During which decade was the electronic communications privacy act passed?

A timeline of the expanding coverage of the Privacy Act
Other additions to our privacy functions

The Australian Parliament passed the Privacy Act 1988 (Privacy Act) at the end of 1988, and it commenced in 1989. It gave effect to Australia’s agreement to implement the Organisation for Economic Cooperation and Development (OECD) Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, as well as to its obligations under Article 17 of the International Covenant on Civil and Political Rights. It set out 11 Information Privacy Principles for how Australian Government agencies must handle personal information.

Expanding coverage of the Privacy Act

1991 — Credit reporting

The Privacy Amendment Act 1990 came into effect on 24 September 1991 to regulate the handling of consumer credit reports by credit reporting bodies and credit providers (Part IIIA of the Privacy Act).

1994 — Australian Capital Territory

ACT Government agencies became bound by a version of the Privacy Act through the Australian Capital Territory Government Service (Consequential Provisions) Act 1994.

2000 — Office of the Privacy Commissioner

The Privacy Amendment (Office of the Privacy Commissioner) Act 2000 established the Office of the Privacy Commissioner and separated the Privacy Commissioner from the Human Rights and Equal Opportunity Commission on 1 July 2000.

2001 — Private sector

In December 2000, the Privacy Amendment (Private Sector) Act 2000 extended coverage of the Privacy Act to some private sector organisations. The amendments commenced on 21 December 2001. These amendments introduced 10 National Privacy Principles into the Privacy Act, which set standards for private sector organisations when they collect, use and disclose, hold secure, give access to, and correct personal information.

2010 — The Office of the Australian Information Commissioner

The Australian Information Commissioner Act 2010 established the Office of the Australian Information Commissioner (OAIC) on 1 November 2010. The former Office of the Privacy Commissioner was integrated into the OAIC on 1 November 2010. The OAIC is headed by the Australian Information Commissioner, who is supported by two other statutory officers: the Freedom of Information Commissioner and the Privacy Commissioner. For more information about the OAIC, see Our Executive.

2011 — Norfolk Island

On 1 January 2011, the Privacy Act was extended to Norfolk Island Government agencies by the Territories Law Reform Act 2010.

2014 — Major privacy reforms

The Privacy Amendment (Enhancing Privacy Protection) Act 2012, which commenced on 12 March 2014, introduced many significant changes to the Privacy Act, including:

the Australian Privacy Principles (APPs) regulate the handling of personal information by Australian and Norfolk Island Government agencies and some private sector organisations (they replaced the Information Privacy Principles and National Privacy Principles)
a new Part IIIA of the Privacy Act, which allows for more comprehensive credit reporting
a new requirement for a credit provider to be a member of an external dispute recognition scheme (EDR scheme) recognised under the Privacy Act to be able to participate in the credit reporting system
new laws on codes of practice about information privacy (APP codes) and a code of practice for credit reporting (the CR code); and enabling the Information Commissioner to develop and register binding codes that are in the public interest
new enforcement powers for the Information Commissioner

2014 – ACT privacy reforms

The Information Privacy Act 2014 (ACT), which commenced on 1 September 2014, introduced new privacy laws for Australian Capital Territory public sector agencies. The Information Privacy Act introduced the Territory Privacy Principles, which set out standards for handling personal information. They’re similar to the APPs. For more information about this change, see Privacy in the ACT.

2018 — The Notifiable Data Breaches scheme

The Privacy Amendment (Notifiable Data Breaches) Act 2017 established the Notifiable Data Breaches scheme for all organisations and agencies with existing personal information security obligations under the Privacy Act.

Other additions to our privacy functions

1990 — Spent convictions

The Privacy Commissioner was given compliance and advisory functions for spent conviction information when Part VIIC of the Crimes Act 1914 and came into effect on 30 June 1990. Part VIIC deals with the collection, use and disclosure of old conviction information. For more information see Criminal Records.

1990 — Tax file number data matching

The Data-matching Program (Assistance and Tax) Act 1990, and guidelines made under that Act, gave the Privacy Commissioner oversight and compliance functions for how the Australian Taxation Office and certain other agencies use tax file numbers to compare personal information to detect incorrect payments. For more information see Government Data Matching.

1991 — Medicare and pharmaceutical benefits schemes

The Privacy Commissioner got additional functions under amendments to the National Health Act 1953 about guidelines to safeguard personal information given in the Medicare and Pharmaceutical Benefits schemes.

1997 — Telecommunications

The Privacy Commissioner was given monitoring, advisory and compliance functions for the privacy of personal information held by telecommunications carriers, carriage service providers and others following the introduction of the Telecommunications Act 1997 and amendments to the Telecommunications (Interception and Access) Act 1979. For more information see Telecommunications.

2006 — Anti-money laundering and counter terrorism

The introduction of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act) required the Australian Transaction Reports and Analysis Centre (AUSTRAC), the agency responsible for ensuring compliance with the AML/CTF Act, consult the Privacy Commissioner on privacy of individuals matters. For more information see Anti-Money Laundering.

2010 — Healthcare identifiers

The Privacy Commissioner was given oversight and compliance functions with the introduction of the Healthcare Identifiers Act 2010, including the investigation of complaints about the mishandling of healthcare identifiers.

2012 — Personal Property Securities Register

The Australian Information Commissioner was given a new compliance function by the Personal Property Securities Act 2009 for personal information in the Personal Property Securities Register (which commenced in 2012).

2012 — Electronic health records

A new function and, importantly, new powers were conferred on the Australian Information Commissioner by the Personally Controlled Electronic Health Records Act 2012. For more information see My Health Records.

The Electronic Communications Privacy Act (ECPA) of 1986 is a federal statute that specifies standards for government monitoring of cell phone conversations and Internet communications. When first written, ECPA was a forward-looking statute that provided important privacy protections to subscribers of then-emerging wireless and Internet services. However, while technology has advanced dramatically in the decades since ECPA was enacted, the statute’s privacy standards have not been updated, leaving important information without full protection. Meanwhile, the courts have been slow in extending the warrant requirement of the Constitution’s Fourth Amendment to new technologies.

Consequently, the government claims the power to track our movements without a warrant, using our cell phones, which constantly report our location to our wireless service providers. And the government argues that it does not need a warrant to read much of our email or any of the documents that we store and share privately in the Internet “cloud.”

The time has come for ECPA to be reformed to provide strong privacy protections while ensuring that law enforcement agencies can obtain the information they need to fight crime. The best way to do that is to ensure that government agents must get a warrant from a judge before tracking our movements or reading our private communications.

A BRIEF HISTORY OF SURVEILLANCE LAW

In 1967, the Supreme Court ruled that telephone conversations were protected by the Fourth Amendment of the Constitution, requiring the government to obtain a warrant from a judge in order to be able to listen in. The next year, in Title III of the Omnibus Crime Control and Safe Streets Act of 1968, Congress set out detailed standards for the government to follow when tapping a phone line. Title III, also known as the Wiretap Act, made it a crime to intercept telephone calls except with a judge’s warrant or under some relatively narrow exceptions.

However, Title III only applied to voice communications over a wire or face to face. Technology continued to evolve. By the 1980’s, companies were beginning to offer wireless telephone services, and businesses and individuals were beginning to communicate by transferring data, not voice. The Wiretap Act did not apply to email and other data transfers and it was unclear whether a cell phone conversation could be shoehorned into the Act’s definition of a “wire communication.” Meanwhile, the courts were uncertain whether communications using these new technologies were protected by the Fourth Amendment. The government argued that people surrendered their privacy when they used a mobile phone or sent their data through the computers of an Internet service provider.

A ruling by the courts that wireless or data communications were not private would have stopped development of these technologies dead in their tracks. So Congress adopted the Electronic Communications Privacy Act. ECPA added wireless communications and data communications to the Wiretap Act, making it clear that government agents needed a judge’s warrant to intercept such communications in transit.

However, in drafting ECPA, Congress was uncertain how to treat email when in storage with an email service provider. (ECPA gave email moving over the network essentially the same protection as a phone call or postal letter.) Congress said that while an email was in temporary storage, waiting to be accessed by the intended recipient, it should fall under the warrant standard. However, the Justice Department argued that, after a certain point, stored email became like abandoned property or the files of a business shipped off for “cold storage” and should no longer be considered private. At the time, electronic storage was expensive, and email service providers routinely deleted email after 30 or 90 days. Congress was swayed by the Justice Department’s arguments. It assumed that, if someone wanted to keep a copy of an email, they would download it onto their own computer or print it out. Settling on what it thought was the outside limit of any conceivable network storage of email, Congress said that after 180 days email would no longer be protected by the warrant standard and instead would be available to the government with a subpoena, issued by a prosecutor or FBI agent without the approval of a judge.

At the same time, Congress concluded that, while the contents of communications must be highly protected in transit, the “transactional data” associated with communications, such as dialing information showing what numbers you are calling, was less sensitive. ECPA allowed the government to use something less than a warrant to obtain this routing and signaling information.

TECHNOLOGICAL CHANGES SINCE ECPA WAS PASSED

In the 25 years since ECPA was enacted, new technologies have emerged, and the ways we use the Internet and communicate with one another have changed dramatically. Two developments stand out in particular: the movement of storage to “the cloud,” that is to network servers, and the development of location-based services and the growing precision of location tracking capabilities of smart phones, cell phones and other mobile devices.

As a result of radically lower costs of storage and the availability of nearly ubiquitous Internet access, most people now save their emails indefinitely and they store them not on their hard drives but in the cloud, on the servers of their email providers. And people store not only email in the cloud, but also their calendars, their photos, draft documents and a wealth of other sensitive, private data. Any of this data stored on your laptop is fully protected by the Constitution, requiring a warrant for the government to seize it. And as you access the data in real-time over the Internet, your communications are fully protected by ECPA (and also by the Constitution). Yet the same data, sitting in your private, password protected account with a service provider, is available to the government without a warrant under ECPA.

The growing significance of location data is driven by two developments: the incorporation of GPS technology into cell phones and other mobile devices and the build-out of wireless networks with smaller and smaller cells and more and more WiFi hotspots, all of which are mapped to precise latitude and longitude. Maps, navigation aids, and other location-based services have become very popular. As a result, the constant generation of location data from a cell phone can reveal a person’s activities and associations, far more precisely than Congress ever contemplated in 1986. ECPA does not set a clear standard for government access to this data. The government argues that it does not need a warrant to force a service provider to disclose your whereabouts in real-time or going back for weeks or months, precisely time-stamped and easily plotted on a map.

ECPA REFORM

ECPA today is a confusing patchwork of standards that have been criticized by the courts and that bear little resemblance to the expectations that the average person has about the privacy of her personal communications. The courts have begun to respond — one federal appeals court has held that ECPA is unconstitutional because it allows the government to read a person’s email without a warrant — but it could take years, even a decade or more, for the courts to work through all the issues posed by the new technology.

This situation is not in the best interest of citizens, corporations, or the government. Therefore, a diverse coalition of companies, think tanks, and public interest groups from across the political spectrum have founded Digital Due Process and have called for change. The coalition has said that the following principles should guide ECPA reform:

Information should receive the same protection regardless of technology or platform.
Reform should preserve the building blocks of criminal investigations–subpoenas, court orders, etc.–as well as the sliding scale that allows law enforcement to escalate investigations.
Generally, a type of information should have the same level of protection whether it is in transit or being stored.
How old a communication is–or whether or not it has been opened–should be irrelevant to the privacy protections it receives.
All stakeholders–service providers, users and government investigators–deserve clear and simple rules.
The exceptions that have been written into ECPA over the years should be left in place.

Based on these principles, Digital Due Process recommends that ECPA be amended to make it clear that the government, except in emergency situations, must obtain a warrant from a judge before reading a person’s email or tracking his movements with his mobile phone.

KEY RESOURCES

Major Court Cases

Katz (Supreme Court, 1967) – holding that telephone conversations are protected by the Fourth Amendment and establishing the principle of “reasonable expectation of privacy.
Smith v. Maryland (Supreme Court, 1979) – deciding that the use of pen registers or trap and trace devices does not constitute a search requiring a warrant. Pen registers and trap and trace devices record dialed numbers, information the Court said that individuals voluntarily give to telephone companies
Warshak (6th Circuit, 2010) – held that law enforcement must have a warrant to obtain emails stored by email providers
Application of the US (3rd Circuit, 2010) – held that judges may require the government to obtain a warrant to access stored location information.