California Leads the Way with Data Privacy Ruling

By Rachel Holdgrafer, Business Content Editor, Code42

Should electronic communications and metadata be afforded the same legal protections as printed correspondence? The State of California thinks so.

Introduced in February 2015 and signed into law on October 8, 2015, the California Electronic Communications Privacy Act prevents law enforcement agencies from requiring a company to turn over metadata or digital communications without a warrant. Home to a large majority of technology-based companies including Apple, Google, Facebook, Dropbox, LinkedIn and Twitter, the State of California recognized the need for updated state privacy laws. In the wake of the NSA scandal and the resulting decline in consumer trust that vendors would (and could) protect individual’s digital privacy, California took action to avoid further negative impact on its technology businesses.

The California Electronic Communications Privacy Act is a move toward instating meaningful digital privacy rights. It is also the clarion call for lawmakers to take up the mantle of privacy protection by proactively changing existing privacy laws to include digital communications. The legislation echoes recent decisions by the Supreme Court in which Fourth Amendment privacy rights preventing unreasonable search and seizure were upheld and expanded to include GPS trackers and cellular phones.

Requests for access to electronic communications are growing at exponential rates. Google reported a 250% jump in government demands for access to digital data in the past five years. AT&T reported a 70% increase in demands for location information in the past year and Verizon reported that only 1/3 of the 15,000 requests it received in 2014 included a warrant. Twitter experienced a 52% increase in access demands in 2015 as well.

The California Electronic Communications Privacy Act takes a ground-breaking stance on digital privacy that the American Civil Liberties Union (ACLU) hopes will spread to other states in coming months. The ACLU urges individual states to take action rather than wait for sweeping federal legislation due to glacial progress in Washington, D.C. Despite having 300 supporters in the House, the Email Privacy Act has failed to receive a floor vote. Clearly, technology companies cannot wait for federal legislators to tackle this issue.

Data privacy is at the heart of every cloud-based or security-based business. Without updates to current legislation—at the federal or state level—technology companies and their customers are left in a precarious position. Other states would do well to follow California’s lead and implement data privacy legislation that accounts for how people communicate in the 21st century while we wait for Washington, D.C. to get moving.