Senator Leahy's Statement On Introduction Of His Bill With Sen. Mike Lee (R-Utah) To Modernize ECPA, To Protect Americans' Email Privacy

(Senator Patrick Leahy (D-Vt.) joined with Senator Mike Lee (R-Utah) on Thursday to introduce their bipartisan legislation to update the Electronic Communications Privacy Act (ECPA) for the 21st Century.  The ECPA Modernization Act of 2017 ensures that law enforcement agencies will have to secure warrants to read Americans’ communications, including those stored in the cloud.  This, coupled with their separate Email Privacy Act of 2017 that the senators introduced at the same time, seeks to preserve the protections of the 4th Amendment in a digital age.  Both bills have broad bipartisan support in both the House and the Senate.  Senator Leahy’s full statement is below.)

Statement of Senator Patrick Leahy (D-Vt.)

On Introduction Of “The ECPA Modernization Act of 2017”

Thursday, July 27, 2017 

Six years ago, Senator Lee and I first joined together to reform our outdated digital privacy laws.  We recognized that our nation’s privacy rules failed to account for how we live our lives today and provided little protection for Americans’ electronic information.

Most Americans are shocked to learn that a law dating back to the Reagan administration governs when the government can read their emails and texts, view their photos, obtain their location information, and even inspect their Internet browsing history.  Thirty-one years ago, I led efforts to write the Electronic Communications Privacy Act (ECPA).  At the time, computers were an emerging technology and there was little understanding of the Internet, let alone cloud computing.  ECPA was significant and forward-looking legislation in 1986, but it was not intended to get us through 30 years of technological innovations.  Modern technology and digital communications have transformed our society.  It is past time for Congress to catch up. 

ECPA no longer makes any sense in our digital world.  When Senator Lee and I first set out to modernize the statute, we focused on one critical reform: enacting a clear, uniform rule that the government must obtain a warrant supported by probable cause whenever it seeks the content our emails, texts, photos, and other electronic documents stored in the cloud.  This is what the Constitution requires; and this is what Vermonters, Utahns, and Americans across the country expect.

But even in the six years since we first introduced legislation to reform ECPA, it has become increasingly clear that broader reforms are necessary to ensure that the statute adequately addresses the privacy and technological challenges of the modern world.  When the U.S. Court of Appeals for the Sixth Circuit held in 2010 that email was fully protected by the Fourth Amendment, the court cautioned that “the Fourth Amendment must keep pace with the inexorable march of technological progress, or its guarantees will wither and perish.”  The bill we introduce today would ensure our laws keep pace.

The ECPA Modernization Act of 2017 introduces a broad set of reforms to our digital privacy statutes.  Like legislation we introduced in previous Congresses, this bill would create a foundational requirement that the government obtain a warrant when it seeks the content of our electronic communications from third-party service providers.  The bill also goes further by addressing the unique privacy concerns associated with Americans’ location information.  Following the example set by states like Vermont, Utah, and California, our bill would require that the government obtain a warrant when it seeks stored or real-time location information from third-party service providers, or uses IMSI-catchers or stingrays to get location data from individuals’ own cell phones. 

The ECPA Modernization Act additionally would require law enforcement to notify individuals when their communications or location information is obtained from third-party service providers.  The bill would also add new privacy protections related to government requests for customer records and metadata; a suppression remedy for illegally obtained electronic data; and reform the pen register and trap and trace device statutes to bring them in line with other laws.

Senator Lee and I are proud to introduce this bill with the support of a broad range of stakeholders, including the Center for Democracy & Technology, the ACLU, the Constitution Project, New America’s Open Technology Institute, the Electronic Frontier Foundation, the American Library Association, the R Street Institute, TechFreedom, FreedomWorks, Google, Engine, BSA | The Software Alliance, and many others.

Today Senator Lee and I are also introducing the Email Privacy Act, companion legislation to the bill introduced in the House of Representatives by Congressmen Yoder and Polis.  The Email Privacy Act passed the House by voice vote earlier this year, and received an overwhelming 419 to 0 vote last congress.  I commend Representatives Yoder and Polis for their efforts, and also commend House Judiciary Committee Chairman Goodlatte and Ranking Member Conyers for reaching a historic compromise that led to unanimous support for this bill in the House.

When the House passed the Email Privacy Act last year, I was hopeful that the Senate would follow suit to protect Americans’ digital privacy and swiftly pass the bill so that it would be enacted into law.  I was disappointed when instead of working in a bipartisan fashion, certain Republicans on the Senate Judiciary Committee threatened to use it as a vehicle to push poison pill amendments on controversial national security matters, effectively killing the bill for their own political purposes.

The Email Privacy Act is a good bill that is unanimously supported by the House of Representatives.  That legislation does not include all the reforms that I believe are necessary to bring our digital privacy laws into the modern age, but it takes a significant step toward ensuring that ECPA complies with the Fourth Amendment by requiring a warrant whenever the government seeks the contents of Americans’ emails and electronic communication.  I have worked for years to see this critical reform implemented into law, and I will take every opportunity to see that it reaches the President’s desk. 

But make no mistake: I believe our work must not stop there.  Americans deserve Fourth Amendment protections for their location information, notice when law enforcement obtains their content or location data, and strong protections governing the acquisition of metadata and records.  I will keep fighting for the protections we have now set forth in the ECPA Modernization Act.  I will keep pushing the Senate to advance legislation that keeps pace with Americans’ expectations of privacy.  The American people expect these protections, and they deserve them.  

Press Contact

David Carle: 202-224-3693