LawFlash

The Stored Communications Act: District Court Issues First Opinion on Privacy Protection for Information on Social Networking and Web Hosting Sites

June 14, 2010

In a recent decision involving stored electronic communications held by third-party social networking sites Facebook and MySpace, Inc. (MySpace) and web hosting provider Media Temple, Inc. (Media Temple), Judge Margaret Morrow of the U.S. District Court for the Central District of California ruled that all three are providers of both Electronic Communication Services (ECS) and Remote Computing Services (RCS) under the Stored Communications Act[1] (SCA). As a result, private communications on these sites are afforded protection from disclosure.

Judge Morrow's order in Buckley H. Crispin v. Christian Audigier Inc.[2] is the first time in which a court has analyzed whether private communications sent through a social networking or web hosting site are afforded protection from disclosure under the SCA. Based on this decision, which found social networking sites and web hosting providers to fall within the SCA's protection from disclosure, civil parties that seek private electronic communications from such sites will likely be prevented from obtaining this information.

Crispin Facts

This case involves a copyright infringement claim brought by Buckley Crispin, an artist who granted defendant and designer Christian Audigier oral license to use Crispin's artwork for certain street-wear garments. Crispin alleges that Audigier used the artwork outside the scope of the original oral license and further sublicensed the artwork to several named codefendants without Crispin's consent.

The defendants served subpoenas duces tecum on several third-party businesses, including Facebook, MySpace, and Media Temple. The subpoenas directed the two social networking providers, Facebook and MySpace, and the web hosting provider, Media Temple, to turn over all communications between Crispin and Audigier, as well as any communications referencing the sublicensee defendants. The defendants argued that such communications were relevant in determining the nature and terms of the agreement, if any, into which Crispin and Audigier entered.

Crispin later brought an ex parte motion to quash the subpoenas. Crispin argued that the subpoenas sought private electronic communications that under the SCA ECS or RCS providers are prohibited from turning over. After Crispin's motion was denied because Judge McDermott determined that Facebook, MySpace, and Media Temple did not qualify for protection from disclosure under the SCA, Crispin moved for reconsideration.

Crispin's Private Communications on Social Networking and
Web Hosting Sites Qualify for Protection

On reconsideration, Judge Morrow reversed Judge McDermott's earlier ruling. In doing so, Judge Morrow noted provisions of the SCA that apply to "providers" of communication services and the information they possess concerning entities and individuals. In order for this information to be afforded protection from disclosure under the SCA, a provider must be either an ECS or RCS provider.[3] The statute defines an ECS provider as "any service which provides to users thereof the ability to send or receive wire or electronic communications." In contrast, the statute defines RCS as "the provision to the public of computer storage or processing services by means of an electronic communications system" and deserving of some lesser standard of protection concerning communications.

The court found that these companies qualified as ECS because they provided message delivery services, and as RCS because they offered message storage services. In support of its conclusion, the court cited examples of ECS: basic email services and private electronic bulletin board services. The court recognized that an RCS provider offered longer-term storage or processing services, tantamount to a virtual filing cabinet. Finally, the court noted that Microsoft was an example of both an ECS and RCS because it provided email delivery and storage service through its Hotmail website.

In fact, because modern electronic communications usually combine both services, the ECS and RCS definitions in the SCA may have become a distinction without a difference.

Because the SCA does not prohibit disclosure of information that is already public-for example, on a public blog-the court also had to determine whether the information requested in the subpoenas was public or private. The court in Crispin was satisfied that the forms of communication at issue-webmail and email messaging-were inherently private because messages on any one of these sites are not readily accessible to the public, or at most are only available to a limited audience as selected or approved by the user.

Judge Morrow concluded that because all three sites-social network providers Facebook and MySpace, and web hosting provider Media Temple-provide private messaging or email services as well as electronic storage, they all qualify as both ECS and RCS providers, and that Judge McDermott had misconstrued the nature of the services provided by these third-party companies.[4]

Judge Morrow reversed Judge McDermott's order with respect to the Facebook, MySpace, and Media Temple subpoenas to the extent they sought private email messaging. However, with respect to Facebook wall postings and MySpace comments, Judge Morrow determined that there was insufficient evidence in the record to make a determination as to whether these wall postings and comments constitute private communications. As a result, a new evidentiary hearing was ordered regarding those portions of the subpoenas that sought Facebook wall postings and MySpace comments for which the user's privacy settings were less clear.

Conclusion

The Crispin opinion illustrates that the courts may afford social networking and web hosting providers protection from disclosure of private electronic communications when such communications are requested via subpoena in a civil matter. Whether electronic communications qualify for protection from disclosure in a civil matter will require an analysis of both ECS and RCS as defined under the SCA, as well as an analysis of the provider's privacy controls and the individual user's privacy settings. Please Note: As a District Court decision on a case "of first impression," the Crispin decision is not binding on other courts, but is an informative analysis of an emerging legal issue.

If you have questions or would like more information on any of the issues discussed in this LawFlash, please contact any of the following Morgan Lewis attorneys:

Philadelphia
Stephanie A. "Tess" Blair
Scott A. Milner


[1] 18 U.S.C. §§ 2701-11.

[2] Buckley H. Crispin v. Christian Audigier, Inc., 2:09-cv-09509, in the U.S. District Court for the Central District of California.

[3] The Stored Communications Act affords Fourth Amendment-like protection in the form of a statute that regulates government access to private electronic communications, and is extended in this case to afford protection from disclosure in response to civil subpoenas.

[4] The SCA was passed as part of the Electronic Communications Privacy Act of 1986, before the advent of the World Wide Web in 1990, and well before the advent of the current Internet applications and technology. As a result, courts, including the court in Crispin, have noted that the application of this nearly 25-year-old statute undoubtedly presents challenges when examined in light of modern computer technology.