Website Privacy Policy Supports Pseudonymous Poster’s Expectation of Privacy — Cornelius v. Deluca

[Post by Venkat Balasubramani]

Cornelius v. Deluca, 10-Cv-027-BLW (D.Id.; Mar. 15, 2011)

A district court judge in Idaho denied a request to unmask the identity of a pseudonymous forum poster. In support of its decision, the court looked to the website’s privacy policy to find an expectation of privacy.

The case revolved around comments made on bodybuilding.com which Cornelius and his company are not happy about. The lawsuit has spanned two jurisdictions (Idaho and Missouri) and spawned two rulings mentioned on this blog. Professor Goldman’s initial post describes the situation as follows:

DeLuca runs bodybuilding.com, a fitness website and online retailer. The plaintiffs sell dietary supplements (“syntrax,” whatever that is). The plaintiffs allege that their competitors posted shill reviews to bodybuilding.com designed to harm the plaintiffs’ business. The plaintiffs sued both bodybuilding.com and the putative shillers.

The first time around, the Missouri judge awarded bodybuilding.com an easy Section 230 win to the extent plaintiff tried to hold it liable for posts made by third parties. (“Online Retailer Isn’t Liable for User Comments.”) In a second ruling (after the dispute moved to Idaho), the court strayed from the Section 230 path and said that bodybuilding.com could be held liable for posts made by “moderators.” (“Troubling Ruling About 47 USC 230 and Moderators.”) In response to this ruling, plaintiff tried to find out the identity of a pseudonymous poster named “INGENIUM,” who posted the following:

despite S103’s constant matrix pimping in CASEIN threads, matrix is not a micellar casein product.

[I’m not even sure what the products in question are, and what claims are being made about them, but the extensive litigation activity in this case makes me think that they must be useful in some way.]

After a November 2010 hearing, the court allowed plaintiff to discover INGENIUM’s identity, based in part on defense counsel’s purported concession that bodybuilding.com did not object to disclosure of INGENIUM’s identity. The court’s earlier decision was also based on the court’s conclusion – relying on a recent Ninth Circuit case (In re Anonymous Online Speakers) – that the statement in question was commercial speech. Bodybuilding.com complained, saying that counsel was not authorized to make this concession, and requested that the court reconsider its prior ruling. Also, in between the court’s earlier ruling and its reconsideration of the order, the Ninth Circuit withdrew its opinion in In re Anonymous Online Speakers and left the opinion intact, except for the language that characterized the speech as commercial speech versus core political speech.

Anonymity v. Disclosure of INGENIUM’s identity: The court decides that INGENIUM’s speech is neither purely commercial nor core political speech, and it then looks to the question of whether plaintiffs’ need for INGENIUM’s identity outweigh INGENIUM’s right to speak anonymously. Without deciding the appropriate test in this context, the court looks to previous cases and settles on five relevant factors (citing Sony Music v. Does, Dendrite, 2TheMart): the plaintiff’s ability to establish a prima facie case; the specificity of the discovery request; the availability of alternate means to obtain the information; the need for discovery to advance plaintiff’s claim; and defendant’s (or the speaker’s) expectation of privacy.

The court reverses itself and finds that plaintiffs could advance their claim without obtaining INGENIUM’s identity – i.e., this information was not central to plaintiffs’ claims. Noting that an ‘extra-high hurdle’ exists when a non-party’s information is involved, the court finds that plaintiffs failed to clear that hurdle here. In particular plaintiffs sought to identify the precise nature of the relationship between bodybuilding.com and INGENIUM, but plaintiffs hadn’t conducted any discovery directed to bodybuilding.com on this issue. Bodybuilding.com submitted a declaration setting forth its relationship with INGENIUM (that INGENIUM was a community-elected volunteer), but plaintiffs did not bother deposing the individual who submitted the declaration. Thus, there was no need for plaintiffs to unmask INGENIUM to obtain this information, at least not at this stage.

The privacy policy: The court also added that:

INGENIUM has an expectation of privacy based on bodybuilding.com’s terms of service and privacy policy. Bodybuilding.com’s terms of service state that no poster may make any post that would infringe on another poster’s right to privacy. Bodybuilding.com’s privacy policy also states that protecting users’ privacy is a top priority, and bodybuilding.com has taken reasonable measures to protect users’ private information.

Ultimately, the court concludes that plaintiff’s attempt to discover INGENIUM’s identity “is a fishing expedition based on speculation that INGENIUM was or is an agent or representative of bodybuilding.com.”

__

There have been a couple of cases dealing with website privacy policies and their effect on whether a user should be unmasked. I blogged about Sedersten v. Taylor, where the court held that language in the policy providing that the site could freely use user information did not result in a waiver of the right to post anonymously. (“Online Commenter Did Not Waive Right to Anonymity by Agreeing to News Website’s Privacy Policy.”) In McVicker v. King, the court held – as the court did in this case – that language in the policy created an expectation of privacy. (Here’s Tom O’Toole’s post on that case: “Newspaper Website’s Privacy Policy Creates Expectation of Privacy for Commenters?“)

The expectation of privacy that is derived from a site or service’s terms is something that courts have looked to in the Fourth Amendment context, in dealing with questions of privilege or whether an employer has the right to access employee communications, and whether disclosure of a person’s social networking profile and communications is appropriate in civil litigation. But thus far, it has not made an appearance in anonymity cases. There are a couple of questions or concerns that this approach raises: (1) whether looking to terms in privacy policies would leave anonymous users at the whim of website terms (which may change from time to time based on business considerations), and (2) whether it makes sense to impute the expectation of privacy on users based on policies that they don’t necessarily read or digest? (See Chris Soghoian’s post the Twitter/Wikileaks disclosure order on the second point: “Federal judge in Twitter/Wikileaks case rules that consumers read privacy policies.”) The First Amendment cases dealing with online anonymity do not discuss whether the poster had a “reasonable expectation” of privacy, and looking to the online terms and privacy policy will just muddy the analysis. While it bolsters the poster’s privacy in this case, it may leave online posters in general worse off. Also, in many instances it will not be determinative because sites tend to include wiggle room in their policies so they can disclose user information if it’s in their interest to do so.

Interestingly, the issue is in front of the court only because of its ruling that bodybuilding.com could be held liable if INGENIUM is found to be an “agent or representative of bodybuilding.com.” See Professor Goldman’s skepticism about this conclusion in his earlier post on the case: “Troubling Ruling About 47 USC 230 and Moderators.”