In contrast to federal right, state recognizes legitimate privacy interest in data held by third parties.
A New Jersey business owner began to suspect that one of his employees had, without authorization, accessed the company’s computer system to modify shipping and other customer information. The business owner knew someone with a Comcast IP address had accessed the system, and a police detective went to the local municipal court, to have the administrator issue a subpoena to Comcast. The ISP complied, and the information provided implicated the suspected employee. She was arrested, and before trial, successfully moved to suppress the evidence linking her identity with the IP address. The state sought review of the suppression of the evidence, and the appellate court affirmed. Pro-privacy advocates should applaud the court’s opinion.
The appellate court first looked at the validity of the subpoena that the administrator of the municipal court issued. For a number of reasons particular to New Jersey criminal procedure, the subpoena was invalid. (For example, the offense being investigated was one that would have been outside that court’s subject matter jurisdiction.)
The court then examined whether the invalidity of the subpoena really mattered. The lower court judge’s decision to suppress the evidence “might still be subject to reversal if [the] defendant had no privacy interest in the information obtained from Comcast. If there were no constitutionally protected privacy interest, it would not matter how the police obtained the information.”
Making no effort to conceal the fact that its decision departed from “uniform” federal jurisprudence on the issue, the court ruled in favor of the defendant’s “informational privacy.” Even though the U.S. Supreme Court “consistently has held that a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties,” the New Jersey court continued a trend apparent in a number of past New Jersey cases which provide an individual with the right to control “the acquisition or release of information about oneself.” In New Jersey, this right to informational privacy is derived from an implied right of privacy found in the state’s constitution, and has manifested itself in past decisions involving a right to privacy in telephone records, bank records, and garbage left out for pickup.
Because the defendant had a reasonable expectation of privacy in her identity linked to the Comcast IP address, the state was required to get a valid subpoena before obtaining that information. Without the valid subpoena, the defendant’s rights were violated, and the evidence was properly excluded.
So does this mean that Internet subscriber information held by ISPs in New Jersey can never be revealed to law enforcement? No. But the court instructed “that information concerning the identity of an internet user can only be obtained by law enforcement through some means of judicial process.” All it takes is a valid subpoena.
State v. Reid, — A.2d —-, 2007 WL 135685 (N.J.Super.A.D., Jan. 22, 2007)