Header graphic for print
Inside Privacy Updates on Developments in Global Privacy & Data Security from Covington & Burling LLP

Rep. Lofgren Introduces Legislation to Update ECPA

Posted in Cloud Computing, Congress

Last Friday, Rep. Zoe Lofgren (D-CA) introduced the ECPA 2.0 Act, H.R. 6529, which would strengthen the legal standards for law enforcement to gain access to electronic communications and location information.  The Electronic Communications Privacy Act (ECPA) is more than 25 years old and is widely seen as needing modernization to address changes in digital storage, the cloud, and location-based services.  As we’ve previously noted, government access to location information is an ongoing issue for legislators, courts, and government officials.  

Among other changes, the ECPA 2.0 Act would modify ECPA so that:

  • Law enforcement would generally be required to obtain a warrant before accessing electronic communications, regardless of how long the communication has been in storage.
  • Unless certain exceptions applied, government entities would be barred from intercepting, disclosing, or using information about the past, current, or projected location of an individual.  The exceptions would permit the government to obtain geolocation information pursuant to a warrant, with the individual’s prior consent, in emergencies, if the information is publicly accessible, or when conducting foreign intelligence surveillance.
  • Entities providing location-based services would be prohibited from divulging geolocation information to the government unless one of the exceptions applied. 
  • Individuals whose geolocation information is improperly intercepted, disclosed, or used could bring a civil action to recover actual or statutory damages.
  • Law enforcement officials seeking court orders for pen registers or trap and trace devices would be required to provide specific and articulable facts establishing reasonable grounds to believe that the information obtained would be material — not just relevant —to an ongoing criminal investigation. 
  • Law enforcement would be prohibited from using bulk subpoenas to obtain customer account and transaction information, and would instead be required to obtain subpoenas specifying the particular customer whose information is sought. 

Because the House has already adjourned until after Election Day, the bill is unlikely to move before the end of the year.  Rep. Lofgren intends to reintroduce the bill during the next session of Congress.

Senator Patrick Leahy (D-VT) has also been working on legislation to update ECPA, as we discussed here and here.  Last Thursday, the Senate Judiciary Committee postponed discussion of proposed amendments to ECPA and the Video Privacy Protection Act after law enforcement organizations objected and requested a more comprehensive review of the legislation’s impact on law enforcement investigations.  The U.S. Department of Justice is expected to raise similar objections to Rep. Lofgren’s bill.