Revisions to Leahy’s proposal provide officials more time to notify individuals that their data was accessed and clarify that existing federal surveillance laws will not be overridden.
Privacy advocates continue to support an online data protection measure revised by Senate Judiciary Chairman Patrick J. Leahy, D-Vt. But the new version does not go far enough to win over some key law enforcement opponents.
Leahy’s proposal would still require search warrants for law enforcement officials to access consumer emails and data stored online. With a Thursday markup looming, he released a tamed version Monday night to quell critics concerned that the proposal could impede criminal investigations. The revisions provide officials more time to notify individuals that their data was accessed, and it clarifies that existing federal surveillance laws will not be overridden.
Leahy’s tweaks do not go far enough to win support from the National District Attorneys Association, which represents criminal prosecutors.
“This doesn’t address the vast majority of issues that law enforcement and prosecutors would like to have direction on,” Scott Burns, the group’s executive director, said in an interview. Burns said a more comprehensive bill is necessary to clarify when and how officials can access data.
Under the current electronic privacy law (PL 99-508) — enacted in 1986, well before consumers began to rely on email and online storage of data — warrants are needed only to access electronic data within 180 days after its transmission. Law enforcement agents can also access a lot of information about the data, including who sent it and when, without a warrant. Leahy would require officials to obtain warrants to access online content regardless of when it was sent.
Ranking member Charles E. Grassley, R-Iowa, expressed concerns about hindering criminal investigations when Leahy introduced his privacy measure as an amendment to an unrelated video rental bill (HR 2471) at a committee markup in September.
A Grassley spokeswoman said Tuesday that Grassley is still reviewing Leahy’s revisions and may suggest amendments when the markup resumes Thursday. But she emphasized Grassley’s interest in enhancing consumer privacy.
“Sen. Grassley does not support an unauthorized dragnet of Internet and email surveillance by law enforcement and believes personal privacy protections need to be in place,” she said.
Proponents of the Leahy amendment see it as their best chance of updating data privacy laws set more than 25 years ago. Even with the revisions, technology companies and consumer advocates are hailing Leahy’s proposal as a win for privacy.
“We’re very happy that a warrant is still required in all cases and that crucial protections of the bill are still there,” said Chris Calabrese, a privacy lawyer for the American Civil Liberties Union.
The group is a member of the Digital Due Process Coalition, which brings together nonprofit advocates and companies such as Google and Microsoft to press for stronger data protections. The Center for Democracy and Technology and the Competitive Enterprise Institute, which are also members, are endorsing Leahy’s revisions.
“Leahy has kept the warrant requirement for basically all content, which we’re very happy about. We’d definitely be happy to see that become law,” said Ross Schulman, a lawyer for the Computer and Communications Industry Association, a member of the pro-privacy coalition.
The privacy groups did express concern about the extended time that law enforcement officials will have under Leahy’s latest proposal to notify consumers that their data was accessed. The new version doubles the amount of time, to 180 days. Agencies can also issue a gag order that prevents companies from notifying their customers of the access for the same time period.
Privacy groups prefer that lawmakers leave in place the 90-day notification rule under current law, but they plan to support the measure regardless.
The groups hope the Leahy amendment, regardless of whether it passes, will encourage a broader debate in the next session of Congress over data privacy.
The widespread access that officials have to emails and electronic data came into the spotlight during the recent scandal that led to the resignation of CIA Director David H. Petraeus. The FBI went through thousands of emails during a harassment investigation, unearthing Petraeus’ extramarital affair in the process.
In the House, members of both parties have expressed interest in the issue. Rep. Jason Chaffetz, R-Utah, has introduced a bill (HR 2168) to require a warrant before officials can access location data through mobile devices or global positioning systems. Rep. Zoe Lofgren, D-Calif., has put forth a measure (HR 6529) that combines the proposals by Chaffetz and Leahy, and she has already stated that she will reintroduce it next year.