Protect Email and Location Privacy

Section 1. This act shall be known and may be cited as the "EMAIL privacy act (electronic messaging and individual location)".

§ 2. Paragraph (c) of subdivision 1 of section 690.15 of the criminal procedure law is amended and a new paragraph (d) is added to read as follows:

(c) A designated or described person[.];

(d) Designated or described electronic customer data or electronic location information held in electronic storage, including the contents of and records and other information related to a wire communication or electronic communication held in electronic storage. For purposes of this paragraph, "electronic communication" has the meaning assigned by section 250.00 of the penal law, "electronic storage", "wire communication", "electronic customer data" and "electronic location information" have the meaning assigned by section 690.05 of this article.

§ 3. Subdivision 2 of section 690.05 of the criminal procedure law, as amended by chapter 504 of the laws of 1991, the opening paragraph as amended by chapter 424 of the laws of 1998, is amended and a new subdivision 3 is added to read as follows:

2. A search warrant is a court order and process directing a police officer to conduct:

(a) a search of designated premises, or of a designated vehicle, or of a designated person, for the purpose of seizing designated property or kinds of property, and to deliver any property so obtained to the court which issued the warrant; or

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD07279-01-9

A. 2313 2

(b) a search of a designated premises for the purpose of searching for and arresting a person who is the subject of: (i) a warrant of arrest issued pursuant to this chapter, a superior court warrant of arrest issued pursuant to this chapter, or a bench warrant for a felony issued pursuant to this chapter, where the designated premises is the dwelling of a third party who is not the subject of the arrest warrant; or

(ii) a warrant of arrest issued by any other state or federal court for an offense which would constitute a felony under the laws of this state, where the designated premises is the dwelling of a third party who is not the subject of the arrest warrant[.]; or

(c) a search of designated or described electronic customer data or electronic location information held in electronic storage or mobile device, including the contents of, and records and other information related to a wire communication or electronic communication held in electronic storage or mobile device.

3. The following definitions are applicable to this article:

(a) "Electronic storage" means any storage of electronic customer data in a computer, computer network, or computer system, regardless of whether the data is subject to recall, further manipulation, deletion, or transmission, and includes any storage of a wire or electronic communication by an electronic communications service or a remote computing service.

(b) "Wire communication" means an aural transfer made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable, or other like connection between the point of origin and the point of reception, including the use of such a connection in a switching station, furnished or operated by a person authorized to engage in providing or operating the facilities for the transmission of communications as a communications common carrier. The term includes the electronic storage of a wire communication.

(c) "Electronic customer data" means data or records that:

(i) are in the possession, care, custody, or control of a provider of an electronic communications service or a remote computing service; and

(ii) contain: (1) information revealing the identity of customers of the applicable service;

(2) information about a customer's use of the applicable service;

(3) information that identifies the recipient or destination of a wire communication or electronic communication sent to or by the customer;

(4) the content of a wire communication or electronic communication sent to or by the customer; and

(5) any data stored by or on behalf of the customer with the applicable service provider.

(d) "Electronic location information" means any information that relates to: (i) the location of a cellular telephone, mobile or other wireless communications device; and (ii) is wholly or partly generated by or derived from the operation of the device.

§ 4. The criminal procedure law is amended by adding a new section 690.60 to read as follows: § 690.60 Search warrants; government access to stored customer data,

communications and electronic location information.

1. An authorized police officer may require a provider of electronic communications service or a provider of a remote computing service to disclose electronic customer data or electronic location information that is in electronic storage by obtaining a warrant.

2. In executing a search warrant directing a provider of an electronic communications service or a provider of a remote computing service to

A. 2313 3

disclose only electronic customer data that is information revealing the identity of customers of the applicable service or information about a customer's use of the applicable service a police officer need not give notice to the subscriber or customer:

(a) by obtaining an administrative subpoena authorized by statute;

(b) by obtaining a grand jury subpoena;

(c) by obtaining a warrant;

(d) by obtaining the consent of the subscriber or customer to the disclosure of the data;

(e) by obtaining a court order; or

(f) as otherwise permitted by applicable federal law.

3. A provider of telephonic communications service shall disclose to an authorized police officer, without any form of legal process, subscriber listing information, including name, address, and telephone number or similar access code that:

(a) the service provides to others in the course of providing publicly available directory or similar assistance; or

(b) is solely for use in the dispatch of emergency vehicles and personnel responding to a distress call directed to an emergency dispatch system or when the information is reasonably necessary to aid in the dispatching of emergency vehicles and personnel for the immediate prevention of death, personal injury, or destruction of property.

4. A provider of telephonic communications service shall provide an authorized police officer with the name of the subscriber of record whose published telephone number is provided to the service by an authorized police officer.

5. Electronic location information may be obtained by an authorized police officer without any form of legal process, if:

(a) the device is reported stolen by the owner; or

(b) there exists an immediate life-threatening situation.

§ 5. The criminal procedure law is amended by adding a new section 690.65 to read as follows: § 690.65 Search warrants; warrant issued in this state for stored

customer data, communications or electronic location informa-

tion.

1. This section applies to a warrant required under section 690.60 of this article to obtain electronic customer data, including the contents of a wire communication, electronic communication or electronic location information.

2. On the filing of an application by an authorized police officer, a district judge may issue a search warrant under this section for electronic customer data held in electronic storage, including the contents of and records and other information related to a wire communication or electronic communication held in electronic storage or electronic location information, by a provider of an electronic communications service or a provider of a remote computing service described by subdivision eight of this section, regardless of whether the customer data is held at a location in this state or at a location in another state. An application made under this subdivision must demonstrate probable cause for the issuance of the warrant and must be supported by the oath or affirmation of the authorized police officer.

3. A search warrant may not be issued under this section unless the application required by section 690.35 of this article sets forth sufficient and substantial facts to establish probable cause that:

(a) a specific offense has been committed; and

A. 2313 4

(b) the electronic customer data or electronic location information sought:

(i) constitutes evidence of that offense or evidence that a particular person committed that offense; and

(ii) is held in electronic storage by the service provider on which the warrant is served under subdivision seven of this section.

4. Only the electronic customer data or electronic location information described in the application required by section 690.35 of this article may be seized under the warrant.

5. The police officer shall execute the warrant not later than the tenth day after the date of issuance, except that the officer shall execute the warrant within a shorter period if so directed in the warrant by the district judge. For purposes of this subdivision, a warrant is executed when the warrant is served in the manner described by subdivision seven of this section.

6. A warrant under this section may be served only on a service provider that is a domestic entity or a company or entity otherwise doing business in this state under a contract or a terms of service agreement with a resident of this state, if any part of that contract or agreement is to be performed in this state. The service provider shall produce all electronic customer data, contents of communications, electronic location information, and other information sought, regardless of where the information is held in the United States and within the period allowed for compliance with the warrant, as provided by subdivision eight of this section. A court may find any designated officer, designated director, or designated owner of a company or entity in contempt of court if the person by act or omission is responsible for the failure of the company or entity to comply with the warrant within the period allowed for compliance. The failure of a company or entity to timely deliver the information sought in the warrant does not affect the admissibility of that evidence in a criminal proceeding.

7. A search warrant issued under this section is served when the authorized police officer delivers the warrant by hand, by facsimile transmission, or, in a manner allowing proof of delivery, by means of the United States mail or a private delivery service to:

(a) a person specified by section three hundred five of the business corporation law;

(b) the secretary of state in the case of a company or entity to which section three hundred six of the business corporation law applies; or

(c) any other person or entity designated to receive the service of process.

8. The district judge shall indicate in the warrant that the deadline for compliance by the provider of an electronic communications service or the provider of a remote computing service is the fifteenth business day after the date the warrant is served if the warrant is to be served on a domestic entity or a company or entity otherwise doing business in this state, except that the deadline for compliance with a warrant served in accordance with section three hundred six of the business corporation law, may be extended to a date that is not later than the thirtieth day after the date the warrant is served. The judge may indicate in a warrant that the deadline for compliance is earlier than the fifteenth business day after the date the warrant is served if the officer makes a showing and the judge finds that failure to comply with the warrant by the earlier deadline would cause serious jeopardy to an investigation, cause undue delay of a trial, or create a material risk of:

A. 2313 5

(a) danger to the life or physical safety of any person;

(b) flight from prosecution;

(c) the tampering with or destruction of evidence; or

(d) intimidation of potential witnesses.

9. If the authorized police officer serving the warrant under this section also delivers an application form to the provider of an electronic communications service or the provider of a remote computing service responding to the warrant, and the police officer also notifies the provider in writing that an executed application is required, then the provider shall verify the authenticity of the customer data, contents of communications, electronic location information, and other information produced in compliance with the warrant by including with the information the application form completed and sworn to by a person who is a custodian of the information or a person otherwise qualified to attest to its authenticity that states that the information was stored in the course of regularly conducted business of the provider and specifies whether it is the regular practice of the provider to store that information.