A California federal district court has ruled that Google must produce data stored on servers located outside the United States in response to a search warrant issued by the court and requested by the U.S. government pursuant to the Stored Communications Act (SCA). This decision is contrary to the 2016 Second Circuit opinion in Microsoft Corporation v. United States, in which the appellate court ordered the district court to quash a government warrant demanding that Microsoft turn over a user’s emails that resided on servers located in Ireland (829 F.3d 197 (2d Cir. 2016)). A petition for a rehearing en banc was denied by the Second Circuit earlier this year in a 4-4 split.
The search warrant at issue In the Matter of the Search of Content that is Stored at Premises Controlled by Google (see Case No. 16-mc-80263-LB) authorized production of data from specific Google email accounts. Google produced records confirmed to be stored in the United States, but refused to include certain data which was confirmed to be stored exclusively outside the United States. Google argued that since the SCA does not specify whether it or its warrant provisions apply outside the United States, it has no extraterritorial application, based upon a canon of statutory construction known as the presumption against extraterritoriality.
The Court declined the follow the Second Circuit decision, which also analyzed the extraterritorial application of the SCA. Instead, it found the four dissenting opinions in the Microsoft rehearing opinion persuasive, and held that even if the intent of the SCA is to protect privacy, the warrant requirement, with its probable cause requirement, adequately meets that intent. Further, the Court reasoned that since the data subject to the search can be accessed and delivered from Google’s corporate headquarters in the U.S., it was subject to a U.S. court’s jurisdiction. The opinion distinguished Microsoft, where the data was stored, based upon the user’s reported location. In Google, the Court found there was no storage decision, since Google distributes information pursuant to an algorithm. The only place where the data could be accessed was at the Google headquarters. Thus, the Court concluded that this was a domestic application of the SCA, sidestepping the extraterritorial application question.
This most recent decision creates even greater uncertainty for companies who are increasingly using overseas servers to store their electronic customer data. These cases illustrate the split in the circuits, and rely upon an outdated statute enacted in 1986 – long before the technology involved in these cases was invented. Until Congress enacts appropriate legislation clarifying rights and responsibilities for technology companies, or the Supreme Court issues a definitive interpretation, companies will be faced with negotiating a patchwork of decisions in deciding how to respond to a warrant.
For more information, contact Joe Dehner, or any other member of Frost Brown Todd’s Privacy & Data Security Team.