Statement Of Senator Patrick Leahy (D-Vt.),
Chairman, Senate Committee On The Judiciary,
On Introduction Of “The Electronic Communications Privacy Act Amendments Act Of 2011”
Today, I am pleased to introduce the Electronic Communications Privacy Act Amendments Act of 2011 — a bill to bring our Federal electronic privacy laws into the digital age. Since the Electronic Communications Privacy Act (ECPA) was first enacted in 1986, the ECPA has been one of our Nation’s premiere privacy laws. But, today, this law is significantly outdated and out-paced by rapid changes in technology and the changing mission of our law enforcement agencies after September 11.
In the digital age, American consumers and businesses face threats to privacy like no time in history. With the explosion of new technologies, including social networking sites, smartphones and other mobile applications, there are many new benefits to consumers. But, there are also many new risks to their privacy.
Just in the past few weeks, we have witnessed significant data breaches involving Sony and Epsilon that impact the privacy of millions of American consumers. We are also learning that smartphones and other new mobile technologies may be using and storing our location and other sensitive information posing other new risks to privacy.
When I led the effort to write the ECPA 25 years ago, no one could have contemplated these and other emerging threats to our digital privacy. Updating this law to reflect the realities of our time is essential to ensuring that our Federal privacy laws keep pace with new technologies and the new threats to our security.
New Privacy Protections for American Consumers
This bill takes several steps to protect Americans’ privacy in the digital age. First, the bill makes common sense changes to the law regarding the privacy protections afforded to consumers’ electronic communications. Under the current law, a single email could be subject to as many a four different levels of privacy protections, depending upon where it is stored and when it was sent. The bill gets rid of the so-called “180-day rule” and replaces this confusing mosaic with one clear legal standard for the protection of the content of emails and other electronic communications. Under my bill, service providers are expressly prohibited from disclosing customer content and the government must obtain a search warrant, based on probable cause, to compel a service provider to disclose the content of a customer’s electronic communications to the government.
This bill also provides important new consumer privacy protections for location information that is collected, used, or stored by service providers, smartphones, or other mobile technologies. To protect consumer privacy, my bill requires that the government obtain either a search warrant, or a court order under the Foreign Intelligence Surveillance Act, in order to access or use an individual’s smartphone or other electronic communications device to obtain geolocation information. There are well-balanced exceptions to the warrant requirement if the government needs to obtain location information to address an immediate threat to safety or national security, or when there is user consent or a call for emergency services. The bill also requires that the government obtain a search warrant in order to obtain contemporaneous (real-time) location information from a provider. There is an exception to the warrant requirement for emergency calls for service.
Strengthening Law Enforcement Tools
To address the role of new technologies in the changing mission of law enforcement, the bill also provides important new tools to law enforcement to fight crime and keep us safe. The bill clarifies the authority under the ECPA for the government to temporarily delay notifying an individual of that fact that the government has accessed the contents of their electronic communications, to protect the integrity of a government investigation. The bill also gives new authority to the government to delay notification in order to protect national security.
Enhancing Cybersecurity and National Security
Lastly, the ECPA Amendments Act strengthens the tools available in ECPA to protect our national security and the security of our computer networks. The legislation creates a new limited exception to the nondisclosure requirements under the ECPA, so that a service provider can voluntarily disclose content to the government that is pertinent to addressing a cyberattack. To protect privacy and civil liberties, the bill also requires that, among other things, the Attorney General and the Secretary of Homeland Security submit an annual report to Congress detailing the number of accounts from which their departments received voluntary disclosures under this new cybersecurity exception.
In addition, the bill clarifies the kinds of subscriber records that the Federal Bureau of Investigations may obtain from a provider in connection with a counterintelligence investigation. This reform will help to make the process for obtaining this information more certain and efficient for both the government and providers.
I drafted this bill with one key principle in mind — that updates to the Electronic Communication Privacy Act must carefully balance the interests and needs of consumers, law enforcement, and our nation’s thriving technology sector. I also drafted this bill in careful consultation with many government and private sector stakeholders, including the Departments of Justice and Commerce, State and local law enforcement, and members of the technology and privacy communities.
I thank the Digital Due Process Coalition and the many other stakeholders who support this bill. I also thank the Departments of Commerce and Justice for their guidance on how the ECPA impacts the needs of our law enforcement community and our national economy. I look forward to continuing to work with all of these stakeholders as this bill moves forward.
Two decades before Congress first enacted the Electronic Communications Privacy Act, Chief Justice Earl Warren wisely opined that “the fantastic advances in the field of electronic communications constitute a greater danger to the privacy of the individual.” This aptly describes the state of our digital privacy rights today. The balanced reforms in this bill will help ensure that our Federal privacy laws address the many dangers to personal privacy posed by the rapid advances in electronic communications technologies. Accomplishing this challenging task will not be easy. But, with the introduction of theElectronic Communications Privacy Act Amendments Act of 2011, we take a significant step towards this very important goal.
I ask that the full text of the bill be printed in the Record immediately following my remarks.