On Oct. 21, 2019, the Supreme Court of Georgia answered the question of whether the Fourth Amendment protects a right to privacy in the air bag safety devices installed in vehicles. These devices, which record for a period of time before, during and after a crash or on a continuous loop until a vehicle is in a crash, have been analogized to the black boxes found on airplanes and are becoming increasingly common in vehicles. According to one estimate, they’ve been installed in about 96% of cars manufactured since 2013.

Why should anyone care whether the Fourth Amendment applies? For the most part, they needn't. That is, until they get into an accident involving a death or a serious injury, in which case the police may impound their vehicle and conduct an investigation, including seizing the data from the air bag device, leading to criminal charges. At this point, the Fourth Amendment question becomes critical. 

But Georgia was just the latest state to consider the issue. One of the first was California, in 2013's People v. Diaz. In the case, Diaz crossed the double yellow lines with a blood alcohol level of approximately 0.23, colliding head-on with another vehicle and killing the other driver. Diaz’s vehicle was impounded and inspected without a search warrant. The inspection included a download of her vehicle’s “Sensing Diagnostic Module”; the SDM’s main functions being to deploy the air bags and record data about the car’s operation. Diaz was charged with involuntary manslaughter and vehicular manslaughter with gross negligence while intoxicated.

Before trial, Diaz moved to suppress the SDM data, arguing her Fourth Amendment right to privacy had been violated. The trial court denied her motion, holding that she couldn’t have a privacy interest in a device that she didn’t even know existed. Diaz was found guilty by the jury.

On appeal, the California Appellate Court agreed, noting that “a person has no reasonable expectation of privacy in speed on a public highway” because speed is easily observable by the public, through radar detectors or estimation by a trained police expert. Thus, Diaz had no Fourth Amendment expectation of privacy; “technology merely captured information defendant knowingly exposed to the public.”

In State of Florida v. Worsham, Worsham was involved in a high-speed crash that killed his passenger. His car was impounded, and days later, the police downloaded data from the vehicle’s "Event Data Recorder" without a warrant. Worsham was charged with DUI manslaughter and vehicular homicide, and, like Diaz, he moved to suppress the evidence. This time, however, the trial court held that the data was protected by the Fourth Amendment. On appeal, the Florida Appellate Court agreed, placing significance on the inherent difficulty in accessing these devices, the specialized skills needed to interpret the data and the breadth of data collected, which, together, gives rise to a Fourth Amendment expectation of privacy.

Finally, on Oct. 21, 2019, the Supreme Court of Georgia issued its ruling in Mobley v. State; Mobley collided with a vehicle pulling onto the road from a private driveway, killing two people. Once again, the police downloaded data from the vehicle’s "Airbag Control Module" without a search warrant. Mobley was subsequently charged with reckless driving and two counts of homicide by vehicle and moved to suppress the data, but the trial court denied his motion. On appeal, the Georgia Court of Appeals held, like Diaz, that the ACM merely collected information already exposed to the public and, therefore, Mobley could not have an expectation of privacy. Eventually, the Georgia Supreme Court took the case and reversed the Court of Appeals, holding that the ACM data was, in fact, protected by the Fourth Amendment.

So two states have found Fourth Amendment protection for data on these air bag devices, and one state found no protection. Questions remain.

For one, can a person have an expectation of privacy on a device when they’re unaware of the device and the data it is collecting? According to the Diaz trial court and the dissenting judge in Worsham, a person cannot. And while this makes sense from a layperson’s perspective — how can you have a privacy expectation if you don’t even know something exists? — it’s a dangerous path to pursue in the context of the Fourth Amendment.

This example will illustrate: Assume that a couple has a home built with high-speed internet, the ability to play music throughout the house and backyard, and the ability to remotely control the lights and thermostat. Depending on their technological sophistication, however, they may have little to no awareness of what devices were actually installed to serve these functions, and while they might receive manuals with details, they may not read them any more so than a new car purchaser reads the voluminous manuals provided them, manuals that presumably describe the air bag device. In other words, the couple has as little awareness of devices in their home as they do of the air bag device in their vehicle.

Yet, it’s hard to imagine a court holding that a person has no Fourth Amendment expectation of privacy in their home and that law enforcement could search without a warrant merely because of lack of awareness. The very core of the Fourth Amendment guarantees “[t]he right of the people to be secure in their ... houses ... against unreasonable searches and seizures ... .” In 2001, the Supreme Court clarified that the Fourth Amendment even protects the privacy of a home when law enforcement physically remains outside using a thermal imaging device to monitor radiation of heat from the home, as that was still invasive of a protected space and, therefore, a Fourth Amendment "search." And as the Worsham court noted (quoting the Supreme Court in New York v. Class), a car’s interior is protected from unreasonable intrusions by the police under the Fourth Amendment, although there’s a reduced expectation of privacy in a vehicle when there’s probable cause to search part of the vehicle.

In short, considering the lack of awareness of a device in a private space, such as a home or vehicle, for purposes of assessing Fourth Amendment protection is a dangerous road to pursue. It’s the reasonable expectation of privacy in the space that is key, and it covers all devices within that space, both known and unknown.

The second issue courts have wrestled with is whether one loses Fourth Amendment protection when their actions are exposed to the public. Realistically, however, as the Georgia Court of Appeals noted in Mobley, what’s exposed to the public is not a driver’s actions, but rather the “outward manifestations” of those actions. For example, when a vehicle accelerates, we assume the driver pushed the gas pedal. But acceleration can also occur when a gas pedal gets trapped beneath the floor mat or sticks due to a manufacturer defect; the same “outward manifestation” caused by different actions. Indeed, from a liability perspective, a fatality caused by an inattentive driver accelerating into the rear of another vehicle is vastly different from the same fatality but due to a manufacturer defect.

Finally, courts have pondered the sensitivity of the information captured by these devices. While air bag devices don’t yet collect the level of sensitive/personal information as a cellphone or a GPS device — the focus of recent Supreme Court decisions finding Fourth Amendment protection — "[j]ust as (cellphones) evolved to contain more and more personal information ... the electronic systems in cars have gotten more complex." It’s not hard to foresee a time when these devices begin recording voices. Was the driver distracted by a phone call? Slurring speech, indicating the influence of alcohol or drugs? Given the amount of data currently collected and propensity for data collection to increase over time, courts may inevitably have little choice but to find Fourth Amendment protection for these devices and their data. 

Interestingly, these devices pose privacy challenges beyond law enforcement access. Consider the California Consumer Privacy Act. Given the CCPA’s broad definition of “personal information,” it’s questionable whether vehicle manufacturers/dealers need to comply when selling to California residents, including the right to notice (lack of awareness of these devices having been highlighted in a number of cases), the right to opt out of data collection and, not to mention, the right to deletion.

To borrow a phrase coined more than a decade ago, the “information superhighway” on which our data transits is on a direct collision course with the real-world highways upon which our vehicles drive.

Joel can be contacted at schwarz@globalcyberrisk.com.

Photo by Alex Suprun on Unsplash