Deleted Facebook and MySpace Posts Are Discoverable–Romano v. Steelcase

By Eric Goldman, with additional comments from Venkat

Romano v. Steelcase Inc., 2010 WL 3703242 (N.Y. Sup. Ct. Sept. 21, 2010).

On my personal blog, I have repeatedly blogged about plaintiffs who tell one story in court only to have that story undone by their postings to social networking sites. See, e.g., Sedie v. US, People v. Franco (despite the tragedy, my personal favorite) and Embry v. State.

This case is in the same vein. Romano claims that she is largely bedridden/housebound, but her public Facebook pictures show her apparently enjoying herself away from home. The defense requests access to her non-public posts on Facebook and MySpace, which the judge grants.

The short opinion focuses on the defense’s ability to access the private posts, but the actual order covers both current as well as deleted material. Specifically, the court orders “Defendant STEELCASE’s motion for an Order granting said Defendant access to Plaintiff’s current and historical Facebook and MySpace pages and accounts, including all deleted pages and related information, is hereby granted in all respects.” The court didn’t discuss the deleted material separately in its analysis, but this seems like a gotcha. Once a person posts material to Facebook or MySpace, there may not be a meaningful “undo”–even deleting it does not eliminate the material as future discoverable evidence for the duration of Facebook’s and MySpace’s retention periods.

[This raises the related Q of how long the sites archive deleted material. Facebook’s privacy policy had the opaque statement “Removed and deleted information may persist in backup copies for up to 90 days, but will not be available to others.” Putting aside the ambiguity of not being available to others–an untrue statement given the subsequent privacy policy statement about cooperating with legal requests–I couldn’t tell if this was the retention policy. So, if I delete a photo from Facebook on day 1, does this statement mean that the photo will become undiscoverable by day 91?]

[UPDATE: I had a few conversations with Facebook and my understanding is that deleted photos indeed would be unavailable for discovery within 90 days in many cases and perhaps substantially less time. Other content items are more complicated, but overall Facebook does not retain complete copies of “everything” indefinitely.]

This case only tells us what we already knew–never post anything online that will be inconsistent with the story you’re planning to tell others. The inconsistent material can surface even if the post is made in a non-public venue and even if you delete it later. Unfortunately, this well-known “rule” appears to be about as teachable as the rules regarding making sex tapes.

Other comments on this ruling:

* Kashmir Hill, pointing out the seeming inconsistency of this ruling with the Crispin ruling from earlier this year. I do think it’s conspicuous that the court seems to treat all material on Facebook as equally discoverable, even though some material might be governed as private communications under the ECPA and other material clearly wouldn’t be. An apropos academic article worth checking out: Lior Strahilevitz, A Social Networks Theory of Privacy (2004).

* Evan Brown

* Mike Masnick

* Bruce Boyden


Venkat’s comments: I don’t know when people will learn the “never post anything online that will be inconsistent with the story you’re planning to tell others” lesson. Perhaps a public awareness campaign is in order? People also tend to be surprised that, absent a specific privilege, personal communications, recollections, notes, and even a party’s diary are discoverable in a civil lawsuit. In fact, this evidence often tells the most accurate version of the story from the person’s perspective.

The wrinkle is the federal statute prohibiting the disclosure of private electronic communications such as emails, and on this basis, at least one court has ruled that the social networking site should not turn over private Facebook or MySpace messages to a party who issues a subpoena. (“Facebook Messages/Wall Posts, Civil Discovery, and the Stored Communications Act — Crispin v. Audigier.”) But this does not mean that the party seeking the discovery is not entitled to the relevant information. It just means that it should not be turned over by the social networking site absent a waiver or consent, and there is nothing to stop a court from requiring you to consent in order to proceed with your claims. I can’t see any universe in which you can bring a lawsuit alleging emotional damages or that an injury affected your lifestyle, and then claim your Facebook or MySpace postings are off limits. (I think it’s worth being clear about the different types of postings as well: there are truly private messages (which are similar to emails) and there are postings for your “friends,” which are quasi-public anyway. All of this should potentially be discoverable.)

This scenario presents an awkward logistical issue. Steelcase is entitled to postings from the plaintiff’s Facebook and MySpace pages, but does this mean that Steelcase can just rummage around in the plaintiff’s accounts? This seems invasive. It allows Steelcase to make the decision of what is and is not relevant and, in the process, get access to potentially sensitive and private information that is not relevant to the lawsuit in any way. I suppose the judge could offer to become Facebook friends with the litigants, but this seems clunky at best. (“Judge Offers to Facebook ‘Friend’ Witnesses in Order to Resolve Discovery Dispute — Barnes v. CUS Nashville.”) Other alternatives are to have a neutral third party view the material and decide what is relevant (this is expensive) or to require Facebook to provide a log of account activity (doesn’t necessarily work with pictures).

I’m not a big fan of courts citing to a bunch of company-drafted policies and concluding that Facebook and MySpace posts should be disclosed because no one expects them to be private anyway. Information that is stored in social networks can be used by several different parties, including law enforcement, the social network itself, and an outsider seeking information in the context of a civil lawsuit. To say that there is no expectation of privacy in your postings obscures the fact that these parties can access the information in different ways and subject to different restrictions. Does the court’s take on the privacy expectations of Facebook and MySpace users mean that law enforcement can freely access your private Facebook posts? This doesn’t seem like a tenable conclusion.

Finally, the fact that the court allowed access to certain deleted posts is interesting. I’m sure parties often receive advice to delete their accounts. Setting aside spoliation of evidence issues, as a practical matter, this may just not be an effective way to delete the material you want deleted.