November 11, 2015 Top Story

Circuit Split Creates Data Protection Uncertainty

Interpreting "electronic storage" proves difficult in the face of evolving technology

Kristen L. Burge

In Anzaldua v. Northeast Ambulance & Fire Protection District, the U.S. Court of Appeals for the Eighth Circuit narrowly interpreted the term electronic storage and rejected the Ninth Circuit’s more expansive interpretation of the term. The Eighth Circuit found that the plaintiff in Anzaldua failed to prove allegedly stolen data violated the Stored Communications Act (SCA). ABA Section of Litigation leaders say the decision creates a circuit split and demonstrates how evolving technology can bedevil the electronic storage definition under the SCA, thereby weakening data privacy.

Anzaldua and its Narrow Interpretation of Electronic Storage 

In Anzaldua, the plaintiff alleged his ex-girlfriend, one of the named defendants, used his password to gain access to his personal email account. The plaintiff argued the defendants violated the SCA by accessing his account without authorization and forwarding two saved emails, including one stored in his sent folder. He further argued, relying upon Ninth Circuit decision Theofel v. Farey-Jones, the sent email qualified as electronic storage because the sent folder served a backup purpose until “the underlying message expired in the normal course.”

The Eighth Circuit held that the user did not store the sent data for backup purposes. The Eighth Circuit noted that “[the electronic storage] requirement is commonly misunderstood because the statutory definition of ‘electronic storage’ is much narrower than its name suggests.” The Eighth Circuit acknowledged the plaintiff’s sent data remained on the server as a matter of course, and under common parlance, may serve as backup for the sender. According to the Eighth Circuit, however, successfully transmitted data no longer qualifies as electronic storage under the SCA. The Eighth Circuit noted the plaintiff had no reason to access the purported backup copy of the file because the message had been successfully delivered.

Under Anzaldua, the SCA may no longer protect stored communications a user considers saved as backup. Unlike the Ninth Circuit, the Eighth Circuit limited protection for sent data to that stored on a recipient’s server. The Eighth Circuit also sought to minimize its disagreement with the Ninth Circuit, explains Elizabeth S. Fenton, Wilmington, DE, past cochair of the Section of Litigation’s Business Torts & Unfair Competition Committee. Although dicta, the Eighth Circuit stated that even adopting Theofel’s rationale, the court would still find the plaintiff did not store the sent email for “the purposes backup protection.” Rather, the Eighth Circuit noted that “[i]f Theofel has any application here, it would be to protect a copy of the email stored with [the recipient’s] email service, not [the plaintiff’s].”

Circuit Split over Definition of “for Purposes of Backup Protection”

Faced with nearly the same issues, the Eighth Circuit and the Ninth Circuit reached opposite conclusions as to which emails the senders stored for backup protection. “Whether the Eighth or Ninth Circuit got it right depends on which school of judicial philosophy one aligns himself with. If you are a believer in strict construction and believe the Act needs to be updated by Congress, then you likely are pleased with the [Eighth Circuit] opinion,” reasons David Gevertz, Atlanta, GA, chair of the Employment Subcommittee of the Section’s Civil Rights Litigation Committee. Conversely, those in favor of loose interpretation tailored to emerging technology prefer the Ninth Circuit decision, says Gevertz.

The split begs the question, “How should the law deal with issues of electronic storage, or data at rest, in light of the revolution in technology services and the cyber area?” asks Harvey Rishikof, Washington, DC, cochair of the ABA Cybersecurity Legal Task Force. Today “people store emails by leaving them in their inboxes, sent mailbox, or deleted folders, where they can keep copies indefinitely,” notes Gevertz. By classifying these communications as electronic storage, the Ninth Circuit expanded protection to technologies not originally contemplated by the SCA, such as emails stored on web-based servers.

“The split leaves a lot of questions unanswered and conflict not only at the federal level, but at the state level too. The case law is all over the map,” observes Fenton. The SCA was not set up to deal with evolving technology, argues Theodore F. Claypoole, Charlotte, NC, chair of the ABA Business Law Section’s Cyberspace Law Committee.

Congress originally intended for the SCA to give Fourth Amendment-like protections to a network of backup servers and intermediaries. As a result, the SCA leaves wanting many areas of privacy protection for the user, explains Rishikof. “It is time for Congress to step in and be more specific as to what stored communications means, and at the very least, make references to current technologies,” suggests Claypoole.

Advising Clients in the Face of Uncertainty

Anzaldua does not foreclose all avenues of protection for stored data under a user’s control. Providers can achieve a broader scope of protection under the SCA as interpreted by the Eighth Circuit. “Service contracts should make clear the intentions of their users to store emails for backup purposes, thereby invoking the common sense interpretation of Judge Alex Kozinski in the Ninth Circuit,” says Rishikof.

With the SCA’s inconsistent application, clients must “be very careful because you cannot expect to know how the court is going to interpret stored communications, especially if the content is stored in the email system and accessible by the sender of the message,” cautions Claypoole. To minimize the risk of litigation, “it is crucial to implement policies limiting or prohibiting access to personal accounts to avoid stored communication disputes,” advises Fenton. Applying common sense, Fenton suggests that “when you break up with someone, change your password!”

Kristen L. Burge, Litigation News Contributing Editor

Keywords: electronic communications, technology, privacy, data security, internet law

Related Resources

Copyright © 2018, American Bar Association. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. The views expressed in this article are those of the author(s) and do not necessarily reflect the positions or policies of the American Bar Association, the Section of Litigation, this committee, or the employer(s) of the author(s).