Employers need to exercise care when accessing employees’ e-mails, particularly e-mails on personal e-mail accounts. In Pure Power Boot Camp Inc. v. Warrior Fitness Boot Camp LLC, a non-compete case that turned into a case about the privacy of stored e-mails and violations of the federal Stored Communications Act (SCA), the court held:
- SCA statutory damages can be recovered by plaintiffs, even if they suffered no actual damages, and
- the calculation of statutory damages ($1,000 per violation), generally is based on the number of times the “electronic communications facility” (or personal e-mail account, e.g., Hotmail) is accessed, not the number of emails accessed.
The dispute arose when two employees of a fitness facility, Pure Power Boot Camp Inc., left to start their own fitness facility, Warrior Fitness Boot Camp LLC. A non-compete action followed because Pure Power learned through 546 mails it had accessed over a nine-day period that its former employees had taken customer lists, training and instruction materials, and solicited Pure Power customers. The e-mails were from four personal accounts belonging to the former employees’ – Hotmail, Gmail, Warrior Fitness, and an unrelated corporate account. Pure Power was able to access these accounts because the former employees stored their usernames and passwords on its computers; when Pure Power accessed the particular site, the username and password automatically populated.
The former employees learned of Pure Power’s accessing their personal e-mail accounts and filed counterclaims, including allegations of violations of the Stored Communications Act.
The court ruled in the non-compete action that accessing the former employees’ four accounts violated the SCA. Two of the issues before Judge Theodore H. Katz were whether statutory damages could be recovered in the absence of actual damages and, if so, how to calculate those damages. The SCA provides that “in no case shall a person entitled to recover receive less than the sum of $1,000,” but there is little guidance as to whether this minimum should be awarded for each violation, or what constitutes distinct and independent violations as opposed to a single continuous violation.
SCA Statutory Damages Without Actual Damages. Judge Katz disagreed with a ruling by the Fourth Circuit of the U.S. Court of Appeal, Van Alstyne v. Elec. Scriptorium, Ltd. 560 F.3d 199 (4th Cir. 2009), which held that statutory damages under the SCA can be recovered only where the plaintiff also has suffered actual damages.
Van Alstyne based its holding (i) on a decision by the U.S. Supreme Court in Doe v. Chao, 540 U.S. 614 (2004), which reached a similar conclusion for statutory damages under the Privacy Act of 1974, and (2) on the fact that the language concerning damages in these two statutes (SCA and Privacy Act) were nearly identical.
However, Judge Katz cited a number of other federal court decisions holding that while the language in the two statutes are similar, they are different statutes with different purposes and penalize different behaviors. Rejecting the Doe analysis, he concluded statutory damages were recoverable for SCA violations in the absence of actual damages.
Calculating Statutory Damages. Judge Katz said the SCA punishes anyone who “intentionally accesses without authorization a facility through which an electronic communication service is provided . . . and thereby obtains . . . access to a wire or electronic communication while it is in electronic storage.” 18 U.S.C. Section 2701(a). Based on this language, he rejected the two former employees’ argument that the number of violations should be measured by the number of e-mails accessed, 546, adopting Pure Power’s argument, instead. Accordingly, when an account is accessed multiple times over a short period of time, it should constitute only a single violation of the SCA. Noting the SCA targets the unauthorized access of an electronic communication facility (not the e-mails themselves), and because there was nothing to indicate the number of times each of the four accounts were accessed over the short nine-day period, the court found four violations.