Are Facebook Postings Discoverable?

October 2010 (No. 4)

Joseph G. Poluka and Michelle Gitlitz Courtney

For The Defense

Yes.  Sometimes.  Well, it depends.  In the recent landmark case, Crispin v. Christian Audigier Inc., 2010 U.S. Dist. Lexis 52832 (C.D. Cal. May 26, 2010),  the court was asked to determine whether the plaintiff’s  e-mail messages sent through Facebook and MySpace, his Facebook “wall” postings and his MySpace “comments”—were discoverable.  The plaintiff, Buckly Crispin, an artist, alleged that Christian Audigier, Inc. (“Audigier”) violated an oral license to use Crispin’s art in the manufacture of garments.  In defense of the claim, the defendants sent third-party subpoenas to, among others, Facebook and MySpace, requesting Crispin’s subscriber information and all communications by Crispin referring to the defendants, including the above-referenced e-mails and wall posts.  As a threshold matter, the court had to determine whether the information was protected from disclosure under the Stored Communications Act (“SCA”), 18 U.S.C. § 2701 et seq., enacted in 1986.

The SCA is part of the Electronic Communications Privacy Act of 1986 (the “ECPA”), 18 U.S.C. § 2510 et seq., which was enacted by Congress to extend government restrictions on wire taps to include transmissions of electronic data by computer.  See id.  “The SCA was enacted because the advent of the Internet presented a host of potential privacy breaches that the Fourth Amendment does not address.”1  Quon v. Arch Wireless Operating Co., Inc., 529 F.3d 892, 900 (9th Cir. 2008) (citing O. Kerr, A User’s Guide to the Stored Communications Act, and a Legislator’s Guide to Amending It, 72 Geo. Wash. L. Rev. 1208, 1209-13 (2004) (emphasis in original)).  It prohibits an electronic communication service (“ECS”)2 provider or a remote computing service (“RCS”)3 provider “from knowingly divulging the contents of any communication while in electronic storage by that service to any person other than the addressee or intended recipient.”  S.Rep. No. 99-541, 97th Cong. 2nd Sess. 37, reprinted in 1986 U.S.C.C.A.N. 3555, 3591.  In particular, the Stored Communications Act regulates when ECS or RCS providers may provide private e-mails and other electronic communications to the government or private parties.

With respect to the government, if an electronic communication has been in storage for 180 days or less, the government must obtain a search warrant to obtain the communication.  18 U.S.C. § 2703(a).  If a communication has been in storage for more than 180 days, or is held “solely for the purpose of providing storage or computer processing services,” the government can compel disclosure in one of three ways: (i) pursuant to a search warrant (without notice to the subscriber or customer);4 (ii) by service of subpoena with notice to the subscriber or customer;5 or (iii) pursuant to a court order with notice for disclosure that provides “specific and articulable facts” showing that there are reasonable grounds to believe that an electronic communication is relevant and material to an ongoing criminal investigation.  Id. § 2703(d).  Prior notice can be delayed for up to 90 days if it would jeopardize an investigation.  Id. § 2705.

In the civil context, for the first time, a federal court has applied the SCA to content posted on or e-mailed through social networking sites such as Facebook and MySpace.  By way of background, there are generally three types of information found on social-networking sites: (1) public information (text or media) that is available to the general public; (2) semi-private information that the subscriber restricts to a self-selected group ("friends" or "friends of friends"); and (3) private messages (instant or e-mail) sent through the social networking site.

As a threshold matter in Crispin v. Christian Audigier Inc., the court had to determine whether the information was protected from disclosure under the SCA by analyzing whether Facebook and MySpace were either ECS or RCS providers.  The court found that Facebook and MySpace were ECS providers because they provided message delivery services.  They also were RCS providers because they offered message storage services.  Therefore, the SCA applied.

Because the SCA applied, the court quashed the subpoenas for Crispin’s private e-mail messages that were sent through the social networking sites because they are private electronic communications, protected from disclosure under the statute.  However, the court recognized a distinction between private messages and messages or comments posted on a “wall,” which can generally be accessed by all subscribers to the website.6  It therefore remanded for the magistrate judge to determine whether Crispin’s privacy settings rendered the wall postings and comments public and therefore unprotected by the SCA.

The decision suggests that privacy settings matter. 

As we have discussed in our recent Whose E-Mail Is It Anyway? articles, the efforts one takes to protect the privacy of his or her e-mail is a factor in determining whether e-mail messages sent or received by the person are subject to disclosure.  Where an employee uses her personal password protected e-mail account to send correspondence to her attorney, such correspondence is privileged even when sent via an employer laptop.  Stengart v. Loving Care Agency, Inc., 990 A.2d 650 (N.J. Super Ct. 2010).  However, when the same type of e-mail is sent using an employer’s e-mail account through an employer’s e-mail server, some courts have held there is no expectation of privacy.  See, e.g., Kaufman v. SunGard Inv. System, No. 05-cv-1236, 2006 U.S. Dist. LEXIS 28149 (D.N.J. May 10, 2006) (holding that employee had waived the attorney-client privilege by communicating with her attorney over a work e-mail system, where the company policy clearly notified employees that e-mails were “subject to monitoring, search or interception at any time . . . .”); Sims v. Lakeside Sch., No. C06-1412RSM, 2007 U.S. Dist. LEXIS 69568 at *2-3 (W.D. Wash. Sept. 20, 2007) (where the defendant advised all employees that they did not have a reasonable expectation of privacy in their company laptops, plaintiff’s e-mails sent on the employer’s e-mail account were not privileged; however, web-based e-mails sent by plaintiff to his counsel from the same laptop were protected by the attorney-client privilege); but see In re Asia Global Crossing, Ltd., 322 B.R. 247, 257 (S.D.N.Y. 2005) (use of a company’s e-mail system by an employee to send personal e-mails to the employee’s counsel did not waive the attorney-client privilege).

Moreover, the order in Crispin shows the complex nature of the SCA, a law enacted by Congress in 1986, before the Internet was widely used and certainly before social networking sites were invented.  The result has led at least one court—the Crispin court—as described above, potentially to treat different communication tools (private e-mail messages and public “wall” posts) on the same website in different ways.  As such, certain information on social networking sites may be subject to disclosure pursuant to a civil subpoena.  Whether electronic communications qualify for protection from disclosure requires an analysis of both ECS and RCS providers as defined under the SCA, the provider's privacy controls, and the individual user's privacy settings.  As we have counseled before, be careful what you put out there.

  1. The Fourth Amendment protects against unreasonable searches and seizures and prescribes criteria for the granting of search warrants.  U.S. Const. art. IV.  The protections of the Fourth Amendment apply if the government action has violated an individual's subjective expectation of privacy, and if society recognizes that expectation as reasonable.  See Smith v. Maryland, 442 U.S. 735, 740 (1979) (citing Katz v. U.S., 389 U.S. 347, 361 (1967) (Harlan, J., concurring)).
  2. An ECS provider is defined in the statute as “any service which provides to users thereof the ability to send or receive wire or electronic communications.”  18 U.S.C. § 2510.
  3. An RCS provider gives the public “computer storage or processing services by means of an electronic communications system.”  Id. § 2711.
  4. Id. § 2703(b)(1)(A).
  5. Id.  § 2703(b)(1)(B)(i).
  6. The SCA is inapplicable to information that is publicly available.

Notice: The purpose of this newsletter is to review the latest developments which are of interest to clients of Blank Rome LLP. The information contained herein is abridged from legislation, court decisions, and administrative rulings and should not be construed as legal advice or opinion, and is not a substitute for the advice of counsel.