The Senate Judiciary Committee Nov. 29 approved amended legislation to modernize two major digital privacy laws--the 1988 Video Privacy Protection Act (VPPA) and the 1986 Electronic Communications Privacy Act--in light of technological advancements since the statutes were enacted.
The bill (H.R. 2471 substitute), which was advanced on a voice vote and is expected to serve as a marker for the next Congress, would update the VPPA to clarify that video companies, such as Netflix, may obtain advance consent from consumers for the ongoing sharing of their video rental information and that such consent may be sought over the internet. The change is designed to facilitate the sharing--on social media networks--of the movies watched or recommended by users.
In addition, the bill would amend ECPA to impose new restrictions on the government's ability to access individuals' email messages and other private data stored by electronic communications providers. A key provision would require the government to obtain a search warrant any time it is seeking such communications.
“Today's executive meeting of the Senate Judiciary Committee was a productive session, and brought about as much progress as we could expect from a lame-duck Congress,” Charles Kennedy, a partner in the Washington office of Wilkinson Barker Knauer LLP, told BNA. The committee's action “gives ECPA reformers good momentum going into the new year, and the bipartisan tone of the meeting was encouraging.”
The big news for proponents of ECPA reform was the proposed elimination of the distinction, for purposes of the warrant requirement, between emails in storage for 180 days or less and emails in storage for more than 180 days, Kennedy added.
The ECPA language is backed by privacy groups and the technology industry, but the law enforcement community has raised concerns that the proposal could impede critical investigations.
The committee adopted a Leahy manager's amendment that was crafted to alleviate such worries by, for example, extending the time allowed for the government to notify surveillance subjects and by clarifying that the search warrant requirement in the bill does not apply to any other federal criminal or national security laws, such as the Foreign Intelligence Surveillance Act.
“My bill stays true to its core purpose--to strengthen the protection provided by requiring that the government get a search warrant to obtain email content, even from third-party providers,” Leahy said in a statement prepared for the markup.
The committee also adopted a video privacy amendment offered by Sen. Dianne Feinstein (D-Calif.). Under that amendment, any advanced consent to share video-viewing information would have to be renewed.
Sen. Charles Grassley (R-Iowa), the committee's ranking member, said that, while he was willing to cooperate with reporting the bill out of committee, he continued to have a number of reservations about the ECPA provisions that he wanted to address prior to floor action.
“While I agree with the business and privacy groups that there is merit to harmonizing the legal requirements for obtaining emails with a search warrant, we would be abdicating our duty if we did not examine the concerns raised by federal, state, and local law enforcement,” Grassley said in a prepared statement. “Additionally, we have heard concerns from civil regulatory agencies such as the [Securities and Exchange Commission] that this legislation would significantly impact the SEC's enforcement of the securities laws--including insider trading.”
Grassley said it was his understanding that there was no “cleared” Obama administration position on the bill. However, he noted that the Department of Justice had offered “technical assistance” and had indicated that Leahy's proposal would negatively impact civil cases brought by the agency.
A DOJ spokeswoman told BNA that the department did not have an immediate comment on the legislation.
The committee's action was applauded by the Business Software Alliance.
“This is an important step in building trust and confidence in cloud computing and other digital services,” said BSA President and CEO Robert Holleyman. “Law enforcement access and civil protections should be the same for online files and other digital records as they are for papers stored in a file cabinet. But because ECPA was enacted before the Internet reshaped the way we live and work, we're operating under a confusing patchwork of legacy standards.”
Chris Calabrese, legislative counsel for the American Civil Liberties Union, also praised the bill's advancement, calling it “an important gain for privacy.”
“We are very happy that the committee voted that all electronic content like emails, photos and other communications held by companies like Google and Facebook should be protected with a search warrant,” he said in a statement. “We believe law enforcement should use the same standard to search your inbox that they do to search your home.”
Konrad Motyka, president of the FBI Agents Association, said he appreciated that Leahy and Grassley have noted that additional changes to the ECPA legislation should be made to address the concerns raised by the law enforcement community.
“Changes to warrant and notice requirements need to be carefully crafted to ensure criminal investigations can continue to be conducted in a manner that effectively protects the public,” Motyka said in a statement emailed to BNA Nov. 29. “The FBIAA looks forward to working with the next session of Congress on these issues.”
Leahy's proposal would require the government to obtain a search warrant--based on probable cause--in order to obtain email content from a third-party service provider and would eliminate a “180-day rule” that calls for different legal standards for the government to obtain email content depending upon the age of the emails in question.
In addition, the government would be required to notify an individual whose electronic communication has been disclosed and provide that individual with a copy of the search warrant used to obtain the information. The manager's amendment revised the bill to extend the time period during which the government must provide such notice from three days to 10 business days after the government has received the information.
By Alexei Alexis
Leahy's original proposal (H.R. 2471 substitute) is available at: http://op.bna.com/pl.nsf/r?Open=dapn-92jl8b.
Proposed and adopted amendments to the bill are available on the committee's website at http://www.judiciary.senate.gov/.
To view additional stories from Privacy & Data Security Law Resource Center™ register for a free trial now