Facts
- Shirley Reid worked for Jersey Diesel, which used Donaldson Company’s online ordering website.
- After a workplace dispute on August 24, 2004, Reid argued with the owner and left work.
- Shortly thereafter, someone accessed Jersey Diesel’s Donaldson account, changed the account password, and altered the shipping address to a non-existent address.
- Donaldson recorded the IP address associated with the account changes and provided the IP address to the owner of Jersey Diesel.
- Because only the internet service provider (ISP) could link the IP address to a subscriber, the owner contacted Comcast; Comcast refused to disclose subscriber information without legal process.
- Police obtained a municipal-court subpoena duces tecum to Comcast captioned as a civil matter between the owner and Reid, despite no such case being pending, seeking subscriber information for the IP address.
- Comcast produced subscriber-identifying information linked to the IP address, including Reid’s name, address, and account details.
- Reid was arrested and later indicted for second-degree computer theft.
- Reid moved to suppress the Comcast subscriber information as unlawfully obtained; the trial court granted suppression, and the appellate court affirmed.
Issues
- Whether, under Article I, Paragraph 7 of the New Jersey Constitution, an internet subscriber has a reasonable expectation of privacy in ISP-held subscriber-identifying information linking a person to an IP address.
- If such a privacy interest exists, what form of legal process is constitutionally sufficient for law enforcement to obtain ISP subscriber information without notice to the subscriber.
- Whether suppression is the proper remedy when law enforcement obtains ISP subscriber information through an invalid subpoena.
Decision
- The New Jersey Supreme Court held that internet subscribers have a reasonable expectation of privacy in the subscriber information they provide to ISPs under Article I, Paragraph 7.
- The Court ruled that law enforcement may obtain ISP subscriber information without notice through a properly issued grand jury subpoena.
- The Court concluded that the municipal subpoena used here was defective (including lack of a related proceeding and lack of municipal-court authority for an indictable offense) and could not justify obtaining the records.
- The Court upheld suppression of the subscriber information obtained from Comcast and remanded for further proceedings.
Legal Principles
- Article I, Paragraph 7 of the New Jersey Constitution protects a reasonable expectation of privacy in ISP subscriber-identifying information that links an IP address to a person.
- New Jersey recognizes privacy interests in certain third-party business records (including bank and telephone billing records), and ISP subscriber records are treated similarly for state constitutional purposes.
- The government’s acquisition of ISP subscriber-identifying information requires valid legal process; a properly issued grand jury subpoena is constitutionally sufficient for this category of information.
- Evidence obtained through an invalid subpoena process may be suppressed.
Conclusion
The court recognized state-constitutional privacy protection for ISP subscriber-identifying information and held that, while law enforcement may obtain such information via a proper grand jury subpoena, subscriber data obtained through a defective municipal subpoena must be suppressed.