Senate Judiciary Passes ECPA Update, Will Use It as Starting Point Next Congress

The amendment has “several common sense updates” to the 1986 law to “eliminate the anachronistic distinction” between physical files and files stored electronically, Leahy said. In addition to the warrant requirement, the amendment would require agencies to, within 10 business days of obtaining an individual’s communications, notify that individual and provide him a copy of the warrant. Leahy’s amendment included a provision that would allow government to postpone that delay by 180 days in cases where a notification may interfere with a sensitive investigation. The committee adopted an amendment from Sens. John Cornyn, R-Texas, and Mike Lee, R-Utah, that would limit that delay to 90 days for government agencies that are not law enforcement agencies.

Requiring a warrant to search electronic communications may harm law enforcement efforts, said Ranking Member Chuck Grassley, R-Iowa. “We should be working through these concerns in committee,” he said, criticizing the process as having been “behind closed doors” and without sufficient input from law enforcement agencies. Earlier this week, public interest groups expressed concern that Grassley would introduce amendments that would create long lists of law enforcement agencies that would not need warrants to search electronically stored communications (WID Nov 27 p7). Grassley did not introduce an amendment to exempt specific agencies from the warrant requirement and voted to move the bill out of committee.

Grassley introduced an amendment that would eliminate the need for a warrant to search communications “in an electronic storage system for more than 180 days” in cases of child abduction, child pornography and violence against women, including cases of rape. In those cases, “time is of the essence,” he said, and “it would be a travesty of justice if a child died and key information had been available” but couldn’t be accessed by law enforcement agencies. While the rest of the present committee members expressed agreement with the intent of Grassley’s amendment, the committee voted it down, citing concerns over potential confusion and areas of overlap with current laws and sections of Leahy’s amendment that require or compel disclosure without a warrant regardless of how long the electronic communication has been stored. Lee said these existing exceptions “should be more than sufficient.” “There will still be work to be done on this,” Leahy said, urging the committee “not to make a broader exception.”

Public interest groups and trade associations applauded the amendment’s passage. In a statement, Chris Calabrese, legislative counsel for the American Civil Liberties Union, called the vote “an important gain for privacy” because it supported the idea that “electronic content like emails, photos and other communications held by companies like Google and Facebook should be protected with a search warrant.” Demand Progress Executive Director David Segal said in a statement that the ECPA amendment “simply brings the law that governs access to them in concert with what most Americans intuitively believe to be appropriate.” Leahy’s amendment “keeps the government from turning cloud providers into a one-stop convenience store for government investigators,” said Greg Nojeim, senior counsel at the Center for Democracy and Technology, in a statement. Software & Information Industry Association Senior Director of Public Policy David LeDuc asked Congress to “ensure that information Americans store in the cloud receives the same level of protection as the information stored in their homes.” In a statement, Computer and Communications Industry Association CEO Ed Black thanked Leahy and the bill’s supporters for approving a “level of protection that is more on par with the principles of a robust 4th Amendment."

Leahy’s amendment also included an update to the Video Privacy Protection Act (VPPA), a 1988 bill authored by the senator which prohibits video service providers from sharing consumer video viewing practices on an ongoing basis with third parties. With the advent of social media, the law has prevented online video services such as Netflix from allowing users to engage in “frictionless sharing” -- or sharing that requires one-time informed, written consent -- with social media like Facebook. This kind of frictionless sharing, which has become common across Facebook, can be seen in partnerships with music streaming services, like Spotify, which, with the user’s consent, automatically broadcasts what music that user is listening to.

Leahy’s amendment allows video service providers to share users’ viewing information on an ongoing basis after they opt in, as long as users can opt out of sharing their information and provide informed, written consent, which can be through electronic means. The committee passed an amendment from Sens. Dianne Feinstein, D-Calif., and Al Franken, D-Minn., which would require services to obtain consent from users every two years to continue automatically sharing their viewing information. Kurt Opsahl, senior attorney at the Electronic Frontier Foundation, said in a statement that Leahy’s amendment to update VPPA “undermin[es] the protections of the Video Privacy Protection Act,” which “doesn’t help Internet users.” Opsahl commended the Feinstein-Franken amendment for helping to “undo some of the damage.”