Privacy Law: Beyond the Fourth Amendment & Cyber-Crimes

CS593: Digital Forensics

• Privacy Law: Beyond the Fourth Amendment & Cyber-Crimes
  • Overview
  • Part I: Privacy Law Beyond the Fourth Amendment
    • Why Statutory Privacy Law Matters
    • Philosophy of Privacy
    • Solove’s Taxonomy of Privacy Violations
      • Information Collection
      • Information Processing
      • Information Dissemination
      • Invasion
    • U.S. Sector-Specific Privacy Statutes
    • Electronic Communications Privacy Act (ECPA)
    • FERPA
    • The Encryption Debate
  • Part II: Privacy and Cyber-Crimes
    • HIPAA and Health Information
    • ECPA: Wiretaps vs. Pen Registers
      • Wiretaps (Wiretap Act, 18 U.S.C. § 2511–2520)
      • Pen Registers (18 U.S.C. § 3121–3127)
    • The Computer Fraud and Abuse Act (CFAA)
      • Protected Computers
      • Core Violations
      • Terms of Service as Authorization
      • Civil Liability
    • Key CFAA Cases
      • U.S. v. Morris (2nd Cir. 1991)
      • U.S. v. Swartz (D. Mass., never tried)
      • U.S. v. Drew (C.D. Cal. 2009)
      • U.S. v. Kim (E.D. Va., 2010s)
    • Genetic Information Privacy
      • Maryland v. King (S. Ct. 2013)
      • GINA — Genetic Information Nondiscrimination Act (2008)
      • 23andMe and Direct-to-Consumer Genetics
  • Part III: Recent Developments (2021–2026)
    • The State Comprehensive Privacy Law Wave
    • No Federal Comprehensive Privacy Law (Yet)
    • Children’s Privacy: KOSA and COPPA 2.0
    • Consumer Health Data Outside HIPAA
    • Biometric Privacy: BIPA Litigation Explosion
    • EU AI Act (2024)
    • FTC Rulemaking and Enforcement: Commercial Surveillance
    • GDPR: The Global Benchmark
    • Flock Safety Cameras and Automated License Plate Readers
  • Summary
  • Key takeaways
  • References

Overview

The Fourth Amendment is not the only source of privacy law relevant to digital forensics. A patchwork of federal statutes creates additional obligations and protections — some filling gaps the Fourth Amendment leaves, others going further. Chapter 8 surveys the statutory privacy landscape and the philosophy behind it; Chapter 9 covers specific crime categories (HIPAA violations, wiretapping, and the Computer Fraud and Abuse Act) that DF professionals frequently encounter.

ℹ️ Two threads run through everything below. First, U.S. privacy law is sector-by-sector (a separate statute for video records, health data, student records, financial data…) where the EU has one comprehensive law — so the rule that applies depends on what kind of data you hold. Second, the law consistently protects content more than metadata, a distinction the Carpenter line of cases is now straining as aggregated metadata becomes as revealing as content.

Part I: Privacy Law Beyond the Fourth Amendment

Why Statutory Privacy Law Matters

Even where the Fourth Amendment does not apply — because no government actor is involved — private parties can violate privacy in ways that cause real harm. The FTC serves as the primary federal regulator of private-sector data practices.

FTC enforcement (under 15 U.S.C. § 45 — “unfair or deceptive acts or practices”):

• Applies to businesses; does not apply to nonprofits, most financial institutions, or carriers.
• Wyndham Hotels case: Wyndham suffered three data breaches in two years, exposing hundreds of thousands of credit card numbers. The FTC sued; Wyndham argued the FTC lacked authority. Third Circuit held that the FTC’s authority to regulate “unfair practices” extends to unreasonable data security practices.

Civil liability threshold: $5,000 in loss triggers civil liability under multiple statutes — this figure recurs across the CFAA and other frameworks.

Philosophy of Privacy

Two competing conceptions:

• Privacy as freedom: The ability to control information about oneself gives individuals autonomy and the power to present themselves on their own terms. On this view, privacy is intrinsically valuable.
• Privacy as secrecy: Privacy means keeping bad things hidden. Critics argue privacy protects the guilty and complicates legitimate law-enforcement investigations.

U.S. vs. European approach:

• United States: Sector-specific, statute-by-statute approach. No comprehensive federal privacy law. Different rules apply to medical records, video rental records, children’s data, financial records, etc.
• European Union: Comprehensive privacy law (General Data Protection Regulation, GDPR) covering all personal data. Treats privacy as a fundamental human right.

Neither approach is clearly superior. The U.S. approach is fragmented and inconsistent; the European approach can be rigid and ill-fitted to specific contexts.

Solove’s Taxonomy of Privacy Violations

Daniel Solove’s taxonomy organizes privacy violations into four categories. It provides a structured vocabulary for analyzing what kind of privacy interest is at stake.

Information Collection

1. Surveillance: Watching, listening to, or recording a person’s activities.
2. Interrogation: Pressuring people to reveal information about themselves.

Information Processing

1. Aggregation: Combining individually innocuous data points into a profile that reveals far more than any single point. Name, employer, neighborhood, and daily routine are each harmless; combined, they enable stalking.
2. Identification: Linking anonymous data to a real person.
3. Insecurity: Failing to protect data from unauthorized access.
4. Secondary use: Using data collected for one purpose in a different, unanticipated context.
5. Exclusion: Denying people access to data about themselves, or failing to let them correct it.

Information Dissemination

1. Breach of confidentiality: Sharing information disclosed under an expectation of confidence.
2. Disclosure: Revealing true private information.
3. Exposure: Exposing intimate aspects of private life (nudity, bodily functions).
4. Increased accessibility: Making information easier to find that was previously technically public but practically obscure.
5. Blackmail: Using the threat of disclosure to extract something.
6. Appropriation: Using a person’s identity or likeness for another’s benefit.
7. Distortion: Spreading false information about a person.

Invasion

1. Intrusion: Disturbing a person’s solitude or seclusion.
2. Decisional interference: Intruding into a person’s decisions about their own life.

Hill v. NCAA three-factor test (applicable to privacy-invasion claims):

1. Does the claimant have an actual, legally protected privacy interest?
2. Did the claimant have a reasonable expectation of privacy in the circumstances?
3. Does the invasion constitute a serious and egregious intrusion — one that would be highly offensive to a reasonable person?

U.S. Sector-Specific Privacy Statutes

The U.S. approach creates different rules for different categories of information:

Electronic Communications Privacy Act (ECPA)

The Electronic Communications Privacy Act (1986) is the primary federal statute governing government access to electronic communications. It has three parts:

Key distinction: The law treats content (what is said) very differently from metadata (who talked to whom, when, for how long). Content gets the most protection; metadata gets the least.

SCA disclosure framework:

• Voluntary disclosure: A provider may voluntarily disclose to law enforcement if the provider reasonably believes an emergency involving danger of death or serious injury exists.
• Compelled disclosure: Law enforcement uses a warrant, 2703(d) order, or subpoena. The appropriate tool depends on what is being sought and how old it is.

FERPA

The Family Educational Rights and Privacy Act prohibits schools receiving federal funding from disclosing student education records without consent.

• Enacted under the Spending Clause — Congress conditions federal education funding on compliance. This limits enforcement: there is no individual right to sue under FERPA; a student who has their records improperly disclosed can complain to the Department of Education, but cannot bring a private lawsuit.
• Applies to universities; parents lose rights when a student turns 18 or enrolls in postsecondary education (rights transfer to the student).

The Encryption Debate

Law enforcement has long sought government access to encrypted communications. The debate has never been fully resolved.

Historical background:

• Clipper chip (1993): NSA proposed a hardware encryption standard with a built-in government backdoor (key escrow). Defeated by technical community opposition after cryptographers found the escrow scheme flawed.
• 1990s Crypto Wars: Encryption was classified as a munition; export was heavily restricted. Phil Zimmermann was investigated for publishing PGP. Restrictions eventually lifted.
• 2014: Apple and Google announced default full-disk encryption on mobile devices, explicitly citing inability to provide plaintext even in response to legal process.

The backdoor debate:

For backdoors: Law enforcement goes dark; encrypted devices protect criminals, terrorists, and child abusers from lawful investigation.

Against backdoors: A backdoor for the government is a backdoor for everyone — there is no mathematically secure way to create a government-only exception. Weakening encryption harms security for all users; foreign adversaries and criminals will exploit the same vulnerability. If U.S. companies are required to build backdoors, customers will use foreign products that do not.

No legislative resolution has been reached. The debate continues.

Part II: Privacy and Cyber-Crimes

HIPAA and Health Information

The Health Insurance Portability and Accountability Act (1996) protects protected health information (PHI) — individually identifiable health information held by covered entities (health plans, clearinghouses, providers).

Important limits:

• HIPAA is a floor, not a ceiling. States can impose stricter requirements.
• HIPAA does not generally prohibit disclosure to treatment providers or for payment processing — sharing your records with other treating physicians does not require your consent.
• Disclosures to law enforcement: HIPAA allows (but does not require) disclosure in response to a court order, warrant, or subpoena. Providers may choose to require a warrant even when a subpoena would suffice.

Technology implications: Modern healthcare produces enormous volumes of electronic data — EHR systems, wearables, genomic databases, insurance billing. DF professionals may encounter HIPAA-protected data and must understand the consent and disclosure framework before handling it.

ECPA: Wiretaps vs. Pen Registers

Although both are in ECPA, wiretaps and pen registers have dramatically different legal requirements.

Wiretaps (Wiretap Act, 18 U.S.C. § 2511–2520)

• Requires a “super-warrant”: probable cause + specific showing that other investigative techniques have been tried and failed or would be impractical.
• Authorization lasts 30 days (renewable).
• Designed for future crimes — ongoing or anticipated criminal activity, not past events.
• 48-hour emergency exception: law enforcement may begin interception without judicial authorization in emergencies involving national security or organized crime, but must apply for a court order within 48 hours.
• Violations: criminal penalties; evidence may be suppressed.

Pen Registers (18 U.S.C. § 3121–3127)

• Captures non-content metadata: numbers dialed, IP addresses contacted, packet headers — not message content.
• Requires only a subpoena plus a relevance showing — no probable cause required.
• Authorization lasts 60 days (renewable).
• The low standard reflects the court’s view (derived from Smith v. Maryland, 1979) that people have no reasonable expectation of privacy in numbers they dial, because they voluntarily convey that information to the phone company (third-party doctrine).

The Computer Fraud and Abuse Act (CFAA)

The Computer Fraud and Abuse Act (1986, substantially amended by the USA PATRIOT Act and subsequent legislation) is the primary federal computer crime statute.

Protected Computers

The CFAA applies to “protected computers” — a term of art that includes:

• Computers used by or for financial institutions or the U.S. government.
• Computers used in interstate or foreign commerce or communications.

In practice, any computer connected to the internet is a protected computer.

Core Violations

Felony vs. misdemeanor: First-time unauthorized access with no aggravating factors is a misdemeanor. Repeat violations, financial gain, damage to critical infrastructure, and espionage elevate charges to felonies with sentences up to 20 years.

Terms of Service as Authorization

A contested question: does violating a website’s Terms of Service (TOS) constitute unauthorized access under the CFAA?

• DOJ position: Yes. If a TOS prohibits something (e.g., creating a pseudonymous account on Facebook), doing it constitutes accessing the computer “without authorization” or “exceeding authorized access.”
• Criticism: This interpretation makes millions of ordinary internet users federal criminals (nearly everyone has violated a TOS at some point). It allows private companies to define the scope of federal criminal liability by writing TOS documents.

Civil Liability

Private parties can sue under the CFAA. Threshold: the plaintiff must demonstrate $5,000 in loss within a one-year period. Forensic investigation costs count toward the threshold — the cost of hiring investigators to determine what happened is a cognizable loss.

Government surveillance exception: Law enforcement conducting lawful surveillance under ECPA does not violate the CFAA, even though interception involves accessing computers without the owner’s consent.

Key CFAA Cases

U.S. v. Morris (2nd Cir. 1991)

Robert Tappan Morris, a Cornell graduate student, released the Morris Worm in 1988 — the first worm to propagate across the internet. It used exploits in sendmail, fingerd, and rsh/rexec; a replication bug caused it to infect machines multiple times, eventually crashing approximately 6,000 systems.

Morris was convicted under the CFAA. His defense argued he had “authorized” access to the internet as a legitimate user. The court rejected this: authorization to use a network does not authorize exploitation of vulnerabilities to gain unauthorized access to other machines on that network. First CFAA conviction; set the precedent that legitimate network access does not authorize everything reachable from that access.

U.S. v. Swartz (D. Mass., never tried)

Aaron Swartz, a developer who co-authored RSS and helped create Creative Commons, used MIT’s network to download approximately 4.8 million JSTOR articles using a script that spoofed MAC addresses to evade blocking. JSTOR settled with Swartz civilly and declined to press charges. Federal prosecutors charged him with 13 felony counts under the CFAA, seeking up to 35 years.

Swartz died by suicide in January 2013 before trial. The case prompted debate about whether the CFAA was being used to prosecute ordinary computer use with disproportionate severity.

U.S. v. Drew (C.D. Cal. 2009)

Lori Drew created a fake MySpace account (“Josh Evans”) to manipulate Megan Meier, a 13-year-old who had a falling out with Drew’s daughter. “Josh” cultivated a romantic relationship with Megan and then sent her a message saying “the world would be better off without you.” Megan died by suicide the same day. Drew was charged under the CFAA on the theory that creating a fake account violated MySpace’s TOS, making her access “unauthorized.”

Drew was convicted by the jury. The judge granted a judgment notwithstanding the verdict (JNOV) — a rare ruling that set aside the jury’s verdict — for three reasons:

1. Breach of contract is not the same as criminal conduct.
2. A private party (MySpace) cannot define the scope of federal criminal liability by writing a TOS.
3. The TOS was too vague to satisfy due process requirements — a criminal statute must give clear notice of what conduct is prohibited.

Drew is the leading case limiting the TOS-as-authorization theory.

U.S. v. Kim (E.D. Va., 2010s)

A GEXA Energy employee was investigated for allegedly stealing trade secrets. A warrant was obtained to search his computer. Investigators found encrypted files; the warrant did not authorize decryption or examination of encrypted data.

A second search was conducted and investigators found child pornography. Defense challenged admission of the child pornography evidence under the plain view doctrine and warrant scope:

• The original warrant did not authorize examination of encrypted files.
• Plain view requires that the incriminating character of an item be immediately apparent — encrypted content is not immediately apparent as contraband.
• The court excluded the evidence: the search exceeded the warrant’s scope, and plain view did not apply because the investigators had to actively decrypt to see what was there.

Kim illustrates how warrant scope constrains digital investigations: if you want to examine encrypted files, your warrant must specifically authorize that examination.

Genetic Information Privacy

DNA evidence is powerful — so powerful that its collection and use raise distinct privacy concerns.

Maryland v. King (S. Ct. 2013)

The Court upheld, 5–4, a Maryland law allowing collection of DNA samples from individuals arrested (not convicted) of serious crimes. The majority analogized DNA swabbing to fingerprinting — a routine booking procedure used to identify the arrestee and check for outstanding warrants.

Justice Scalia’s dissent (joined by Ginsburg, Sotomayor, and Kagan) argued that the majority’s identification rationale was pretextual: the DNA profile is not actually used to identify the arrestee; it is run against a national database of unsolved crimes. The real purpose is suspicionless crime investigation, not identification.

Significance: DNA can now be collected from arrestees who are never convicted, and who may be innocent.

GINA — Genetic Information Nondiscrimination Act (2008)

GINA prohibits discrimination based on genetic information in:

• Employment (Title II): Employers cannot use genetic information in hiring, firing, or terms of employment.
• Health insurance (Title I): Health insurers cannot use genetic information to determine eligibility or premiums.

GINA does not cover: life insurance, disability insurance, or long-term care insurance. An insurer offering those products can use genetic information.

23andMe and Direct-to-Consumer Genetics

Commercial genetic testing companies collect and analyze customer DNA and share aggregate data with pharmaceutical companies. 23andMe sold data from ~650,000 customers to Genentech for $60 million.

The FDA has restricted 23andMe from providing certain health-related interpretations without regulatory approval, citing concerns about the accuracy and clinical utility of some analyses.

2025 update: 23andMe filed for Chapter 11 bankruptcy in March 2025 and was subsequently acquired. The disposition of its genetic database — covering approximately 14 million customers — became a major legal and ethical issue during the bankruptcy proceedings. Several state attorneys general raised concerns about whether GINA and state genetic privacy laws adequately govern a sale of genetic data through a bankruptcy proceeding, and some courts allowed customers to request deletion of their data before the acquisition closed. This case illustrates that the privacy implications of large genetic databases are not merely theoretical: company insolvency creates a scenario where data collected under one company’s privacy policy may be transferred to a third party under entirely different terms.

Part III: Recent Developments (2021–2026)

The State Comprehensive Privacy Law Wave

The California Consumer Privacy Act (CCPA, 2018; effective 2020) opened the floodgates for state-level comprehensive privacy legislation. Since 2021, roughly 20 states have enacted their own consumer privacy laws.

California — CPRA (Prop 24, 2020; effective Jan 2023)

• Amends and expands CCPA; creates the California Privacy Protection Agency (CPPA) as an independent enforcement body (the first of its kind in the U.S.)
• Adds a “sensitive personal information” category (SSN, race, health, precise geolocation, sexual orientation) with separate opt-out rights
• New right to correct inaccurate personal information
• Data minimization and purpose limitation requirements

Virginia — VCDPA (signed March 2021; effective Jan 2023)

• Consumer rights: access, correction, deletion, portability, opt-out of targeted advertising/sale/profiling
• Requires data protection assessments for high-risk processing activities
• No private right of action — AG enforcement only

Colorado — CPA (signed July 2021; effective July 2023)

• Similar to Virginia but adds a universal opt-out mechanism requirement: platforms must honor browser- or OS-level opt-out signals (e.g., Global Privacy Control)
• Rulemaking authority granted to the AG

Other states (2022–2025): Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Florida, Oregon, Delaware, New Hampshire, New Jersey, Kentucky, Nebraska, Maryland, Minnesota — each has enacted a comprehensive privacy law. Most follow the Virginia/Colorado model: AG enforcement only, no private right of action, opt-out for sale and targeted advertising.

Common pattern vs. GDPR: Unlike the EU’s opt-in consent model, U.S. state laws mostly use opt-out — data can be collected and processed until the consumer objects. This is a weaker baseline protection.

No Federal Comprehensive Privacy Law (Yet)

Congress has repeatedly attempted to pass a national privacy law:

• American Data Privacy and Protection Act (ADPPA) — passed the House Commerce Committee July 2022 with bipartisan support; stalled on the floor over whether federal law should preempt stricter state laws (California objected to anything weaker than CPRA)
• American Privacy Rights Act (APRA) — introduced April 2024; advanced in committee; stalled before a floor vote

The core political obstacle has remained constant: the tech industry wants federal uniformity (one set of rules nationally); California and consumer advocates oppose preemption of stronger state protections. Until this is resolved, the U.S. will continue operating under a patchwork of ~20 state laws with no national floor.

Children’s Privacy: KOSA and COPPA 2.0

Kids Online Safety Act (KOSA) — signed into law August 2024

• Imposes a “duty of care” on online platforms likely to be accessed by minors: must take reasonable steps to prevent and mitigate specified harms (anxiety, depression, eating disorders, substance use, sexual exploitation)
• Requires default privacy settings that minimize data collection for users under 17
• Requires platforms to give parents tools to limit features and apply time restrictions
• Requires annual independent audits of platform compliance
• FTC enforcement

Children and Teens’ Online Privacy Protection Act (COPPA 2.0) — as of mid-2025, not yet enacted

• Would raise the age threshold from 13 to 16
• Would ban targeted advertising to minors under 17
• Would create a “Digital Marketing Bill of Rights for Minors”

The original COPPA (1998) predates smartphones, social media, and app stores. These proposals attempt to address the reality that platforms designed for adults are routinely used by children.

Consumer Health Data Outside HIPAA

HIPAA protects health data held by covered entities (providers, insurers, clearinghouses). Enormous amounts of health data are collected by entities that are not HIPAA-covered: period-tracking apps, fitness wearables, direct-to-consumer genetic testing, wellness and mental health platforms.

Washington My Health My Data Act (signed April 2023; effective March 2024 for large businesses)

• Covers “consumer health data” — broadly defined as any data that could identify a consumer’s physical or mental health conditions, including reproductive health, precise location data at healthcare facilities, and biometric data
• Requires affirmative opt-in authorization before collecting or sharing consumer health data
• Prohibits geofencing within 2,000 feet of healthcare facilities for the purpose of collecting health data
• Includes a private right of action — unusual for a U.S. privacy law; consumers can sue directly without waiting for the AG
• Nevada and Connecticut have enacted similar provisions; other states are following

Post-Dobbs relevance: After the Supreme Court’s 2022 decision overturning Roe v. Wade, location data and reproductive health data held by non-HIPAA apps became a significant law enforcement target. Washington’s Act was partly designed to close this gap.

Biometric Privacy: BIPA Litigation Explosion

Illinois’ Biometric Information Privacy Act (BIPA, 2008) requires informed written consent before collecting biometric identifiers (fingerprints, iris scans, face geometry). Unlike most U.S. privacy laws, it includes a private right of action with statutory damages ($1,000 per negligent violation, $5,000 per intentional violation).

In 2022–2024, BIPA litigation exploded into one of the highest-volume class-action areas in the country:

• Cothron v. White Castle (Ill. S. Ct. 2023): Each scan and each transmission constitutes a separate violation — not merely one violation per person. White Castle’s per-scan timeclock fingerprint system theoretically exposed it to $17 billion in liability.
• The Illinois legislature amended BIPA in 2024 to limit accrual to one violation per person (not per scan), capping exposure.
• Texas (CUBI) and Washington (H.B. 1493) have similar biometric laws but without private rights of action.

Forensic implication: Biometric data collected without proper BIPA consent is legally tainted. Evidence derived from biometric identification systems (facial recognition databases, fingerprint scanners) may face admissibility challenges if the underlying collection violated consent requirements.

EU AI Act (2024)

The EU AI Act (provisionally agreed December 2023; entered into force August 2024) is the world’s first comprehensive legal framework for artificial intelligence. Privacy is central to its structure.

Risk-tiered framework:

Extraterritorial reach: Applies to any AI system that affects persons in the EU, regardless of where the developer or deployer is located — analogous to GDPR’s extraterritorial scope.

For DF professionals: AI tools used in investigations — facial recognition systems, predictive policing algorithms, automated evidence analysis — may fall under the Act’s high-risk category if results are used in EU proceedings. Vendors must maintain technical documentation and allow audits; investigators relying on non-compliant tools may see evidence challenged.

FTC Rulemaking and Enforcement: Commercial Surveillance

In the absence of a comprehensive federal privacy statute, the FTC has expanded its § 5 “unfair or deceptive practices” authority into a de facto privacy regulatory program:

• 2022 ANPR on Commercial Surveillance and Data Security: Proposed rules covering data minimization, algorithmic discrimination, automated decision-making, and baseline security requirements. Rulemaking ongoing.
• 2024 Health Breach Notification Rule update: Expanded the rule’s scope to explicitly cover health apps, fitness trackers, and other non-HIPAA entities — requiring breach notification to consumers and the FTC.
• Data broker enforcement: FTC actions against Kochava (selling precise location data linked to sensitive locations — abortion clinics, domestic violence shelters) and X-Mode/Outlogic (selling location data to military contractors). FTC obtained consent orders prohibiting sale of sensitive location data.
• Facial recognition in employment: Pursuing rulemaking to prohibit or restrict use of facial recognition in hiring and employment decisions.

The FTC’s statutory authority has limits — it cannot impose fines for first-time violations without a prior order — but these constraints have driven it toward rulemaking rather than one-off enforcement actions.

GDPR: The Global Benchmark

The EU’s General Data Protection Regulation (effective May 2018) is the world’s most influential privacy law and the explicit model that U.S. state legislators have used as a reference point — even where they chose weaker standards.

Core principles (Article 5):

• Lawfulness, fairness, transparency: Processing must have a legal basis; individuals must be informed.
• Purpose limitation: Data collected for one purpose cannot be used for an incompatible purpose.
• Data minimization: Collect only what is necessary.
• Accuracy: Inaccurate data must be corrected or deleted.
• Storage limitation: Data must not be kept longer than necessary.
• Integrity and confidentiality: Appropriate security required.
• Accountability: Controllers must be able to demonstrate compliance.

Legal bases for processing (Article 6): Consent, contract performance, legal obligation, vital interests, public task, or legitimate interests. Unlike U.S. law, GDPR requires a documented legal basis before processing begins.

Individual rights: Access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection, rights related to automated decision-making/profiling.

Enforcement: Fines of up to €20 million or 4% of global annual turnover, whichever is higher. Recent major fines:

Extraterritorial reach (Article 3): GDPR applies to any organization that processes data of EU residents, regardless of where the organization is located. A U.S. company with EU customers is subject to GDPR.

EU–U.S. data transfers: Transferring personal data outside the EU requires an adequacy mechanism:

• Privacy Shield (2016) — invalidated by the Court of Justice of the EU in Schrems II (2020), which found U.S. surveillance law (FISA § 702) incompatible with GDPR rights.
• EU–U.S. Data Privacy Framework (2023) — replacement framework; already under legal challenge by Max Schrems and NOYB; outcome uncertain.

DF implications: Evidence obtained from EU-based systems or involving EU residents may implicate GDPR obligations around lawful access, data minimization, and retention. Investigators working with EU counterparts must understand what data can be lawfully transferred and under what conditions.

Flock Safety Cameras and Automated License Plate Readers

Flock Safety is a company that sells automated license plate reader (ALPR) systems to law enforcement agencies, homeowners associations, and private property owners. As of 2024, Flock cameras are deployed in thousands of communities across all 50 states, making it one of the largest ALPR networks in the U.S.

How the system works:

• Passive cameras capture images of every passing vehicle — license plate, make, color, body type, and distinguishing features (bumper stickers, roof racks)
• Data is uploaded to Flock’s cloud platform and retained for 30 days by default (configurable)
• Law enforcement agencies can query the database; agencies participating in “Flock Falcon” can share hotlist alerts across jurisdictions
• Hotlists flag plates associated with stolen vehicles, Amber Alerts, wanted persons, and (controversially) immigration enforcement

Privacy concerns:

Aggregation problem: Any individual capture is unremarkable — a car passing a camera is not a search. But ALPR networks aggregate thousands of data points per vehicle over time, reconstructing detailed patterns of movement: where someone works, worships, receives medical care, and who they associate with. This is the same aggregation problem the Supreme Court addressed in Carpenter v. United States (2018), which held that obtaining seven days of cell-site location information required a warrant.

Third-party doctrine tension: Driving on a public road has traditionally been treated as public activity with no reasonable expectation of privacy. Courts have generally allowed ALPR data to be obtained without a warrant. But Carpenter suggested that long-term, comprehensive location tracking is different in kind — the logic may eventually extend to ALPR databases.

Private network surveillance: Flock cameras owned by HOAs and private businesses feed the same platform used by police. Law enforcement can query data collected by private parties without a subpoena, because the third party (the HOA) voluntarily shares it. This creates a de facto surveillance network with no judicial oversight.

Immigration enforcement: Flock’s terms of service were revised after scrutiny of whether ICE could access plate reader data. The question of what data a private ALPR provider can share with federal immigration enforcement — and whether that sharing is lawful — remains unresolved.

Legislative responses:

• Minneapolis (2023): Banned city use of ALPR technology.
• Several states (Maine, New Hampshire) have enacted retention limits and audit requirements for government ALPR use.
• California requires ALPR operators to have a usage and privacy policy; data cannot be sold.
• No federal ALPR-specific statute exists.

DF relevance: ALPR data is increasingly offered as evidence in criminal cases — placing a vehicle at a location at a time. Defense challenges have focused on: retention policy compliance, chain of custody for cloud-stored data, accuracy rates of the OCR reading system, and whether the scope of queries exceeded what the investigating warrant authorized.

Summary

Key takeaways

• The U.S. has no comprehensive federal privacy law — protection is a patchwork of sector-specific statutes (VPPA, COPPA, HIPAA, FERPA, GLBA) plus the FTC’s § 5 “unfair or deceptive practices” authority acting as a de facto regulator.
• ECPA draws the central line between content and metadata: real-time content needs a Wiretap “super-warrant” (30 days), real-time metadata needs only a pen-register order (subpoena + relevance, 60 days), and stored data is governed by the SCA based on age and type.
• The CFAA turns on “unauthorized access” / “exceeding authorized access” with a $5,000 civil threshold; Drew and the courts have largely rejected the theory that a Terms-of-Service breach is a federal crime, and Kim shows warrant scope constrains examination of encrypted files.
• Solove’s taxonomy (collection → processing → dissemination → invasion) and the aggregation problem — innocuous data points combining into a revealing profile — are the conceptual core that Carpenter imported into Fourth Amendment doctrine.
• The frontier is state law and data outside HIPAA: ~20 state comprehensive laws (mostly opt-out, AG-enforced), Washington’s My Health My Data Act (opt-in, private right of action), Illinois BIPA (statutory per-violation damages), plus the EU AI Act and GDPR setting the global benchmark.
• For DF work, the practical upshots are warrant scope, retention compliance, and lawful transfer — especially for biometric, genetic, location/ALPR, and EU-resident data, any of which can be challenged on admissibility if collected improperly.

References

• Solove — A Taxonomy of Privacy (U. Penn. Law Review). https://www.law.upenn.edu/journals/lawreview/articles/volume154/issue3/Solove154U.Pa.L.Rev.477(2006).pdf
• Electronic Communications Privacy Act (ECPA) — DOJ overview. https://bja.ojp.gov/program/it/privacy-civil-liberties/authorities/statutes/1285
• Computer Fraud and Abuse Act — 18 U.S.C. § 1030. https://www.law.cornell.edu/uscode/text/18/1030
• Carpenter v. United States (2018). https://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf
• HIPAA Privacy Rule — HHS. https://www.hhs.gov/hipaa/for-professionals/privacy/index.html
• EU GDPR — full text. https://gdpr-info.eu/
• EU Artificial Intelligence Act. https://artificialintelligenceact.eu/
• California Privacy Protection Agency (CPRA). https://cppa.ca.gov/
• Illinois Biometric Information Privacy Act (BIPA). https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004

Related course pages: Incident Response · Adversary Models: MITRE ATT&CK · Technical Writing

🛠️ Maintenance note: this page is unusually time-sensitive — legislative and case status changes term to term. Re-verify before each offering: federal bills (APRA, COPPA 2.0 were unpassed as of mid-2025), the count of state comprehensive laws (~20 and climbing), the 23andMe bankruptcy/data disposition, BIPA’s 2024 accrual amendment, the EU–U.S. Data Privacy Framework’s pending Schrems challenge, and Flock/ALPR litigation. Treat every “20XX” date and “not yet enacted” status as a checkpoint, not a fixed fact.