United States. Surveillance / law enforcement access. Act

SCAElectronic Communications Privacy Act, Title II – Stored Communications Act (18 U.S.C. §§ 2701–2713)

In force

Partly verified

Medium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.

§1Summary

Synopsis

Restricts unauthorised access to stored electronic communications and limits voluntary disclosure of content and records by providers of electronic communication and remote computing services. Sets the legal process (subpoena, 2703(d) order, warrant) required for government access.

Key themes

stored communications
voluntary disclosure limits
subpoenas
2703(d) orders
warrants
non-disclosure orders

Unique features

Provider-centric: distinguishes electronic communication services from remote computing services, with different rules for content and non-content data.

SaaS relevance

Cloud/SaaS hosts storing customer communications are typically RCS/ECS providers that cannot voluntarily hand over content to government and must respond to compulsory process.

§2Obligations

Extraterritorial: Yes
Breach notification: None
DPO: No
Cross-border transfers: CLOUD Act executive agreements
Maximum penalty: Civil: actual damages or minimum $1,000 plus punitive damages; criminal penalties

§3Dates

Key dates

Adopted 21 October 1986
In force 20 January 1987
Amended by the CLOUD Act 2018 (s2713 extraterritorial reach).

§4Text and authority

Text

Authoritative text uscode.house.gov

Authority

US Department of Justice; courts

§6Sources and verification

Sources consulted

justice.gov

Verification

Medium confidence.