New Google Case--It's Not the Transfer, It's the Production
Wednesday, February 22, 2017
Posted by: Mary Mack
Setting up a possible Supreme Court case, and laying groundwork to determine many activities around data are not "seizures", a magistrate judge in Pennsylvania dealing with Google data sought from international storage disagreed with the Second Circuit Court of Appeals in the Microsoft/Ireland warrant case.
The Google case includes a legal analysis of Magistrate Judge Francis' opinion in Microsoft upholding the warrant. It also includes a technical analysis of how load balancing and "shard" storage impacts the ability to determine a jurisdiction or territorial location for specific data. Rather than focus on the location of the ESI, and the mechanics of data transfer, the focus was the location of the production of the data for the SCA analysis.
In a client advisory Latham and Watkins explains, "Last summer, the US Court of Appeals for the Second Circuit sustained Microsoft’s challenge, holding that the use of an SCA warrant to obtain data stored overseas would constitute an impermissible extraterritorial application of the statute. On January 24, 2017, the Second Circuit declined to rehear the case en banc...On February 3, 2017, US Magistrate Judge Thomas J. Rueter of the Eastern District of Pennsylvania issued a decision compelling Google to comply with search warrants issued under the SCA for two separate Google accounts."
While this specific analysis may turn on the specific operational parameters of Google regarding how data is stored, for example, whole files in a discreet location vs shards of a file spread over multiple locations, that there is disagreement among the circuits on SCA extraterritorial warrants is clear.
Further, the decision in Google about the locus of data and the privacy implications of cross border transfer aims squarely at the EU understanding of "processing" data, a definition so strict that the act of preservation in place can sometimes be considered "processing".
Rueter states, "Electronically transferring data from a server in a foreign country to Google’s data center in California does not amount to a ‘seizure’ because there is no meaningful interference with the account holder’s possessory interest in the user data.”
Read the opinion here.