Montana Becomes First State To Close the Law Enforcement Data Broker Loophole

Montana has enacted SB 282, becoming the first state to prohibit law enforcement from purchasing personal data they would otherwise need a warrant to obtain. The landmark legislation closes what privacy advocates call the "data broker loophole," which previously allowed police to buy geolocation data, electronic communications, and other sensitive information from third-party vendors without judicial oversight.

The new law specifically restricts government access to precise geolocation data, communications content, electronic funds transfers, and "sensitive data" including health status, religious affiliation, and biometric information. Police can still access this information through traditional means: warrants, investigative subpoenas, or device owner consent.

Wrong solution to the problem

[Mononymous]

If it shouldn't be legal for law enforcement to get that data without a warrant, why the hell is it legal for the data brokers to buy and sell it?

And...

[ebunga]

Those data brokers will happily sell your data to hostile foreign intelligence services that will use those same targeting methods to get you to be an unwitting accomplice in something nefarious, or just outright murder you because your wrote a skeet talking negatively about their beloved dictator, or maybe it's just some overseas scammer trying to do a bit of sextortion against your children

Or perhaps the databroker is really just a dirtbag who started an adtech company to legally stalk his victims as they

Re:Wrong solution to the problem

[VertosCay]

If it shouldn't be legal for law enforcement to get that data without a warrant, why the hell is it legal for the data brokers to buy and sell it?

Good question. If it's freely available why is LE the only ones being restricted? I'd much rather they had it than the insurance and advertising industries.

Re:

[NotEmmanuelGoldstein]

... insurance and advertising ...

You're forgetting the Proud Boys buying this data, then impersonating police officers to conduct "wellness checks" and kidnap their victims.

Re:Wrong solution to the problem

[fwc]

I don't disagree with your sentiment.

However, the reason it's legal is that we often give away permission to do so without even knowing it. For example, the slashdot terms of service include:

"By sending, uploading, displaying, posting or transmitting Content to any area of the Sites, you grant us and our subsidiaries, affiliates, agents, employees and designees a worldwide, non-exclusive, sub-licensable (through multiple tiers), assignable, royalty-free, perpetual, irrevocable right to link to, reproduce, distribute (through multiple tiers), adapt, create derivative works of, publicly perform, publicly display, digitally perform or otherwise use such Content in any media or site now known or hereafter developed. You further hereby grant Company permission to display your logo, trademarks and company name on the Sites and in press and other public releases or filings. Further, by submitting Content to the Company, you acknowledge that you have the authority to grant such rights to the Company."

and:

"Slashdot Media may assign, transfer or sub-license this Agreement without your consent and without notice to you."

The problem is that these terms are often buried in a big legal agreement which itself is buried on a website or something you click through without thinking.

Whether this should be legal or not is one of those things that I'd have a fairly easy time arguing either side of. On one side, part of the bargain you make to use a site like slashdot for free is to see advertisements and have your data scraped. On the other side, I don't think many of us really want our cell companies selling our geolocation data. The question is where should the line be drawn and what should or should not be legal.

Note that in the US we generally have laws that prohibit this type of thing for medical records (HIPAA) but for non-medical records there are few if any protections. I'd argue that there needs to be more protection. I also realize that in order to not have to pay (or in order to pay less) for certain services that those services being able to sell certain datasets derived from my usage of those services is required.

Re:

[JustNiz]

The terms around the transferring or selling of personal data without consent shouldn't ever be legal in the first place either,

Re:

[bobby]

^^^ This ^^^^

And the laws need to firmly prevent anyone ever putting in any TOS or contract that "by using this service you consent to ..."

It needs to be 100% illegal.

And even if you do give consent to someone to share your identity / data, it must never be allowed that there's any kind of automatic chain of inherited consent.

I have some things in a storage locker. They just sent out modifications to the contract, including that I now have given them consent to share / sell any and all information they have

Contract

[JBMcB]

Because when you signed up for whatever thing you signed up for, you agreed to let them sell your data.

You could outlaw that practice, but you'll have to figure out how to unwind hundreds of millions of contracts equitably. Also, if Montana did this unilaterally, I'm guessing the easiest solution for most companies would to simply stop doing business in Montana, as it's not a huge market.

Re:Contract

[Inglix the Mad]

Actually that's fairly simple, a GDPR style law and you have 3 years to unwind contracts. I mean, this isn't rocket science and most consumer contracts are less than 3 years. Car companies (and similar) can have longer contracts, but honestly if they have 3 years to change things there's not an excuse there either in a financial / legal / technical sense.

The only reason it's "difficult" is because companies want to pretend it is difficult. They also like to make it so it only takes an askance click to sign up for a service, but takes you hours to get that same service canceled.

We've spent over 50 years creating the legal fictions that have led to companies having more rights than people... it's time for that to end.

Re:

[Z00L00K]

I agree - make it illegal to sell personal data instead.

Re:

[mspohr]

Good point.
Of course, our tech overlords have bought and paid for all the politicians so nobody will stand up to them.

Because Americans have different priorities

[rsilvergun]

Besides data privacy. At least when they are voting for a politician.

Some of those priorities are economic. And a lot of them are dumb culture war issues.

Fixed the economy and get people to stop freaking out about moral panics and you can have privacy rights. That's more or less how Europe has gotten as far ahead of us. Their economies tend to do better for rank and file voters (note the qualifier if you are extraordinarily wealthy you do better in America) and they don't fall for moral panics quite as often as we do.

Re:

[ihavesaxwithcollies]

If it shouldn't be legal for law enforcement to get that data without a warrant, why the hell is it legal for the data brokers to buy and sell it?

Because the system is rigged against you. The american people voted for a nepotistic son of a slum lord that thrived off free government money to amass wealth. The orange turd is and has always been part of the system doing the rigging.

Re:

[flink]

If it shouldn't be legal for law enforcement to get that data without a warrant, why the hell is it legal for the data brokers to buy and sell it?

Any law that Michigan could make restricting the selling of that information would probably bump up against the Commerce Clause and get struck down. Even if they could make a restriction on the sale stick, brokers with no physical presence in Michigan could still sell to Michigan cops. The one thing that they have total control over is their own police, so restraining them from using that information without a warrant at least preserves civil liberties in the face of the lack of de facto privacy.

Legislatures

[hierofalcon]

This would be a good law to see the federal government and all state legislatures pass. Too bad Congress is wasting time renaming the Gulf of Mexico.

Re:

[Inglix the Mad]

Better watch out, the GQP might get mad you didn't call it GULF OF 'MURICA! and send some "agents" wearing facemasks and no ID to black bag you without an arrest warrant. After that they'll ship you to Egypt or El Salvador without so much as a hearing.

Well if DJT gets his way, it won't matter even if you are an American citizen.

Good

[Waffle Iron]

The fuzz has no business knowing whether I'm a dental floss tycoon.

Re:

[davidwr]

The fuzz has no business knowing whether I'm a dental floss tycoon.

Was your grandfather Rufus Mayflower?

Workaround

[davidwr]

A local or state cop is investigating a case but he can't quite justify a warrant, but he's all but sure the guy is guilty. And oh by the way, the internet was involved somehow, making it technically a federal crime too, "because internet" (technically, "because interstate commerce," but I digress).

He calls up his friends at the federal prosecutor's office and says "Can you take this case? I've done most of the legwork but I'm stymied by this state law that says I can't buy data from a data broker and I c

Re:

[techno-vampire]

There's a much better, far stronger reason to abolish this practice at a national level: buying this data from a broker without a warrant is a clear violation of the Fourth Amendment. If you can't get a judge to sign a warrant, you're not entitled to the data, period, end of discussion. And, this is exactly the type of case where the current SCOTUS would love to take your side because the Executive Branch, in it's job of law enforcement, is trying to chip away at the powers of the Judicial Branch and ext

I could argue myself even if it was used

[sentiblue]

Selling private data is a crime. Buying it is supporting such crime. Say the cops bought data that incriminates me. I can easily disqualify that data based on the fact that the transaction was illegal to begin with, not to mention cops engaged in trading illegal products with criminals. Plus, there's no guaranteed that because someone wanted money, could have made up random data and sold to the cops for a buck. If a cop presents such evidence to incriminate me, I'll demand the court to place that cop under arrest for engaging in criminal behavior in order to prosecute. That's the definition of malicious prosecution, a crime that puts DAs in jail.

Congrats Montana you missed the point

[thegarbz]

Why is the data for sale at all? How about this, instead of restricting the government from buying the data, how about you restrict the data horders from selling it.