More Regulation, Stronger Investigations and Home Tech Devices Concerns to Come in 2020, New Gibson Dunn Report Warns

One trend that started in 2019 that will carry over into 2020, Southwell says, is the attention paid to passive listening devices — smart speakers, Internet-connected home video surveillance products and other connected in-home "Internet of Things" devices. "As those technologies become more wide-spread in usage, the privacy and cybersecurity issues will become more significant," he says.

AI and facial recognition will also be a focus this year, according to Southwell, "both in terms of their use and the risks related to privacy and cybersecurity, which will in turn likely generate more interest and attention by legislators and regulators."

On the judicial front, the report cites several important privacy and security litigation from 2019, but Southwell notes that we're still feeling the effect of is the U.S. Supreme Court's 2016 ruling in Spokeo, Inc. v. Robins, 136 S.Ct. 1540, in which the Court found that a plaintiff suing in federal court must allege an injury that is "particularized" and "concrete," rather than speculative. That case, Southwell says, "continues to have a dramatic effect on privacy cases with a deepening circuit split."

Biometrics and Cellphone Data

The report mentions that several court decisions have addressed the issue of accessing personal data stored on cellphones and how "courts have reached divergent conclusions regarding the Government's authority to demand that an individual provide biometric input (such as pressing their fingerprint) to unlock digital devices." For example, in one case, In the Matter of the Search of a Residence in Oakland, 354 F. Supp. 3d, 1010, 1013 (N.D. Cal. 2019), an application for a warrant to search electronic devices included the authority for a person present during the search to provide biometric data to unlock the devices. The court denied the application, saying that forcing the person to provide the biometric data is like forcing a witness to testify and thus a violation of the Fifth Amendment. However, in In the Matter of the Search Warrant Application for the Cellular Telephone in United States v. Anthony Barrera, No. 19 CR 439, 2019 WL 6253812 (N.D. Ill. Nov. 22, 2019), the court compared providing biometric data to providing blood or handwriting samples, which courts have routinely held to be non-testimonial.

State Privacy Legislation

The report points out several state privacy laws either in effect (the California Consumer Privacy Act (CCPA)) in process (Nevada, Maine, NY) or coming soon (Washington, Florida, Texas, Massachusetts, New Jersey, Virginia, and New Hampshire). All of these state laws share the fundamental concept that "privacy protections is a significant area of focus for state legislatures, particularly in light of the absence of comprehensive federal legislation," Southwell says. "Each law is focused on addressing privacy issues in different ways and they are not simply CCPA copycats."

And so what about the possibility of a federal privacy regulation in 2020? "At this point, I don't believe there's a reasonable prospect of a federal privacy statute," Southwell says, "in part because of the difficulty in passing any legislation in today's political environment and in part due to the complex nature of privacy legislation, with many different interests at play and an absence of clear political priorities."

*****

Steven Salkin, Esq., is the Managing Editor of Cybersecurity Law & Strategy. He can be reached at [email protected] and on Twitter @ljn_online.