United StatesStored Communications Act, provider disclosure of customer communications and records
Also known as Stored Communications Act.
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition
- Audit expectation
- none
What it requires
- Applies to a provider of an electronic communication service or a remote computing service to the public, and to a governmental entity that seeks a customer's communications or records from such a provider.
- If you provide an electronic communication service to the public, do not knowingly divulge the contents of a communication in electronic storage by that service to any person or entity unless an exception in section 2702(b) applies.
- If you provide a remote computing service to the public, do not knowingly divulge the contents of a communication you maintain for a subscriber or customer solely to store or process it unless an exception in section 2702(b) applies.
- If you provide either service to the public, do not knowingly divulge a record or other information about a subscriber or customer, other than the contents of communications, to a governmental entity unless an exception in section 2702(c) applies; the prohibition does not reach a disclosure of such a record to a person other than a governmental entity.
- Give a governmental entity the contents of a communication only on the process section 2703 requires: a warrant for contents in electronic storage for 180 days or less, and for other contents a warrant, or a subpoena or court order with the prior notice section 2703(b) describes.
- Give a governmental entity a customer record other than contents only on a warrant, a court order under section 2703(d), the customer's consent, a formal written telemarketing-fraud request, or, for the subscriber information listed in section 2703(c)(2), a subpoena.
These lines are LexLint's reading of the law's text. Also read by: Hately v. Watts, 917 F.3d 770 (4th Cir. 2019) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Statutory damages
18 U.S.C. 2707(c): the court may assess the sum of the actual damages suffered by the plaintiff and any profits made by the violator, but in no case may a person entitled to recover receive less than $1,000, and may assess punitive damages if the violation is willful or intentional.
- As of
- Currency
- USD
- Per person minimum
- 1,000
Who enforces it
Enforcement body
No agency enforces sections 2702 and 2703: a person aggrieved by a knowing or intentional violation sues in a civil action under 18 U.S.C. 2707(a). The criminal offence in section 2701 (unlawful access to stored communications) is a separate offence and does not reach a provider's disclosure under section 2702.
Settledness
- As of
- Case link
- https://www.govinfo.gov/content/pkg/USCOURTS-ca4-18-01306/pdf/USCOURTS-ca4-18-01306-0.pdf
- Case citation
- Hately v. Watts, 917 F.3d 770 (4th Cir. 2019)
- Open questions
- Does a message the recipient has already opened remain in 'electronic storage' under 18 U.S.C. 2510(17)(B), as section 2702(a)(1) uses that term, in a circuit that has not followed the Fourth Circuit's reading?
- Does 'to the public' in section 2702(a)(1) reach an electronic communication service that a provider offers only to a closed group, such as an employer's staff?
What record it asks for
Who may demand the log
Court
Log retention
90 days on a governmental entity's request, extended once by a further 90 days on a renewed request.
- Unit
- Days
- As of
- Basis
- Fixed
- Maximum value
- 180
- Minimum value
- 90
Logging duty
On a governmental entity's request a provider must take all necessary steps to preserve records and other evidence in its possession pending a court order or other process; the records are retained for 90 days, extended by a further 90 days on a renewed request, which is the stated period. No trigger value in the vocabulary names a government preservation request, so none is recorded. The preserved records reach the requesting authority through a court order or other process, recorded as court access. The disclosure prohibitions and process rules in sections 2702 and 2703(a) to (e) create no further record duty, and no audit of the preserved records is stated. The sections state no territorial hook.
- Kind
- Explicit
- As of
- Provision
- 18 U.S.C. 2703(f) (a provider preserves records and other evidence on a governmental entity's request, pending a court order or other process)
What this law does
Chapter 121 of title 18 is popularly known as the Stored Communications Act. Chapter 121 was added by Public Law 99-508, enacted on , and Title II of that law took effect ninety days after the date of its enactment. A person or entity providing an electronic communication service to the public shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service.
A person or entity providing remote computing service to the public shall not knowingly divulge the contents of a communication that it carries or maintains for a subscriber or customer solely for the purpose of providing storage or computer processing services, if the provider is not authorized to access the contents for any other service.
A provider of remote computing service or electronic communication service to the public shall not knowingly divulge a record or other information pertaining to a subscriber or customer, not including the contents of communications, to any governmental entity.
A provider may divulge the contents of a communication to an addressee or intended recipient, with the lawful consent of the originator or an addressee or intended recipient, or of the subscriber in the case of remote computing service, or as may be necessarily incident to the rendition of the service or to the protection of the rights or property of the provider, among the other exceptions in section 2702(b).
A provider may divulge a record or other information pertaining to a subscriber or customer, not including the contents of communications, to any person other than a governmental entity. A governmental entity may require a provider of electronic communication service to disclose the contents of a communication that has been in electronic storage for one hundred and eighty days or less only pursuant to a warrant.
A governmental entity may require a provider of remote computing service to disclose contents without notice to the subscriber if it obtains a warrant, or with prior notice to the subscriber if it uses an administrative subpoena, a grand jury or trial subpoena, or a court order under subsection (d) of section 2703.
A governmental entity may require a provider to disclose a record or other information pertaining to a subscriber, not including contents, only when it obtains a warrant, obtains a court order under subsection (d), has the consent of the subscriber or customer, submits a formal written request in a telemarketing fraud investigation, or seeks the subscriber information listed in section 2703(c)(2) with a subpoena.
A court order under subsection (d) of section 2703 shall issue only if the governmental entity offers specific and articulable facts showing that there are reasonable grounds to believe that the contents or the records sought are relevant and material to an ongoing criminal investigation.
No cause of action shall lie in any court against a provider of wire or electronic communication service for providing information, facilities, or assistance in accordance with the terms of a court order, warrant, subpoena, statutory authorization, or certification under the chapter.
Except as provided in section 2703(e), a provider of electronic communication service, a subscriber, or another person aggrieved by a violation of the chapter committed with a knowing or intentional state of mind may bring a civil action against the person or entity, other than the United States, that engaged in the violation.
The court may assess actual damages and any profits made by the violator, but a person entitled to recover shall receive not less than $1,000, and may assess punitive damages if the violation is willful or intentional. Among the grounds in section 2707(e), a good faith reliance on a court warrant or order, a grand jury subpoena, a legislative authorization, or a statutory authorization is a complete defense to any civil or criminal action brought under the chapter or any other law.
A civil action may not be commenced later than two years after the claimant first discovered or had a reasonable opportunity to discover the violation. The remedies and sanctions described in the chapter are the only judicial remedies and sanctions for nonconstitutional violations of the chapter. The provisions this entry describes came into force on different days.
How courts have read itPremium data
Our analysis of this law draws on 11 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app operates a social platform or provides telecom services.
Back to the example · Lint your app
Page updated .
Stored Communications Act ; us-18-u-s-c-2702-2703