During 2018, the hand-wringing demands for “better” protection of online consumers’ privacy (despite the likely costs, some of which we documented here) grew to a fever pitch. Easily forgotten amid the cacophony is data-collecting companies’ own expectation of privacy in their extremely valuable property. A federal court decision last week provides a timely reminder that businesses possess civil liberties too, which they can use to defend against unreasonable government intrusion. The decision also gives local, state, and federal regulators and legislators something to keep in mind as they rush to “do something” about data privacy.
The decision arises from New York City’s attempt to minimize the societal ills that purportedly accompany short-term rentals. Citing the difficulty of enforcing a 2010 city ordinance that prohibits certain rental arrangements, the City Council approved a second ordinance last year requiring all home-share “booking services” to hand over monthly transaction reports. Regulators could then scour the reports for violations of the 2010 law. The 2018 law, which was to take effect on February 2, imposes fines of up to $1,500 for each withheld listing.
Airbnb, Inc. and HomeAway, Inc., whose online platforms arrange short-term rentals in the city, moved last August to preliminarily enjoin the disclosure ordinance, arguing it violated the First and Fourth Amendments of the U.S. Constitution. On January 3, Southern District of New York Judge Paul A. Engelmayer enjoined enforcement of the ordinance on Fourth Amendment grounds.
The plaintiffs argued that New York City’s ordinance unconstitutionally compels them to surrender privacy-protected information. The Fourth Amendment protects information such as a business’s customer data from unreasonable searches and seizures, Judge Engelmayer explained. He cited a number of U.S. Supreme Court decisions in support of that conclusion, including a 2015 ruling, City of Los Angeles v. Patel (which, in an irony we’re sure wasn’t lost on Airbnb, involved an LA law aimed at seizing hotel-customer data).
The court rejected several of the city’s arguments against the Fourth Amendment’s application. First, the individual customers’ own privacy interest in their data did not prevent the plaintiffs from also maintaining a privacy interest. Once it is in Airbnb or HomeAway’s possession, the companies have a strong competitive interest in keeping such data from their market rivals, and an even stronger customer-relations reason for opposing disclosure.
Second, home-sharing platforms don’t operate in a historically “closely regulated industry” whose companies’ business records, the Supreme Court has ruled, are more easily subject to administrative warantless searches. Judge Engelmayer reasoned that since the Court in Patel found that hotels are not closely regulated for purposes of the Fourth Amendment, home-sharing platforms should receive the same treatment.
Third, the platforms’ notice to customers in their privacy statements that their personal data may be disclosed to regulators does not strip Airbnb or HomeAway from their right to claim privacy interests in the business records. The privacy notice affects only the customers’ expectation of privacy, not the company’s.
The court then went on to assess whether New York City’s seizure of the plaintiffs’ records was reasonable, balancing the ordinance’s intrusion of protected interests against the city’s pursuit of a legitimate governmental interest. The ordinance requires the plaintiffs to produce records to the agency, not to an inspector who shows up at the business unannounced, as was the case with the Los Angeles ordinance in Patel. Also, the information sought is set out in meticulous detail, and does not grant regulators arbitrary authority to pursue data at their own discretion. Those two factors, the court explained, weighed in favor of the ordinance being reasonable.
Two factors that weighed heavily against reasonableness, however, were the ordinance’s “breathtaking” document-production demand and its lack of a temporal sunset. The precedents on administrative searches stress that much like a criminal subpoena, laws like New York City’s must be narrowly targeted. The city’s ordinance, Judge Engelmayer stated, is “devoid of any tailoring.” That type of blunderbuss approach could be acceptable in certain circumstances, the court explained, but the city failed to provide sufficient evidence that it could not enforce its ban on certain home sharing through individual seizures. The supposed ease with which Airbnb and HomeAway could supply the records—electronically—did not, in the court’s estimation, mitigate the severity of the city’s privacy invasion.
The final Fourth Amendment nail in the city’s coffin was its failure to provide the plaintiffs with any form of pre-compliance review.
Judge Engelmayer ended his Fourth Amendment analysis with a forceful statement on the ordinance’s “far-reaching implications.” He warned that regulators should not equate the “more ready ability of a modern company whose business is accomplished through cyber communications” with a reduced expectation of privacy. Government regulators eager to bring online businesses to heel should keep the judge’s warning in mind, as should the many businesses that exchange services for information.
Also published by Forbes.com on WLF’s contributor page.