We write about data breaches and privacy issues all the time. We are desensitized in some ways to the fact that our privacy may have been or will be compromised and, quite frankly, many people now distrust some of the very companies with whom they shared their information. California led the way with the California Consumer Privacy Act of 2018 (CCPA). Various states like Washington, Massachusetts and Rhode Island are a few of the states right now with pending legislation to address data privacy issues and we recently wrote about the possibility of federal privacy legislation.

This week we spotlight the state of Utah where Governor this week signed legislation that is designed to protect private electronic data stored and held by third parties, such as wireless providers, email or search engine data, from government access without a warrant.   Highlights of the bill include:

• Requirement of the issuance of a search warrant to obtain certain electronic information or data;
• addresses notification that electronic information or data was obtained;
• provides for transmission of electronic information or data to a remote computing service, including restrictions on government entities;
• provides that the individual who transmits electronic information or data is the presumed owner of the electronic information or data;
• provides for the exclusion of electronic information or data obtained without a warrant.

The legislation is designed to add protections to individuals’ electronic data that is entrusted to third parties. Why is this important? It’s no secret that technology has developed far faster than legal doctrines, statutes and regulations. What happens when law enforcement wants access to cell phone location data? It is data that is in the hands of a third party. Do we have an expectation of privacy in this information?

Right now, we rely on the Supreme Court’s ruling in Carpenter v. United States, where the Court acknowledged that cell phone personal location information maintained by a third party does not fit neatly under existing precedents. The Court’s ruling was narrow; that is, that the cell phone location records and the Government’s acquisition of the records was a Fourth Amendment search, and in this case, the Government did not obtain a warrant for the cell phone location records and the mechanism the Government used to obtain the records was not permissible.

Utah is now the first state to pass legislation that will require law enforcement to obtain a search warrant for electronic information or data held by a third party.