H.R. 2604 — Protecting Data at the Border Act

This section states congressional findings that (1) U.S. persons have a reasonable expectation of privacy in the digital contents of their electronic equipment, online accounts, and online presence; (2) the Supreme Court in Riley v. California recognized extraordinary privacy interests in electronic equipment such as cell phones; (3) such privacy interests differ in degree and kind from those in closed containers; and (4) accessing such data or information without a warrant based on probable cause is unreasonable under the Fourth Amendment.

This section defines key terms for purposes of the Act, including (1) access credential (i.e., a username, password, PIN number, fingerprint, or biometric indicator); (2) border (i.e., the international border of the United States and the functional equivalent of such border); (3) digital contents (i.e., any signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by electronic equipment, or stored in electronic equipment or an online account); (4) electronic communication service (as defined in 18 U.S.C. 2510); (5) electronic equipment (i.e., a computer, as defined in 18 U.S.C. 1030(e)); (6) governmental entity (i.e., a department or agency of the United States, including any officer, employee, contractor, or other agent thereof); (7) online account (i.e., an online account with an electronic communication service or remote computing service); (8) online account information (i.e., the screen name or other identifier or information that would allow a governmental entity to identify the online presence of an individual); (9) remote computing service (as defined in 18 U.S.C. 2711); and (10) United States person (i.e., an individual who is a United States person, as defined in 50 U.S.C. 1801).

This section establishes procedures limiting governmental entities' access to digital contents of electronic equipment or online accounts belonging to or possessed by U.S. persons at the U.S. border. It generally prohibits (1) such access without a warrant supported by probable cause; (2) denial of entry into or exit from the United States based on a U.S. person's refusal to disclose access credentials, provide access, or supply online account information; and (3) delays of entry or exit exceeding 4 hours to determine if such consent will be provided. The section provides emergency exceptions permitting warrantless access by designated DHS officers if an emergency involves immediate danger of death or serious injury, national security threats, or organized crime activities, provided a warrant application is submitted within 7 days (with data destruction, nondisclosure, and notice to the person required if no warrant is obtained); or for public safety purposes (e.g., fire or medical services) unrelated to criminal investigations. It further requires governmental entities to provide written notice—in a language understood by the U.S. person—explaining these protections prior to requesting consent for access, credentials, or information.

This section establishes an exclusionary rule prohibiting the use in evidence of digital contents or online account information—and any evidence derived therefrom—obtained in violation of the Act, in any federal, state, or local trial, hearing, or other proceeding, including immigration proceedings (as defined in INA §101(a)). The rule applies in the same manner as the wiretap exclusionary rule in 18 U.S.C. §2515, to the maximum extent practicable.

This section prohibits a governmental entity from seizing electronic equipment belonging to or in the possession of a United States person at the border unless there is probable cause to believe the equipment contains information relevant to an allegation that the person has committed a felony.

This section requires the Secretary of Homeland Security to submit to Congress, and publicly post on the Department of Homeland Security (DHS) website by March each year, a report on DHS officer and employee access during the previous calendar year to digital contents of electronic equipment or online accounts of individuals at U.S. borders. The report must include (1) the number of times DHS personnel conducted specified actions regarding U.S. persons, such as accessing contents pursuant to a probable-cause warrant (under Federal Rules of Criminal Procedure), emergency authority under section 5(b), written consent under section 5(c), a consensually disclosed access credential under section 5(c), or in violation of section 5; accessed non-U.S. persons' contents; or accessed at another governmental entity's request; (2) aggregate data on the number of U.S. persons and non-U.S. persons (by nationality) whose contents or account information was accessed, including the most recent country of departure for each group; and (3) aggregate data on the perceived race and ethnicity of all individuals whose contents or account information was accessed.

This section provides savings provisions clarifying that the Act does not (1) prohibit governmental entities from conducting warrantless inspections of the external physical components of electronic equipment to detect weapons or contraband, including activating or attempting to activate an object to verify it is electronic equipment; or (2) limit governmental authorities under the Foreign Intelligence Surveillance Act (50 U.S.C. 1801 et seq.).