A Guide: Electronic Communications Privacy Act

Electronic Communications Privacy Act: the ultimate guide

The Electronic Communications Privacy Act (ECPA) is a US regulation that stands to prevent the unauthorized access, use or disclosure of electronic communications. It protects email, telephone, wire and other electronic data from misuse, ensuring any information found within these communications remains private and secure. 

What is the purpose of the Electronic Communications and Privacy Act?

The ECPA was introduced in 1986 as an update to the original communication regulation; the Federal Wiretap Act (1968). This made it a Federal crime to use a machine to record the communications of others, or disclose any information acquired this way.

While the Federal Wiretap Act sufficiently addressed the interception of telephone comms, it felt outdated. This was largely due to the lack of guidelines around computers and other electronic forms of communication.

The ECPA is a law consistent with the fourth amendment, and aims to protect wire, oral and electronic communications:

1. As they’re being made
2. While they’re in transit
3. During computer storage

The Act applies to the likes of email, telephone and other electronic data such as social media messages. To understand more about this Act, it’s important to understand the components, and the requirements for compliance.

What are the requirements of the Act?

Governments and businesses that are required to comply with the ECPA must understand that the Act is made from three separate laws that have now become a collective.

These are:

• Federal Wiretap Act (1968)
• Stored Wire Electronic Communications Act (1986)
• Pen Register / Trap and Trace Devices Act (1986)

Federal Wiretap Act

As mentioned, the Federal Wiretap Act was the original regulation around communications and their access. In order to comply, organizations and individuals must not intentionally intercept communications while in transit, or use and disclose the contents of the communications if obtained during a violation.

In practice, this essentially means that it’s illegal for anybody to listen to and record another person or entity’s communications, or illegally get hold of this information while it’s stored. 

Stored Wire Electronic Communications Act

The Stored Communications Act was the update that brought the ECPA into effect in 1986. It usurps the previous Federal Wiretap Act by also including provisions for computer and other electronic communications. Moreover, this Act includes the instruction that individuals or organizations in violation must not obtain, alter or prevent another (authorized) user’s access.

For example, this makes it illegal to access somebody else’s email account and forward their private emails to yourself. However, one exception to this rule is that employers are typically allowed to access the accounts of all of their employees’ workplace accounts – and this is included in the contract.

Pen Register and Trap and Trace Devices

An extra feature of ECPA rules consists of government surveillance equipment for communication regulations. The Pen Register and Trap Trace Device rules regulate the government’s use of these devices to access communications.

The regulations signify which suspected criminal activities are exceptions to this rule, and which activities require warrants or subpoenas in order to access, surveil and store a perpetrator’s electronic communications. 

Updates and future requirements of the ECPA

There have been several updates to this regulation over the years, including under the US Patriot Act (2001). The main reason for these updates was to ensure the ECPA fits with emerging developments, and covers data privacy across new devices and technologies.

The Patriot Act

The main aim of the Patriot Act was to prevent terrorism attacks, and one way to enable this is by tracking the communication of suspected terrorists. By combining communications with monetary tracking, investigators are looking for patterns of money laundering that could signal terrorist financing. Therefore, the Patriot Act increases the number of exceptions for monitoring communications, and easing access for law enforcement investigators. 

Cloud computing

As cloud computing grows, it’s likely that the ECPA will see more updates in order to protect data access, transit and storage within these networks.

One area for change might include the 180 day rule, which currently states that data can be treated as ‘abandoned’ after it has been stored without use for 180 days. However, the nature of cloud-based computing means that storage is virtually unlimited, so there is no need to abandon ‘old’ data. With much criticism to this rule, it’s likely to undergo changes.

State Privacy Acts

Finally, in recent years, states like California and Colorado have brought out their own Privacy Acts. These were formed both in response to Europe’s GDPR, and also to increase the restrictions around business’ collection and use of personal information.

State Privacy Acts ensure that businesses prove the necessity of the information they collect. They also enable residents to opt out of targeted advertising, and give customers the right to request, edit or delete the data that businesses hold on them.

Penalties for ECPA non-compliance

The penalties for non-compliance include up to five years imprisonment and fines of up to $250,000 for individuals. However, organizations that commit offenses under this Act could find the consequences much worse. In both cases, victims are able to claim back the costs of their civil suits, damages and other associated fees, such as the appointment of an attorney.

Ensure your firm not only meets compliance requirements, but keep pace with innovations in electronic communications. Create a regulatory intelligence strategy that reflects the integrated world we live in, by booking a demo with Global Relay.

< Back to the hub