June 01, 2011
Yahoo! Entitled to Immunity for Disclosing User Information in Response to Subpoena -- Sams v. Yahoo!
[Post by Venkat Balasubramani]
Sams v. Yahoo!, Inc., CV-10-5897-JF(HRL) (N.D. Cal.; May 18, 2011)
Fayelynn Sams sued Yahoo!, contending that Yahoo! improperly produced information in response to a subpoena which requested information regarding Sams's account. She brought a putative class action asserting a variety of claims, including a state law privacy claim, breach of contract, breach of the duty of good faith and fair dealing, and claims under the Electronic Communications Privacy Act. The court finds that Yahoo! is entitled to immunity under the Electronic Communications Privacy Act's immunity provisions and dismisses the case.
Yahoo! received a grand jury subpoena signed by the Clerk of the Superior Court of Lowndes County (Georgia). This subpoena sought:
any and all records regarding the identification of a user with the Yahoo! ID "lynnsams" or "firstname.lastname@example.org" to include name and address, date account created, account status, Yahoo! E-mail [sic] address, alternate e-mail address, registration from IP, date IP registered and login IP address associated with session times and dates.
A second subpoena issued from the same court sought "any and all I.P. login tracker for "lynnsams" or "email@example.com"" for dates in December 2008. The subpoenas, which stated that they were related to a child pornography investigation, specifically instructed Yahoo! to not inform the account-owner of the subpoena or that any information was provided. (See both subpoenas here.)
It's unclear exactly what information Yahoo! disclosed in response to the subpoenas, but the subpoenas do not seek the substantive contents of any communications--the subpoenas are directed to account and identification information. Sams did not specifically allege in her complaint that Yahoo! produced the contents of any of her email messages.
Yahoo! argued that it was entitled to immunity under 18 U.S.C. section 2703(e). Immunity under section 2703(e) is available to "any provider of wire or electronic communication service . . . for providing information . . . in accordance with the terms of a court order, warrant, subpoena, statutory authorization, or certification under this chapter." Yahoo! alternatively argued that 18 U.S.C. section 2707(e) immunized the disclosure in question. This subsection contains a similar immunity provision, but requires "good faith" reliance on a subpoena or other process, and requires notice in certain circumstances.
Resolution of affirmative defense on a motion to dismiss: The court first addressed Sams's argument that since Yahoo! raised defenses based on statutory immunity, these were not properly resolved on a motion to dismiss. The court says that Yahoo!'s defenses can be resolved at the 12b stage, citing Goddard v. Google, among other cases. Sams's pleading raised the issue of whether Yahoo!'s disclosure of information was proper, and this was something the court could resolve at the pleading stage because it turned on the Sams's arguments regarding validity of the subpoenas.
Was Yahoo! entitled to immunity?: Yahoo! was entitled to immunity to the extent it disclosed the information "in accordance" with a subpoena. Sams made a couple of creative arguments as to why this immunity was not available to Yahoo!
Sams first argued that the subpoena was invalid because it was issued out of Georgia and directed at a California company (Yahoo!). State procedural rules do not require an out-of-state company to comply with a Georgia subpoena, and there is a procedure (which is often ministerial in practice) to get a subpoena issued by a local court seeking information from a California company. Since these procedures were not followed, Sams argued that the subpoena was invalid. Yahoo! argued that although the subpoenas were faxed to Yahoo!'s compliance office in Sunnyvale, "the language [of the subpoena] could be read to refer generally to Yahoo! as a singular corporate entity." Yahoo! further explained that although it used to contest jurisdiction in states other than California (where it has offices and employees) and resist subpoenas on this basis, it no longer does so. It pointed to one decision where it raised the issue and lost. Apparently Yahoo! argued that it was subject to jurisdiction in Georgia, so it did not bother to raise the argument that the subpoena should have been issued out of a California court. [Going forward, it's not clear if you need to obtain a local subpoena if you are in a state where Yahoo! has an office, but it's interesting that Yahoo! says that it has a policy of no longer contesting subpoenas in states where it has an office.]
Sams also argued that Yahoo! did not produce the information "in accordance" with the subpoena because the subpoena directed Yahoo! to "appear and produce evidence," and Yahoo! instead sent the information to avoid the hassle of having to appear personally. The court says that there is no authority for the proposition that a person who produces documents instead of appearing in person is not producing the documents "in accordance" with the subpoena.
Finally, the court addressed Sams's argument that Yahoo! was not entitled to immunity because it disclosed the "contents" of her communications. The court says that there are no allegations to support her argument that Yahoo! disclosed the "contents" of any communication. The ECPA sets forth a hierarchy of protection for user information, and non-content information is entitled to less protection. The statute authorizes the disclosure of things like user identification information, records or session times and durations, and temporarily assigned network addresses in response to a subpoena, as opposed to a court order. The court concludes that Sams fails to adequately allege facts that Yahoo! is not entitled to immunity because she does not specify the contents of any communications which were actually disclosed by Yahoo!. The court dismisses the case, but grants leave to amend if Sams can allege that Yahoo! impermissibly disclosed any content-based information.
One notable thing about this case is Judge Fogel's willingness to dismiss at the pleading stage based on Yahoo!'s claim of immunity. Section 230 cases have been somewhat mixed, but the court cites to at least a couple of cases granting requests to dismiss on Section 230 grounds at the pleading stage. Goddard v. Google, cited by the court, was also decided by Judge Fogel. (Professor Goldman's post on that case: "Google Not Liable for False Ads.")
The disclosure of user information has generated a fair amount of attention recently. The United States government sought and obtained a court order requiring disclosure of the information of various Twitter users in connection with its Wikileaks investigation. (See "Court Refuses to Set Aside Order Requiring Disclosure of Twitter Users' IP Addresses." The court's refusal to set aside the order is currently on appeal, and in that case, Twitter sought permission in order to provide notice to the users in question.) More recently, a council in the UK subpoenaed (in California) user information from Twitter about a possible whistleblower who was badmouthing the council. This The Next Web story has some details, but the user in question was given the opportunity to contest the subpoena but he did not, citing to the costs involved. In both situations, Twitter looks like it did what it could as far as providing users notice and not just handing over the information.
Section 2703(c)(2) sets forth certain information (name; address; local and long distance telephone connection records, or records of session times and durations; length of service and types of service utilized; telephone or instrument number or other subscriber number or identity, including any temporarily assigned network address; and means and source of payment for such service (including any credit card or bank account number)), which can be disclosed to the government pursuant to an "administrative subpoena authorized by a Federal or State statute or a Federal or State grand jury or trial subpoena or any means available under paragraph (1) [a warrant, court order, or consent]." It would seem that in response to a subpoena such as this one, a service provider that falls under the statute would be well served to restrict the disclosure of information to what is contained in subsection (c)(2), unless its user agreement clearly allows for greater disclosure. User agreements are not always conclusive, and the court did not rely on the user agreement in this case. I'm somewhat surprised that the court did not look to this laundry list of items that may be disclosed to the government in response to a subpoena and compare it to the actual subpoenas in the case. The statute is specific as to what types of information may be disclosed, but the court focuses on the distinction between content information and all other information.
Although the court ruled in Yahoo!'s favor, disclosure of user information comes with risk, from both the perspective of the service provider and the party (and its lawyer) who seeks the information. The service provider should not take the shotgun approach of turning over user information. Cases have held that "content" information may not be produced in response to a civil subpoena, and at least one court has imposed liability on a party and its lawyer for obtaining email messages using what the court described as a "patently invalid" subpoena. (Theofel v. Farey Jones.) Additional uncertainties are present when a party seeks to subpoena information from social networking sites, where the sites' classification under the statute and the distinction between "content" information and other information are more fluid.
Posted by Venkat at June 1, 2011 10:08 AM | Privacy/Security