New England Biz Law Update
With the enduring popularity of web-based mail services like Hotmail, Yahoo! Mail and Google’s Gmail, it’s hardly surprising that courts have found themselves considering requests in civil lawsuits for electronic discovery of e-mail messages.
But with many people using these sites for both work and personal business, the scope of such requests can lead to disputes over what responsibilities the web-mail providers have to respond to subpoenas.
For example, North Billerica, Mass. attorney Jenny J. Liu is currently representing a party in a civil dispute that’s in discovery. The other side, she said, originally requested her client’s e-mails pertaining to the case, which she produced, including messages sent from the client’s Gmail account.
“Then, without any notification, I received a copy of a subpoena the other side sent to Google … for all e-mails sent to and received by my client’s personal e-mail account,” said Liu. “My client used that e-mail account partially for business, but mostly for personal use – and to communicate with me.”
Like a desk drawer
Just because a party intermingles personal and business e-mail, the personal e-mails should not be discoverable, according to Boston attorney Jonathan Sablone, who frequently handles e-discovery issues.
“If I subpoena someone’s Gmail account, I’m not entitled to the entire content of the account, just the e-mails related to the litigation,” Sablone said. “It’s just like if you kept personal bills in a desk drawer along with business bills; those personal bills still wouldn’t be producible.”
Thanks to laws such as Sarbanes-Oxley, businesses are frequently required to retain old e-mails on their servers – even those a user thinks he has deleted. But accessing old web-mail messages from a personal account can be more difficult, according to Sablone.
“Getting e-mails [directly from] a web-based provider is very difficult in a lot of ways,” he said, noting that if the e-mails have been deleted, the web-mail providers do not keep their data “hanging around on servers for very long.”
Sablone added: “Does Google keep a backup tape of deleted e-mails floating around somewhere? Even if they do, it would be very expensive and time consuming to go through them, so they tend to put up all sorts of defenses and fight subpoenas [from civil litigants] tooth and nail.”
Even if the account remains active and the e-mails have not been deleted, web-mail providers often resist turning over contents of an account, Sablone said.
But Liu said her client was notified by Google that, unless the client objected, Google would turn over the e-mails to the opposing side. Liu said her client was told it could file a motion to quash the subpoena.
Some parties might not understand such a notice, said Liu, resulting in Google “just going ahead and producing” the messages despite the wishes of the e-mail account holder.
Liu said her motion to quash cited the Electronic Communications Privacy Act, which forbids parties from accessing or distributing e-mail messages without the account holder’s permission. She also cited privacy and attorney-client privilege issues.
Sablone said he thinks it is “highly unlikely” that Google will start turning over e-mails every time one of its users is involved in a civil dispute, instead telling courts that doing so would be an undue burden for a third party.
“You see it more in criminal investigations, where they might do a targeted search,” he said.
Asked to comment on the issue, a Google spokesperson in an e-mail said that “Google does comply with valid legal process[es], such as court orders and subpoenas, as required by law. It’s difficult to comment on subpoenas generally, because each subpoena is evaluated on an individual basis.”
The spokesperson added that the provider has “very strict compliance protocols and an entire legal team whose job is to scrutinize these requests to ensure their validity. And because Google isn’t in a position to evaluate the claims of the litigants, it is our policy to attempt [to] notify the user who is subject to the subpoena, so that he or she may respond directly to the litigant.”
‘Apple’ case
The Electronic Communications Privacy Act is generally used in criminal cases, according to Robert J. Ambrogi, a Rockport, Mass. attorney whose practice includes technology law. But in a 2006 decision, O’Grady v. Superior Court, the California Appeals Court found that the ECPA could also apply to discovery in a civil case.
“In litigation, the other party can seek discovery of your e-mail directly from you. What this law says is they can’t circumvent you, go to the Internet Service Provider, and get the e-mails from the ISP without requesting them from you,” said Ambrogi.
In the O’Grady case, computer manufacturer Apple Inc. was seeking to identify the authors of blogs that had leaked sensitive company information. The court ordered a protective order that kept the ISPs from releasing that information to Apple.
“It’s different in the criminal context,” explained Ambrogi. “If the government serves a subpoena, there’s a safe harbor provision for ISPs to respond to a subpoena from an agency like the FBI and still be protected from any liability. … In a civil context, I would hope that [ISPs] would understand that they don’t have to comply, that they can act to protect the privacy of their customers.”
A subpoena for a user’s e-mail activity over the course of several years, regardless of the topic, could be subject to a claim from the other party that the request is overly broad, said Ambrogi.
Ultimately, Sablone said, attorneys should treat subpoenas to web-mail providers the way they would any third-party subpoena.
“Be cautious and be sure you get involved in the process,” he advised. “It’s not all that different from subpoenas for cell phone records: You want to make sure you stay on top of it, and to the extent you can, control the process. You want to be the one to ask the court for a protective order. You don’t necessarily want to leave the process of deciding what does and doesn’t get produced to the third party.”
