Internet Library of Law
and Court Decisions

Email, Right of Privacy and Internet Use - Internet Library of Law and Court Decisions - Updated March 25, 2008

This section of the Internet Law Library contains court decisions analyzing an employee's right of privacy in his or her office computer, or in email sent over his employer's company email system, and his employer's right to inspect the same. This section also contains court decisions which address an employer's legal responsibility for inappropriate or offensive email sent by employees over a company email system. Court decisions addressing the legality of other uses of email, including those containing forged headers and/or identifiers, are also analyzed.

Court denied motion to dismiss complaint charging the defendant Union and two of its organizers with violating the CAN-SPAM Act by sending email solicitations promoting union membership to Verizon employees which purported to come from Verizon managers who did not authorize their transmission.  The Virginia District Court held that it could exercise personal jurisdiction over the non-resident Union organizers because both the corporate servers used to transmit these emails, as well as some of the employees who received them, were located in Virginia. 

The Court further held that plaintiff Verizon had stated valid CAN-SPAM claims against the defendants.  In reaching this result, the Court rejected defendants’ contentions that their solicitations constituted non-commercial speech promoting union membership exempt from the strictures of CAN-SPAM.  Because the Union rendered a service – representation of employees – for a fee – union dues – the emails constituted commercial speech.  As such, held the Court, the failure of these emails to accurately describe their source, or to appropriately advise that they were, in fact, advertisements, as well as their failure to provide mandated opt-out instructions, rendered their senders potentially liable for violations of CAN-SPAM.

Court denies bloggers' motion for a protective order, which sought to quash a subpoena served by plaintiff Apple Computer, Inc. ("Apple") on Nfox, the e-mail service provider for the blog PowerPage.  The subpoena sought materials, including e-mails, that would permit Apple to identify the individual(s) who transmitted trade secret information about an Apple product to PowerPage, which information PowerPage subsequently published on its blog/website.  The Court held that the bloggers were not entitled to such relief under California's 'Shield Law,' as that statute only protects journalists from being found in contempt for failing to produce information, and does not support a motion to quash.  Similarly, such relief could not be grounded on the privilege afforded journalists under the First Amendment, as this privilege cannot be used to prevent the disclosure of information related to criminal activity such as that at issue here, the disclosure of trade secrets.  Because Apple had made a prima facie case that a crime had occurred, it was entitled to the requested discovery.

Court holds that the use of a company's e-mail system by an employee to send personal e-mails to the employee's personal counsel does not, without more, waive any attorney client privilege in such communications.  Whether a waiver had occurred must instead be resolved by examining the employee's subjective and objective expectations that the communications would be confidential.  In analyzing this question, Courts should look for guidance to cases that address an employee's privacy rights in e-mail sent over company e-mail systems, which hinge on the resolution of a similar question -- the reasonableness of an employee's expectation of privacy in such e-mails.  Issues of fact as to the existence and application of company computer usage policies, and whether employees were warned that the Company could inspect e-mails sent over the company's system, prevented the Court from resolving the issue at this time.

The Court further held that any privileges attendant to certain additional e-mails between company employees and their personal counsel had been waived by their voluntary transmission of such e-mails both to counsel representing the company, and to a consultant rendering services to the company.

Court holds that an e-mail sent by one merchant to another purporting to confirm an agreement to purchase goods is sufficient to satisfy the requirements for a writing contained in the Statute of Frauds, as set forth in NY UCC § 2-201(2), known as the merchant's exception.  The e-mail in question was sent to defendant by a third party on behalf of plaintiff, and had attached as a pdf file a letter on plaintiff's letterhead which closed with the typed signature of plaintiff's president.  The attached letter recited that the parties had an agreement, and set forth a quantity of items to be purchased, but not the price to be paid therefore.  The court nonetheless held that issues of fact existed as to both the existence of a contract between the parties for the purchase of the goods at issue, and its enforceability under the Statute of Frauds, which precluded the grant of defendant's motion for summary judgment, or dismissal of plaintiff's complaint.

The Eighth Circuit, affirming the court below, dismisses invasion of privacy claims brought by an employee of a state university under the Fourth and Fourteenth Amendments arising out of the search of his office computer by University employees.  The University undertook the search in connection with a discovery request in a pending arbitration.  As a result of documents discovered in this search, the University terminated plaintiff.  The Eighth Circuit held that plaintiff's claims failed, both because plaintiff had no reasonable expectation of privacy in his computer in light of the University's computer policy, and because the search was reasonable given its scope and motivation.  The Court reached this result notwithstanding the fact that the University's policy provided that "a user can expect the files and data he … generates to be private information."  Plaintiff's claims were also dismissed because they were advanced against University employees who authorized the search, who, as public officials, possessed a qualified immunity from such claims which plaintiff was unable to overcome.  Plaintiff's claims against these individuals failed because of his inability to submit evidence sufficient to establish that a reasonable official would have believed the search at issue violated plaintiff's Fourth Amendment rights.

Granting defendant’s motion for summary judgment, the District Court dismisses defamation, trademark infringement, and invasion of privacy claims brought by plaintiffs against a blogger.  The claims arose out of defendant’s publication of articles on his blog, featuring plaintiff’s trademark, that were critical of plaintiffs’ eBay auction listing business. 

The Court held plaintiff’s trademark dilution claims failed because defendant used the mark in connection with “news reporting and news commentary,” a non-actionable use under the Federal dilution statute.  The Court held plaintiffs’ defamation claims failed because the statements at issue – which purportedly accused plaintiff Schmidt of being a “yes man” ‘who overpromised and underdelivered’ were non-actionable statements of opinion.  Finally, the Court held plaintiffs’ invasion of privacy claims – which were premised on a link on defendant’s blog to another site which contained a picture of plaintiffs – failed.  The Curt rested this holding on its determination both that South Carolina does not recognize a claim for false light invasion of privacy, and that, in any event, the link and article in question did not cast plaintiffs in a false light.  The Court also grounded its rejection of this claim on its holding that the link and corresponding use of the photo did not constitute a viable ‘wrongful appropriation of personalty’ invasion of privacy claim, given that plaintiffs had consented to the use of their photo on the internet site on which it was contained.

Colorado Court of Appeals holds that a governmental official has a limited expectation of privacy in sexually explicit and romantic e mails he sent to a female subordinate via a County’s e mail system.  This expectation of privacy was created, in part, by the County’s e-mail policy.  As a result, the Court remanded for reconsideration so much of the trial court’s decision which directed disclosure of these e-mails pursuant to Colorado’s Open Records Act (“CORA”).  On remand, the trial court was directed to determine the “least intrusive” form of disclosure necessary to serve the “compelling state interests” for which such disclosure was sought.

Employer's review of e-mail of a personal and sexual nature sent by employee over company system did not constitute invasion of employee's right of privacy under either the California Constituion or common law where employee signed a form agreeing to restrict use of e-mail to company purposes, and had been notified by other employees that e-mail was reviewed by people other than the intended recipient.

Court denies defendant employer's motion for summary judgment, holding issues of fact preclude dismissal of plaintiff employee's invasion of privacy claim.  Plaintiff's claim arises out of the manner in which his employer obtained information about plaintiff's activities on eBay, which information supported employer's conclusion that the employee had stolen its property, which in turn led to the employee's termination.  Issues of fact existed as to whether defendant obtained this information by accessing plaintiff's password-protected eBay account, which, in the absence of an appropriate computer usage policy, could give rise to an invasion of privacy claim.  Notably, however, the Court held that if the employer had a computer usage policy that "advised its employees that their computer activities on the office system were monitored" plaintiff employee would lack a reasonable expectation of privacy in any eBay records he accessed from defendant's computer system and server.

The court holds that the transmission of two ethnically and racially insensitive jokes over a company's e-mail system, which jokes were not sent directly to the plaintiffs, does not create a hostile work environment, or give rise to a claim under 42 U.S.C. §§ 1981, 1985 or 1986. Said the court: "the case law makes clear that the sending of a single racist e-mail does not create a hostile work environment." In reaching this conclusion, the court relied on Owens v. Morgan Stanley & Co., Inc., 1997 W.L. 403454 (S.D.N.Y. 1997) ("[A]s a matter of law, (the sending of a single racist e-mail), while entirely reprehensible, cannot form the basis for a claim of hostile work environment.")

Affirming the decision of the Magistrate Judge, the District Court holds that an employee did not waive any attorney client or work product privileges that may exist in various email communications with her personal counsel transmitted to and from the employee's personal AOL email account by using a company laptop to send them from her home.  Plaintiff's employer had obtained these emails by "restoring" deleted files stored on the hard drives of these company laptops.  The Court reached this result notwithstanding the fact that the Company had a computer usage policy, of which the employee was aware, that warned employees that they had no right of privacy in Company computer equipment, the contents of which could be inspected by the Company.

(Pro se plaintiffs charged that they were the subject of race discrimination because they received four jokes sent over defendant WorldCom, Inc.'s ("Defendant") company e-mail system which allegedly contained "racial undertones." The court rejected both plaintiffs' claims that defendant was negligent, as well as plaintiffs' claims that defendant violated Title VII and §§ 1981 and 1983 of the Civil Rights Act of 1964. Defendant's response to the alleged misconduct, which included oral and written reprimands of the employee who sent the offending e-mail, as well as staff meetings at which employees were informed of the company's e-mail policy prohibiting use of the company e-mail for non-business purposes, was reasonable as a matter of law. This prompt remedial action also mandated dismissal of plaintiffs' §1981 claim. Plaintiffs' Title VII and retaliation claims were dismissed because of plaintiffs' failure to file the requisite charge with the appropriate governmental agencies.)

A California intermediate appellate court holds that the Communications Decency Act ("CDA"), 47 U.S.C. Section 230(c), immunizes an employer from claims arising out of the transmission by a then employee of threatening emails to, and posts about, plaintiffs from his office computer.  As a result, the Court of Appeals affirmed the dismissal of intentional infliction of emotional distress claims advanced by plaintiffs against Agilent Technologies.  Plaintiffs had sought to hold Agilent Technologies responsible for its employee's threatening conduct on theories of respondeat superior, negligent supervision/retention, and ratification. 

The Court further held defendant entitled to summary judgment dismissing such claims on the facts before it.  The respondeat superior claim failed because the evidence established that the employee was acting outside the scope of his employment when he transmitted the threatening emails in question.  The negligent supervision/retention claim similarly failed because there was no evidence that Agilent Technologies was aware of its employee's activities when he was transmitting the emails at issue from his office computer.  Agilent only learned of this misconduct after the fact, at which time it terminated the employee.  Finally, there was no evidence that the defendant employer ratified its employee's misconduct.

Court dismisses plaintiffs' claims that Northwest Airlines violated the Electronic Communications Privacy Act ("ECPA") by disclosing personal information about plaintiff passengers to governmental authorities.  The Court grounded its decision on its determination that the ECPA did not apply because Northwest, by virtue of its operation of a web site at which consumers can purchase airline tickets, was not a provider of "electronic communication services" within the meaning of the ECPA.  The Court also dismissed plaintiffs' claims that this disclosure constituted a breach of the parties' agreement, as reflected in the privacy policy Northwest posted on its web site, not to disclose such personal information, finding that the posting of such a policy did not create an enforceable agreement between the parties.

Court allows plaintiff to proceed with claims advanced against his employer and various fellow employees under the Electronic Communications Privacy Act, the Electronic Communications Storage Act, and Wisconsin's right to privacy statute, Wis. Stat. Section 895.50, as well as a common law defamation claim, arising out of defendants' interception of a telephone call plaintiff placed from his place of employ, and defendants' review of e-mails contained in a personal e-mail account plaintiff maintained with Hot Mail, which account plaintiff accessed from his work place.  There were sharply differing versions of the content of these various communications.  Defendants alleged that during the telephone call, the participants, while masturbating, graphically described homosexual activity between two males.  Plaintiff denied this.  Defendants also alleged that e-mails read from plaintiff's email account evidenced that plaintiff was involved in homosexual activity.  Plaintiff denied that these e-mails had been sent to him.

Defendants' version of the telephone conversation was related to various third parties, which resulted in the termination of plaintiff's employment.  This lawsuit ensued.  The court determined that plaintiff should be permitted to proceed with various claims he asserted. 

The court refused to dismiss plaintiff's claim, advanced under Wisconsin's right of privacy law, section 895.50, arising out of the review of e-mail from plaintiff's personal Hot Mail account.  The court held that issues of fact existed as to whether the review of such e-mail would be highly offensive to a reasonable person, and as to whether a reasonable person could consider such an account to be private, which precluded a grant of summary judgment to defendants.  The court also refused to dismiss the claim plaintiff brought under the Electronic Communications Storage Act arising out of the review of these e-mails.  If such a review took place (as opposed to defendants' having fabricated the e-mails) it would run afoul of the Stored Communications Act.  The court did dismiss the claims plaintiff raised under the Computer Fraud and Abuse Act, holding that plaintiff had not alleged economic damages arising from the review of these e-mails sufficient to state a claim under the Act.

The court also refused to dismiss the claims plaintiff advanced under the Electronic Communications Privacy Act and Wisconsin Privacy Act arising out of the interception of the telephone call described above.  The court refused to dismiss plaintiff's ECPA claim because, depending on what actually occurred, the defendants should have stopped listening to the telephone call when they discovered it was personal in nature.  The court refused to dismiss plaintiff's privacy act claims because plaintiff may have had a reasonable expectation of privacy in the telephone call if his claim that he made the call from a place his employer designated for private personal calls was true.

Lastly, the court refused to dismiss plaintiff's defamation claim, finding that issues of fact precluded it from determining whether defendants' communication of their version of the telephone call to third parties was protected by the common interest privilege possessed by members of religious associations as to communications pertaining to the qualifications of those who work for the organization.  Such privilege may have been lost, given plaintiff's claim that the defendants were lying about what took place during the telephone call.

Court dismisses claims of invasion of privacy and violation of the Massachusetts Wiretap Act MGL c 272 §99 arising out of employer's review of e-mail sent and received by company employees.  The e-mail in question was located by the company in both the personal password protected folders the employees maintained on the company's computers, as well as in the personal folders of other company employees who received e-mail from plaintiffs.  The court held that plaintiffs' invasion of privacy claim failed because they had no reasonable expectation of privacy in their personal folders, given the company's existing e-mail usage policy.  In that policy, the company reserved the right to examine all e-mail files.  The court rejected plaintiffs' Massachusetts Wiretap Act claim because the e-mail at issue was not intercepted during transmission, as it was reviewed by the company only after it had been received by the intended recipient.  The court accordingly granted defendant's motion for summary judgment and dismissed plaintiffs' lawsuit.

Court grants plaintiff, a former assistant attorney general, a preliminary injunction:  (i) enjoining his former employer, the Kansas Attorney General, from further review and/or dissemination of e-mails contained in 'private' computer files maintained by plaintiff on his employer's computer system, and (ii) directing his former employer to permit plaintiff to access and copy materials contained in these files.  In reaching this result, the Court found that plaintiff had raised serious questions as to whether defendants' review of the e-mails at issue violated his 4th Amendment expectations of privacy in these materials sufficient to warrant the issuance of injunctive relief.  The Court granted such relief notwithstanding the fact that the Attorney General's computer use policy provided, in part, that "There shall be no expectation of privacy in using this [computer] system….".

By a 4-3 margin, the California Supreme Court holds that the transmission of six e-mails criticizing Intel's employment practices to approximately 35,000 Intel employees over Intel's Intranet, despite Intel's objection, does not constitute an actionable trespass to chattels because the transmission did not cause any injury to Intel's computer systems.  The transmission of these e-mails neither slowed nor otherwise disrupted the functioning of Intel's computer system.  As a result, the California Supreme Court rejected Intel's application for an injunction, enjoining defendant, a former Intel employee, from continuing to send e-mails to Intel employees.  In reaching this result, the Court held that neither the time Intel's employees spent reviewing these unwanted communications, nor the funds Intel expended in attempting to block their continued transmission, constituted the type of injury necessary to sustain a trespass to chattels claim.

This result constituted a reversal of prior decisions by both the California Superior Court and the California Court of Appeals, each of which had enjoined future transmissions by the defendant.  Three justices dissented in two extensive dissents.  Each of the dissenters would have continued the injunction issued by the lower courts on the grounds, inter alia, that a trespass to chattels claim does not require injury to the chattel in question -- rather, such a claim can be established solely by showing an unpermitted and objected to use of the chattel.

Reversing the court below, a New Jersey intermediate appellate court holds that an employer has a duty to take "prompt and effective action" to prevent an employee that it had notice was viewing child pornography in the workplace from continuing such criminal activity.  This obligation to act requires the employer to investigate the employee's activities.  It also requires the employer to report the employee's activities to the appropriate governmental authorities and to take effective action to prevent it, which may require the employee's termination.  As a result of this determination, the Court allowed the ex-wife of a former company employee, individually and as guardian for her minor daughter, to proceed with a lawsuit against the employer arising out of the employee's transmission via e-mail from his office computer of three pornographic images of his minor stepdaughter to a child porn site.

Court holds defendant's unauthorized transmission of commercial e-mails automatically converted by recipient's cell phone carrier into text messages runs afoul of the Federal Telephone Consumer Protection Act, 47 U.S.C. §227 ("TCPA").  Such conduct constitutes a prohibited use of an "automatic dialing system" to make a "call" to a "telephone number assigned to a cellular telephone service." 47 U.S.C. §227 (b)(1)(A)(iii).  The Court further held that the TCPA was neither preempted by the CAN-SPAM Act's regulation of such conduct, nor an unconstitutional regulation of speech that violated the First Amendment.

Court dismisses invasion of privacy claims advanced by plaintiff Linda Kelleher, City Clerk of Reading Pennsylvania, arising out of defendants' alleged dissemination to the Press of emails plaintiff sent and/or received from a City of Reading computer.  Kelleher had no reasonable expectation of privacy in the subject emails because the City's computer usage policy expressly advised that the City could access and disclose emails sent from its computer network.

Plaintiff asserted this claim in a lawsuit in which she also claimed that various governmental officials and/or entities harassed her in retaliation for her exercise of her First Amendment right of Free Speech.  This harassment allegedly included providing the Press with information that would discredit her, including an ethics complaint lodged against plaintiff, and a job related one week disciplinary suspension.   Kelleher claimed that such conduct violated her rights under 42 U.S.C. § 1983.  The Court granted defendants' motions for summary judgment and dismissed the complaint, finding, inter alia, that plaintiff had failed to establish either that she had, in fact, engaged in speech which could give rise to such claims, or that the defendants' conduct was motivated by their desire to retaliate against her as a result of the activities she claimed to have engaged in.  It is beyond the scope of the Internet Library to address plaintiff's 1983 claims.  As such, the balance of this article will focus solely on the invasion of privacy claims plaintiff asserted.

The Second Circuit holds that a government employee has a reasonable expectation of privacy in an office computer located in his private office in light of the absence of both a computer usage policy advising him to the contrary, and a regular practice by his employer of searching the same.  The Court nonetheless holds that the government's search of its employee's computer for evidence of suspected work - related misconduct did not violate the employee's rights under the Fourth Amendment.  Such searches are permitted if the search is both justified at its inception and of appropriate scope.  Such was the case here, because the government had received notice of alleged job-related misconduct by the plaintiff employee and had conducted an appropriately circumspect inspection of his office computer to ascertain the validity of these allegations.

The Second Circuit also affirmed the dismissal of plaintiff's claims that both the government's failure to give him a pay raise, as well as its decision to demote him, violated his Due Process rights.  Such claims failed because plaintiff lacked the requisite property interest in either his job or raise to sustain a Due Process violation.

Court holds that employees waived both the attorney client and work products privileges by using a company computer system to transmit otherwise privileged communications to their counsel.  These communications were sent from private password protected email accounts, and not from the company's own email system.   Importantly, however, copies of these emails were retained by the company's system in "temporary internet files."  As the company could and did obtain these emails by reviewing its own system, the court held that plaintiffs had waived applicable privileges by failing to maintain the confidentiality of these communications in light of the company's electronic communications policy.  That policy advised the employees not to use the company system for personal purposes, and warned them that they had no right of privacy in any materials sent over the system.  The court reached this result notwithstanding its determination that the employees had no knowledge that copies of their email communications were so retained in the company's computer system.

Court holds that defendant Microsoft Corporation ("Microsoft") did not invade its former employee's right to privacy under Texas law by reading e-mail the employee stored on a personal office computer in a "personal folder" accessible by use of a password known only to the employee.

Plaintiff was employed by Microsoft Corporation ("Microsoft") which provided him with a personal computer and access to the company's e-mail system to aid him in the performance of his job duties. Access to this e-mail system was gained by use of a network password, which password was known by both plaintiff and his employer. In addition, Microsoft permitted plaintiff to maintain on this PC a "personal folder" in which he could store e-mail he received. Access to this folder was via a second password known only to plaintiff. Plaintiff informed Microsoft that e-mail contained in his "personal folder" would aid him in defending charges of sexual harassment that had been made against him.

The court held that plaintiff's claim failed for two reasons. First, plaintiff had no reasonable expectation of privacy in the e-mail in question because, before reaching plaintiff, this e-mail had traveled through various points in the Microsoft company e-mail system where it was accessible by Microsoft. Second, Microsoft's "interest in preventing inappropriate and unprofessional comments, or even illegal activity, over its e-mail system ... outweigh[ed] McLaren's claimed privacy interest in those communications."

Court issued a preliminary injunction enjoining the Navy from discharging plaintiff because of his sexual orientation. Such discharge, premised on AOL's identification of plaintiff as both the sender of an anonymous e-mail, and as a member described anonymously in AOL's member directory as gay, violated the Navy's "Don't Ask, Don't Tell, Don't Pursue" policy, and was likely aided by a violation of the Electronic Communications Privacy Act.

Seventh Circuit affirms dismissal of claims brought by former employee against his employer arising out of employer's seizure of a company lap top used by plaintiff in the course of his employ, and subsequent delivery of that lap top to federal authorities in response to a search warrant. Defendant employer could not be held to have violated plaintiff's Fourth Amendment rights because plaintiff had no reasonable expectation of privacy in the lap top in light of the company's computer use policy, which permitted the company to inspect the lap top at any time. Moreover, as the defendant was neither the state or a public entity, it could not be liable for violating plaintiff's Fourth Amendment rights.

Court holds that the unauthorized use of a spyware program to capture screen shots of a husband's online communications violates Florida's Security of Communications Act, modeled after the Federal Wiretap Act, 18 U.S.C. Section 2501, et seq.  An intermediate Florida appellate court accordingly affirms the trial court decision to bar the wife from introducing these screen shots into evidence in her divorce proceeding with her husband.

Reversing the court below, the California Court of Appeals holds that the Stored Communications Act prohibits an ISP that hosted a blog's email account from disclosing e-mails sent to the blog in response to a subpoena issued in a civil litigation.  The subpoena sought production of e-mails that would permit Apple Computer ("Apple") to identify the individual(s) who transmitted trade secret information about an as yet unreleased Apple product to the blog/website Power Page, which information was the source of articles Power Page subsequently published on its blog/website.

The Court further held that petitioners, who acted as publishers of, and/or editors or reporters for, the news blogs that published the stories at issue about this Apple product, were entitled to a protective order against their disclosure of the confidential sources of their stories.  Notwithstanding Apple's claim that the information petitioners received from these services constituted trade secrets disclosed in violation of confidentiality agreements each of its employees had signed, the Court held such disclosure barred by both California's Reporter's Shield Law and the First Amendment.  The Court held that the Shield Law, which prohibits a court from holding in contempt a publisher, editor or reporter of "a newspaper, magazines or other periodical publication" for failing to disclose the source of a published story, protected petitioners, publishers and/or reporters of news blogs, from having to disclose the sources of the stories at issue.  The First Amendment similarly provided protection, given Apple's failure to fully exhaust other avenues of disclosure before pursuing discovery from petitioners.

Court holds that defendants Diebold Incorporated and Diebold Election Systems Inc. (collectively “Diebold”) violated Section 512(f) of the Digital Millennium Copyright Act (“DMCA”) by having outside counsel send DMCA take-down notices to Internet Service Providers (“ISPs”).  These notices demanded that the ISPs disable access to or remove a website containing an archive of emails prepared by Diebold employees in which “some employees acknowledged problems associated with [Diebold’s electronic voting] machines.”  Diebold claimed a copyright in this archive, which had apparently been stolen and posted on the Internet.  The take-down notices also sought to disable a hypertext link to this website, found in an online newspaper article critical of Diebold’s electronic voting machines.  The Court held that because “portions of the email archive are subject to fair use protections,” the notices constituted knowing material misrepresentations that material or activity infringes Diebold’s claimed copyright in the archive in violation of Section 512(f), exposing Diebold to liability for the damages and attorneys’ fees resulting from actions taken by the ISPs in response to these notices.  It has subsequently been reported by the Online Policy Group that Diebold paid $125,000 to plaintiffs and their attorneys in satisfaction of this claim.

Reversing the decision of the court below, the First Circuit holds that the grant of permission by web site owners to defendant Pharmatrak to operate web tracking software on their web sites does not constitute consent to intercept their communications with site users, because the site owners expressly instructed defendant Pharmatrak not to gather personal information about site users.  As a result, the First Circuit reversed the District Court's decision, which had dismissed claims brought by site users under the Electronic Communications Privacy Act ("ECPA") arising out of defendant Pharmatrak's gathering of information concerning individual site users, and their use of the web site owners' sites, from communications between the users and the sites themselves.  The First Circuit remanded the case for further consideration as to whether defendant Pharmatrak's actions were intentional, a prerequisite to an ECPA claim, in light of the fact that Pharmatrak appeared to have gathered personally identifiable information as to only 232 of the approximately 18.7 million users whose activities it tracked.

Court holds that communications between plaintiff and his counsel, sent from and to  plaintiff over his employer’s email system, were not protected from disclosure by the attorney client privilege because these communications were not made in confidence.  In reaching this result, the Court relied, in large part, on the email policy that governed the use of this company email system.  This policy advised all employees that the company email system should not be used for personal purposes, and that employees had no personal privacy right in email sent over the company email system, which the employer could access and disclose at any time. 

Notably, the Court reached this result notwithstanding the fact that New York’s Civil Practice Law and Rules (“CPLR”) section 4548 provides that “no communication privileged under this article shall lose its privileged character for the sole reason that it is communicated by electronic means, or because persons necessary for the delivery or facilitation of such electronic communication may have access to the content of the communication.”  (Emphasis added).  The Court held that it is the presence of the employer’s computer use policy, and not the fact that the material was transmitted over the company’s email system, that rendered the communication non-privileged.

The Court further held that plaintiff waived any work product privilege attendant to his communications with counsel by transmitting them over a company email system, as they were subject to the email policy recited above, which permitted the company to examine and disclose such communications at any time.  By such actions, the court held that plaintiff was so careless with these materials that he waived any work product privilege attendant thereto and could not claim their disclosure was inadvertent.

As a result, the Court denied plaintiff’s motion for a protective order, which sought to compel his employer to return these communications with counsel to plaintiff.

The Court granted in part and denied in part an employer’s motion to compel production and inspection of the hard drive of a laptop the company furnished to an employee.  The Court held that the company could inspect the contents of the laptop, and any emails sent by the employee over the company email system, because the company had in place a policy that advised its employees that they had no expectations of privacy therein.  However, the Court held that the attorney client and marital communications privilege protected from disclosure “any web-based generated emails, or materials created by Sims[,] to communicate with his counsel or his wife.”  Said the Court:

[T]o the extent that the laptop contains web-based emails sent and received by plaintiff Sims and any other material prepared by plaintiff Sims to communicate with his counsel, the Court agrees with plaintiff that such information is protected under the attorney-client privilege and the marital communications privilege.  Notwithstanding defendant Lakeside’s policy in its employee manual, public policy dictates that such communications shall be protected to preserve the sanctity of communications made in confidence.

A New York intermediate appellate court affirms the dismissal of plaintiffs' action, and holds that defendant's act of allegedly selling personal information about plaintiffs, including their names, addresses and telephone numbers, to third party vendors in violation of defendant's promise not to divulge such information does not give rise to claims under either New York General Business Law §394 or Civil Rights Law Sections 50 and 51, or to a claim for breach of contract or unjust enrichment.  No claim arises under Gen. Bus. Law §349 because plaintiffs have not alleged that they suffered the requisite actual injury necessary to sustain such a claim as a result of Chase's sale of such personal information.  This burden was not met by plaintiffs' allegations that the sale of such information led to their receipt of unwanted solicitations by third party vendors.  Similarly, no claim for breach of contract was stated, because plaintiffs failed to allege the requisite injury needed to sustain such a claim.  This holding was premised on the court's determination that any emotional distress plaintiffs' sustained as a result of receiving unwanted solicitations is not actionable on a breach of contract theory.  Lastly, the court dismissed plaintiffs' unjust enrichment claim, which claim was based on the commissions paid to Chase on sale transaction completed by plaintiffs.  The court dismissed this claim because plaintiffs always received precisely that which they bargained for in these transactions.

(Court upholds employer's termination of at-will employee based on review of intercepted e-mail transmitted over company system. In reaching this conclusion, the court held that such review is not a violation of employee's right of privacy, even assuming employer promised not to intercept the e-mail or to terminate an employee based on a review of its contents, because employee has no reasonable expectation of privacy in messages sent over company e-mail)

Court grants defendant’s motion to suppress both evidence of defendant’s computer usage obtained via a warrantless search of his office computer, as well as subsequent incriminating statements concerning such usage made in his interrogation by law enforcement officials.  The evidence at issue indicated defendant, a pastor, was engaged in viewing child pornography.  The Court held that the government’s search violated defendant’s rights under the Fourth Amendment.

In reaching this result, the Court held that Young had a reasonable expectation of privacy in his office computer.  The court rested this determination on the fact that:
(i) the church did not have a computer usage policy, and did not regularly monitor the use of the computer,
(ii) the Pastor was the only regular user of the computer at issue, which, owned by his employer, was located in defendant’s private, locked office, to which only he and a church administrator had a key,
(iii) no one was allowed to enter the pastor’s office or use the pastor’s computer without his consent, and
(iv) the Pastor’s computer was not networked to other computers. 

Notably, the court held that the pastor had such a reasonable expectation of privacy despite the fact that he understood the computer could be accessed by the Church Administrator to perform maintenance work.

The Court further held that law enforcement’s search of the computer was not authorized by either an individual having actual or apparent authority to do so.   Law enforcement officials were authorized to search the Pastor’s computer by a church official, who, in turn, had been authorized to grant such permission by the Pastor’s supervisor.  The Court held that these individuals did not have actual authority to grant such a search, given the absence of a computer usage policy, and the fact that they themselves did not regularly use the machine.  For the same reason – the fact that they did not regularly use or access the computer at issue – the court held they lacked apparent authority to authorize the search.  As such, the Court affirmed the lower’s court decision to suppress the evidence of defendant’s computer usage obtained via the search of his computer.

As evidence from this search was used during the subsequent interrogation of defendant, the Court held that incriminating admissions made by the Pastor during this interrogation were also suppressed under the Fourth Amendment, under the ‘fruit of the poisonous tree’ doctrine.

The Magistrate Judge recommended the dismissal of plaintiff employee's invasion of privacy claims, which arose out of his employer's review of both e-mails he had received and stored in a personal, non-password protected, folder on a company computer, as well as a list of websites the employee visited from his office computer.  The Court held that employee had no reasonable expectation of privacy in the materials searched because the Company had explicit policies advising its employees that Company computer equipment could be monitored for any legitimate business purpose, including ascertaining whether the Company computer had been improperly used for personal reasons or to send offensive emails, as was allegedly the case here.

This claim arose in the context of a lawsuit arising out of the employee's termination for cause for "spending an inordinate amount of time on the internet during work hours" and downloading and storing on his office computer "sexually inappropriate material," which evidently consisted of nude pictures and sexually explicit jokes.  The employee claimed that his termination for cause was motivated by a desire to deny him severance benefits in violation of 29 U.S.C. §1140 of ERISA.  The Court held that issues of fact precluded an award of summary judgment dismissing this claim.  The Court did not dismiss claims plaintiff asserted arising out of the Company's alleged wrongful denial of benefits, and failure to notify him of how to apply for such severance benefits.  Such claims were dismissed, respectively, because of the employee's failure to appropriately exhaust available administrative remedies, and his failure to file a claim for such benefits in the proper manner.  As these later claims are beyond the scope of the Internet Library they will not be addressed below.  Instead, our analysis will focus solely on the dismissal of plaintiff's invasion of privacy claim.

Affirming the court below, the First Circuit, by a 2-1 vote, holds that defendant's alleged involvement in a scheme in which e-mails were copied while in transit to, but before their receipt by, their intended recipients, was not a violation of the Wiretap Act, 18 U.S.C. §§ 2510 et seq. and accordingly dismisses an indictment charging defendant with conspiring to violate the Wiretap Act.  In reaching this result, the Court held that the Wiretap Act does not apply to the interception of e-mails in storage.  Because the e-mails at issue were in temporary storage when intercepted, no violation of the Wiretap Act occurred.

In a vigorous dissent, Circuit Judge Lipez warned that the majority's holding would effectively eliminate all protection for e-mail under the Wiretap Act, as all e-mail, when in transit, is stored in either the hard drives or RAM of the various computers involved in its delivery.  As such, e-mail recipients would be relegated to the lesser protections provided by the Stored Communications Act, 18 U.S.C. §§ 2701 et seq., which, among other things, provides certain exceptions for "conduct authorized by the person or entity providing a wire or electronic communications service …", and lowers the showing law enforcement officials must make to access such stored communications.  Judge Lipez accordingly would reverse the court below, and hold that the Wiretap Act applies to the unauthorized interception of e-mail while such e-mail is being transmitted, whether then in storage or not.

10th Circuit holds that a University professor has no reasonable expectation of privacy in an office computer supplied for his use by the University which employed him.  This result was mandated by the University's computer policy, which provides both that the University may inspect such computers at any time to ensure their appropriate use, and that the University is the owner of everything stored in such computers.  As a result, the court held that the seizure of these images did not violate defendant's Fourth Amendment rights, given his lack of a reasonable expectation of privacy in this computer.  The 10th Circuit accordingly affirmed the denial of defendant's motion to suppress the introduction of child pornography found in files defendant attempted to delete from his computer hard drive and upheld defendant's agreement to plead guilty to violating 18 U.S.C. §2252(a)(5)(b) based on his possession of child pornography.

Ninth Circuit holds that an employee has a reasonable expectation of privacy in his private office, because it is locked and not shared with others.  This reasonable expectation of privacy extends to the contents of his office, including the employee’s company computer, located therein.

As a result, the Court holds that the Fourth Amendment protects both the office and computer from warrantless searches by the Government unless it obtains valid consent from either the defendant himself or one with common authority over the items searched, or proceeds on the authorization of one with apparent authority to give such valid consent.

Here, the Ninth Circuit holds that the Government obtained valid consent from one with common authority over the items searched, when it received such consent from the employee’s employer.  The employer had common authority over the employee’s office computer because it had a policy of, and regularly did, monitor employees’ computer usage of company machines, a policy of which its employees were made aware.

The Court accordingly denied defendant’s motion to suppress evidence found by the Government during its warrantless search of defendant’s office computer.  As a result, pursuant to a plea agreement, defendant was convicted of the receipt of obscene material based, in part, on evidence obtained during this search.  The evidence obtained during this search, and by the company earlier, showed that defendant had viewed and had possession of child pornography.

Fourth Circuit holds that various warrantless searches of the defendant employee's computer did not violate his Fourth Amendment protections against unreasonable governmental search and seizures. The Fourth Circuit remanded for reconsideration that portion of the lower court's determination that upheld a search of the defendant employee's office and computer pursuant to a warrant where the searching officials, contrary to its terms, failed to leave the warrant for the employee after completing their search.

Transmission of e-mail via AOL from defendant, a Utah resident, to AOL facilities in Virginia and back to the victim, another Utah resident, was a transmission in interstate commerce sufficient to support a violation of 18 U.S.C. §875, which prohibits the transmission of threats in interstate commerce.

Affirming the decision of the District Court below, the Tenth Circuit, by a 2-1 margin, holds that the defendant’s ninety-one year old father had apparent authority to consent to the government’s warrantless search of defendant’s password protected computer.  The computer was located in defendant’s bedroom in his father’s house.  The Court reached this result notwithstanding the fact that defendant’s father neither used the computer, nor knew the password thereto.  As a result, the Tenth Circuit affirmed the denial of defendant’s motion to suppress the evidence of child pornography found during the resulting search, and affirmed defendant’s conviction for violation of 18 U.S.C. Section 2252(a)(4)(B), which prohibits the possession of materials depicting minors engaged in explicit sexual conduct.

The Tenth Circuit holds that an individual with apparent (but not actual) authority can give valid consent for a warrantless governmental search of another’s computer.  An individual has such apparent authority when, examining the totality of the circumstances, the facts available to the officers at the time they commenced their search would lead a reasonable officer to believe that that individual had authority to consent to such a search based on that individual’s relationship to the object searched.

There was a strong dissent by Judge McKay, who would have held, under the circumstances, that the officers had a duty to inquire as to whether the computer was password protected and, if so, whether the party consenting to the search knew the password or had access to the computer in question.  As the government neither made such inquiry, nor knew the password in question, the dissent would hold that defendant’s father did not have apparent authority to consent to the alleged search.

Court denies defendant's motion to suppress both pornographic images obtained from the hard drives of two University computers located in a computer lab that defendant used, and logs pertaining to the usage of such computers.  In so doing, the court rejected  defendant's claim that he had a reasonable expectation of privacy in such hard drives, holding that "there is no generic expectation of privacy for shared usage of computers at large."  As defendant did not advance any evidence to support his claimed expectation of privacy, the court denied defendant's motion to suppress.

Magistrate Judge issues report, recommending denial of so much of defendant's motion to suppress which sought to prevent use of various pornographic images found in the recycle bin of a University computer, in a personal computer maintained by defendant at his home, and in a computer used by defendant at his place of employ.  In so holding, the Magistrate Judge determined that defendant did not have a reasonable expectation of privacy in either the University or office computers, so that their searches did not violate the Fourth Amendment.  The court further held that the search of defendant's home computer was made pursuant to a validly issued search warrant.

The Supreme Court of Indiana affirmed in part and reversed in part the decisions of the courts below. The Indiana Supreme Court affirmed those portions of the lower courts' decisions that held that Dr. Felsher had violated the privacy rights of three University of Evansville employees by, inter alia, creating e-mail accounts and web sites containing their last name, first initial, and the letters UE (an abbreviation for University of Evansville), sending e-mail from such accounts nominating the employees for various positions at other institutions, and referring the reader of such e-mail to the web sites defendant created which contained materials critical of the three employees. The Supreme Court affirmed that portion of the decisions below which held that such conduct violated the individual defendants' privacy rights, and enjoined defendant from engaging in such conduct in the future. The Supreme Court reversed those portions of the decisions below which held that Felsher, by his acts, had also violated the privacy rights of the University of Evansville on the grounds that a corporation does not possess a right to privacy. The court held that the University may be able to obtain redress for any misuse of its name by asserting claims under other theories, such as unfair competition, which had not yet been plead.

E-mail sent by corrections officers over correction facilities' e-mail system which allegedly contained racial slurs is not "public record" subject to disclosure under Ohio Public Record Act R.C. 149.43. The court reached this conclusion because the e-mail "was never used to conduct the business of the public office...".

Quick Hits

The Court holds that the unauthorized use of a password to access a website does not constitute a violation of the Digital Millennium Copyright Act, 17 U.S.C. Section 1201, et seq.  The DMCA provides that “no person shall circumvent a technological measure that effectively controls access to a work protected [by Title 17, the section of the US Code governing copyright].”  Under the DMCA, “circumventing a technological measure” “means to descramble a scrambled work, to decrypt a decrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner.”  Section 1201(a)(3)(A).   Because circumvention, under the DMCA, requires an act such as descrambling, decrypting, deactivating or impairing a protective technological measure, the unauthorized use of a password does not qualify.  “[T]he court concludes that using a username/password combination as intended – by entering a valid username and password, albeit without authorization – does not constitute circumvention under the DMCA.”  In reaching this result, the Court found persuasive the decision of the District Court in I.M.S. Inquiry Mgmt. Sys. Ltd. v. Berkshire Info. Sys. Inc., 307 F. Supp. 2d 521 (S.D.N.Y. 2004).  The Court accordingly granted defendants’ motion to dismiss DMCA claims brought by plaintiff arising out of defendants’ alleged unauthorized use of a password to access plaintiff’s password protected site, and thereby to obtain and review the contents thereof.

The Court did not reach the question of whether such conduct violated the Computer Fraud and Abuse Act, 18 U.S.C. Section 1030, because plaintiff’s claim that it did was held to be time-barred by the applicable statute of limitations.  Nor did the Court reach the question of whether, by so using the password to access plaintiff’s site, defendants committed an actionable tort under state law – such as trespass – because the Court, on the dismissal of plaintiff’s Federal claims, declined to exercise pendent jurisdiction over plaintiff’s state law claims, which were accordingly dismissed without prejudice.

This dispute arose out of a prior lawsuit in which plaintiff served as an expert witness in a case in which the defendant law firms represented the defendant in that suit.  In that case, the court had issued a gag order, prohibiting the parties and their experts from publicly discussing the case.  Apparently, plaintiff, in violation of the court’s order, posted material about the case on his password protected website.  In his complaint, plaintiff alleged that defendants, without authorization, used the site’s password to obtain access.  Defendants then presented materials from the site to the judge, who issued sanctions against plaintiff – including striking the plaintiff’s expert trial testimony and instructing the jury to disregard it - for violating his gag order.  This suit sought redress for this alleged misconduct.

Download PDF of Court Decision

Court allows the social networking site Facebook Inc. (“Facebook”) to proceed with claims charging its competitor ConnectU with improperly harvesting email addresses of Facebook users from its site, who were then sent emails soliciting their patronage. 

Denying in part defendant’s motion to dismiss, the Court held that Facebook had stated a valid claim under California Penal Code Section 502 by alleged that defendant knowingly accessed Facebook’s site and, in violation of the site’s prohibitions, copied user email addresses.  One violates this section when he “knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.”  This claim was valid notwithstanding the fact that ConnectU obtained such access by using, with their permission, authorized passwords given Facebook users. 

The Court also allowed Facebook to proceed with common law misappropriation claims arising out of such activities, holding the same were not preempted by the Copyright Act.

The Court did grant so much of ConnectU’s motion to dismiss which sought relief under California Business & Profession’s Code Sections 17529.4 and 17538.45, holding those statutes preempted by the Federal CAN-SPAM Act.  Cal. Bus. & Prof. Code Section 17529.4 makes it unlawful “for any person or entity to collect electronic mail addresses posted on the Internet if the purpose of the collection is for the electronic mail addresses to be used to … initiate or advertise in an unsolicited commercial email advertisement …”.  Because, under CAN-SPAM, the Act “supersedes any statute, regulation or rule of a State or political subdivision of a State that expressly regulates the use of electronic mail to send commercial messages, except to the extent that any such statute, regulation or rule prohibits falsity or deception in any portion of a commercial electronic mail message or information attached thereto,” the Court held these California statutes preempted, and accordingly dismissed Facebook’s claims thereunder.  The Court reached that result because “neither section 17529.4 nor section 17538.45 purport to regulate false or deceptive email, or require such falsity or deception as an element of the statutory violation.”

Finally, the Court dismissed, with leave to replead, Facebook’s CAN-SPAM Act claims, holding that the Act prohibited the use of materially false or misleading header information concerning the originating address of the emails, which had not yet been alleged here.  A claim alleging deception in the manner in which destination email addresses were obtained did not state a claim under CAN-SPAM, held the Court.   

Download PDF of Court Decision

Court denies motion to enjoin enforcement of Utah's Child Protection Registry Act, a statute that prohibits the transmission of emails promoting products that are either harmful to, or that a minor is prohibited from purchasing to email addresses registered with the Utah registry, absent the consent of an adult.  The Court held plaintiff, a trade association representing members "involved in the production [or] dissemination of sexually explicit … expression", unlikely to succeed on the merits of its claims that Utah's Child Protection Registry Act was preempted by CAN-SPAM, or ran afoul of either the Commerce Clause or the First Amendment.  In reaching this result, the Court relied on an express exception to preemption provided in CAN-SPAM for state laws "relate[d] to … computer crime."

Court holds that “aggravated harassment in the second degree [in violation of New York Penal Law section 240.30] may be committed by sending harassing or threatening messages by email.”

A computer usage policy that warns the employee of the company’s right to inspect computers provided to him for business use, has been held sufficient to entitle the company to inspect the contents of a company computer used by the employee in his home over the employee’s objections.  Said the Court: 

[Company’s] advance notice to [Employee] (the company’s policy statement) gave [employee] the opportunity to consent to or reject the very thing that he now complains about, and that notice, combined with his written consent to the policy, defeats [the] claim that he had a reasonable expectation of privacy.

Pursuant to this policy, employee “consented to have his computer “use monitored by authorized company personnel” on an ‘as needed’ basis and agreed that communications transmitted by computer were not private.”) id. at 446

Download PDF of Court Decision

The New York Court of Appeals extends New York’s common law tort of conversion to “intangible electronic records.”  Prior to the High Court’s decision, in the state of New York, the common law tort of conversion was limited to the conversion  of tangible personal property, or intangible personal property that had ‘merged’ into a tangible object, such as a stock certificate.  Finding that it was time for the tort of conversion to evolve to “keep pace with contemporary realities of widespread computer use,” the Court held that it extended to intangible electronic records stored on a company computer system.  Said the Court:

Computers and digital information are ubiquitous and pervade all aspects of business, financial and personal communication activities.  … We cannot conceive of any reason in law or logic why this process of virtual creation should be treated any differently form production by pen on paper or quill on parchment.  A document stored on a computer hard drive has the same value as a paper document kept in a file cabinet. … “It would be a curious jurisprudence that turned on the existence of a paper document rather than an electronic one.  Torching a company’s file room would then be conversion while hacking into its mainframe and deleting its data would not.” … It generally is not the physical nature of a document that determines its worth, it is the information memorialized in the document that has intrinsic value. … In the absence of a significant difference in the value of information, the protections of the law should apply equally to both forms – physical and virtual.

In light of these considerations, we believe that the tort of conversion must keep pace with the contemporary realities of widespread computer use.  We therefore answer the certified question in the affirmative and hold that the type of data that Nationwide allegedly took possession of – electronic records that were stored on a computer and were indistinguishable from printed documents – are subject to a claim of conversion in New York.

As a result of this decision, the plaintiff, formerly an insurance agent for defendant Nationwide Mutual Insurance, was allowed to pursue a conversion claim arising from defendant’s decision to deny plaintiff access to electronic personal and business records he stored on the company’s computer system.  Plaintiff used Nationwide’s computer system throughout the course of his business relationship with Nationwide.   

Download PDF of Court Decision

Additional relevant authority can be found in the Subpoena and Spamming/Junk E-mail sections of the Internet Library.