GOP chairman makes change to email privacy bill

Email privacy legislation heading toward a long-anticipated House Judiciary Committee markup has undergone a series of small but significant changes ahead of Wednesday’s vote.  

{mosads}The new warrant protections at the center of the widely supported Email Privacy Act remain in tact.

But Judiciary Chairman Bob Goodlatte (R-Va.) on Friday circulated a substitute amendment with a few differences, including the removal of a provision that would have required the government to quickly notify customers after obtaining their emails from a provider. 

The substitute amendment could go through small changes before the markup, but supporters say there is a deal in principle. 

Securing a committee vote on the bill is a small victory for privacy advocates, who have complained for years that Goodlatte dragged his feet on advancing the bill that has more than 300 co-sponsors. Further movement is uncertain in a cramped election-year schedule.  

The core bill would still update the 30-year-old Electronic Communications Privacy Act (ECPA) to require the government to get a warrant before forcing technology companies to hand over their customers’ emails or other electronic communications.

To do that, it closes off a loophole, which hasn’t been used in years, that allows the government to use a subpoena to get the communications if they are more than six months old. 

The 12-page substitute amendment, obtained by The Hill, does include some notable differences. 

NOTICE REQUIREMENT

It removes a provision that would have required the government to quickly notify any individuals targeted by an ECPA warrant. Tech companies themselves could still tell their customers a warrant has been served. 

The old version would have forced law enforcement to tell an individual after 10 days that it had received that person’s emails from a technology company. When that warrant originated from a government entity, the government would have had to tell a person in three days. 

Goodlatte’s office removed that provision after calling it burdensome and potentially dangerous. 

CONGRESS SUBPOEANA POWERS

The new substitute bill would also explicitly state that nothing in the language would limit Congress’s own investigative powers, “including the authority to compel the production of a wire or electronic communication.”

Goodlatte had expressed concern about Congress’s investigative power being limited by the bill during a hearing last December. He had a largely unanswered back-and-forth with a Google lawyer on whether it is unconstitutional for Congress to use a subpoena to force Google to hand over a customer’s emails during an investigation. 

REMOTE COMPUTING SERVICES 

The substitute would also preserve a legal distinction between remote computing services and electronic communications services, removing a drafting issue in earlier legislation. 

A Google document stored in the cloud is an example of a remote computing service, while a shared Google document would become an electronic communication. There was worry the original bill would have expanded the scope of remote computing services that fall under the warrant requirement. 

NO EMERGENCY/CIVIL ENFORCEMENT ADDITIONS

Important for the privacy community, the substitute does not include a carve-out for civil enforcement agencies, who had asked for a way to obtain customer emails from a provider without a criminal warrant. Those warrants are unavailable to them in purely civil cases. 

Goodlatte also chose not to add a provision that would mandate technology companies hand over communications without a warrant in an emergency. Currently, technology companies have the option to — and frequently do — voluntarily hand over the information during those kinds of situations.