MONTPELIER — How much privacy should Vermonters expect in a world brimming with new technology?
The Senate Judiciary Committee is trying to determine exactly that.
The committee held the first of four pre-session hearings Tuesday to consider an omnibus privacy bill that addresses four major privacy concerns and could include more by the time lawmakers finish their work.
The bill, S.18, looks to regulate the use of drones and license plate readers by law enforcement, and to require police to obtain warrants before a company can release electronic data. It also looks to establish “a private right of action” for people whose health care records are improperly released.
Allen Gilbert, executive director of the American Civil Liberties Union of Vermont, warned the committee that the state’s laws must be updated to match technology that did not exist in 1986, when the federal Electronic Communications Privacy Act was passed.
“It has gotten to the point where if something is not done with the statutes, privacy as we’ve known it for a long time … is really going to become a very different thing,” he said.
Gilbert said California Gov. Jerry Brown signed a bill into law last week that establishes a warrant requirement for law enforcement officers when they want to obtain electronic communications records. Vermont should follow suit, he argued.
“As more states move away from just the federal law … Vermont is in a very good position to carve out more protections, because we’ve been kind of doing that for a long time,” he said.
Legislative attorney Erik FitzPatrick said law enforcement, under the federal law, needs a warrant to obtain the contents of an email or other electronic communication within the first 180 days of its creation but can get the same information after that time frame with only a subpoena — which can be issued by a judicial officer and doesn’t require a finding of probable cause that someone has committed a crime.
The bill under consideration would require a warrant even after 180 days, he said.
Metadata — including who sent an electronic communication, who received it, the time it was sent and the location from where it was sent — can currently be obtained without a warrant, FitzPatrick said.
“I didn’t even know there was such a thing as metadata until today,” said the committee’s chairman, Sen. Dick Sears, D-Bennington, highlighting how far technology has advanced.
David Cahill, executive director of the Department of State’s Attorneys and Sheriffs, brought up three cases in which women were killed. He said all three cases were solved with electronic communication data “obtained by the state using, at the time, the appropriate legal process.”
Cahill said requiring police to obtain warrants for such information could inhibit investigations.
“This is how we solved murders, this is how we solve sexual assaults, this is how we solve child endangerment cases,” he said.
The legislation would also require a warrant for police to use information gathered with a drone.
Public Safety Commissioner Keith Flynn said his department, including the Vermont State Police, does not currently have any drones, but “there are real uses” for them. They would be helpful in cold-weather rescue situations, for example, he said.
“Rather than sending troopers down when it’s 21 below zero, it would be nice to have an unmanned aircraft,” he said. “It’s about saving people.”
Lawmakers said they realized the bill may not go far enough in protecting the privacy of people from commercial or private use of drones. FitzPatrick said the federal government likely has authority over that and is currently developing regulations on the use of drones outside of law enforcement.
“I think people’s expectation of privacy is certainly impacted by that. We’re doing a bill on privacy,” Sears said. “I’m just thinking of all the different expectations that people have in their backyards.”
“There is nothing that prevents people from using whatever,” he added.
Sen. Tim Ashe, D-Chittenden, who sponsored the bill along with Sen. Joe Benning, R-Caledonia, said drone use outside law enforcement was not considered.
“We were focusing on the law enforcement access to it, but the public’s interest is exploding around it,” Ashe said.
The use of automated license plate readers by law enforcement was also discussed. The bill proposes that any data gathered by the devices be deleted after 90 days. Current law allows law enforcement agencies to keep the data for 18 months.
The current time frame was set to expire July 1, but lawmakers extended it until July 1, 2016, to allow more time to consider an appropriate length. Several law enforcement officials testified Tuesday and said there is no issue with the 18-month time frame.
“We’d probably prefer to keep it where it is, but we understand there’s concerns about the length of the retention period,” Flynn said.
He said having a governance policy in place about how the data is used is more important than the length of time it is kept.
“It’s how we’re going to govern that and how we’re going to use that information and balance the privacy interests of people using our highways and legitimate law enforcement use,” Flynn said.
“As of today we’re not aware of any problems that have occurred as a result of the 18-month period,” he said. “… I guess I’m trying to get an understanding of what the 90 days is trying to fix.”
Lt. Kevin Lane, director of the Department of Public Safety’s Intelligence Center, said 67 automated plate readers are being used by 42 law enforcement agencies in Vermont. They have read 6.3 million license plates since Jan. 1. Last year they read about 8.3 million.
The department has had 134 requests for information so far this year and information was returned on 24 of those requests, which included investigations into attempted murder, burglary and terrorism, Lane said.
“It’s just a mammoth amount of information,” Sears said.
Benning said he was struggling with the amount of money the state is investing in automated plate readers compared with what it is getting in return.
Flynn said the devices have an investigative value that can’t be measured and storing the data for 18 months can help solve crimes that sometimes take time to come to light.
“Sometimes you don’t even know a murder has occurred until sometime afterward,” he said. “What’s the value you put on potentially solving a homicide, a murder?”
Existing law requires automated plate readers to be used by police only for “legitimate law enforcement purposes.” The officers must also be certified by the Vermont Criminal Justice Training Council before being allowed to use them. The data gathered is exempt from public records requests.
The use of body cameras by police is not contemplated in the bill, but Sears said it is a concern that may need to be addressed to protect video that captures victims, including domestic violence victims.
“You’ve now filmed the victim of domestic violence,” he said. “Generally, Vermont media has been very careful about not identifying victims of domestic violence. That doesn’t mean YouTube would.”
Sears indicated a provision could be added to determine how video captured by body cameras would be handled.
The committee is expected to hold at least three more hearings on privacy this month. Sears said he hopes to have a bill on the Senate floor very early in the legislative session, which begins in January.
Read the proposed legislation below: