With all of the NSA / Prism conversation going on I thought I would dig up some case laws around the expectation of privacy in context to government access. There was a pivotal Supreme Court case in 1979 (Smith v. Maryland) where a man robbed a woman and then later harassed her. The police, through the phone company, tracked the numbers he called and used that to later get a warrant to investigate his location. This resulted in him being arrested, etc. The debate was over the legality of the phone "pen register" where it was not implemented via a warrant but just given by the phone company. To this day this is the case law used on behalf of expectation of privacy and records stored with 3rd parties.
Here are the key components of that ruling:
(a) Application of the Fourth Amendment depends on whether the person invoking its protection can claim a "legitimate expectation of privacy" that has been invaded by government action. This inquiry normally embraces two questions: first, whether the individual has exhibited an actual (subjective) expectation of privacy; and second, whether his expectation is one that society is prepared to recognize as "reasonable."Katz v. United States, 389 U. S. 347. Pp. 442 U. S. 739-741.
(b) Petitioner in all probability entertained no actual expectation of privacy in the phone numbers he dialed, and even if he did, his expectation was not "legitimate." First, it is doubtful that telephone users in general have any expectation of privacy regarding the numbers they dial, since they typically know that they must convey phone numbers to the telephone company and that the company has facilities for recording this information and does, in fact, record it for various legitimate business purposes. And petitioner did not demonstrate an expectation of privacy merely by using his home phone, rather than some other phone, since his conduct, although perhaps calculated to keep the contents of his conversation private, was not calculated to preserve the privacy of the number he dialed. Second, even if petitioner did harbor some subjective expectation of privacy, this expectation was not one that society is prepared to recognize as "reasonable." When petitioner voluntarily conveyed numerical information to the phone company and "exposed" that information to its equipment in the normal course of business, he assumed the risk that the company would reveal the information