Carving Out New Privacy Rights for E-Mailers

The three-judge panel of the Sixth Circuit Court has upheld a ruling that grants extensive new privacy protections for e-mail users. It is an ambitious decision — said to be the first for the Circuit Courts — and one that is almost surely headed to the Supreme Court for review.

In Warshak v. United States, the federal court upheld the finding that e-mail users are entitled to the same expectation of privacy as persons using the telephone. The decision clarifies a gray area that has been exploited by law enforcement officials in federal — and some state — criminal investigations.

The federal law in question is the 1986 Stored Communications Act, which amended the 1960s-era Wiretap Act — both of which were amended by the Patriot Act in 2001.

Prior to this ruling, the Stored Communications Act required Internet service providers such as Yahoo to give investigators e-mails that had been stored for more than 180 days, if they were relevant to an ongoing criminal investigation.

All the government had to do was show reasonable grounds that the e-mail was germane — a lower threshold than probable cause, according to David Ries, partner with Thorp Reed & Armstrong.

Also, the government could delay giving notice to the parties by claiming that it would compromise the investigation. The court held that the provision in the Stored Communications Act that allowed for such a delay was unconstitutional, Ries told the E-Commerce Times.

Heart of the Matter

The case arose from the prosecution of Steven Warshak, who was indicted last year for allegedly defrauding customers and banks of more than US$100 million. Federal investigators were able to read Warshak’s e-mails — held by NuVox Communications and Yahoo — under the Stored Communications Act provision, and they did not notify him until more than a year later.

Now, according to the ruling, the government must jump through some hoops before gaining access to this information trove:

1. It must get a search warrant based on probable cause; or
2. It must get an order under the Stored Communications Act, with notice to the account holder required; or
3. It can obtain the content if the ISP’s privacy notice specifically says it reserves the right to access content, and it actually does access users’ content. This is a major — and thus far, rare — departure from typical notices, Ries said, that state the ISP can access content for network maintenance.

Indeed, the decision is notable not only for the new privacy rights granted to e-mail users, but also for its far-reaching and prescriptive language. There have been a number of “open” issues resulting from murky policy language in the various federal privacy laws passed over the years, Robert Brownstone, law and technology director at Fenwick & West, told the E-Commerce Times.

“In this particular decision, the court gets to the heart of the notice provision in the Stored Communications Act,” he explained.

“Now, an appellate court in a detailed way has weighed in on the issue and has also tried to make sense of various other scenarios that may arise in this setting,” Brownstone noted.

The decision covers a wide range of circumstances, he pointed out, some of which came up in the Warshak case and some of which did not, and suggests alternative avenues for the government to take in an investigation.

“It is a helpful decision,” said Brownstone, because it not only “addresses the scenario at hand, but attempts to educate us.”

Headed for Appeal

Supporters of stronger privacy rights, for their part, are delighted with the end result. In short, the decision has been hailed as a major step forward for privacy rights in electronic communications.

“The case marks a major recognition of the status of e-mail communications under the search and seizures requirements of the U.S. Constitution” by placing e-mail on par with wireline communications and postal mail, Jeffrey D. Neuburger, partner with Thelen Reid Brown Raysman & Steiner, told the E-Commerce Times.

“It will be interesting to follow the implications of this decision for the privacy of other emerging communications technologies, such as Voice over Internet Protocol (VoIP),” he said.

Indeed, the fact that this decision has such a far reach — beyond the immediate issue of how law enforcement pursues criminal investigations — is just one reason the government will no doubt appeal the decision, first to the full 12-person Circuit Court and potentially to the Supreme Court.

The case could have an impact on a broad spectrum of actions — some high-profile, some under the radar — taken by the government over the last six years to push the boundaries of federal and prosecutorial rights to information, especially electronic information.

“The government really wants to have this information, so you can bet they are going to push to have it overturned,” Andy Serwin, a partner with Foley & Lardner, told the E-Commerce Times, “especially as e-mail is becoming the preferred method of communication.”

In theory, the government could ask ISPs to change their terms of use to accommodate the new ruling, although Ries doubts that would meet the criteria in the decision.

Also, as Serwin noted, ISPs are becoming more sensitive to privacy issues and are unlikely to do anything that would irk consumers unless forced to by law — or unless the government waves the homeland security flag. Homeland security has been an exception among service providers, Serwin said. “For criminal investigations, though, the ISPs aren’t going to do anything beyond what the law requires.”

Copyright Questions

Besides curtailing investigative methods used in law enforcement, Warshak v. United States, if upheld, could impact other areas as well.

This opinion goes beyond the issue of privacy for the individual, Carole Enid Handler, vice chair at Foley & Lardner and adjunct professor at Rutgers University Law School, told the E-Commerce Times.

“Storage on a server has been argued to be ‘public’ for copyright purposes, and this decision rejects that analysis,” she said.

“Therefore, the opinion could have ramifications for the troubling issue of what constitutes ‘public’ performance or display for infringement purposes on the Internet as well, and open the door to protection for the individual in that context as well,” Handler explained.

Big Brother at the Office

It’s possible that the most interesting byproduct of the case will be felt in the office. By now, it is widely established that employees can have no expectation of privacy regarding e-mail communications at work. Under certain circumstances, the Warshak decision could be used to argue otherwise.

Warshak highlights the importance of implementing an electronic resources policy in the workplace that establishes the employer’s right to monitor electronic mail, Philip Gordon, chair of the Privacy and Data Protection Practice Group for Littler Mendelson, told the E-Commerce Times.

“The court in Warshak held that the e-mail user in that case had a reasonable expectation of privacy in his e-mail stored at an Internet service provider because there is a societal expectation that the ISP … will not access the stored e-mail,” he observed.

The court also noted, in contrast, that an employee generally does not have a reasonable expectation of privacy in his e-mail stored on the employer’s network if the employee receives an employer’s policy providing explicit notification of intent to audit, inspect and monitor computer files, Gordon continued.

“Employers should be aware that the Sixth Court did not state that a workplace-monitoring policy will always defeat an employee’s expectation of privacy. If, for example, a company representative with appropriate authority tells an employee that the company will not read his e-mail despite the existence of a policy to the contrary, the employee may be able to argue that he did have a reasonable expectation [of privacy] in his work e-mail,” he cautioned.

“It also is possible that an employee who becomes aware of his employer’s practice not to enforce its right to monitor e-mail may be able to show that he had an expectation of privacy in his e-mail,” Gordon concluded.

For all of these reasons, said Martin Jaron, litigation partner at Holland & Knight and cochair of its electronic discovery team, this decision is just a way station in the broader discussion of privacy rights.

“To be sure it is an important decision,” he told the E-Commerce Times, “but it is not a final answer to a lot of questions still out there.”