The House Judiciary Committee has unanimously approved the Email Privacy Act (EPA), which would update the Electronic Communications Privacy Act (ECPA) to, among other things, require the government to get a warrant to access emails, social media posts and other online content stored by internet service providers and other email service providers—like Google.
And in a nod to the permanence of cloud storage, eliminates the 180-day sunset on stored communications. Previously a warrant was not required for communications stored beyond 180 days.
The vote was 28 to 0.
Reforming ECPA has been a priority for committee chairman Bob Goodlatte (R-Va.). A legislative hearing on the bill was held in committee last December. “The Email Privacy Act modernizes ECPA to ensure it keeps pace with ever-changing technologies. These updates to the law protect Americans’ constitutional rights and provide law enforcement with the tools they need to protect public safety," Goodlatte said following its passage out of committee.
The bill updates the 1986 Electronic Communications Privacy Act and, according to the committee, specifically does the following:
"Warrant requirement: The bill creates a uniform warrant standard for law enforcement to obtain the content of communications in criminal investigations. ECPA warrants will continue to be executed with the provider since, as with any other third-party custodian, the information is stored with them. It allows the provider to notify its customers of receipt of a warrant, court order, or subpoena, unless the provider is court ordered to delay such notification.
"Remote Computing Services: The bill maintains current law that delineates which remote computing service providers – or cloud providers – are subject to the warrant requirement for content in a criminal investigation."
ECPA has traditionally imposed heightened legal process and procedures to obtain information for which the customer has a reasonable expectation of privacy, namely emails, texts, photos, videos and documents stored in the cloud.
"Allows Law Enforcement to Access Public Information: ECPA currently makes no distinction between content disclosed to the public, like an advertisement on a website, versus content disclosed only to one or a handful of persons, like an email or text message. The result is that law enforcement would be required to obtain a warrant even for publicly-disclosed content. The bill clarifies that commercial public content can be obtained with a process other than a warrant.
"Maintains Congress’s investigative power: The bill clarifies that nothing in the law limits Congress’s authority to subpoena information from third parties in furtherance of congressional oversight."
Passage of the ECPA reform drew praise from industry and civil society quarters.
New America’s Open Technology Institute, which had joined with various groups to urge passage, was understandably pleased at the unanimous approval, though it said the bill was not all it wanted in terms of privacy protections.
"While the latest version of the bill is not perfect and eliminates some important protections that we supported," said OTI senior counsel Ross Schulman, "the new bill still marks a large step forward. OTI calls on the full House, as well as the Senate, to move forward with this bill that has already garnered the support of over 300 cosponsors."
"Every single American will enjoy greater privacy protection in their personal communications with the passage of the Email Privacy Act," said Center for Democracy & Technology VP of Policy Chris Calabrese. "It's a huge step forward to bring the same protections we enjoy in our homes to our digital lives. With such overwhelming support, the House should move quickly to vote for and pass this essential bill."
"Today’s vote in the House Judiciary Committee approving the Email Privacy Act moves us that much closer to updating the woefully outdated thirty-year old Electronic Communications Privacy Act,” said Information Technology Industry Council president Dean Garfield.
“Our nation’s electronic communications privacy laws are seriously out of date,” said Linda Moore, president of TechNet. “These laws were last updated in 1986, at a time when the modern Internet and the ‘cloud’ did not exist."
“Today, the House Judiciary Committee took a major step toward updating these laws. The bill approved by the committee today makes clear that the warrant standard of the U.S. Constitution applies to private digital information just as it applies to physical property. It also ends ECPA’s arbitrary ‘180-day rule,’ which permits email communications to be obtained without a warrant after 180 days. And, it ensures that a document stored in the cloud receives the same protections that it would if it were stored under user control."
