California Governor Jerry Brown signed into law this week the nation’s most robust and protective electronic privacy law.
The California Electronic Communications Privacy Act (ECPA) bars any state law enforcement agency or other investigative entity from requiring a business to turn over digital communications or metadata—including texts messages, emails, documents stored in the cloud—absent a valid search warrant. California’s ECPA also requires a search warrant to track the location of mobile phones and other electronic devices, or to search them.
Under existing law, a valid search warrant must meet four requirements: (1) the warrant must be filed in good faith by a law enforcement officer; (2) the warrant must be based on reliable information showing probable cause to search; (3) the warrant must be issued by a neutral and detached magistrate; and (4) the warrant must state specifically the place to be searched and the items to be seized.
The American Civil Liberties Union described California’s new electronic privacy law as a “landmark victory for digital privacy” it hopes will become a model for other states.
State senators Mark Leno (D-San Francisco) and Joel Anderson (R-Alpine) wrote the legislation earlier this year to give digital data the same kinds of protection that non-digital communications have.
“For what logical reason should a handwritten letter stored in a desk drawer enjoy more protection from warrantless government surveillance than an email sent to a colleague or a text message to a loved one?” Leno said earlier this year. “This is nonsensical and violates the right to liberty and privacy that every Californian expects under the constitution.”
The bill enjoyed widespread support among civil libertarians like the American Civil Liberties Union and the Electronic Frontier Foundation as well as tech companies like Apple, Google, Facebook, Dropbox, LinkedIn, and Twitter, which have headquarters in California. It also had huge bipartisan support among state lawmakers.
Under the federal Electronic Privacy Communication Act, the government can access digital data using only a subpoena rather than a valid search warrant.