State Privacy Claims not Preempted by ECPA — Leong v. Carrier IQ
[Post by Venkat Balasubramani]
Leong v. Carrier IQ et al., CV 12-01562 GAF (NRWx) (C.D. Cal.; Apr. 27, 2012)
This case addresses the issue of whether claims under state privacy statutes are preempted by ECPA, the federal statute governing the interception, access, and disclosure or electronic communications. The lawsuit is one of the many filed against Carrier IQ, which allegedly “developed and maintain[ed] a software that is installed on cell phones and surreptitiously records the user’s keystrokes, text messages and passwords” (without the user’s consent). Plaintiffs sued on behalf of a California class, asserting state law claims against Carrier IQ. Carrier IQ moved to dismiss on the basis that the state law claims were preempted by ECPA.
Courts have come out differently on the preemption issue. Carrier IQ relied heavily on Judge Ware’s ruling in the Google Wi-Fi case for the proposition that ECPA represents a Congressional intent to comprehensively regulate the field of privacy in electronic communications. (Here’s is our previous post on Judge Ware’s ruling: “Google Not Entitled to “Readily Accessible to the General Public” Defense in Street View Class Action.”) The court disagrees with Judge Ware, noting that Judge Ware’s ruling embraces the minority position and there are several cases going the other way. The court also cites to the legislative history for the proposition that Congress actually intended to set a minimum floor for privacy in electronic communications (citing to Lane v. CBS and Valentine v. NebuAd [pdf]). The ECPA also contains a provision limiting remedies for the interception of communications where the interception does not comply with the statute, but the court says that this provision means that criminal defendants whose communications are obtained in violation of ECPA are only entitled to suppression as a remedy.
End result: the lawsuit is remanded to state court where the plaintiffs can pursue their state law claims against Carrier IQ.
__
The ECPA preemption argument is an important one, and will come up in a variety of contexts. While this case dealt with the interception of electronic communications, other scenarios where it may come into play is where someone accesses emails and other communications (e.g, social networking posts) or records conversations without consent authorization. The ECPA admittedly has some gaps when it comes to privacy protection for electronic communications (see, for example Anderson Consulting v. UOP and Charles Jones & Associates v. The H Group), and plaintiffs can be expected to use state law claims to fill the gaps.
It’s tough to be sympathetic with the argument from service providers or third parties who are making a preemption argument in this situation. Unlike laws regulating spam or that cover online content—where complying with a patchwork of regulation across 50 states would be untenable—complying with state laws governing the privacy of electronic communications sounds pretty doable. At least, the parties arguing preemption haven’t to date presented good examples of why this is not the case. On the other hand, it’s easy to see that these types of rulings will pave the way for the class action machine to unleash state law claims, and have available yet another tool for extracting settlements.
Other coverage: Wendy Davis: “Carrier IQ Loses Preliminary Round in Privacy Lawsuit”
Inside Privacy: Carrier IQ Class Action Sent Back to State Court