By Barry Friedman & Danielle Keats Citron

Working hand-in-hand with the private sector, largely in a regulatory vacuum, policing agencies at the federal, state, and local levels are acquiring and using vast reservoirs of personal data. They are doing so indiscriminately, which is to say without any reason to suspect the individuals whose data they are collecting are acting unlawfully. And they are doing it in bulk. People are unlikely to want this personal information shared with anyone, let alone law enforcement. And yet today, private companies are helping law enforcement gather it by the terabyte. On all of us. Our thesis is straightforward: the unregulated collection of this data must cease, at least until basic rule-of-law requisites are met. Any collection must be authorized by democratically accountable bodies. It must be transparent. It must be based on clear proof of efficacy (that a legitimate purpose actually is being served). There must be protections that minimize or avoid harms to individuals and society. And, of course, there must be judicial review of whether indiscriminate bulk data collection is constitutional, either at all or with regard to specific programs. The basis for this thesis is a first-of-its-kind review of instances, from the dawn of the Information Age, in which Congress acted on these very issues. Much of that history involves indiscriminate collection of data on Americans for reasons of national and domestic security, because national security represents the outer bounds of what law enforcement and intelligence agencies are permitted to do, and much of what is done in the name of national security is inappropriate for domestic policing. Yet, in incident after incident, Congress made clear that indiscriminate bulk collection of Americans’ data is unacceptable, unlawful, and of dubious constitutionality. To the extent that such collection was permitted at all, Congress demanded the very requisites specified above. Today’s indiscriminate bulk surveillance by federal, state, and local policing agencies violates virtually all of these congressionally established norms. It should cease, at least until the rule-of-law requisites are met. 

Virginia Law Review [Vol. 110:1351 2024.