Georgia Supreme Court Rules Police Must Get Warrant to Access Personal Data Cars Store

ATLANTA — The Georgia Supreme Court today ruled that police must obtain a warrant in order to download data stored in a car’s computer systems during an investigation after a car crash. This is the first state supreme court to recognize the danger of warrantless access to the unprecedented types and quantities of personal data collected by modern cars. The ruling came in Mobley v. State, a case challenging the police’s warrantless search and seizure of data collected in a car’s Event Data Recorder, also known as a vehicle’s “black box.”

The American Civil Liberties Union, along with the ACLU of Georgia and digital privacy expert Riana Pfefferkorn, appeared as a friend-of-the-court in the case to argue for warrant protections for the sensitive data cars are increasingly collecting on drivers and their passengers.

“Police should not be able to conduct warrantless searches of computers, even if that computer happens to be on wheels,” said Nathan Freed Wessler, staff attorney with the ACLU’s Speech, Privacy, and Technology Project, who argued on behalf of amici before the Georgia Supreme Court. “This ruling brings the law decades forward to help ensure that the troves of personal information cars now collect on us are protected from warrantless searches. Other states should follow Georgia’s lead to protect our privacy in the digital age.”

The personal data stored in vehicle “black boxes” includes granular information about the function and operation of a car. Black boxes are also connected with other parts of vehicles’ computer systems, which can reveal cellphone contacts, music preferences, detailed location history, and other sensitive data. To justify warrantless access to this information, the state had cited U.S. Supreme Court cases dating back to the early 20th century that hold that police do not need a warrant to search a car for physical items.

The ACLU responded that the U.S. Supreme Court recently made clear in Riley v. California and Carpenter v. United States that older rules permitting warrantless searches for physical items cannot be automatically extended to searches of digital data. Courts must assess people’s privacy interest in this data, and ensure that the warrant requirement is robustly enforced.

The ruling is here: https://www.gasupreme.us/wp-content/uploads/2019/10/s18g1546.pdf.

An ACLU blog post on the case is here: https://www.aclu.org/blog/privacy-technology/surveillance-technologies/our-cars-are-now-roving-computers-fourth-amendment.

The amicus brief filed by the ACLU, ACLU of Georgia, and Riana Pfefferkorn, who is affiliated with Stanford’s Center for Internet and Society, is here: https://www.aclu.org/legal-document/mobley-v-state-amicus-brief.