Proposed Bill Would Protect Customer Metadata Stored in the Cloud

By Laura Stotler, TMCnet Contributing Editor  |  April 29, 2022

A new proposed Congressional bill would create more legal protections for customer data stored in cloud- based systems. The Warrant for Metadata Act, introduced by Rep. Ted Lieu of California, would create additional protections for any metadata generated by customers of online service providers, as well as the content of electronic communications generated by them.

The Act, which is an amendment to the Stored Communications Act, would require government authorities to obtain a search warrant for any metadata associated with customer communications through online service providers. According to the current Act, a warrant is required to obtain the contents of any of those communications, but not the metadata associated with them.

According to Lieu, the amendment is important since communications metadata can contain a large amount of information about service providers' customers as well as their online communications.

“In Ukraine, for example, reporters are able to use the metadata collected from digital photos on social media -- like the location a photo was taken and whether it has been manipulated -- to verify the photos’ legitimacy,” said Lieu. “Organizing and analyzing metadata can offer a wealth of information for individuals and businesses to help with things like decision-making and operations.”

Lieu added that large amounts of metadata also create potential risks, particularly when it comes to civil liberties.

“Right now, a governmental entity can seize an individual’s metadata stored on the cloud without needing a warrant,” said Lieu. “Current law has failed to keep up with the advancements and nuances of technology related to cloud computing.”

The proposed legislation would eliminate limitations “on the warrant requirement for recent communications and those that have been in electronic storage for more than 180 days” and require “a governmental entity to obtain a search warrant to compel providers to disclose the content of wire or electronic communications held in electronic storage regardless of how old the communication is,” according to a statement from Lieu's office.




Edited by Maurice Nagle