In Against Data Exceptionalism, Andrew Keane Woods explores “one of the greatest societal and technological shifts in recent years,” 1 Andrew Keane Woods, Against Data Exceptionalism, 68 Stan. L. Rev. 729, 739 (2016). which manifests in the “same old” questions about government power. 2 Id. at 765. The global cloud is an important feature of modern technological life that has significant consequences for individual privacy, law enforcement, and governance. Yet, as Woods suggests, the legal challenges presented by the cloud have analogies in age-old puzzles of public and private international law.
Identifying these connections is a conceptual advance, and this contribution should not be understated. But the most telling statement in Woods’s excellent article comes early on: “Showing that the jurisdictional challenges presented by the global cloud are not conceptually novel does not resolve those problems . . . .” 3 Id. at 735. Data may not be exceptional, and the legal puzzles posed by data sound in existing notions of jurisdiction and conflict of laws. The problem, however, is that existing answers to these puzzles are unsatisfying. They are unsatisfying in that they do not provide clear answers, but instead pose even more challenging normative questions. And they are unsatisfying because some consensus answers sit on shaky normative footing. More satisfying answers, I contend, require attention to institutions, not just laws.
This Essay proceeds as follows. Part I briefly summarizes Woods’s core conceptual argument: the case against data exceptionalism. This claim has much going for it, but it does not provide crisp answers to many of the challenging problems of transnational jurisdiction and conflict of laws. Part II then assesses what Woods’s thesis tells Congress, the courts, and the executive, and it highlights the questions that remain contested when applying his insights. Part III concludes by identifying some ways in which a sensitive institutional account can improve upon existing approaches to these important questions.
I. The Argument
“One of the great regulatory challenges of the Internet era—indeed, one of today’s most pressing privacy questions—is how to define the limits of government access to personal data stored in the cloud.” 4 Id. at 729. Woods begins his treatment of this great regulatory challenge by describing the practical and legal consequences of cloud data. These data present particular challenges because they frequently produce jurisdictional conflicts among interested states. To make matters worse, Woods offers reasons to doubt that existing mechanisms to deal with these conflicts are functioning effectively. 5 Id. at 739-54.
Following this clear-eyed descriptive account, Woods turns to his more pressing task: explaining why we should not treat data as exceptional. Data are intangible, but so are debts. Data are mobile, but so are patents. Data are divisible and fungible, but so is money. And so on. 6 See id. at 756-63 (discussing inter alia the intangibility, mobility, divisibility, and fungibility of data). Indeed, Woods suggests that data cases may be less challenging because unlike intangible assets, data have physical locations. 7 Id. at 760-63. Just ask Apple and the FBI. 8 See, e.g., Katie Benner & Eric Lichtblau, U.S. Says It Has Unlocked iPhone Without Apple, N.Y. Times (Mar. 28, 2016), http://nyti.ms/1XZ3tLn (discussing the FBI’s efforts to unlock an iPhone in the government’s possession).
Having explained why data are not exceptional, Woods examines the unexceptional doctrines of jurisdiction and conflict of laws that bear on data questions. He relies on the international law of jurisdiction to define the scope of substantive law (“prescriptive jurisdiction”) and the reach of courts’ process (“enforcement jurisdiction”). 9 Woods, supra note 1, at 764-73. And he suggests that transnational conflicts over data look like common questions in the conflict of laws, which may be answered through Brainerd Currie’s balancing of governmental interests (“interest analysis”). 10 Id. at 774-80. Because data are not exceptional, these existing doctrines offer a starting point for resolving the regulatory challenges of the global cloud. 11 See id. at 781.
II. The Solutions?
Assuming that the challenges of cloud data are not so dissimilar from longstanding issues in transnational law, Part V of Woods’s article asks the next logical question: “what should be done?” 12 Id. at 781-88. It turns out, however, that asking what should be done under existing approaches raises more questions than it answers. 13 And, as I have argued elsewhere, these data cases serve to highlight the weaknesses that are present in current doctrine. See generally Zachary D. Clopton, Territoriality, Technology, and National Security, 83 U. Chi. L. Rev. 45 (2016). And in so doing, this inquiry highlights reasons to be unsatisfied with the existing approaches upon which Woods’s article relies.
A. Congress
The first recommendation of Woods’s piece is that Congress should apply notions of prescriptive jurisdiction and interest analysis. 14 Woods, supra note 1, at 781-85. The international law of prescriptive jurisdiction provides the circumstances under which a state may “make its law applicable to the activities, relations, or status of persons, or the interests of persons in things.” Restatement (Third) of Foreign Relations Law §§ 401 et seq. Interest analysis is a method to determine the applicable law championed by Brainerd Currie and the Second Restatement of Conflicts. See generally Brainerd Currie, Selected Essays on the Conflict of Law 188 (1963). Although Congress is not obligated to follow jurisdictional and conflict of laws doctrines, 15 See, e.g., Lauritzen v. Larsen, 345 U.S. 571, 578 (1953) (“[International law] is not, as sometimes is implied, any . . . limitation of the power of Congress.”). it might choose to do so as a matter of policy.
Woods is right to identify Congress as a key institution in managing jurisdictional issues with respect to data. But calling on Congress to apply notions of prescriptive jurisdiction and interest analysis is just step one.
Imagine that Congress elects to respect the international law of prescriptive jurisdiction. This means that legislation must be tied to one of the internationally recognized bases for jurisdiction. So far, so good. But international jurisdictional law provides a ceiling, not a floor. 16 This is not news to Woods. See, e..g., Woods, supra note 1, at 764 ([“States] can regulate acts taking place on their soil as well as acts that affect their citizens, regardless of the location of those acts.” (emphasis added)); id. at 769-70 (“‘[A] nation can exercise enforcement jurisdiction only against persons or entities with a presence or assets within its territory.’” (quoting Jack Goldsmith, Unilateral Regulation of the Internet: A Modest Defence, 11 Eur. J. Int’l L. 135, 139 (2000)) (emphasis added)). Calling for Congress to voluntarily comply with international jurisdictional law only begins the conversation about where, beneath that ceiling, the law should reside.
Similarly, Congress could adopt a conflict of laws method, but which one? Woods prefers interest analysis, but other conflict of laws methodologies are regularly practiced in U.S. and foreign jurisdictions. 17 See, e.g., Symeon C. Symeonides, The Choice-of-Law Revolution Fifty Years After Currie: An End and a Beginning, 2015 U. Ill. L. Rev. 1847 (surveying state conflict of laws methodologies). This is not news to Woods either. He frequently observes that conflicts doctrine poses multiple answers to the same question. See, e.g., Woods, supra note 1, at 756-57 (noting multiple approaches to situs for intangibles); id. at 777-78 (criticizing courts unpredictably relying on the “notoriously malleable concept of international comity”). The choice of method requires a normative judgment about policy tradeoffs. Further, even if we assume that Congress would do some sort of interest balancing, it is not clear that Congress should follow interest analysis’s advice for courts. Many conflict of laws decisions are predicated on the institutional position of courts (as distinct from legislatures), 18 See, e.g., Larry Kramer, Rethinking Choice of Law, 90 Colum. L. Rev. 277 (1990) (approaching choice of law in light of a conceptualized bargain among state lawmakers). and it would not be unreasonable to suggest that Congress should have wider berth in defining the nature and scope of the interests to be balanced. 19 Cf. Zachary D. Clopton & P. Bartholomew Quintans, Extraterritoriality and Comparative Institutional Analysis: A Response to Professor Meyer, 102 Geo. L.J. Online 28 (2013) (suggesting reasons to give weaker extraterritorial effect to common-law rules than statutory ones).
Woods’s application of his general insights to the Electronic Communication Privacy Act (ECPA) highlights these challenges. Woods suggests that Congress should reform ECPA to remove its “blocking statute” effects. 20 Woods, supra note 1, at 781. Putting aside the hazy boundary between disrespectable blocking statutes and legitimate expressions of substantive preferences, there is much to like in Woods’s proposal. But it must be acknowledged that it depends on normative priors. Woods writes that “the aim of these [proposed] requirements is not to dictate as a normative matter how such requests for data ought to be processed, but rather to design the system to maximize appreciation of state interests and minimize conflicts.” 21 Id. at 782. This, of course, is a normative statement in itself—it is not a foregone conclusion that the law should “maximize appreciation of state interests and minimize conflicts.” 22 Id. This goal may be even less important for legislatures than for judges (for whom minimizing conflicts also has a separation of powers justification). See infra Part III. Moreover, the proposed four-pronged test is just one conflicts approach to answering these questions—other conflicts models may select other factors, or may give them different weights. This approach is only justified if it coheres with background normative commitments not fully developed herein Woods’s article.
Returning to the general, Woods is correct to suggest that Congress should balance foreign and domestic interests. And centuries of conflict of laws thinking may provide Congress with helpful ways to address these issues. But merely labeling this as a conflicts problem does not actually balance the competing interests for ECPA amendments or other related regulatory challenges. Instead, it poses normative questions that demand normative theories (and perhaps substantial amounts of empirical data).
B. The Courts
Recognizing that Congress may not rewrite ECPA immediately, Woods’s second recommendation suggests how courts should resolve disputes regarding ECPA’s reach. Again, Woods’s institutional diagnosis is spot on. Courts frequently need to interpret statutes where the intended territorial reach is unclear. To answer this question, Woods reasonably proposes a three-step approach applying a presumption against extraterritoriality: (1) does the statute have extraterritorial reach?; (2) are these data in fact extraterritorial?; and (3) how should interest analysis affect the decision? 23 Woods, supra note 1, at 785-86.
Woods makes an important contribution in identifying the proper questions, but current approaches to each question produce inconclusive answers. First, even if we accepted that the presumption against extraterritoriality is the optimal tool of statutory interpretation, different jurists apply the presumption differently. 24 Consider the multiple opinions in Morrison v. National Australia Bank Ltd., 561 U.S. 247 (2010), and Kiobel v. Royal Dutch Petroleum, 133 S. Ct. 1659 (2013), especially in light of the Court’s changing composition. And, as I have explained elsewhere, this presumption rests on weak normative footing. 25 See generally Zachary D. Clopton, Replacing the Presumption Against Extraterritoriality, 94 B.U. L. Rev. 1 (2014). Instead of resting on existing doctrine, perhaps the salience of data cases could spur efforts to reform this doctrine.
The second question is whether these data should be treated as extraterritorial. Reasonable minds differ over whether these data are extraterritorial under the Supreme Court’s decision in Morrison v. National Australia Bank. 26 561 U.S. 247, 266-69 (applying the presumption against extraterritoriality only when the conduct comprising the “focus” of the statute is extraterritorial). Indeed, that is what the tech companies and government lawyers are fighting about in these cases. 27 See Woods, supra note 1, at 731-32 (describing litigation). And, again, it is far from clear that Morrison’s approach to this question is the right one. 28 See, e.g., Lea Brilmayer, The New Extraterritoriality: Morrison v. National Australia Bank, Legislative Supremacy, and the Presumption Against Extraterritorial Application of American Law, 40 Sw. L. Rev. 655 (2011) (criticizing the indeterminacy of Morrison); Clopton, Replacing, supra note 25 (same).
Third, although Woods’s suggestion that courts apply interest analysis to federal statutes has intuitive appeal, it stands in marked contrast to the way that the Supreme Court has answered these questions in recent cases. As Caleb Nelson put it, “[w]hen the modern Supreme Court invokes the ‘presumption against extraterritoriality,’ . . . it does not appear to have current choice-of-law jurisprudence in mind.” 29 Caleb Nelson, State and Federal Models of the Interaction Between Statutes and Unwritten Law, 80 U. Chi. L. Rev. 657, 721-22 (2013). Nelson speculates that this reflects the “fragmented” state of current choice-of-law jurisprudence or the Supreme Court’s “distaste for the content of that jurisprudence.” Id. at 722. Neither sounds good for Woods. So Woods’s suggestion to apply conflicts law to this dispute would require a significant departure from current law.
Even assuming that conflict of laws analysis applied, the focus on reciprocity is a bit startling. 30 Woods, supra note 2, at 778 (suggesting that a reciprocity rule “could easily be applied to the context of cloud data”). For one thing, most U.S. jurisdictions do not apply reciprocity to foreign judgments, and even in those jurisdictions that do, reciprocity is not applied to the interpretation of federal statutes or to the reach of U.S. legal instruments. 31 See Gary B. Born & Peter B. Rutledge, International Civil Litigation in United States Courts 1094-1102 (5th ed. 2011). So at a minimum, this proposal is beginning to look a little exceptional. Moreover, the decision whether to adopt a reciprocity rule has many characteristics of classically political issues left to the political branches. 32 Zachary D. Clopton, Judging Foreign States, 94 Wash. U. L. Rev. (forthcoming 2016). The mere fact that reciprocity exists as a matter of judge-made law in some jurisdictions does not resolve the political question whether it is the normatively preferable approach. 33 Woods also suggests that his conflicts analysis is valuable because it can deliver outcomes that are “the same across service providers.” Woods, supra note 1, at 786. But as noted above, conflicts doctrine is not uniform. Indeed, interest analysis likely would be less predictable than clear rules against which parties could negotiate. This is not to suggest that rules are preferable to standards in this area. See Clopton, Territoriality, supra note 13, at 62-63 (suggesting that standards may be preferable in some cases involving technology). But arguments for standards rely on more than predictability.
C. The Executive Branch
Woods’s last two recommendations are that mutual legal assistance (MLA) procedures should be strengthened and that calls for a global treaty should be resisted. 34 Woods, supra note 1, at 786-88. At the risk of sounding like a broken record, there is a lot to like in these proposals and in their implicit institutional analysis—the executive branch must be central in making and executing policy in transnational law enforcement.
I will add only a brief comment. Although Woods’s proposed MLA reforms seem facially reasonable, 35 See id. at 786-87. it would be unfair to suggest that they are costless. Each proposed reform creates direct costs and opportunity costs. 36 See id. Arguably they present tradeoffs with respect to security as well: query whether digitization, increased staff, and transparency increase the risk of unintended disclosures. Devoting resources to MLA reform means that we are taking resources from another project, and it is not obvious that MLA is the top priority for limited government resources. Indeed, given how “straightforward” these proposals seem, 37 Id. at 787. it would not be unreasonable to think that executive actors have eschewed these reforms because they consciously defined other priorities. For better or worse, answering these questions of law-enforcement resource allocation is canonically an executive-branch function.
III. An Institutional Approach
The foregoing review has suggested that even if legislative, judicial, and executive actors accepted international principles of jurisdiction and conflict of laws, we should expect to face many unanswered questions calling out for normative judgments. Organizing this review around the three branches was intentional. An institutional analysis centered on the separation of powers informs these normative judgments by suggesting which branches should answer these questions and how they might go about doing so. 38 Federalism also may have something to say about these proposals, but that is beyond the scope of this Essay. See Clopton, Judging Foreign States, supra note 32.
First, the separation of powers suggests a division of labor between the work of courts resolving bilateral disputes and the work of the political branches making system-wide, polycentric choices. 39 Id. This division reflects considerations of both institutional authority and institutional capacity. 40 Id. As applied to questions in Woods’s article, that means we should look to Congress and the executive branch to define the extraterritorial reach of SCA warrants, provide reciprocity rules, or invigorate MLA efforts. Or not—the political branches could exercise their institutional prerogatives to decline these invitations, and those decisions would reflect normative commitments that are the product of their institutional judgment. 41 Notably, the separation of powers does not shut out international law—it just filters its influence through an institutional analysis. See id.
Second, the separation of powers does not imply three hermetically sealed branches. Particularly given the complex, evolving questions at the intersection of national security and technology, reforms that promote inter-branch coordination could be encouraged. 42 See Clopton, Territoriality, supra note 13, at 62-63. This logic favors coordinated approaches to stored communications and surveillance authorities, and disfavors doctrines that call for one or more branches to abdicate their role in the separation of powers. 43 Id. And, again, it calls upon the branches to take up their shared-but-differentiated responsibilities in keeping with their institutional authorities and capacities.
Finally, this separation of powers analysis calls back to the initial question regarding data exceptionalism. Woods is probably correct that many data cases are not exceptional. However, our separation of powers structure implies that this is a question ultimately posed to the political branches (within constitutional limits). So even if data cases should not be exceptional, that does not mean that Congress cannot pass laws that treat them as such, and it does not mean that executive officials cannot make decisions about priorities with data exceptionalism in mind. For better or worse, policy choices have created countless exceptions in the face of arguments against exceptionalism: foreign defamation cases are exceptional for judgment recognition; 44 See 28 U.S.C. § 4102 (2013). Cuban citizens are exceptional in immigration; 45 See 8 U.S.C. § 1255 (2013). Washington, D.C., is exceptional in the Constitution; 46 See U.S. Const., amend. XXIII. and a single case against the Central Bank of Iran is exceptional for foreign sovereign immunity. 47 See 22 U.S.C. § 8772 (2013); see generally Bank Markazi v. Peterson, 136 S. Ct. 1310 (2016) (describing this statute and confirming its constitutionality).
Woods argues ably that policymakers should not elect to create data exceptions. I hope that they are listening. But this is just the first step in a process of policymaking that is—and should be—governed by unexceptional institutional relationships.
* Assistant Professor of Law, Cornell Law School. Special thanks to Kevin Clermont and Rebecca Ingber for their feedback on this essay. All errors are mine.