The Fourth Amendment limits the ability of government agents to search for evidence — such as EDR information — without a warrant. It does not apply to searches conducted by private parties who are not acting as agents of the government. However, the fact that the person conducting a search is not a government employee does not mean that the search is “private” for Fourth Amendment purposes. A search by a private party will be considered a Fourth Amendment search if the private party acts as an agent of the government.

The Supreme Court has offered little guidance as to when private conduct can be attributed to the government. Rather, the question turns upon the degree of the government's participation in the private party's activities. The federal Courts of Appeal have adopted a range of approaches for distinguishing between private and government searches. About half apply a totality of the circumstances approach that examines three factors: whether the government knows of or acquiesces to the intrusive conduct; whether the party performing the search intends to assist law enforcement efforts at the time of the search; and whether the government affirmatively encourages, initiates, or instigates the private action. Other Courts of Appeal have adopted more rule-like formulations that focus upon only the first and second factors.

The Fifth Amendment provides that no person “shall be compelled in any criminal case to be a witness against himself.” It has been suggested that the Fifth Amendment's protection against self-incrimination could be invoked as a means of preventing the admission of EDR data at trial. It is this writer's opinion that the admission of EDR information does not violate the Fifth Amendment because by its terms, it applies only to criminal, not civil cases. Furthermore, the only evidence that is shielded by the privilege against self-incrimination is testimonial evidence. Thus, the protection of the Fifth Amendment only exists to shield statements, not data. Accordingly, the Fifth Amendment should not preclude the admission of EDR information in a civil proceeding.

While it could also be argued that the common law of trespass may prevent EDR data from being obtained without the owner's consent, in all likelihood the data can be retrieved as part of discovery in litigation. For instance, Rule 26(b) of the Federal Rules of Civil Procedure provides that “[p]arties may obtain discovery regarding any nonprivileged matter that is relevant to any party's claim or defense …. ” With respect to the nature of the materials that may be obtained under Rule 26, Rule 34(a)(1)(A) allows discovery of “ other data compilations.” This language has been broadly interpreted to include electronic data.

State Statutes

Although there is no federal statute governing access to EDR information, state legislatures have addressed EDR access concerns. Since 2004, 12 states have enacted pertinent laws, while at least eight states have introduced legislation in 2008.

All of the statutes require the vehicle owner's consent to retrieve data. Of the 12 states, three require the consent to be in writing, one places time limits on the consent, and one addresses admissibility. All of these laws have an exception to the consent requirement when data is recovered for research purposes and the identity of the owner is not disclosed. In criminal cases, they all provide that a search warrant overrides the owner consent requirement.

California, Maine, Nevada, New York, and Texas have the most basic forms of EDR legislation, which require that the vehicle owner's consent must be obtained before data can be examined.

On the other end of the spectrum is Arkansas' statute, which is the most restrictive. The Arkansas statute declares that the EDR data is private and that all owners of the vehicle must consent in writing before the EDR data can be accessed. The owner of the vehicle at the time the EDR information is created retains exclusive ownership rights. The statute also states that the “ownership of the data shall not pass to a lienholder or to an insurer because the lienholder or insurer succeeds in ownership to the vehicle as a result of the accident.” Finally, an insurer or lienholder may not make an owner's consent to use EDR data a condition of the policy or a condition of the payment or settlement of an obligation or claim.

Colorado specifies that EDR data is the “personal information of the vehicle owner.” The statute also provides that the vehicle owner has to consent to the release of the EDR data within 30 days of its retrieval.

Connecticut prohibits the alteration or deletion of EDR data or the deliberate destruction of the EDR unless a reasonable amount of time is provided for the police to obtain a search warrant. Notably, the Connecticut statute does not address whether data ownership transfers with the transfer of ownership to a carrier when a car is salvaged.

New Hampshire's statute provides that ownership of the EDR data does not transfer with the transfer of ownership to a carrier when the car is salvaged. Instead of treating the gathering of EDR information as a privacy issue, New Hampshire refers to it as private property. The statute provides that violations “shall constitute an unfair or deceptive act or practice.” This is notable since violation of this statute carries a criminal penalty with a statutory maximum sentence of 12 months.

North Dakota's statute is similar to that of Arkansas', in that exclusive ownership of the EDR information remains with the owner of the vehicle at the time the data record is created and may not be retrieved without the owner's permission. The law states that “[a]n insurer may not require as a condition of insurability consent of the owner for access to data that may be stored within an event data recorder and may not use data retrieved with the owner's consent before or after an accident for the purpose of rate assessment.”

Maine's statute, in addition to requiring the vehicle owner's consent, notes that “[n]othing is this subchapter affects an insured's duty to cooperate as provided in an applicable insurance contract or agreement.”

Oregon requires the consent of all registered owners and provides that the EDR information does not become the property of a lienholder or insurer because the lienholder or insurer gains ownership of the vehicle as a result of an accident. Furthermore, an insurer may not condition the payment or settlement of a claim upon the owner's consent to the retrieval or use of the EDR data or as a condition of providing the policy or lease.

The statute also has specific requirements for criminal versus civil cases. In criminal cases, there is a specific exception for search warrants, which override a lack of owner consent. In civil cases, an insurer may petition a court for an order to retrieve EDR data from a vehicle without the owner's consent if the court determines: (i) the owner of the vehicle has a policy of insurance issued by the petitioning insurer; (ii) the data is necessary to reconstruct the facts of the accident and “to allow the insurer to determine the obligations of the insurer under [its] insurance policy”; and (iii) “an accurate and timely determination of the facts of the accident cannot occur without the [EDR] date.” Since EDR information is supplemental to any accident reconstruction analysis, the petitioning insurer may not be able to satisfy these requirements.

Virginia's statute provides that ownership of the EDR as well as the data it captures survives the salvage transfer of ownership of the vehicle so long as the EDR is not separated from the vehicle. Just like the Arkansas and North Dakota statutes, consent cannot be conditioned upon an insurance cooperation clause since advance written permission to gain access to EDR data is strictly prohibited. The statute also provides that “[t]he failure of an insurer to obtain access to the [EDR] data shall not create, nor shall it be construed to create, an independent or private cause of action in favor of any person.”

Aside from the specific declaration in the Arkansas statute that EDR data is “private,” the Arkansas, New Hampshire, North Dakota, Oregon, and Virginia EDR statutes all refer to EDR data as property with the same ownership rights as tangible property.