Privacy advocates and government agencies constantly war over the extent to which the government should be able to access the digital records of individuals. While the NSA appears to have almost unrestricted authority on the federal level, the issue is still being addressed at the state level. To this extent, privacy advocates scored a strong victory this week with the passage of the California Electronic Communications Act.
California Electronic Communications Act
Can state law enforcement authorities access your electronic communications without judicial oversight? Specifically, we are talking about information such as:
- Email messages,
- Mobile phone messages,
- Keywords used in searches on Google, Yahoo, and Bing,
- Websites you’ve visited over a period of time.
Law enforcement authorities have long answered this question in the affirmative. California has just rejected this position.
The New Law
The California Electronic Communications Act is drafted to favor the privacy of individuals over the access rights of state agencies and law enforcement. This bias is evident in the legislative intent accompanying the law:
“Existing law provides that a search warrant may only be issued upon probable cause, supported by affidavit, naming or describing the person to be searched or searched for, and particularly describing the property, thing, or things and the place to be searched. Existing law also states the grounds upon which a search warrant may be issued, including, among other grounds, when the property or things to be seized consist of any item or constitute any evidence that tends to show a felony has been committed, or tends to show that a particular person has committed a felony, or when there is a warrant to arrest a person.
This bill would prohibit a government entity from compelling the production of or access to electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant under specified conditions, except for emergency situations, as defined. The bill would also specify the conditions under which a government entity may access electronic device information by means of physical interaction or electronic communication with the device, such as pursuant to a search warrant, wiretap order, or consent of the owner of the device…”
Online Business Duties
While media outlets are reporting the new law impacts only government agencies, online businesses do not escape unscathed completely. The new law does carry an authentication requirement when responding to valid legal requests:
1546.1d(3) The warrant shall comply with all other provisions of California and federal law, including any provisions prohibiting, limiting, or imposing additional requirements on the use of search warrants. If directed to a service provider, the warrant shall be accompanied by an order requiring the service provider to verify the authenticity of electronic information that it produces by providing an affidavit that complies with the requirements set forth in Section 1561 of the Evidence Code.
Section 1561 requires the following authentication steps:
1561. (a) The records shall be accompanied by the affidavit of the custodian or other qualified witness, stating in substance each of the following:
(1) The affiant is the duly authorized custodian of the records or other qualified witness and has authority to certify the records.
(2) The copy is a true copy of all the records described in the subpoena duces tecum, or pursuant to subdivision (e) of Section 1560 the records were delivered to the attorney, the attorney’s representative, or deposition officer for copying at the custodian’s or witness’ place of business, as the case may be.
(3) The records were prepared by the personnel of the business in the ordinary course of business at or near the time of the act, condition, or event.
(4) The identity of the records.
(5) A description of the mode of preparation of the records.
(b) If the business has none of the records described, or only part thereof, the custodian or other qualified witness shall so state in the affidavit, and deliver the affidavit and those records that are available in one of the manners provided in Section 1560.
(c) Where the records described in the subpoena were delivered to the attorney or his or her representative or deposition officer for copying at the custodian’s or witness’ place of business, in addition to the affidavit required by subdivision (a), the records shall be accompanied by an affidavit by the attorney or his or her representative or deposition officer stating that the copy is a true copy of all the records delivered to the attorney or his or her representative or deposition officer for copying.
[California Evidence Code Section 1561]
Ultimate, the California Electronic Communications Act places a small burden on businesses. Authentication should be a pro forma act.
Death of Privacy
The California Electronic Communications Act is an excellent step towards establishing a checks and balances procedure for data access by law enforcement authorities in California. Pity the federal government doesn’t pass a similar piece of legislation.
Richard Chapo, Esq.