Three: Finally, Senator Paul is entirely right that we need legal privacy protections that evolve with modern technology and societal views of what should be private. As a self-proclaimed constitutionalist, however, he should understand how the Framers thought this evolution should occur. In the Fourth Amendment, they gave us a core of protection from government intrusion on specific, intimate privacy interests — our physical persons, our homes, and our private papers and effects. But that core of protection is only the bare minimum of what we now call our “privacy” rights; it was never meant to be the totality of those rights.

We were always meant to have additional privacy protections beyond the Fourth Amendment. But those protections are supposed to be enacted by Congress, which can weigh competing concerns and strike the right balance between liberty and security. They are not supposed to be judicially manufactured by pretending that the Fourth Amendment is “organic” and that it says things it plainly does not say.

Section 215 of the PATRIOT Act attempts to strike the right balance. Even though the Supreme Court has said phone data are not protected by the Fourth Amendment, and therefore that investigators could scrub it for all kinds of personal information without violating the Constitution, Section 215 sharply limits the government. Investigators may only collect metadata, not scrutinize it, and they are prohibited from collecting personal identifying information. If they want to scrutinize the data, they must have just cause (e.g., known terrorist phone numbers calling various other numbers) and they must follow strict court-imposed rules for conducting their search — rules that are designed to minimize the chance that innocent people’s records will be analyzed. And they must destroy data periodically to minimize the amount of time the records of innocent people are retained.