Privacy in the Digital Age

On February 25, 2016, the House Judiciary Committee held a hearing to discuss the impact of international law on the privacy of information that crosses borders.  However, the discussion at the hearing continually came back to a domestic issue:  the need for Congress to update the Electronic Communications Privacy Act of 1986 (ECPA) in order to address the disparity between ECPA and the changes in technology since the law was enacted.  

The Fourth Amendment states:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

In 1986, when an increasing number of individuals were digitizing their papers, Congress enacted ECPA to provide clarity to laws covering wiretaps and intentional electronic eavesdropping, making these activities a federal crime.  Federal and state law enforcement officials are exempt from ECPA’s prohibitions under three specific circumstances:  1) if they have received or expect to receive a court order; 2) if they have the consent of one of the participants in the communication; or 3) with respect to the communications of an intruder within an electronic communications system.  This law has been critically important to businesses, government investigators, and ordinary citizens by creating a constitutionally valid process through which law enforcement could access electronic data.  When the law was enacted, individuals and companies were far away from connecting with one another and storing information on remote servers through email and the cloud. 

Advances in technology over the past 30 years have rendered ECPA out of date.  As a result, hundreds of federal agencies, including the FBI, DEA, and IRS, as well as state and local law enforcement agencies, can demand access to emails and documents stored in the cloud without a warrant.

In an October 25, 2011 op-ed in The Hill, former Reps. Asa Hutchinson (R-Ark.) and Mickey Edwards (R-Okla.) cited the need to update ECPA:  “ECPA’s standards and the privacy safeguards they once provided have been outpaced by advances in technology and the new ways in which Americans use electronic communications … ECPA must be amended to require that the government obtain a search warrant from a judge based on probable cause, rather than a mere subpoena issued by a prosecutor before it can obtain Americans’ electronic communications.”

Many providers, who are concerned about the privacy rights of their customers, are requiring a warrant from law enforcement officials who seek access to content.  The providers cite U.S. v. Warshak, a 2010 case in which the U.S. Court of Appeals for the District of Columbia determined that the Fourth Amendment protects email content stored by third parties.  The Department of Justice has stated that it follows the warrant-for-content rule.  In 2012, the Supreme Court, in United States v. Jones, emphasized the legislature’s role in protecting constitutional rights in the information age:  “In circumstances involving dramatic technological change,” Justice Alito explained in his concurrence, “the best solution to privacy concerns may be legislative.”  He went on to note that legislative bodies are “well situated to gauge changing public attitudes, to draw detailed lines, and to balance privacy and public safety in a comprehensive way.”

Efforts are underway in Congress to update ECPA.  H.R. 699, the Email Privacy Act, was introduced by Rep. Kevin Yoder (R-Kan.) on February 4, 2015, and currently has 311 co-sponsors.  This legislation revises the circumstances in which the government may require a provider to disclose the contents of email and other electronic information stored or otherwise maintained by the provider.  Some in law enforcement as well as certain independent agencies such as the Securities and Exchange Commission (SEC) have been fighting ECPA reform efforts, in part because they want a carve-out allowing them to obtain information that would otherwise require a warrant without one being issued.  Thirty former prosecutors and judges disagree with their concerns, stating that, “Requiring law enforcement to obtain a warrant from a court does not prevent law enforcement from doing its job.” 

The House Judiciary Committee is expected to hold a markup on the Email Privacy Act on April 13, 2016. 

Ensuring that communications among individuals, regardless of their source or destination, have equal protection under the law is critical to keeping the freedoms that are guaranteed under the Fourth Amendment.  Law enforcement is required to obtain a search warrant in order to access information in their homes, offices, and even their mailboxes.  Certainly, the same standard should apply to information that is stored electronically.  It is time to provide certainty to the protection of that information by updating ECPA and enacting the Email Privacy Act.