Existing law authorizes the head of a department in state government to make investigations and prosecute actions concerning all matters relating to the business activities and subjects under the jurisdiction of the department, violations of any law or rule or order of the department, and other matters as may be provided by law. Existing law requires the head of a department, in any hearing in any part of the state or in any investigation conducted pursuant to the law described above, to issue process and subpoenas in a manner consistent with the California Constitution and the United States Constitution. Existing law requires the process and subpoenas to be served in the same manner as provided for the service of a summons, as prescribed.

Existing law, the Electronic Communications Privacy Act, prohibits a government entity from compelling the production of, or access to, electronic communication information from a service provider, subject to certain exceptions, including by authorizing a government entity to compel the production of, or access to, electronic communication information from a service provider pursuant to a subpoena if the information is not sought for the purpose of investigating or prosecuting a criminal offense and compelling the production of, or access to, the information via the subpoena is not otherwise prohibited by state or federal law.

This bill would authorize a department to use an administrative subpoena to obtain electronic communication information from a service provider only if certain conditions are met, including that the department has served notice of the administrative subpoena on the customer, as prescribed, and a copy of the administrative subpoena is attached to the notice.

This bill would require a service provider to make a copy of any electronic communication information within the scope of the subpoena and to retain it only until the information is disclosed pursuant to the subpoena, or the subpoena is quashed or modified. The bill would require a service provider to maintain, for a period of 5 years, a record of any disclosure pursuant to the bill. The bill would require a service provider to provide to a customer, upon request and the payment of the reasonable cost of reproduction and delivery, any part of the record maintained pursuant to the bill that relates to the customer.

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anthony Portantino, Chair

2023 - 2024 Regular Session

AB 522 (Kalra) - State departments: investigations and hearings: administrative subpoenas

Bill Summary:

AB 522 would require administrative subpoenas seeking to obtain a customer’s electronic communication information from a service provider to meet certain conditions, including that notice and a right to object be provided to the customer.

Fiscal Impact:

• The Department of Justice (DOJ) reports costs of approximately $1.7 million in 2023-24 and $3 million annually thereafter for additional staff and resources to effectively perform consumer and privacy protection investigations, including additional investigative work to obtain the information necessary to satisfy the proposed notice requirements in the bill (General Fund). See Staff Comments for additional detail.
  
• The California Privacy Protection Agency (CPPA) and the Civil Rights Department (CRD) reports absorbable costs.

Background:

A subpoena is a writ or order directed to a person and requiring the person’s attendance at a particular time and place to testify as a witness. It may also require a witness to bring any books, documents, electronically stored information, or other things under the witness’s control which the witness is bound by law to produce in evidence. The heads of state departments are authorized to issue subpoenas in connection with investigations and the prosecution of actions within their jurisdiction.

The California Electronic Communications Privacy Act (CalECPA) generally prohibits a government entity from compelling the production of or access to electronic communication information from a service provider or to electronic device information, as defined, from any person or entity other than the authorized possessor of the device, absent a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant to specified conditions. Concerns have arisen that the protections afforded by CalECPA do not sufficiently protect electronic communication information when sought by an administrative subpoena that is served on a service provider.

Proposed Law:

• Provides that, in addition to any other requirements that govern the use of an administrative subpoena, an administrative subpoena may be used to obtain a customer’s electronic communication information from a service provider only if specified conditions are satisfied, including that the department has served notice of the administrative subpoena on the customer.
• Requires the service provider to produce the electronic communication information specified in the subpoena, as provided, unless the customer has notified the service provider that a motion to quash or modify the subpoena has been filed.
• Requires the relevant proceeding to be afforded priority if a customer files a motion to quash or modify an administrative subpoena issued pursuant hereto. The matter shall be heard within 10 days from the filing of the motion to quash or modify.
• Provides that a service provider is not required to inquire whether, or to determine that, the department has complied with these requirements if the documents served on the service provider facially show compliance. However, the service provider is not precluded from notifying a customer of the receipt of the administrative subpoena.
• Requires a service provider to maintain, for a period of five years, a record of any disclosure of its customers’ electronic communication information pursuant hereto, including a copy of the administrative subpoena.
• Requires a service provider to provide to the customer any part of the record maintained pursuant hereto that relates to the customer, upon customer request and the payment of the reasonable cost of reproduction and delivery.
• Provides that if an administrative subpoena is served on a service provider pursuant hereto, the service provider shall promptly make a copy of any electronic communication information that is within the scope of the subpoena and within the possession of the service provider at the time that the subpoena was served. The copy shall be preserved only until it is disclosed pursuant to the subpoena or the subpoena is quashed or modified.

Related Legislation:

• SB 178 (Leno, Ch. 651, Stats. 2015) established CalECPA.
• SCR 54 (Padilla, Ch. 115, Stats. 2013) directed the California Law Review Commission to recommend to the Legislature how best to “revise statutes governing access by state and local government agencies to customer information from communications service providers” so that these statutes met specified requirements, including safeguarding customers’ constitutional rights, accommodating mobile and Internet-based technologies, and enabling state and local government agencies to protect public safety.

Staff Comments:

Among other requirements, AB 522 would authorize a department to use an administrative subpoena to obtain electronic communication information from a service provider only if certain conditions are met. Existing law provides the attorney general with the authority to issue subpoenas to advance consumer and privacy protection investigations. AB 522 would significantly restrict that authority, as applied to electronic communications, requiring additional staff and resources. The DOJ anticipates needing 4.0 Deputy Attorneys General, 4.0 senior Legal Analysts, 2.0 investigators, and 5.0 legal secretaries, as well as $200,000 per year in expert consulting fees. These additional staff would be placed within the Public Rights Division, in the Consumer Protection Section.

-- END --

SENATE COMMITTEE ON PUBLIC SAFETY

Senator Aisha Wahab, Chair

2023 - 2024 Regular

Bill No: AB 522 Hearing Date: July 11, 2023

Subject: State departments: investigations and hearings: administrative subpoenas

HISTORY

Source: California Law Review Commission

Prior Legislation: SB 178 (Leno), Ch. 651, Stats. 2015

SCR 54 (Padilla) Ch. 115, Stats. 2013

Support: Unknown

Opposition: None known

Assembly Floor Vote: 80 - 0

PURPOSE

The purpose of this bill is to establish procedures that the state must follow to administratively subpoena a person’s electronic communication information.

Existing law the California Electronic Communications Privacy Act (CalECPA), which generally prohibits a government entity from compelling the production of, or access to, electronic communication information without a warrant, wiretap order, an order for electronic reader records, a subpoena, or an order for a pen register or trap and trace device. CalECPA also provides the target whose information is sought the ability to void or modify the warrant or order. (Pen. Code §§ 1546-1546.5.)

Existing law defines a "search warrant" as a written order in the name of the people, signed by a magistrate and directed to a peace officer, commanding them to search for a person or persons, a thing or things, or personal property, and in the case of a thing or things or personal property, bring the same before the magistrate. (Pen. Code, § 1523.)

Existing law provides the specific grounds upon which a search warrant may be issued, including when the property or things to be seized consist of any item or constitute any evidence that tends to show a felony has been committed, or tends to show that a particular person has committed a felony. (Pen. Code, § 1524.)

Existing law provides that a search warrant cannot be issued but upon probable cause, supported by affidavit, naming or describing the person to be searched or searched for, and particularly describing the property, thing, or things and the place to be searched. (Pen. Code, § 1525.)

Existing law requires a magistrate to issue a search warrant if they are satisfied of the existence of the grounds of the application, or that there is probable cause to believe their existence. (Pen. Code, § 1528, subd. (a).)

Existing law requires a provider of electronic communication services or remote computing services to disclose to a governmental prosecuting or investigating agency the name, address, local and long distance telephone toll billing records, telephone number or other subscriber number or identity, and length of service of a subscriber to or customer of that service, and the types of services the subscriber or customer utilized, when the governmental entity is granted a search warrant. (Pen. Code, § 1524.3, subd. (a).)

Existing law states that a governmental entity receiving subscriber records or information is not required to provide notice of the warrant to a subscriber or customer. (Pen. Code, § 1524.3, subd. (b).)

Existing law authorizes a court issuing a search warrant, on a motion made promptly by the service provider, to quash or modify the warrant if the information or records requested are unusually voluminous in nature, or if compliance with the warrant otherwise would cause an undue burden on the provider. (Pen. Code, § 1524.3, subd. (c).)

Existing law requires a provider of wire or electronic communication services or a remote computing service, upon the request of a peace officer, to take all necessary steps to preserve records and other evidence in its possession pending the issuance of a search warrant or a request in writing and an affidavit declaring an intent to file a warrant to the provider. Records shall be retained for a period of 90 days, which shall be extended for an additional 90-day period upon a renewed request by the peace officer. (Pen. Code, § 1524.3, subd. (d).)

Existing law specifies that no cause of action shall be brought against any provider, its officers, employees, or agents for providing information, facilities, or assistance in good faith compliance with a search warrant. (Pen. Code, § 1524.3, subd. (e).)

Existing law provides for a process for a search warrant for records that are in the actual or constructive possession of a foreign corporation that provides electronic communication services or remote computing services to the general public, where the records would reveal the identity of the customers using those services, data stored by, or on behalf of, the customer, the customer’s usage of those services, the recipient or destination of communications sent or from those customers, or the content of those communications. (Pen. Code, § 1524.2.)

Existing law provides that it is the state’s policy to divide the work of executing and administering its laws into departments. (Gov. Code § 11150.)

Existing law empowers state department heads to issue subpoenas for the attendance of witnesses and the production of papers, books, accounts, documents, any writing (as that term is defined under the Evidence Code), tangible things, and testimony pertinent or material to any inquiry, investigation, hearing, proceeding, or action conducted in any part of the state. (Gov. Code § 11181, subd. (e).)

Existing law requires, pursuant to the California Right to Financial Privacy Act, that when a financial institution is served with an administrative subpoena requesting the customer’s records, the customer be given adequate notice and an opportunity to bring a motion to quash the subpoena. (Gov. Code § 7474.)

Existing law requires a consumer, as defined, whose personal records are being subpoenaed from a third party to be given notice and an opportunity to object to the production of their records. (Code Civ. Proc. § 1985.3, subd. (b).)

Existing law authorizes designated persons who are commanded by a subpoena to produce books, documents, or other items to bring a motion in court to quash or modify the subpoena. (Code Civ. Proc. § 1987.1.)

This bill establishes procedures that the state must follow to administratively subpoena a person’s electronic communication information.

This bill defines “customer” to mean “a person or entity that receives an electronic communication service from a service provider.”

This bill conforms its definitions for “electronic communication service,” “electronic communication information” and “service provider” with existing definitions in CalECPA.

This bill provides that an administrative subpoena may be used to obtain a customer’s electronic communication information from a service provider only if all of the following conditions are satisfied:

• The department has properly served the customer with notice of the administrative subpoena, following specified procedures;
• A copy of the administrative subpoena is attached to the notice;
• The administrative subpoena includes the name of the department that issued it and the statutory purpose for which the electronic communication information is to be obtained; and,
• The notice includes a statement in substantially the following form: “The attached subpoena was served on a communication service provider to obtain your electronic communication information. The service provider has made a copy of the information specified in the subpoena. Unless you (1) move to quash or modify the subpoena within 10 days of service of this notice, and (2) notify the service provider that you have done so, the service provider will disclose the information pursuant to the subpoena.”
• The department has served a proof of service on the service provider stating its compliance with the above requirements.

This bill states that unless the customer has notified the service provider that a motion to quash or modify the subpoena has been filed, the service provider shall produce the electronic communication information specified in the subpoena no sooner than 10 days after the department served the proof of service as required.

This bill specifies that if a customer files a motion to quash or modify an administrative subpoena for electronic communication information, the proceeding shall be afforded priority on the court calendar, and the matter shall be heard within 10 days from the filing of the motion to quash or modify.

This bill states that this section does not require a service provider to inquire whether, or to determine that, the department has complied with the requirements of this bill if the documents served on the service provider facially show compliance.

This bill states that a service provider is not precluded from notifying a customer of the receipt of an administrative subpoena.

This bill requires a service provider shall maintain, for a period of five years, a record of any disclosure of its customers’ electronic communication information and shall include a copy of the administrative subpoena.

This bill states that upon customer request and the payment of the reasonable cost of reproduction and delivery, a service provider shall provide to the customer any part of the record maintained that relates to the customer.

This bill provides that if an administrative subpoena is served on a service provider, the service provider shall promptly make a copy of any electronic communication information that is within the scope of the subpoena and within the possession of the service provider at the time that the subpoena was served and preserve the copy only until it is disclosed pursuant to the subpoena or the subpoena is quashed or modified.

COMMENTS

1. Need for This Bill

According to the author of this bill:

As a member of the California Law Revision Commission, consumer protection has continued to be a priority for me to protect vulnerable people. AB 522 would provide greater protection to consumers when the government subpoenas their electronic records via a communications company. Although consumers are in their right to exercise the Fourth Amendment, administrative subpoenas do not grant the consumer adequate time to seek judicial review of the reasonableness of the search before any records are produced. By extending these protections already applied to financial institutions, AB 522 will further protect consumers’ constitutional rights before the state intrudes on their privacy.

1. The California Electronic Communications Privacy Act (CalECPA)

In 2015, the Legislature enacted CalECPA (SB 178 (Leno), Chapter 651 , Statutes of 2015), a comprehensive digital privacy law which took effect on January 1, 2016 (§ 1546 et seq.).

[CalECPA] requires all California state and local law enforcement agencies to obtain a search warrant or wiretap order before they can access any electronic communication information. The law defines ‘electronic communication information’ in the broadest terms possible so that it includes emails, digital documents, text messages, location information, and any digital information stored in the cloud. The law protects all aspects of electronic communication information, not just its contents, but also metadata information relating to the sender, recipient, format, time, date, and location of the communications, including IP addresses.

CalECPA also limits the ability of California law enforcement to obtain information directly from a smartphone or similar device, or to track them. Law enforcement must either obtain a warrant or get the consent of the person possessing the electronic device.

(Daniels, California Updates Privacy Rights with the Electronic Communications Privacy Act (Nov. 17, 2015) JDSupra.

The act defines “electronic device information” as any information stored on or generated through the operation of an electronic device, including the current and prior locations of the device. “Electronic communication information” means any information about an electronic communication or the use of an electronic communication service, including, but not limited to, the contents, sender, recipients, format, or location of the sender or recipients at any point during the communication, the time or date the communication was created, sent, or received, or any information pertaining to any individual or device participating in the communication, including, but not limited to, an IP address. “Government entity” means a department or agency of the state or a political subdivision thereof, or an individual acting for or on behalf of the state or a political subdivision thereof.

This bill cross references CalECPA’s definitions for “electronic communication service,” “electronic communication information” and “service provider” in its provisions.

1. California Law Review Commission Report

Ten years ago, the Legislature enacted Senate Concurrent Resolution 54 (Padilla, Chap. 115, Stats. 2013) (SCR 54), which directed the Commission to recommend to the Legislature how best to “revise statutes governing access by state and local government agencies to customer information from communications service providers” so that these statutes met specified requirements, including safeguarding customers’ constitutional rights, accommodating mobile and Internet-based technologies, and enabling state and local government agencies to protect public safety.

Two years later, many of SCR 54’s requirements were met when the Legislature enacted SB 178 (Leno, Chap. 651, Stats. 2015), CalECPA, which established a legal framework governing how state and local law enforcement agencies could lawfully obtain nearly every form of electronic communications and related data, whether stored in a physical device belonging to a person or in equipment owned or operated by a service provider. Information covered by CalECPA ranges from records of whom a person has spoken to on the phone; to the content of text messages, emails, and voicemails; to metadata such as a person’s location when answering their phone. At its core, CalECPA requires law enforcement agencies to have a search warrant in order to obtain such information. CalECPA also requires that the target of the warrant be given adequate notice (in emergency circumstances, notice can be provided after the fact) and authorizes that person to petition to void or modify the warrant, as well as to move to suppress evidence obtained in violation of the law’s requirements.

The California Law Revision Commission issued a report last year making recommendations to address the one issue that was not resolved by CalECPA, specifically the need for notice to a customer when an administrative subpoena is served on a communication service provider to obtain the customer’s information. (State and Local Agency Access to Electronic Communications: Notice of Administrative Subpoena (Mar. 2022) CLRC, http://www.clrc.ca.gov/pub/Printed-Reports/Pub244-G300.pdf [as of June 29, 2023]. This bill adopts the California Law Revision Commission’s recommendations to provide adequate notice and an opportunity to challenge the subpoena in court before the customer’s records are produced.

1. Constitutional Requirements for a Valid Administrative Subpoena

The United States Supreme Court has recognized the lawfulness of administrative subpoenas. (See v. Seattle (1967) 387 U.S. 541, 544-545.) But people and entities whose records are sought via an administrative subpoena are nevertheless protected by the Fourth Amendment’s prohibition against unreasonable searches and seizures. The California Supreme Court has interpreted the Fourth Amendment as requiring that “the inquiry [in an administrative subpoena] be one which the agency demanding production is authorized to make, that the demand be not too indefinite, and that the information sought be reasonably relevant.” (Brovelli v. Superior Court (1961) 56 Cal.2d 524, 529.)

Moreover, according to the U.S. Supreme Court, “while the demand to inspect may be issued by the agency, in the form of an administrative subpoena, it may not be made and enforced by the inspector in the field, and the subpoenaed party may obtain judicial review of the reasonableness of the demand prior to suffering penalties for refusing to comply.” (See, supra, 387 U.S. at p. 544-545.)

In other words, to meet constitutional standards, an administrative subpoena must make an inquiry for records (i) that the state agency is authorized to make, (ii) that is sufficiently definite, and (iii) that is reasonably relevant to the purposes for which the inquiry is made. The person whose records are being subpoenaed must also have an opportunity to seek judicial review of the administrative subpoena.

This latter requirement can be met by ensuring that the person whose records are being sought has sufficient notice of the subpoena and the ability to move a court to quash (i.e., invalidate) or modify the subpoena, as provided for by this bill.

1. Argument in Support

According to the California Law Review Commission, the sponsor of this bill:

Assembly Bill 522 would implement a recommendation of the California Law Revision Commission (available at http://clrc.ca.gov/pub/Printed-Reports/Pub244-G300.pdf).

The proposed law would require that a customer of a communication service provider be given notice when a state agency seeks to obtain the customer’s electronic communication information, by serving an administrative subpoena on the service provider. This requirement provides a meaningful opportunity for the customer to object to the search in court, before records are provided to the agency.

As the Commission’s recommendation explains, service of the administrative subpoena on the service provider without notice to the customer would likely violate the customer’s Fourth Amendment right against unreasonable search and seizure.

Such a requirement already exists in other areas of the law. For example:

• Under the California Right to Financial Privacy Act a customer must be given notice when a financial institution is served with an administrative subpoena requesting the customer’s records (see Gov’t Code § 7474).

• In pretrial discovery, a “consumer” must be given notice when a subpoena is used to obtain the personal records of the “consumer” from a wide range of third parties who hold such records (see Code Civ. Proc. § 1985.3(b))

-- END –

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2023-2024 Regular Session

Bill No: AB 522 (Author:Kalra)

Version: February 7, 2023

Hearing Date: June 27, 2023

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

State departments: investigations and hearings: administrative subpoenas

DIGEST

This bill requires administrative subpoenas seeking to obtain a customer’s electronic communication information from a service provider to meet certain conditions, including that notice and a right to object be provided to the customer.

EXECUTIVE SUMMARY

A subpoena is a writ or order directed to a person and requiring the person’s attendance at a particular time and place to testify as a witness. It may also require a witness to bring any books, documents, electronically stored information, or other things under the witness’s control which the witness is bound by law to produce in evidence. The heads of state departments are authorized to issue subpoenas in connection with investigations and the prosecution of actions within their jurisdiction.

The California Electronic Communications Privacy Act (CalECPA) generally prohibits a government entity from compelling the production of or access to electronic communication information from a service provider or to electronic device information, as defined, from any person or entity other than the authorized possessor of the device, absent a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant to specified conditions. Concerns have arisen that the protections afforded by CalECPA do not sufficiently protect electronic communication information when sought by an administrative subpoena that is served on a service provider.

This author-sponsored bill requires such administrative subpoenas to also be served on the customer whose electronic communication information is being sought, providing them a right to move to quash or modify the subpoena. It is based on a recommendation by the California Law Revision Commission. There is no known support or opposition. If this bill passes this Committee, it will be referred to the Senate Public Safety Committee.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Enacts the California Electronic Communications Privacy Act (CalECPA), which generally prohibits a government entity from compelling the production of or access to electronic communication information from a service provider or to electronic device information, as defined, from any person or entity other than the authorized possessor of the device, absent a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant to specified conditions, or pursuant to an order for a pen register or trap and trace device, as specified. CalECPA also generally specifies the only conditions under which a government entity may access electronic device information by means of physical interaction or electronic communication with the device, such as pursuant to a search warrant, wiretap order, consent of the owner of the device, or emergency situations, as specified. (Pen. Code § 1546 et seq.)
2. Defines “electronic communication information,” for purposes of CalECPA, to mean any information about an electronic communication or the use of an electronic communication service, including, but not limited to, the contents, sender, recipients, format, or location of the sender or recipients at any point during the communication, the time or date the communication was created, sent, or received, or any information pertaining to any individual or device participating in the communication, including, but not limited to, an IP address. (Pen. Code § 1546.)
3. Provides that the process by which the attendance of a witness is required is the subpoena. It is a writ or order directed to a person and requiring the person’s attendance at a particular time and place to testify as a witness. It may also require a witness to bring any books, documents, electronically stored information, or other things under the witness’s control which the witness is bound by law to produce in evidence. (Code Civ. Proc. § 1985.)
4. Authorizes state department heads to issue subpoenas for the attendance of witnesses and the production of papers, books, accounts, documents, any writing, tangible things, and testimony pertinent or material to any inquiry, investigation, hearing, proceeding, or action conducted in any part of the state, in connection with any authorized investigation or action, as provided. (Gov. Code § 11181.)
5. Establishes the California Law Revision Commission (CLRC). (Gov. Code § 8280.) Directs the CLRC to study any topic that the Legislature, by concurrent resolution or statute, refers to it for study. (Gov. Code § 8293(a).)

This bill:

1. Provides that, in addition to any other requirements that govern the use of an administrative subpoena, an administrative subpoena may be used to obtain a customer’s electronic communication information from a service provider only if all of the following conditions are satisfied:
   1. The department has served notice of the administrative subpoena on the customer, as specified.
   2. A copy of the administrative subpoena is attached to the notice.
   3. The administrative subpoena includes the name of the department that issued it and the statutory purpose for which the electronic communication information is to be obtained.
   4. The notice includes a statement in substantially the following form:
      1. “The attached subpoena was served on a communication service provider to obtain your electronic communication information. The service provider has made a copy of the information specified in the subpoena. Unless you (1) move to quash or modify the subpoena within 10 days of service of this notice, and (2) notify the service provider that you have done so, the service provider will disclose the information pursuant to the subpoena.”
   5. The department has served a proof of service on the service provider stating its compliance with the above.
2. Requires the service provider to produce the electronic communication information specified in the subpoena, as provided, unless the customer has notified the service provider that a motion to quash or modify the subpoena has been filed.
3. Requires the relevant proceeding to be afforded priority if a customer files a motion to quash or modify an administrative subpoena issued pursuant hereto. The matter shall be heard within 10 days from the filing of the motion to quash or modify.
4. Provides that a service provider is not required to inquire whether, or to determine that, the department has complied with these requirements if the documents served on the service provider facially show compliance. However, the service provider is not precluded from notifying a customer of the receipt of the administrative subpoena.
5. Requires a service provider to maintain, for a period of five years, a record of any disclosure of its customers’ electronic communication information pursuant hereto, including a copy of the administrative subpoena.
6. Requires a service provider to provide to the customer any part of the record maintained pursuant hereto that relates to the customer, upon customer request and the payment of the reasonable cost of reproduction and delivery.
7. Provides that if an administrative subpoena is served on a service provider pursuant hereto, the service provider shall promptly make a copy of any electronic communication information that is within the scope of the subpoena and within the possession of the service provider at the time that the subpoena was served. The copy shall be preserved only until it is disclosed pursuant to the subpoena or the subpoena is quashed or modified.
8. Defines “electronic communication information” and “service provider” with cross-references to CalECPA.

COMMENTS

1. The California Electronic Communications Privacy Act (CalECPA)

In 2015, the Legislature enacted CalECPA to protect Californians from intrusive government searches in the digital era.^[1] Senator Mark Leno, the author of the bill, argued that “clear warrant standards for government access to electronic information” needed to be instituted in order “to properly safeguard the robust constitutional privacy and free speech rights of Californians.” He stated the case:

SB 178 updates existing federal and California statutory law for the digital age and codifies federal and state constitutional rights to privacy and free speech by instituting a clear, uniform warrant rule for California law enforcement access to electronic information, including data from personal electronic devices, emails, digital documents, text messages, metadata, and location information. Each of these categories can reveal sensitive information about a Californian’s personal life: her friends and associates, her physical and mental health, her religious and political beliefs, and more. The California Supreme Court has long held that this type of information constitutes a “virtual current biography” that merits constitutional protection. SB 178 would codify that protection into statute.^[2]

CalECPA prohibits a government entity from the following:

• compelling the production of or access to electronic communication information from a service provider;
• compelling the production of or access to electronic device information from any person or entity other than the authorized possessor of the device; or
• accessing electronic device information by means of physical interaction or electronic communication with the electronic device.

(Pen. Code § 1546.1.) CalECPA provides an exclusive list of exceptions to these prohibitions, including the issuance of a valid warrant or wiretap order. A government entity may access electronic device information by means of physical interaction or electronic communication with the device under certain circumstances, including with the specific consent of the authorized possessor of the device or the owner of the device, when the device has been reported as lost or stolen. It can also be accessed if the entity has a good faith belief that an emergency involving danger of death or serious physical injury to any person requires access to the electronic device information.

The act defines “electronic device information” as any information stored on or generated through the operation of an electronic device, including the current and prior locations of the device. “Electronic communication information” means any information about an electronic communication or the use of an electronic communication service, including, but not limited to, the contents, sender, recipients, format, or location of the sender or recipients at any point during the communication, the time or date the communication was created, sent, or received, or any information pertaining to any individual or device participating in the communication, including, but not limited to, an IP address. “Government entity” means a department or agency of the state or a political subdivision thereof, or an individual acting for or on behalf of the state or a political subdivision thereof.

1. The limitations of CalECPA in protecting electronic communication information

Although CalECPA applies broadly to “government entities,” it generally restricts access via subpoena only when connected to criminal investigations. It authorizes a government entity to compel the production of or access to electronic communication information from a service provider, or compel the production of or access to electronic device information from any person or entity other than the authorized possessor of the device under certain circumstances, including:

Pursuant to a subpoena issued pursuant to existing state law, provided that the information is not sought for the purpose of investigating or prosecuting a criminal offense, and compelling the production of or access to the information via the subpoena is not otherwise prohibited by state or federal law.

(Pen. Code § 1546.1(b).)

Existing law authorizes state department heads to investigate and prosecute actions concerning all matters relating to the business activities and subjects under the jurisdiction of the department, violations of any law or rule or order of the department, and such other matters as may be provided by law. (Gov. Code § 11180.) In connection with such investigations or actions, these departments are authorized to carry out certain acts, including issuing subpoenas for the attendance of witnesses and the production of papers, books, accounts, documents, writings, tangible things, and testimony pertinent or material to any inquiry, investigation, hearing, proceeding, or action conducted in any part of the state. (Gov. Code § 11181.)

Therefore, CalECPA does not adequately apply its due process protections when these administrative subpoenas are issued by government entities.

1. Filling the gap in protections

This bill is sponsored by the California Law Revision Commission. CLRC was initially tasked with studying and reporting on the constitutional concerns in connection with government access to electronic communication information. Many of the opportunities for reform were accomplished by the passage of CalECPA; however, CLRC believes that there is one specific area that was not resolved by CalECPA, the need for notice to a customer when an administrative subpoena is served on a service provider seeking to obtain the customer’s electronic communication information.

The issue stems from the fact that when a customer’s electronic communication information is sought by a government entity through service of an administrative subpoena on a service provider, the customer receives no notice and does not have an opportunity to object or assert its rights.

The CLRC explains the issue in a report^[3] issued last year, entitled State and Local Agency Access to Electronic Communications: Notice of Administrative Subpoena:

A warrant supported by probable cause is not the only constitutionally sufficient authority to conduct a search that is governed by the Fourth Amendment of the United States Constitution and Section 13 of Article I of the California Constitution. In some circumstances, a search pursuant to a subpoena duces tecum, issued by a state administrative agency, can also be constitutionally reasonable.

The use of an administrative subpoena to compel the production of evidence (rather than a warrant) does not violate the Fourth Amendment, so long as the subpoena is authorized, sufficiently definite, and reasonable:

Insofar as the prohibition against unreasonable searches and seizures can be said to apply at all it requires only that the inquiry be one which the agency demanding production is authorized to make, that the demand be not too indefinite, and that the information sought be reasonably relevant.^[4]

However, courts have held that a search pursuant to an administrative subpoena is constitutionally permissible only if the person whose records would be searched has notice and an opportunity to move to quash or modify the subpoena before any records are actually produced.^[5]

The CLRC report goes on to explain courts’ reasoning that issuance of a subpoena starts an adversarial process that ensures adequate due process is afforded. However, the CLRC reports points out that this reasoning is only sound when a subpoena is served on the person whose records will be searched:

[T]hat will not necessarily be the case when a subpoena is served on a communication service provider for access to a customer’s records. In the latter situation, the customer may not be notified of the subpoena and might have no real opportunity to object before records are produced. That would undermine or negate the above argument for the constitutionality of a search by administrative subpoena. In particular, if the customer is not separately notified of the subpoena, then only the communication service provider will have an opportunity to object to the subpoena through an adversarial judicial process. That will often be insufficient to protect the interests of the customer, because the interests of the service provider and customer are not the same. The service provider will mostly be concerned with unreasonable burdens created by the subpoena; the customer is concerned with privacy. In order to ensure that the use of an administrative subpoena to obtain customer records from a communication service provider is constitutional, the customer must be given notice and an opportunity to challenge the subpoena in court before the customer’s records are produced.

Therefore, the constitutional concerns that prompted the passage of CalECPA continue to apply where administrative subpoenas seek to gain access to customer electronic communication information without adequate notice and process afforded the customer.

This bill addresses this issue by requiring certain conditions be satisfied before an administrative subpoena can be used to obtain a customer’s electronic communication information from a service provider.^[6] First, the relevant state entity must serve notice of the administrative subpoena on the customer and attach a copy of the actual subpoena. The subpoena must include certain information, including the name of the department that issued it; the statutory purpose for which the electronic communication information is to be obtained; and a statement informing the customer of their rights to this effect:

“The attached subpoena was served on a communication service provider to obtain your electronic communication information. The service provider has made a copy of the information specified in the subpoena. Unless you (1) move to quash or modify the subpoena within 10 days of service of this notice, and (2) notify the service provider that you have done so, the service provider will disclose the information pursuant to the subpoena.”

The department must provide proof of service to the subpoenaed service provider and the provider is not required to otherwise establish such compliance. However, the provider is authorized to notify the customer of the subpoena.

The service provider is required to turn over the information unless the customer informs it that the customer has moved to quash or modify the subpoena. If such motion is made, it shall be given priority in the court and be heard within 10 days of filing. Service providers are required to maintain records of any such disclosures and provide them to a customer upon demand, as specified.

These protections are already largely afforded in the context of accessing customers’ financial records through administrative subpoenas served on financial institutions. The California Right to Financial Privacy Act (the Act) provides that an officer, employee, or agent of a state or local agency or department thereof, may obtain financial records pursuant to an administrative subpoena or summons otherwise authorized by law and served upon the financial institution only if certain conditions are met, including that a copy of the subpoena or summons be served on the customer. (Gov. Code § 7474.) Similar to this bill, the Act also requires that the subpoena include the name of the agency or department in whose name the subpoena is issued and the statutory purpose for which the information is to be obtained. The customer must then be given 10 days to move to quash the subpoena and notify the financial institution.

1. Stakeholder positions

According to the author:

As a member of the California Law Revision Commission, consumer protection has continued to be a priority for me to protect vulnerable people. AB 522 would provide greater protection to consumers when the government subpoenas their electronic records via a communications company. Although consumers are in their right to exercise the Fourth Amendment, administrative subpoenas do not grant the consumer adequate time to seek judicial review of the reasonableness of the search before any records are produced. By extending these protections already applied to financial institutions, AB 522 will further protect consumers’ constitutional rights before the state intrudes on their privacy.

SUPPORT

None known

OPPOSITION

None known

RELATED LEGISLATION

Pending Legislation: AB 561 (Chen, 2023) allows service of process and subpoenas to incarcerated individuals on the first try at a state prison or county jail if the prison or county jail is the recipient party’s only reasonably known address by leaving a copy with the warden, sheriff, or jailer of that state prison or county jail. AB 561 is currently in the Assembly Public Safety Committee.

Prior Legislation:

SB 178 (Leno, Ch. 651, Stats. 2015) established CalECPA.

SCR 54 (Padilla, Ch. 115, Stats. 2013) directed the CLRC to recommend to the Legislature how best to “revise statutes governing access by state and local government agencies to customer information from communications service providers” so that these statutes met specified requirements, including safeguarding customers’ constitutional rights, accommodating mobile and Internet-based technologies, and enabling state and local government agencies to protect public safety.

PRIOR VOTES:

Assembly Floor (Ayes 80, Noes 0)

Assembly Appropriations Committee (Ayes 15, Noes 0)

Assembly Public Safety Committee (Ayes 8, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 11, Noes 0)

**************

1. SB 178 (Leno, Ch. 651, Stats. 2015), Pen. Code § 1546 et seq. ↑

2. Senate Public Safety Committee (2015) Committee Analysis of SB 178. ↑

3. State and Local Agency Access to Electronic Communications: Notice of Administrative Subpoena (Mar. 2022) CLRC, http://www.clrc.ca.gov/pub/Printed-Reports/Pub244-G300.pdf [as of June 17, 2023]. ↑

4. Citing Brovelli v. Superior Court (1961) 56 Cal.2d 524, 529. ↑

5. Citing In re Subpoena Duces Tecum (4th Cir. 2000) 228 F.3d 341, 347-48; People v. West Coast Shows, Inc. (1970) 10 Cal.App.3d 462, 470 (“The Government Code provides an opportunity for adjudication of all claimed constitutional and legal rights before one is required to obey the command of a subpoena duces tecum issued for investigative purposes.”). ↑

6. The definitions used in the bill for “electronic communication information” and “service provider” cross-reference those in CalECPA. ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 522

Author:(Kalra)

As Introduced Ver:February 7, 2023

Majority vote

SUMMARY

Establishes procedures that the state must follow to administratively subpoena a person's electronic communication information while meeting constitutional due process requirements.

Major Provisions

1. Defines the following terms:
2. "Electronic communication information" means information about an electronic communication, including but not limited to, its contents, sender, recipients, or format; the location of the sender or recipients; the time or date the communication was created or sent; or any other information pertaining to any individual or device participating in the communication. The definition includes Internet Protocol (IP) addresses.
3. "Service provider" means a person or entity that offers an electronic communication service.
4. "Customer" means a person or entity that receives an electronic communication service from a service provider
5. Sets forth requirements that a state department must satisfy before it can use an administrative subpoena to obtain a customer's electronic communication information from a service provider using an administrative subpoena, including properly serving the customer with notice of the administrative subpoena. The notice must include a copy of the subpoena, the department's name, and the statutory purpose for obtaining the electronic communication information.
6. Requires a service provider, if the requirements above are met, to produce the electronic communication information specified in an administrative subpoena 10 days or more after being served—unless a customer notifies the service provider of having filed a motion to quash or modify the subpoena.
7. Clarifies that a service provider need not independently inquire into, or determine that, a state department has complied with this bill's requirements if the department provides the service provider with documents showing compliance.
8. Requires service providers to maintain, for a period of five years, a record of any disclosure of a customer's electronic communication information and to provide this record to the customer upon payment of the reasonable cost of reproduction and delivery.

COMMENTS

Background. Eight years ago, the Legislature enacted SB 178 ((Leno), Chapter 651, Statutes of 2015), the California Electronic Communications Privacy Act (CalECPA). CalECPA established a legal framework governing how state and local law enforcement agencies can lawfully obtain nearly every form of electronic communications and related data, whether stored in a physical device belonging to a person or in equipment owned or operated by a service provider. Information covered by CalECPA ranges from records of whom a person has spoken to on the phone; to the content of text messages, emails, and voicemails; to metadata such as a person's location when answering their phone. At its core, CalECPA requires law enforcement agencies to have a search warrant in order to obtain such information. CalECPA also requires that the target of the warrant be given adequate notice (in emergency circumstances, notice can be provided after the fact) and authorizes that person to petition to void or modify the warrant, as well as to move to suppress evidence obtained in violation of the law's requirements.

The text of this bill originates with the California Law Revision Commission (Commission). Before the passage of CalECPA, the Commission had issued recommendations addressing how electronic communications could be lawfully obtained. But, as observed by the Commission, "[CalECPA] addressed nearly all of the legal deficiencies that the Commission had identified in its study." (49 Cal. L. Revision Comm'n Preprint Recommendation #G-300 (2022) 1 (CLRC Report), available at http://clrc.ca.gov/pub/Printed-Reports/RECpp-G300.pdf.) Nevertheless, the Commission added, "a few minor matters [have] not been addressed by CalECPA[.]" (Ibid.) This bill addresses one of these unaddressed matters: establishing procedures through which the state may administratively subpoena a customer's electronic communications information in a manner that satisfies constitutional due process requirements.

What is an administrative subpoena? In criminal and civil court cases, it is common for parties to exercise the court's authority to subpoena—this is, order the production of—records in the possession of third parties who are not otherwise involved in the case. The purpose of issuing such a subpoena, known as a subpoena duces tecum ("bring with you under penalty of law"), is to obtain evidence. Take the example of injured workers who sue their employer for failing to provide adequate protective gear. In defending itself, the employer would ordinarily use a subpoena duces tecum to obtain medical records from doctors who treated the workers, to learn more information about the workers' injuries. (See, generally, Code of Civil Procedure Sections 1985-1997.)

A subpoena duces tecum may also be used to obtain evidence in an administrative proceeding, i.e., an investigation or an enforcement action brought by a state agency, rather than a dispute decided in court. In this context, subpoenas duces tecum are commonly known as "administrative subpoenas." (Throughout this document, the term "state agency" is intended to apply to any part of California's executive branch, whether an agency, department, board, committee, or commission, that possesses administrative subpoena power under statute.)

The types of proceedings in which administrative subpoenas can be used vary widely, reflecting the many issues addressed by California state agencies. For example, the California Court of Appeal recently upheld the power of the State Water Resources Control Board to subpoena financial documents in order to determine the relationship between entities being investigated for water quality violations. (State Water Resources Control Bd. v. Baldwin (2020) 45 Cal. App. 5th 40.) In a much older case, the California Supreme Court authorized the issuance of administrative subpoenas in disciplinary hearings before the State Board of Medical Examiners. (Shively v. Stewart (1966) 65 Cal. 2d 475.)

State agencies are granted general authority to issue administrative subpoenas under Government Code Section 11181. Among the third-party records that a state agency may seek to obtain using an administrative subpoena are records of electronic communications.

Constitutional requirements for a valid administrative subpoena. The United States Supreme Court has recognized the lawfulness of administrative subpoenas. (See v. Seattle (1967) 387 U.S. 541, 544-5 (White, J).) But people and entities whose records are sought via an administrative subpoena are nevertheless protected by the Fourth Amendment's prohibition against unreasonable searches and seizures.

To meet Constitutional standards, an administrative subpoena must make an inquiry for records (i) that the state agency is authorized to make, (ii) that is sufficiently definite, and (iii) that is reasonably relevant to the purposes for which the inquiry is made. (Brovelli v. Superior Court (1961) 56 Cal. 2d 524, 529.) The person whose records are being subpoenaed must also have an opportunity to seek judicial review of the administrative subpoena. (See, supra, 387 U.S. at 544-45.)

What this bill would do. This bill would establish the following process to be followed by a state agency when administratively subpoenaing electronic communications information:

1. When an administrative subpoena is served on a communication service provider to obtain customer records, the subpoenaing agency would need to serve notice on the affected customer. The notice would include a copy of the subpoena and a specified advisory statement.
2. The subpoena would require that the service provider make and retain a copy of the requested records, to prevent spoliation [i.e., destruction of records], until the subpoena operates or is quashed.
3. Proof of service of the notice to the customer would be served on the communication service provider.
4. Unless the customer first moves to quash the subpoena and notifies the service provider of that fact, the requested records must be produced 10 days after the proof of service is served on the communication service provider. (CLRC Report 4.)

Under this bill, the subpoena would have to include the department's name and the statutory purpose for obtaining the electronic communication information. The advisory statement referenced in step 1 would read:

The attached subpoena was served on a communication service provider to obtain your electronic communication information. The service provider has made a copy of the information specified in the subpoena. Unless you (1) move to quash or modify the subpoena within 10 days of service of this notice, and (2) notify the service provider that you have done so, the service provider will disclose the information pursuant to the subpoena.

What are the implications of this bill for due process and for privacy protections? The process this bill establishes would appear to meet Constitutional due process standards, by giving the person whose records are being subpoenaed sufficient notice of the records being sought, so that the person has an opportunity to move a court to modify or quash the subpoena.

The ten days' notice provided for in this bill is identical to the notice period in at least two other pertinent California laws that govern subpoenas of a person's information from third parties. The first is the California Right to Financial Privacy Act, Government Code Sections 7460-7493, which regulates government access to customer records held by financial institutions. That Act provides customers with ten days after notice to move to quash an administrative subpoena. (Government Code Section 7474.) The ten-day notice period was first enacted into law in 1978. (See Chapter 1346, Statutes of 1978.)

The second law providing a similar ten-day notice period is included in the procedures governing issuance of subpoenas duces tecum to third parties in court proceedings. A party who serves such a subpoena in order to compel the production of records containing the personal information of a consumer must provide notice to the consumer that their records are being sought. The customer then has ten days to object to production of the records or move to quash or modify the subpoena. (Civil Protections Code Section 1985.3.) This provision was first enacted in 1980. (See Chapter 976, Statutes of 1980.)

The fact that the processes established by these statutes have withstood Constitutional scrutiny for over four decades strongly suggests that the ten-day notice period under this bill will be found to provide adequate due process protections. This bill is also commendable for enhancing privacy protections for people whose electronic communication information is the subject of an administrative subpoena.

According to the Author

As a member of the California Law Revision Commission, consumer protection has continued to be a priority for me to protect vulnerable people. AB 522 would provide greater protection to consumers when the government subpoenas their electronic records via a communications company. Although consumers are in their right to exercise the Fourth Amendment, administrative subpoenas do not grant the consumer adequate time to seek judicial review of the reasonableness of the search before any records are produced. By extending these protections already applied to financial institutions, AB 522 will further protect consumers' constitutional rights before the state intrudes on their privacy.

Arguments in Support

None on file.

Arguments in Opposition

None on file.

FISCAL COMMENTS

According to the Assembly Appropriations Committee:

1. Costs of an unknown, but significant amount, likely in the high hundreds of thousands of dollars to low millions of dollars annually, for the Department of Justice (DOJ) to perform consumer and privacy protection investigations to obtain the information necessary to satisfy the bill's proposed notice requirements. For its part, the DOJ estimates these costs to be approximately $3 million annually to fund four deputy attorney generals, four legal analysts, two investigators, five legal secretaries and $200,000 in consultant costs.
2. Collective costs of an unknown, but presumably significant amount, for state agencies to produce notice documents, notify customers of requests for records and present proof of such notice to service providers (various funds).

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 11-0-0

YES: Gabriel, Joe Patterson, Bauer-Kahan, Bennett, Essayli, Vince Fong, Irwin, Lowenthal, Papan, Wicks, Wilson

ASM PUBLIC SAFETY: 8-0-0

YES: Jones-Sawyer, Alanis, Bonta, Bryan, Lackey, Ortega, Santiago, Zbur

ASM APPROPRIATIONS: 15-0-1

YES: Holden, Megan Dahle, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Hart, Lowenthal, Mathis, Papan, Pellerin, Sanchez, Weber, Ortega

ABS, ABST OR NV: Robert Rivas

UPDATED

VERSION: February 7, 2023

CONSULTANT: Jith Meganathan / P. & C.P. / (916) 319-2200 FN: 0000527

Date of Hearing: May 17, 2023

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Chris Holden, Chair

ABPCA Bill Id:AB 522

Author:(Kalra) – As Introduced Ver:February 7, 2023

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill establishes a process a state agency must follow when serving a subpoena on a provider of electronic communication services to obtain a customer’s electronic communication information.

Specifically, this bill requires the following when a state agency serves a subpoena to a service provider to obtain a customer’s electronic information:

1. The state agency has served notice of the administrative subpoena on the customer.
2. A copy of the administrative subpoena is attached to the notice.
3. The administrative subpoena includes the name of the state agency that issued it and the statutory purpose for which the electronic communication information is to be obtained.
4. The notice includes a statement in substantially the following form:

The attached subpoena was served on a communication service provider to obtain your electronic communication information. The service provider has made a copy of the information specified in the subpoena. Unless you (1) move to quash or modify the subpoena within 10 days of service of this notice, and (2) notify the service provider that you have done so, the service provider will disclose the information pursuant to the subpoena.

1. The state agency has served a proof of service on the service provider stating the agency’s compliance with all of the preceding requirements.

The subpoena requires the service provider make and retain a copy of the requested records for five years. The service provider must receive from the state agency proof of service of the notice to the customer. Unless the customer first moves to quash the subpoena and notifies the service provider of that fact, the service provider must produce the records within 10 days after the proof of service is served on the communication service provider.

FISCAL EFFECT:

Costs of an unknown, but significant amount, likely in the high hundreds of thousands of dollars to low millions of dollars annually, for the Department of Justice (DOJ) to perform consumer and privacy protection investigations to obtain the information necessary to satisfy the bill’s proposed notice requirements. For its part, the DOJ estimates these costs to be approximately $3 million annually to fund four deputy attorney generals, four legal analysts, two investigators, five legal secretaries and $200,000 in consultant costs.

Collective costs of an unknown, but presumably significant amount, for state agencies to produce notice documents, notify customers of requests for records and present proof of such notice to service providers (various funds).

COMMENTS:

Background and Purpose. The California Electronic Communications Privacy Act (CalECPA) established a legal framework governing how state and local law enforcement agencies could lawfully obtain nearly every form of electronic communications and related data, whether stored in a physical device belonging to a person or in equipment owned or operated by a service provider. Generally, CalECPA requires law enforcement agencies to have a search warrant in order to obtain such information. CalECPA also requires that the person who is the target of the warrant be given adequate notice and authorizes that person to petition to void or modify the warrant, as well as to move to suppress evidence obtained in violation of the law’s requirements.

In 2103, statute directed the California Law Revision Commission to study the constitutional and statutory law on state and local agency access to customer records of communication service providers and to prepare statutory reforms to protect customers’ constitutional rights. The commission reports that, before it could begin to develop statutory reforms, the Legislature enacted the CalECPA (SB 178, Leno, Chapter 651, Statutes of 2015), which, according to the commission, “addressed nearly all of the legal deficiencies the Commission had identified in its study.” (See the commission’s “State and Local Agency Access to Electronic Communications: Notice of Administrative Subpoena,” March 2022.)

The commission cited one issue not addressed by the CalECPA, that is, when a subpoena is served on a communication service provider for access to a customer’s records. According to the commission, in such a circumstance:

the customer may not be notified of the subpoena and might have no real opportunity to object before records are produced. That would undermine or negate the above argument for the constitutionality of a search by administrative subpoena.

For this reason, the commission recommended enactment law to require notice to the affected customer when an administrative subpoena is served on a communication service provider to obtain the customer’s records. This bill creates such law. According to the author:

AB 522 would provide greater protection to consumers when the government subpoenas their electronic records via a communications company. Although consumers are in their right to exercise the Fourth Amendment, administrative subpoenas do not grant the consumer adequate time to seek judicial review of the reasonableness of the search before any records are produced. By extending these protections already applied to financial institutions, AB 522 will further protect consumers’ constitutional rights before the state intrudes on their privacy

Analysis Prepared by: Jay Dickenson / APPR. / (916) 319-2081

Date of Hearing: April 25, 2023

Counsel: Andrew Ironside

ASSEMBLY COMMITTEE ON

Reginald Byron Jones-Sawyer, Sr., Chair

ABPCA Bill Id:

Author:() – As Ver:

SUMMARY:

Establishes procedures that the state must follow to administratively subpoena a person’s electronic communication information. Specifically, this bill:

1. Establishes the following conditions that a state department must satisfy before it can obtain a customer’s electronic communication information from a service provider using an administrative subpoena:
2. The department must properly serve the customer with notice of the administrative subpoena, following specified procedures;
   
3. A copy of the administrative subpoena must be attached to the notice;
   
4. The administrative subpoena must include the department’s name and the statutory purpose for obtaining the electronic communication information;
   
5. The notice must include the following statement: “The attached subpoena was served on a communication service provider to obtain your electronic communication information. The service provider has made a copy of the information specified in the subpoena. Unless you (1) move to quash or modify the subpoena within 10 days of service of this notice, and (2) notify the service provider that you have done so, the service provider will disclose the information pursuant to the subpoena”; and,
   
6. The department must serve a proof of service on the service provider that states that the department has complied with the above conditions.
7. Requires the service provider to produce the electronic communication information specified in an administrative subpoena 10 days or more after being served, unless the customer has notified the service provider that a motion to quash or modify the subpoena has been filed.
8. Requires a court, if a customer files a motion to quash or modify an administrative subpoena, to give the motion priority on its calendar and to hear the matter within 10 days of the filing of the motion.
9. Provides that a service provider need not inquire into, or determine that, a state department has complied with these requirements if the department provides the service provider with documents showing compliance.
10. Provides that a service provider may notify a customer that it has received an administrative subpoena for the customer’s electronic communication information.
11. Requires service providers to maintain, for a period of five years, a record of any disclosure of a customer’s electronic communication information and to provide this record to the customer upon payment of the reasonable cost of reproduction and delivery.
12. Defines “customer” as a person or entity that receives an electronic communication service from a service provider.
13. Defines “electronic communication” as the transfer of signs, signals, writings, images, sounds, data, or intelligence, whether in whole or in part, by a wire, radio, electromagnetic, photoelectric, or photo-optical system.
14. Defines “electronic communication information” as information about an electronic communication, including but not limited to, its contents, sender, recipients, or format; the location of the sender or recipients; the time or date the communication was created or sent; or any other information pertaining to any individual or device participating in the communication, including Internet Protocol (IP) addresses.
15. Defines “service provider” as a person or entity that offers an electronic communication service.

EXISTING FEDERAL LAW:

1. Provides that the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched and the persons or things to be seized. (U.S. Const., 4th Amend.)
   

EXISTING STATE LAW:

1. Provides that the right of the people to be secure in their persons, houses, papers, and effects against unreasonable seizures and searches may not be violated; and a warrant may not issue except on probable cause, supported by oath or affirmation, particularly describing the place to be searched and the persons and things to be seized. (Cal. Const., art. I, § 13.)
2. Provides that all people are by nature free and independent and have inalienable rights, including privacy. (Cal. Const., Art. I, § 1.)
3. Establishes the California Electronic Communications Privacy Act (CalECPA), which generally prohibits a government entity from compelling the production of, or access to, electronic communication information without a warrant, wiretap order, an order for electronic reader records, a subpoena, or an order for a pen register or trap and trace device. CalECPA also provides the target whose information is sought the ability to void or modify the warrant or order. (Pen. Code §§ 1546-1546.5.)
4. Defines a "search warrant" as a written order in the name of the people, signed by a magistrate and directed to a peace officer, commanding them to search for a person or persons, a thing or things, or personal property, and in the case of a thing or things or personal property, bring the same before the magistrate. (Pen. Code, § 1523.)
   
5. Provides the specific grounds upon which a search warrant may be issued, including when the property or things to be seized consist of any item or constitute any evidence that tends to show a felony has been committed, or tends to show that a particular person has committed a felony. (Pen. Code, § 1524.)
   
6. Provides that a search warrant cannot be issued but upon probable cause, supported by affidavit, naming or describing the person to be searched or searched for, and particularly describing the property, thing, or things and the place to be searched. (Pen. Code, § 1525.)
   
7. Requires a magistrate to issue a search warrant if they are satisfied of the existence of the grounds of the application, or that there is probable cause to believe their existence. (Pen. Code, § 1528, subd. (a).)
   
8. Requires a provider of electronic communication services or remote computing services to disclose to a governmental prosecuting or investigating agency the name, address, local and long distance telephone toll billing records, telephone number or other subscriber number or identity, and length of service of a subscriber to or customer of that service, and the types of services the subscriber or customer utilized, when the governmental entity is granted a search warrant. (Pen. Code, § 1524.3, subd. (a).)
   
9. States that a governmental entity receiving subscriber records or information is not required to provide notice of the warrant to a subscriber or customer. (Pen. Code, § 1524.3, subd. (b).)
   
10. Authorizes a court issuing a search warrant, on a motion made promptly by the service provider, to quash or modify the warrant if the information or records requested are unusually voluminous in nature, or if compliance with the warrant otherwise would cause an undue burden on the provider. (Pen. Code, § 1524.3, subd. (c).)
    
11. Requires a provider of wire or electronic communication services or a remote computing service, upon the request of a peace officer, to take all necessary steps to preserve records and other evidence in its possession pending the issuance of a search warrant or a request in writing and an affidavit declaring an intent to file a warrant to the provider. Records shall be retained for a period of 90 days, which shall be extended for an additional 90-day period upon a renewed request by the peace officer. (Pen. Code, § 1524.3, subd. (d).)
    
12. Specifies that no cause of action shall be brought against any provider, its officers, employees, or agents for providing information, facilities, or assistance in good faith compliance with a search warrant. (Pen. Code, § 1524.3, subd. (e).)
    
13. Provides for a process for a search warrant for records that are in the actual or constructive possession of a foreign corporation that provides electronic communication services or remote computing services to the general public, where the records would reveal the identity of the customers using those services, data stored by, or on behalf of, the customer, the customer’s usage of those services, the recipient or destination of communications sent or from those customers, or the content of those communications. (Pen. Code, § 1524.2.)
    
14. Provides that it is the state’s policy to divide the work of executing and administering its laws into departments. (Gov. Code § 11150.)
15. Empowers state department heads to issue subpoenas for the attendance of witnesses and the production of papers, books, accounts, documents, any writing (as that term is defined under the Evidence Code), tangible things, and testimony pertinent or material to any inquiry, investigation, hearing, proceeding, or action conducted in any part of the state. (Gov. Code § 11181, subd. (e).)
16. Requires, pursuant to the California Right to Financial Privacy Act, that when a financial institution is served with an administrative subpoena requesting the customer’s records, the customer be given adequate notice and an opportunity to bring a motion to quash the subpoena. (Gov. Code § 7474.)
17. Requires a consumer, as defined, whose personal records are being subpoenaed from a third party to be given notice and an opportunity to object to the production of their records. (Code Civ. Proc. § 1985.3, subd. (b).)
18. Authorizes designated persons who are commanded by a subpoena to produce books, documents, or other items to bring a motion in court to quash or modify the subpoena. (Code Civ. Proc. § 1987.1.)

FISCAL EFFECT:

Unknown

COMMENTS:

1. Author's Statement: According to the author, “As a member of the California Law Revision Commission, consumer protection has continued to be a priority for me to protect vulnerable people. AB 522 would provide greater protection to consumers when the government subpoenas their electronic records via a communications company. Although consumers are in their right to exercise the Fourth Amendment, administrative subpoenas do not grant the consumer adequate time to seek judicial review of the reasonableness of the search before any records are produced. By extending these protections already applied to financial institutions, AB 522 will further protect consumers’ constitutional rights before the state intrudes on their privacy.”
   
2. Background: This bill originates with the California Law Revision Commission (Commission). Ten years ago, the Legislature enacted Senate Concurrent Resolution 54 (Padilla, Chap. 115, Stats. 2013) (SCR 54), which directed the Commission to recommend to the Legislature how best to “revise statutes governing access by state and local government agencies to customer information from communications service providers” so that these statutes met specified requirements, including safeguarding customers’ constitutional rights, accommodating mobile and Internet-based technologies, and enabling state and local government agencies to protect public safety.
   
   Two years later, many of SCR 54’s requirements were met, and much of the need for Commission action in this area obviated, when the Legislature enacted SB 178 (Leno, Chap. 651, Stats. 2015), the California Electronic Communications Privacy Act (CalECPA). CalECPA established a legal framework governing how state and local law enforcement agencies could lawfully obtain nearly every form of electronic communications and related data, whether stored in a physical device belonging to a person or in equipment owned or operated by a service provider. Information covered by CalECPA ranges from records of whom a person has spoken to on the phone; to the content of text messages, emails, and voicemails; to metadata such as a person’s location when answering their phone. At its core, CalECPA requires law enforcement agencies to have a search warrant in order to obtain such information. CalECPA also requires that the target of the warrant be given adequate notice (in emergency circumstances, notice can be provided after the fact) and authorizes that person to petition to void or modify the warrant, as well as to move to suppress evidence obtained in violation of the law’s requirements.
   
   As observed by the Commission, “[CalECPA] addressed nearly all of the legal deficiencies that the Commission had identified in its study.” (Cal. L. Revision Comm’n Preprint Recommendation #G-300 (June 21, 2022) p. 1 (CLRC Report), <http://clrc.ca.gov/pub/Printed-Reports/RECpp-G300.pdf> [last visited Apr. 17, 2023].) Nevertheless, the Commission added, “a few minor matters [have] not been addressed by CalECPA[.]” (Ibid.) This bill would address one of these unaddressed matters: establishing procedures through which the state may administratively subpoena a customer’s electronic communications information in a manner that satisfies constitutional due process requirements.
   
3. Administrative Subpoenas: In criminal and civil court cases, it is common for parties to exercise the court’s authority to subpoena—this is, order the production of—records in the possession of third parties who are not otherwise involved in the case. The purpose of issuing such a subpoena, known as a subpoena duces tecum (“bring with you under penalty of law”), is to obtain evidence. Take the example of injured workers who sue their employer for failing to provide adequate protective gear. In defending itself, the employer would ordinarily use a subpoena duces tecum to obtain medical records from doctors who treated the workers, to learn more information about the workers’ injuries. (See generally Code Civ. Proc. §§ 1985-1997.)
   
   A subpoena duces tecum may also be used to obtain evidence in an administrative proceeding, i.e., an investigation or an enforcement action brought by a state agency, rather than a dispute decided in court. In this context, subpoenas duces tecum are commonly known as “administrative subpoenas.”^[1]
   
   The types of proceedings in which administrative subpoenas can be used vary widely, reflecting the many issues addressed by California state agencies. For example, the California Court of Appeal recently upheld the power of the State Water Resources Control Board to subpoena financial documents in order to determine the relationship between entities being investigated for water quality violations. (State Water Resources Control Bd. v. Baldwin & Sons, Inc. (2020) 45 Cal.App.5th 40.) In a much older case, the California Supreme Court authorized the issuance of administrative subpoenas in disciplinary hearings before the State Board of Medical Examiners. (Shively v. Stewart (1966) 65 Cal.2d 475.)
   
   State agencies are granted general authority to issue administrative subpoenas under Government Code section 11181:

In connection with any investigation or action authorized by this article, the department head may do any of the following:

[…]

(e) Issue subpoenas for the attendance of witnesses and the production of papers, books, accounts, documents, any writing…, tangible things, and testimony pertinent or material to any inquiry, investigation, hearing, proceeding, or action conducted in any part of the state.

Specific statutes may also provide procedures for issuing administrative subpoenas for particular types of information. For example, the California Right to Financial Privacy Act (CRFPA), regulates government access to customer records held by financial institutions. (See Gov. Code §§ 7460-7493.) A state or local agency that wishes to obtain customer records held by financial institutions, e.g., to investigate alleged fraud or elder abuse, must follow the procedures in the CRFPA, rather than Government Code section 11181, in order to administratively subpoena such records.

1. Constitutional Requirements for a Valid Administrative Subpoena: The United States Supreme Court has recognized the lawfulness of administrative subpoenas. (See v. Seattle (1967) 387 U.S. 541, 544-545.) But people and entities whose records are sought via an administrative subpoena are nevertheless protected by the Fourth Amendment’s prohibition against unreasonable searches and seizures. The California Supreme Court has interpreted the Fourth Amendment as requiring that “the inquiry [in an administrative subpoena] be one which the agency demanding production is authorized to make, that the demand be not too indefinite, and that the information sought be reasonably relevant.” (Brovelli v. Superior Court (1961) 56 Cal.2d 524, 529.)
   
   Moreover, according to the U.S. Supreme Court, “while the demand to inspect may be issued by the agency, in the form of an administrative subpoena, it may not be made and enforced by the inspector in the field, and the subpoenaed party may obtain judicial review of the reasonableness of the demand prior to suffering penalties for refusing to comply.” (See, supra, 387 U.S. at p. 544-545.)
   
   In other words, to meet constitutional standards, an administrative subpoena must make an inquiry for records (i) that the state agency is authorized to make, (ii) that is sufficiently definite, and (iii) that is reasonably relevant to the purposes for which the inquiry is made. The person whose records are being subpoenaed must also have an opportunity to seek judicial review of the administrative subpoena.
   
   This latter requirement can be met by ensuring that the person whose records are being sought has sufficient notice of the subpoena and the ability to move a court to quash (i.e., invalidate) or modify the subpoena, as provided for by this bill.
   
2. Need for the Bill: Among the third-party records that a state agency may seek to obtain using an administrative subpoena are records of electronic communications. As explained by the California Law Review Commission:
   

[W]hen a subpoena is served on a communication service provider for access to a customer’s records…the customer may not be notified of the subpoena and might have no real opportunity to object before records are produced. That would undermine or negate…the constitutionality of a search by administrative subpoena.

In particular, if the customer is not separately notified of the subpoena, then only the communication service provider will have an opportunity to object to the subpoena through an adversarial judicial process. That will often be insufficient to protect the interests of the customer, because the interests of the service provider and customer are not the same. The service provider will mostly be concerned with unreasonable burdens created by the subpoena; the customer is concerned with privacy. (CLRC Report, supra, at p. 3)

The issue, then, is that a person may have a legal basis to quash or modify an administrative subpoena seeking their electronic communications information but, under current law, they will not be informed of the subpoena. While their communications provider will be notified, the provider likely has no interest in resisting the subpoena and/or may be unaware of the customer’s legal basis for doing so. This arguably violates the customer’s due process rights. Per the California Law Review Commission:

In order to ensure that the use of an administrative subpoena to obtain customer records from a communication service provider is constitutional, the customer must be given notice and an opportunity to challenge the subpoena in court before the customer’s records are produced. (CLRC report, supra, at p. 3.)

In order to remedy this deficiency, this bill would require a subpoenaing agency, when an administrative subpoena is served on a communication service provider to obtain customer records, to serve notice of the subpoena on the affected customer. The notice must include a copy of the subpoena and a specified advisory statement, which states:

The attached subpoena was served on a communication service provider to obtain your electronic communication information. The service provider has made a copy of the information specified in the subpoena. Unless you (1) move to quash or modify the subpoena within 10 days of service of this notice, and (2) notify the service provider that you have done so, the service provider will disclose the information pursuant to the subpoena.

This bill would require the service provider to make and retain a copy of the requested records until the subpoena operates or is quashed. It also requires that a state agency serve proof of service of the notice to the customer on the communication service provider. Moreover, unless the customer first moves to quash the subpoena and notifies the service provider of that fact, the service provider must produce the requested records no sooner than 10 days after the proof of service is served on it.

1. Implications for Due Process and Privacy Protections: The process this bill establishes would appear to meet constitutional due process standards by giving the person whose records are being subpoenaed sufficient notice of the records being sought, so that the person has an opportunity to move a court to modify or quash the subpoena.
   
   The 10-day notice requirement in this bill is identical to the notice period in at least two other pertinent California laws that govern subpoenas of a person’s information from third parties. Gov. Code § 7474; Code Civ. Proc. § 1985.3.) The fact that the processes established by these statutes have remained in effect for over four decades suggests that the ten-day notice period under this bill will be found to provide adequate due process protections.
2. Argument in Support: According to the California Law Revision Commission, “Assembly Bill 522 (Kalra), would implement a recommendation of the California Law Revision Commission on State and Local Agency Access to Electronic Communications: Notice of Administrative Subpoena (March 2022).
   
   “The California Law Revision Commission has been directed to prepare proposed legislation on government access to customer records of communication service providers, in order to protect customers’ constitutional rights.
   
   “Most of the areas for possible reform that the Commission identified were addressed by the California Electronic Communication Privacy Act (“Cal-ECPA”), which was enacted before the Commission could complete its work on this study.
   
   “This recommendation addresses one issue that was not resolved by Cal-ECPA, the need for notice to a customer when an administrative subpoena is served on a communication service provider to obtain the customer’s information. The proposed law would require such notice.”
3. Related Legislation: AB 793 (Bonta), would prohibit a government entity from seeking or obtaining information from a reverse-location demand or a reverse-keyword demand, and prohibits any person or government entity from complying with a reverse-location demand or a reverse-keyword demand. AB 793 is pending hearing in the Assembly Judiciary Committee.
   
4. Prior Legislation:
   1. AB 1242 (Bauer-Kahan), Chapter 627, Statutes of 2022, among other things, amended CalECPA to prohibit corporations incorporated in, or whose principal offices are located in, California from providing information in response to a warrant or other legal process if the process relates to an investigation into, or enforcement of, a law creating liability for providing, facilitating, or obtaining an abortion that is legal under California law.
   2. AB 928 (Grayson), of the 2019-2020 Legislative Session, would have created a CalECPA exemption by allowing law enforcement to use an administrative subpoena, rather than a warrant, to obtain information regarding a subscriber suspected of engaging in the exploitation or attempted exploitation of a child. AB 928 failed passage in the Assembly Public Safety Committee.
   3. SB 811 (Committee on Public Safety), Chapter 269, Statutes of 2017, createed an exception to CalECPA’s notice requirements if a government entity accesses information concerning the location or the telephone number of an electronic device in order to respond to an emergency 911 call from that device.
   4. AB 165 (Cooper), of the 2017-2018 Legislative Session, would have created a CalECPA exemption by allowing local educational agencies to access information from electronic devices belonging to students enrolled in kindergarten through 12th grade. AB 165 failed passage in the Assembly Public Safety Committee.
   5. SB 1121 (Leno), Chapter 541, Statutes of 2016, made a number of minor amendments to CalECPA in order to address unintended consequences and outstanding stakeholder concerns.
   6. SB 178 (Leno), Chap. 651, Statutes of 2015, enacted CalECPA.

REGISTERED SUPPORT / OPPOSITION:

Support

California Law Revision Commission

Opposition

None submitted.

Analysis Prepared by:

1. Throughout this analysis, the term “state agency” is intended to apply to any part of the executive branch, whether an agency, department, board, committee, or commission, that possesses administrative subpoena power under statute. ↑

Date of Hearing: March 21, 2023

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Jesse Gabriel, Chair

ABPCA Bill Id:AB 522 (

Author:Kalra) – As Introduced Ver:February 7, 2023

SUBJECT: State departments: investigations and hearings: administrative subpoenas

SYNOPSIS

This author-sponsored measure enacts a recommendation of the California Law Review Commission. Under current law, state agencies have the power to subpoena (that is, order the production of) documents and other information when they are conducting an investigation or an enforcement proceeding. The person whose information is being sought has the power to oppose the subpoena by moving a court to modify or quash it on the grounds that it is unlawful in some respect.

A difficulty arises if the records being sought are in the possession of a third party. While the third party ought to receive timely notice of the subpoena, that party may lack the interest or ability to assert the right to modify or quash the subpoena on behalf of the person whose information is being sought.

This deficiency is particularly glaring if the information being sought is electronic communication information, such as emails, text messages, or a person’s location while making telephone calls. Such information is protected from unauthorized seizure by law enforcement under the California Electronic Privacy Act (CalECPA), but CalECPA does not address administrative subpoenas.

This bill would address this gap by enacting procedures whereby a person whose records are subject to an administrative subpoena is given both notice and an opportunity to respond. These procedures appear to satisfy constitutional due process standards while enhancing privacy protections for electronic communication information.

If passed by this Committee, this bill will next be heard by the Assembly Public Safety Committee.

SUMMARY: Establishes procedures that the state must follow to administratively subpoena a person’s electronic communication information while meeting constitutional due process requirements. Specifically, this bill:

1. Defines the following terms:
2. “Electronic communication” means the transfer of signs, signals, writings, images, sounds, data, or intelligence, whether in whole or in part, by a wire, radio, electromagnetic, photoelectric, or photo-optical system.
3. “Electronic communication information” means information about an electronic communication, including but not limited to, its contents, sender, recipients, or format; the location of the sender or recipients; the time or date the communication was created or sent; or any other information pertaining to any individual or device participating in the communication. The definition includes Internet Protocol (IP) addresses.
4. “Service provider” means a person or entity that offers an electronic communication service.
5. “Customer” means a person or entity that receives an electronic communication service from a service provider
6. Sets forth the following conditions that a state department must satisfy before it can use an administrative subpoena to obtain a customer’s electronic communication information from a service provider using an administrative subpoena:
7. The department must properly serve the customer with notice of the administrative subpoena, following procedures outlined in the Code of Civil Procedure.
8. A copy of the administrative subpoena must be attached to the notice.
9. The administrative subpoena must include the department’s name and the statutory purpose for obtaining the electronic communication information.
10. The notice must include the following statement: “The attached subpoena was served on a communication service provider to obtain your electronic communication information. The service provider has made a copy of the information specified in the subpoena. Unless you (1) move to quash or modify the subpoena within 10 days of service of this notice, and (2) notify the service provider that you have done so, the service provider will disclose the information pursuant to the subpoena.”
11. The department must serve a proof of service on the service provider that states the department has complied with 2) a) – d).
12. Requires a service provider, if the requirements above are met, to produce the electronic communication information specified in an administrative subpoena 10 days or more after being served—unless a customer notifies the service provider of having filed a motion to quash or modify the subpoena.
13. Requires a court to give priority on its calendar to any motion to quash or modify an administrative subpoena for electronic communication information, so that the motion is heard within 10 days of its filing.
14. Clarifies that a service provider need not independently inquire into, or determine that, a state department has complied with this bill’s requirements if the department provides the service provider with documents showing compliance.
15. Clarifies that a service provider may notify a customer that it has received a subpoena for the customer’s electronic communication information.
16. Requires service providers to maintain, for a period of five years, a record of any disclosure of a customer’s electronic communication information and to provide this record to the customer upon payment of the reasonable cost of reproduction and delivery.

EXISTING LAW:

1. Establishes the California Law Revision Commission (Commission). (Gov. Code § 8280.)
2. Specifies that the duties of the Commission include:
3. Examining the common law and statutes of the state and judicial decisions for the purpose of discovering defects and anachronisms in the law and recommending needed reforms.
4. Recommending, from time to time, such changes in the law as it deems necessary to modify or eliminate antiquated and inequitable rules of law, and to bring the law of this state into harmony with modern conditions. (Gov. Code § 8289.)
5. Provides, pursuant to the U.S. Constitution, that “the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched and the persons or things to be seized.” (U.S. Const., 4th Amend.)
6. Establishes the California Electronic Communications Privacy Act (CalECPA), which generally prohibits a government entity from compelling the production of, or access to, electronic communication information without a warrant, wiretap order, an order for electronic reader records, a subpoena, or an order for a pen register or trap and trace device. CalECPA also provides the target whose information is sought the ability to void or modify the warrant or order. (Pen. Code §§ 1546-1546.5.)
7. Provides that it is the state’s policy to divide the work of executing and administering its laws into departments. (Gov. Code § 11150.)
8. Empowers state department heads to issue subpoenas for the attendance of witnesses and the production of papers, books, accounts, documents, any writing (as that term is defined under the Evidence Code), tangible things, and testimony pertinent or material to any inquiry, investigation, hearing, proceeding, or action conducted in any part of the state. (Gov. Code § 11181(e).)
9. Requires, pursuant to the California Right to Financial Privacy Act, that when a financial institution is served with an administrative subpoena requesting the customer’s records, the customer be given adequate notice and an opportunity to bring a motion to quash the subpoena. (Gov. Code § 7474.)
10. Requires a consumer, as defined, whose personal records are being subpoenaed from a third party to be given notice and an opportunity to object to the production of their records. (Code Civ. Proc. § 1985.3(b).)
11. Authorizes designated persons who are commanded by a subpoena to produce books, documents, or other items to bring a motion in court to quash or modify the subpoena. (Code Civ. Proc. § 1987.1.)

FISCAL EFFECT: As currently in print this bill is keyed non-fiscal.

COMMENTS:

1) Background. The text of this bill originates with the California Law Revision Commission (Commission). Ten years ago, the Legislature enacted Senate Concurrent Resolution 54 (Padilla, Chap. 115, Stats. 2013) (SCR 54), which directed the Commission to recommend to the Legislature how best to “revise statutes governing access by state and local government agencies to customer information from communications service providers” so that these statutes met specified requirements, including safeguarding customers’ constitutional rights, accommodating mobile and Internet-based technologies, and enabling state and local government agencies to protect public safety.

Two years later, many of SCR 54’s requirements were met, and much of the need for Commission action in this area obviated, when the Legislature enacted SB 178 (Leno, Chap. 651, Stats. 2015), the California Electronic Communications Privacy Act (CalECPA). CalECPA established a legal framework governing how state and local law enforcement agencies could lawfully obtain nearly every form of electronic communications and related data, whether stored in a physical device belonging to a person or in equipment owned or operated by a service provider. Information covered by CalECPA ranges from records of whom a person has spoken to on the phone; to the content of text messages, emails, and voicemails; to metadata such as a person’s location when answering their phone. At its core, CalECPA requires law enforcement agencies to have a search warrant in order to obtain such information. CalECPA also requires that the target of the warrant be given adequate notice (in emergency circumstances, notice can be provided after the fact) and authorizes that person to petition to void or modify the warrant, as well as to move to suppress evidence obtained in violation of the law’s requirements.

As observed by the Commission, “[CalECPA] addressed nearly all of the legal deficiencies that the Commission had identified in its study.” (49 Cal. L. Revision Comm’n Preprint Recommendation #G-300 (2022) 1 (CLRC Report), available at http://clrc.ca.gov/pub/Printed-Reports/RECpp-G300.pdf.) Nevertheless, the Commission added, “a few minor matters [have] not been addressed by CalECPA[.]” (Ibid.) This bill addresses one of these unaddressed matters: establishing procedures through which the state may administratively subpoena a customer’s electronic communications information in a manner that satisfies constitutional due process requirements.

2) Author’s Statement. The author states:

As a member of the California Law Revision Commission, consumer protection has continued to be a priority for me to protect vulnerable people. AB 522 would provide greater protection to consumers when the government subpoenas their electronic records via a communications company. Although consumers are in their right to exercise the Fourth Amendment, administrative subpoenas do not grant the consumer adequate time to seek judicial review of the reasonableness of the search before any records are produced. By extending these protections already applied to financial institutions, AB 522 will further protect consumers’ constitutional rights before the state intrudes on their privacy.

3) What is an administrative subpoena? In criminal and civil court cases, it is common for parties to exercise the court’s authority to subpoena—this is, order the production of—records in the possession of third parties who are not otherwise involved in the case. The purpose of issuing such a subpoena, known as a subpoena duces tecum (“bring with you under penalty of law”), is to obtain evidence. Take the example of injured workers who sue their employer for failing to provide adequate protective gear. In defending itself, the employer would ordinarily use a subpoena duces tecum to obtain medical records from doctors who treated the workers, to learn more information about the workers’ injuries. (See, generally, Code of Civil Procedure §§ 1985-1997.)

A subpoena duces tecum may also be used to obtain evidence in an administrative proceeding, i.e., an investigation or an enforcement action brought by a state agency, rather than a dispute decided in court. In this context, subpoenas duces tecum are commonly known as “administrative subpoenas.” (Note: throughout this analysis, the term “state agency” is intended to apply to any part of the executive branch, whether an agency, department, board, committee, or commission, that possesses administrative subpoena power under statute.)

The types of proceedings in which administrative subpoenas can be used vary widely, reflecting the many issues addressed by California state agencies. For example, the California Court of Appeal recently upheld the power of the State Water Resources Control Board to subpoena financial documents in order to determine the relationship between entities being investigated for water quality violations. (State Water Resources Control Bd. v. Baldwin (2020) 45 Cal. App. 5th 40.) In a much older case, the California Supreme Court authorized the issuance of administrative subpoenas in disciplinary hearings before the State Board of Medical Examiners. (Shively v. Stewart (1966) 65 Cal. 2d 475.)

State agencies are granted general authority to issue administrative subpoenas under Government Code § 11181:

11181. In connection with any investigation or action authorized by this article, the department head may do any of the following:

[…]

(e) Issue subpoenas for the attendance of witnesses and the production of papers, books, accounts, documents, any writing…, tangible things, and testimony pertinent or material to any inquiry, investigation, hearing, proceeding, or action conducted in any part of the state.

Specific statutes may also provide procedures for issuing administrative subpoenas for particular types of information. For example, the California Right to Financial Privacy Act, Government Code §§ 7460-7493, regulates government access to customer records held by financial institutions. A state or local agency that wishes to obtain customer records held by financial institutions, e.g., to investigate alleged fraud or elder abuse, must follow the procedures in this Act, rather than the more-general Government Code § 11181, in order to administratively subpoena such records.

4) Constitutional requirements for a valid administrative subpoena. The United States Supreme Court has recognized the lawfulness of administrative subpoenas. (See v. Seattle (1967) 387 U.S. 541, 544-5 (White, J).) But people and entities whose records are sought via an administrative subpoena are nevertheless protected by the Fourth Amendment’s prohibition against unreasonable searches and seizures. The California Supreme Court has interpreted the Fourth Amendment as requiring that “the inquiry [in an administrative subpoena] be one which the agency demanding production is authorized to make, that the demand be not too indefinite, and that the information sought be reasonably relevant.” (Brovelli v. Superior Court (1961) 56 Cal. 2d 524, 529.)

Moreover, according to the U.S. Supreme Court, “while the demand to inspect may be issued by the agency, in the form of an administrative subpoena, it may not be made and enforced by the inspector in the field, and the subpoenaed party may obtain judicial review of the reasonableness of the demand prior to suffering penalties for refusing to comply.” (See, supra, 387 U.S. at 544-45.)

In other words, to meet Constitutional standards, an administrative subpoena must make an inquiry for records (i) that the state agency is authorized to make, (ii) that is sufficiently definite, and (iii) that is reasonably relevant to the purposes for which the inquiry is made. The person whose records are being subpoenaed must also have an opportunity to seek judicial review of the administrative subpoena.

This latter requirement can be met by ensuring that the person whose records are being sought has sufficient notice of the subpoena and the ability to move a court to quash (i.e., invalidate) or modify the subpoena.

5) Why is this bill necessary? Among the third-party records that a state agency may seek to obtain using an administrative subpoena are records of electronic communications. As explained by the California Law Review Commission:

[W]hen a subpoena is served on a communication service provider for access to a customer’s records…the customer may not be notified of the subpoena and might have no real opportunity to object before records are produced. That would undermine or negate…the constitutionality of a search by administrative subpoena.

In particular, if the customer is not separately notified of the subpoena, then only the communication service provider will have an opportunity to object to the subpoena through an adversarial judicial process. That will often be insufficient to protect the interests of the customer, because the interests of the service provider and customer are not the same. The service provider will mostly be concerned with unreasonable burdens created by the subpoena; the customer is concerned with privacy. (CLRC Report 3)

The issue, then, is that a person may have a legal basis to quash or modify an administrative subpoena seeking their electronic communications information, but under current law, they will not be informed of the subpoena. While their communications provider will be notified, the provider likely has no interest in resisting the subpoena and/or may be unaware of the customer’s legal basis for doing so. This arguably violates the customer’s due process rights. Per the California Law Review Commission:

In order to ensure that the use of an administrative subpoena to obtain customer records from a communication service provider is constitutional, the customer must be given notice and an opportunity to challenge the subpoena in court before the customer’s records are produced. (Ibid.)

In order to remedy this deficiency, this bill would establish the following process to be followed by a state agency when administratively subpoenaing electronic communications information:

1. When an administrative subpoena is served on a communication service provider to obtain customer records, the subpoenaing agency would need to serve notice on the affected customer. The notice would include a copy of the subpoena and a specified advisory statement.
2. The subpoena would require that the service provider make and retain a copy of the requested records, to prevent spoliation [i.e., destruction of records], until the subpoena operates or is quashed.
3. Proof of service of the notice to the customer would be served on the communication service provider.
4. Unless the customer first moves to quash the subpoena and notifies the service provider of that fact, the requested records must be produced 10 days after the proof of service is served on the communication service provider. (CLRC Report 4.)

Under this bill, the subpoena would have to include the department’s name and the statutory purpose for obtaining the electronic communication information. The advisory statement referenced in step 1 would read:

The attached subpoena was served on a communication service provider to obtain your electronic communication information. The service provider has made a copy of the information specified in the subpoena. Unless you (1) move to quash or modify the subpoena within 10 days of service of this notice, and (2) notify the service provider that you have done so, the service provider will disclose the information pursuant to the subpoena.

6) What are the implications of this bill for due process and for privacy protections? The process this bill establishes would appear to meet Constitutional due process standards, by giving the person whose records are being subpoenaed sufficient notice of the records being sought, so that the person has an opportunity to move a court to modify or quash the subpoena.

The ten days’ notice provided for in this bill is identical to the notice period in at least two other pertinent California laws that govern subpoenas of a person’s information from third parties. The first is the California Right to Financial Privacy Act, Government Code §§ 7460-7493, mentioned above, which regulates government access to customer records held by financial institutions. The Act provides customers with ten days after notice to move to quash an administrative subpoena. (Gov. Code § 7474.) The ten-day notice period was first enacted into law in 1978. (See Chap. 1346, Stats. 1978.)

The second law providing a similar ten-day notice period is included in the procedures governing issuance of subpoenas duces tecum to third parties in court proceedings. A party who serves such a subpoena in order to compel the production of records containing the personal information of a consumer must provide notice to the consumer that their records are being sought. The customer then has ten days to object to production of the records or move to quash or modify the subpoena. (Code Civ. Proc. § 1985.3.) This provision was first enacted in 1980. (See Chap. 976, Stats. 1980.)

The fact that the processes established by these statutes have withstood Constitutional scrutiny for over four decades strongly suggests that the ten-day notice period under this bill will be found to provide adequate due process protections.

This bill is also commendable for enhancing privacy protections for people whose electronic communication information is the subject of an administrative subpoena.

7) Related legislation. AB 1242 (Bauer-Kahan, Chap. 627, Stats. 2022), among other things, amended CalECPA to prohibit corporations incorporated in, or whose principal offices are located in, California from providing information in response to a warrant or other legal process if the process relates to an investigation into, or enforcement of, a law creating liability for providing, facilitating, or obtaining an abortion that is legal under California law.

AB 928 (Grayson, 2019) would have created a CalECPA exemption by allowing law enforcement to use an administrative subpoena, rather than a warrant, to obtain information regarding a subscriber suspected of engaging in the exploitation or attempted exploitation of a child. The bill failed in the Assembly Public Safety Committee.

SB 811 (Public Safety, Chap. 269, Stats. 2017) created an exception to CalECPA’s notice requirements if a government entity accesses information concerning the location or the telephone number of an electronic device in order to respond to an emergency 911 call from that device.

AB 165 (Cooper, 2017) would have created a CalECPA exemption by allowing local educational agencies to access information from electronic devices belonging to students enrolled in kindergarten through 12th grade. The bill failed in this Committee.

SB 1121 (Leno, Chap. 541, Stats. 2016) made a number of minor amendments to CalECPA in order to address unintended consequences and outstanding stakeholder concerns.

SB 178 (Leno, Chap. 651, Stats. 2015) enacted CalECPA.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

None on file

Analysis Prepared by: Jith Meganathan / P. & C.P. / (916) 319-2200