- Privacy Act of 1974.102 warranted disclosure of personal information might have con- However, the majority opinion in Nelson alluded to the ex- stitutional implications, the protections afforded in that case istence of an undefined constitutional protection for privacy,103 were adequate. Thus, the question was not ripe for decision. identifying no decision where those protections are defined Department of Justice v. Reporters Committee for Freedom specifically. The absence of such a specific privacy protection of the Press,97 expressed similar concerns over data aggrega- has been a source of continued constitutional debate. Justice tion. In Reporters Committee, the Court extensively addressed Scalia in his concurring opinion sharply criticized the major- the subject of privacy without providing a precedential ruling. ity’s suggestion of a constitutionally established right of privacy. The Court reviewed decisions concerning a request under the While he thought protection of privacy might be a good idea, Federal Freedom of Information Act (FOIA) for criminal his- he argued that “[a] federal constitutional right to ‘informational tory data. The Court observed that while records of arrest and privacy’ does not exist.”104 The absence of citation to a specific prosecutions were publicly available, the difficulty of finding constitutional reference to the right to privacy is a theme that and compiling them provided some protections for individual has characterized Supreme Court decisions since the notion of privacy.98 It also noted that large aggregations of data not only information privacy was first raised in the 1970s. posed a threat, they also changed the character of the data stored. Discrete pieces of information that may have at the time 3. Value of Legislative Action of collection been publicly accessible were changed in their The Scalia concurrence in Nelson showcases not only the ­nature by compilation over time.99 ­ ebate over the existence of comprehensive constitutional pro- d More recently, the concern about data aggregations was tections for privacy, but also echoes the Court’s notion that the ­adopted by five Justices in the two concurring opinions in Jones. For example, in his concurrence Justice Alito observed: In the precomputer age, the greatest protections of privacy 100   Id. at 429-30 [citations omitted]. were neither constitutional nor statutory, but practical. Tradi- 101   362 U.S. 134 (2011). 102   5 U.S.C. § 552a.  103   Nelson, 362 U.S. at 138 (citing Whalen v. Roe, 429 U.S. 589, 599- 96   Whelan v. Roe, 429 U.S. 589, 605-6 (1977) (citations omitted). 600 (1977); Nixon v. Admin. of Gen. Servs., 433 U.S. 425, 457 (19770). 97   489 U.S. 749 (1989). The Court in Nelson notes a broad reference in those cases to privacy 98   Reporters Committee, 489 U.S. at 764. interests in avoiding the disclosure of personal matters. Id. 99   Id. 104   Id at 159-60. 

ACRP LRD 42   25 legislative branch and not the Court should be the source of concluded it “risks error”111 in adjudicating whether reason- such a right. Justices Scalia’s invitation for legislative action (or able expectations of privacy exist or have been violated. This at the least the observation of an absence of it) is a good example position is understandable as the judiciary is relatively insu- of the Court’s concern over lack of legislative involvement.105 In lated from electoral politics and, thus, less accountable than the other cases, different members of the Court have acknowledged other branches for any pronouncements regarding what society the need to defer to the legislative branch in dealing with emerg- thinks is ­reasonable. ing surveillance technologies that can adversely impact indi­ Similar to the concerns raised in Quon regarding technol- vidual privacy rights. ogy’s ability to change privacy expectations are the ones that In Jones v. United States,106 a case involving warrantless use appear in Riley v. California.112 There, the Court examined an of GPS surveillance, Justice Alito in his concurrence observed: individual’s privacy rights in data on a cellphone possessed at In circumstances involving dramatic technological change, the best the time of arrest. Flatly rejecting the government’s position that solution to privacy concerns may be legislative… A legislative body searching a cellphone was “materially indistinguishable” from is well situated to gauge changing public attitudes, to draw detailed previously approved searches of physical items in an arrestee’s lines, and to balance privacy and public safety in a comprehensive possession, the Court explained “[t]hat is like saying a ride on way. To date, however, Congress and most States have not enacted statutes regulating the use of GPS tracking technology for law en- horseback is materially indistinguishable from a flight to the forcement purposes.107 moon. Both are ways of getting from point A to point B, but The notion that legislatures are equipped to deal with pri- little else justifies lumping them together.”113 In reaching its con- vacy protections were principal findings of the Court in both clusion, the Court detailed the extensive amount of information Whelan and Reporters Committee. In those cases, the Court was routinely contained in cellphones and growing reliance on those satisfied that legislative action had adequately secured the indi- devices by individuals in everyday life. viduals privacy interest. In contrast, however, is the decision in The result in Riley was the Court’s decision to overturn long Carpenter, where the Court found the congressional protections standing precedent concerning the ability to of law enforcement for privacy for CSLI under the provisions of the Stored Com- to search the items in possession of an arrestee at the time of munications Act108 inadequate to meet Fourth Amendment arrest. As was the case subsequently in the Carpenter decision, requirements. Thus, while legislative enactments may be useful the Court concluded that technology adoption changed the in demonstrating that adequate privacy protections are estab- indi­vidual’s and society’s expectations of what was private. The lished, those enactments are not a panacea. ­lesson from this line of opinions is that things once thought not to be privacy-protected might change in character as technol- 4. Technology Fueling Changing Privacy Expectations ogy develops and becomes more embedded in people’s lives. by Individuals While the Supreme Court’s assessment of privacy in the cases Related to the issue of legislatures as better suited than courts outlined above applies only to activity conducted by govern- to deal with rapidly changing effects of emerging technology on ment, the Court’s analysis offers interesting perspectives about informational privacy, are the Court’s observations that emerg- what is a legitimate expectation of privacy and what measures ing technology itself is shaping the privacy expectations of indi­ serve to protect those expectations. Quon, Jones, and Riley dem- viduals. The Court has noted in addition to the pace of tech- onstrate how the Court anticipates the possibility of changing nology change, which makes it difficult for courts rather than expectations of privacy. As the population adapts to using new legislatures to react, there is also an evolving standard of privacy technologies, especially in the context of communication, the being driven by technology. In City of Ontario v. Quon,109 the parameters of privacy will continue to evolve. Court observed that “[r]apid changes in the dynamics of com- Overall, the arc of the Supreme Court’s review of privacy, munication and information transmission are evident not just particularly under the Fourth Amendment, has been to move in the technology itself but in what society accepts as proper in the direction of privacy protection. The increasing pace of behavior.”110 Until there is clarity in how an emerging tech- data collection and the ability of government to access data is a nology has shaped societal expectations of privacy, the Court matter of significant concern. Even justices who have concluded there is no constitutional protection for data privacy under the Fourth Amendment have indicated that protection of data and 105  In Nelson, Justice Scalia in his concurrence concludes, “[l]ike limitation of government use of data are matters that command many other desirable things not included in the Constitution, “infor- the attention of the legislative branch. There is near universal ac- mational privacy” seems like a good idea—wherefore the People have ceptance of the notion that the advances in technology are out- enacted laws at the federal level and in the states restricting the govern- ment’s collection and use of information. But it is up to the People to pacing the ability of courts to effectively regulate privacy protec- enact those laws, to shape them, and, when they think it appropriate, to tion. There is also a consensus that technology is changing how repeal them.” Id. the public views privacy and even the fundamental question of 106   565 U.S. 400 (2012). what kinds of information are even private. 107   Id. at 429-30. 108   18 U.S.C. § 2703(d). 111   Id. 109   560 U.S. 746 (2010). 112   Riley v. Cal., 573 U.S. 373 (2014). 110   Id. at 759. 113   Id. at 393.