House Passes Email Privacy Act

WASHINGTON, February 6, 2017  – The House of Representatives on Monday approved by voice vote the Email Privacy Act, H.R. 387, designed to protect Americans’ privacy and public safety in the digital age. Below is a statement from House Judiciary Committee Chairman Bob Goodlatte, R-Virginia, applauding passage of the bill.

I’ve written about previous version of this legislation in each of the past three years, including this column from March 1, 2015 and from May 1, 2016 for the Deseret News. In the former of the two columns, I wrote:

It’s important at the outset to dispense the shibboleth that the Internet changes everything. What the Internet needs is a strong dose of 18th century legal wisdom, not words about “freedom of expression in the 21st century,” to quote the [former] chairman of the Federal Communications Commission during [a vote by] the agency on network neutrality.

The Constitution says that we have the right to be secure in our “persons, houses, papers and effects.” We have the right to speak free from regulation by the government. There are some who say that the Internet has rewritten the laws of supply and demand, or changed common decency and morality, or altered the possibility of being free from police surveillance. They are mistaken.

[more…]

From Chairman Goodlatte: “The U.S. Constitution protects Americans’ property from unreasonable searches and seizures and we must ensure that this principle continues to thrive in the digital age. Current law governing law enforcement’s access to electronic communications was enacted in 1986 – when mail was sent through the U.S. Postal Service, a search engine was called a library, tweets were the sounds made by birds in the trees, and clouds were found only in the sky.

“As technology has far-outpaced the Electronic Communications Privacy Act of 1986, the Email Privacy Act modernizes this decades-old law to establish a uniform warrant requirement to acquire stored electronic communications in criminal investigations. These updates to the law will better safeguard Americans’ constitutional rights while also protecting law enforcement’s ability to fight crime.  As the House again has overwhelmingly approved this bill, it’s time for the Senate to take up this bipartisan legislation and send it to the President’s desk to become law.”

Background from House Judiciary Committee Chairman Goodlatte:

Nearly 30 years ago, Congress passed the Electronic Communications Privacy Act of 1986 to provide a fair balance between the privacy expectations of American citizens and the legitimate needs of law enforcement agencies. The law sets forth a system to protect the privacy rights of customers and subscribers of computer network service providers and governs requests to obtain stored content, records, or other information, which includes stored emails, text or instant messages, documents, videos, or sound recordings stored in the cloud. ECPA applies not only to federal criminal investigations and prosecutions, but to state and local investigations and prosecutions, public safety requests, and civil investigations in which stored communications of these types of information are sought.

There is broad consensus that ECPA is outdated and contains insufficient protections for Americans’ privacy. The Email Privacy Act, sponsored by Rep. Kevin Yoder, R-Kansas, modernizes ECPA to protect Americans’ privacy and provide law enforcement with tools needed for its investigations. Last year, the House passed the bill unanimously by a vote of 419-0 but the Senate failed to act.

Key Provisions of the Email Privacy Act:

Warrant requirement: The bill creates a uniform warrant standard for law enforcement to obtain the content of communications in criminal investigations. ECPA warrants will continue to be executed with the provider since, as with any other third-party custodian, the information is stored with them. It allows the provider to notify its customers of receipt of a warrant, court order, or subpoena, unless the provider is court ordered to delay such notification.

Remote Computing Services: The bill maintains current law that delineates which remote computing service providers – or cloud providers – are subject to the warrant requirement for content in a criminal investigation.  ECPA has traditionally imposed heightened legal process and procedures to obtain information for which the customer has a reasonable expectation of privacy, namely emails, texts, photos, videos, and documents stored in the cloud.

Allows Law Enforcement to Access Public Information: ECPA currently makes no distinction between content disclosed to the public, like an advertisement on a website, versus content disclosed only to one or a handful of persons, like an email or text message.  The result is that law enforcement would be required to obtain a warrant even for publicly-disclosed content. The bill clarifies that commercial public content can be obtained with a process other than a warrant.

Maintains Congress’s investigative power: The bill clarifies that nothing in the law limits Congress’s authority to subpoena information from third parties in furtherance of congressional oversight.