Privacy, the cloud, and investigations

Wexler, Rebecca, The Global Cloud, the Criminally Accused, and Executive Versus Judicial Compulsory Process Powers (October 10, 2022). Texas Law Review, Forthcoming, Available at SSRN: https://ssrn.com/abstract=4244186 or http://dx.doi.org/10.2139/ssrn.4244186

U.S. policymakers’ responses to the global data privacy movement are creating a deep structural unfairness in the criminal legal system. In an era of cloud computing, when data about communications and activities occurring anywhere in the world can be stored on servers located anywhere else, access to such data can make the difference between convictions and acquittals. At the same time, a wave of new global data privacy laws risks cutting off cross-border access to digital evidence in criminal investigations. Recognizing the threat to law enforcement interests, U.S. policymakers enacted the CLOUD Act of 2018 to create special procedures for law enforcement to circumvent foreign data privacy laws and access cross-border evidence anyway. Yet no one is creating similar procedures for criminal defense investigators.

In the U.S. adversarial legal system, criminal defense counsel are the sole actors formally tasked with investigating evidence of innocence. While law enforcement must disclose exculpatory evidence that they happen to possess, law enforcement has no formal duty to actively seek out such evidence. As a result, selectively advantaging law enforcement investigations of guilt without creating parallel procedures for the defense means selectively suppressing evidence of innocence. This asymmetry gets privacy backwards. Privacy protections ostensibly meant to constrain government power may accomplish that goal in an absolute sense, but relatively speaking they specially empower the government as compared to the defense. They thereby undermine the criminal defense process that is itself supposed to guard against government abuse.

This Article exposes this structural, anti-defendant bias that U.S. responses to the global data privacy movement are in the midst of producing. It then uses this problem as a case study to examine the constitutionality of a more general category of laws: privacy laws that disadvantage criminal defense investigations as compared to their law enforcement counterparts. It diagnoses why constitutional challenges to these types of laws have failed in the past and proposes a novel definitional argument to strengthen these challenges moving forward. Ironically, the very CLOUD Act procedures that exclude defense investigators also hold a key to advocating on their behalf.