Industry Coalition Urges Congress To Update 24-Year-Old Electronic Privacy Act

A coalition of Web companies including Google, AOL and Microsoft, along with digital rights groups like the Electronic Frontier Foundation, are calling on Congress to enact new online privacy protections.

The organizations have formed the group, Digital Due Process, which is urging lawmakers to protect information that is not generally accessible by the public, including emails, some photos and videos, cell phone location data, and even search queries. Specifically, the coalition argues that such information should remain private unless courts issue search warrants for it.

The Electronic Privacy Communications Act already says that Internet service providers can't disclose some data without search warrants, including many emails that are less than 180 days old. But the 1986 statute does not appear to cover much of the data that users currently store online.

In some circumstances, the government can obtain access to material uploaded by users simply by issuing subpoenas -- which are easier to obtain than search warrants. In general, courts require that officials have probable cause of criminal activity to obtain a search warrant, but will issue subpoenas as long as the information requested is considered "relevant" to an investigation.

Google's Richard Salgado, senior counsel for law enforcement and information security, says that updating the law will provide some needed clarity in the space. "It will be much easier to keep our users informed about how their data is protected from disclosure to the government," he says.

Although the Electronic Communications Privacy Act is somewhat dated, its provisions banning ISPs from disclosing some data have been used by consumers in lawsuits alleging privacy violations by online companies. Currently, social networking sites Classmates.com and Facebook are facing lawsuits alleging violations of the ECPA.

In addition, when consumers filed a potential class-action privacy lawsuit against behavioral targeting company NebuAd and its Internet service provider partners, the consumers alleged that the companies had violated the law by using data about users' Web-surfing activity to serve them ads.