Tech Policy for Startups: Electronic Communications Privacy Act (ECPA)
The Gist: The Electronic Communications Privacy Act (ECPA) sets the standards for when the government can access information stored in the cloud. It was passed under Ronald Reagan so it’s not surprising how outdated it has become. An important court case provides additional protections in some cases.
Why It Matters: In 1986, ECPA was a major step forward for privacy, but it hasn’t kept pace with advancements in technology. This creates uncertainty for businesses and consumers that store digital content in the cloud (email, photos, documents, etc.).
The most glaring problem with ECPA is that in many cases, law enforcement officials don’t need a search warrant to access content like email stored in the cloud, as they would when they searching sensitive areas like a home. This makes troves of data available to law enforcement at a low standard, potentially eroding the trust of customers – especially if they are businesses that store sensitive or confidential data.
The Need to Know: Some businesses are pushing back on this. In 2010, the Sixth Circuit Court of Appeals ruled in United States v. Warshak that government must possess a warrant to obtain electronically stored content. Many major companies now demand a warrant on the basis of this case — arguing that to do otherwise would be unconstitutional, though it’s only legally binding on the Sixth Circuit (Kentucky, Michigan, Ohio, and Tennessee). Some law enforcement agencies such as the FBI have recognized that ECPA is outdated, and now obtain a warrant from a federal judge no matter how old an email is.
States are also beginning to pass legislation requiring warrants for electronic information. In 2015, California passed an omnibus bill requiring California law enforcement agencies to obtain warrants for content, metadata, and location information from subscribers.
Get Involved: There is major traction on this issue. Legislation is moving in the House to reform ECPA, and if it’s brought to a vote, it’s likely to pass. Visit Digital4th.org and CDT’s ECPA reform page for the latest information.