SB 178: Privacy for electronic messages

On Oct. 8, 2015, Gov. Jerry Brown signed Senate Bill 178, the California Electronic Communications Privacy Act (CalECPA), a landmark law that comprehensively regulates access to electronic communications and related data by state government agencies. The CalECPA modernizes legal frameworks established by the federal Electronic Communications Privacy Act (ECPA), which was enacted in 1986, long before cellular phones and the Internet became a part of daily of life.

The CalECPA bolsters privacy protections for emails, text messages, and many other forms of communications in various ways, including expanding warrant and wiretap order requirements for communications, metadata, and geolocation information.

One of CalECPA's most notable features is its rejection of the seemingly arbitrary "180-day" rule created by the federal ECPA, which allowed law enforcement to compel service providers to disclose electronic communications by issuing a subpoena with no warrant requirement if they had remained stored on a server for more than 180 days. It is thought that Congress rationalized the 180-day rule by analogizing email that remained on a server for that period of time to "abandoned property," which is not subject to Fourth Amendment protections against search and seizure. While this comparison may have made sense in 1986, at a time when emails were painstakingly downloaded to home computers from servers with limited storage capacities, it has clearly become outdated in an era where people store huge volumes of email indefinitely on servers hosted by companies like Google. The CalECPA does away with the 180-day rule and requires state government agencies to obtain a warrant or wiretap order to compel a service provider to produce any electronic communications (subject to other exceptions, such as subpoenas authorized by another state law that are not part of a criminal investigation).

The CalECPA doesn't merely restrict law enforcement's access to the contents of communications. Recognizing the strong privacy interests in metadata associated with communications, the law specifically includes that information, including IP addresses and the dates and times of communications, in its definition of the "electronic communication information" subject to warrant and wiretap requirements.

The new law also clamps down on the government's ability to use technology to perform surveillance to obtain "electronic device information," defined as "information stored or generated through the operation of an electronic device." This part of the law addresses concern over growing police use of technology like cellular site simulators, commonly known as "stingrays," which are devices that mimic the interaction of phones with cellular towers to track the location of known phone numbers or identify unknown phone numbers used at a particular location. Under CalECPA, the government's ability to access or compel production of such "electronic device information" is subject to similar (although somewhat different) restrictions to those that the law imposes on "electronic communication information."

The CalECPA has many other important features, including specific rules on the contents of warrants, strict notice requirements related to warrants and wiretap orders, a statutory evidence suppression remedy, and regular reporting requirements for agencies.

According to supporters of the bill, the need for new regulations had arisen along with a sharp spike in demand for electronic evidence. Google, for example, reported a 250 percent increase in government demands over the last five years. The Mountain View company, and many other California-based technology titans like Facebook, Apple and Twitter, all issued statements of support backing the CalECPA, and its passage into law is sure to have a significant impact on their interactions with the government.

Joe Farris is an associate in Arnold & Porter LLP's Intellectual Property & Technology Litigation Group.