Hatch bill to update international electronic communications privacy laws

U.S. Sen. Orrin Hatch (R-UT) introduced legislation on Tuesday that aims to strengthen international data privacy protections while clarifying the ability of law enforcers to obtain warrants to access electronic communications of U.S. citizens, including across borders.

“It is past time for Congress to address the critically important issue of international data privacy and the need to establish a sensible legal framework for law enforcement to access extraterritorial communications,” said Hatch, the chairman of the Senate Republican High-Tech Task Force.

The bill, the International Communications Privacy Act (ICPA), would also reform the process for mutual legal assistance treaty (MLAT) agreements, which enable countries to gather and exchange information. The attorney general would be required to develop an online docketing system for MLAT requests.

“The potential global reach of government warrant authority has significant implications for multinational businesses and their customers,” Hatch said. “Failing to address this issue in a reasonable, comprehensive way will only continue to cause problems between American businesses and the U.S. government. ICPA will aid US law enforcement while safeguarding consumer privacy, striking a much-needed balance in today’s data-driven economy.”

Diplomatic channels are currently in place to facilitate the sharing of data between countries, Hatch said on the Senate floor, but those channels are “exceptionally slow and can take months or even years to process requests.”

While some have suggested simply extending the reach of U.S. warrants globally, Hatch noted that foreign disclosure laws conflict with U.S. laws.

“Extending the reach of U.S. warrants without reasonable limits would thus place service providers in the impossible position of having to choose which country’s laws to violate — ours or the foreign jurisdiction’s,” said Hatch, who is also chairman of the Senate Finance Committee.

ICPA outlines rules for when U.S. law enforcers are able to access electronic data based on the location and nationality of the individual whose data is being sought.

“If a person is a U.S. national, or is located in the United States, law enforcement may compel disclosure, regardless of where the data is stored, provided the data is accessible from a U.S. computer and law enforcement uses proper criminal process,” Hatch said. “If a person is not a U.S. national, however, and is not located in the United States, then different rules apply.”

Various tech companies and trade groups have supported the bill. Apple, AT&T, Facebook, Google, Microsoft, Oath, Rackspace and Verizon wrote in a joint letter that “technology has moved ahead by leaps and bounds” while electronic privacy law has “mostly stood still.”

“We agree that law enforcement needs to be able to do its job, but it needs to do it in a way that respects fundamental rights, including the personal privacy of people around the world and the sovereignty of other nations,” the letter states.

“The uncertainty of our existing legal framework is causing other countries to be concerned about the privacy rights of their citizens. It is causing foreign governments, businesses and individuals to question whether they can trust American products and technologies. And these concerns are leading other nations to enact new laws that seek to block the very steps that our government typically takes through unilateral search warrants,” the letter said.