Skip to content

Menu

Jackson Lewis P.C.  logo
HomeAboutServicesContactSubscribe
Search
Close

Workplace Privacy, Data Management & Security Report

Access to Personal E-mails Enough for Statutory Damages under Federal Stored Communications Act . . . Even With No Actual Damages

By Joseph J. Lazzarotti on January 10, 2011
Posted in Monitoring

Employers need to exercise care when accessing employees’ e-mails, particularly e-mails on personal e-mail accounts. In Pure Power Boot Camp Inc. v. Warrior Fitness Boot Camp LLC, a non-compete case that turned into a case about the privacy of stored e-mails and violations of the federal Stored Communications Act (SCA), the court held:

  1. SCA statutory damages can be recovered by plaintiffs, even if they suffered no actual damages, and
  2. the calculation of statutory damages ($1,000 per violation), generally is based on the number of times the “electronic communications facility” (or personal e-mail account, e.g., Hotmail) is accessed, not the number of emails accessed.

The dispute arose when two employees of a fitness facility, Pure Power Boot Camp Inc., left to start their own fitness facility, Warrior Fitness Boot Camp LLC. A non-compete action followed because Pure Power learned through 546 mails it had accessed over a nine-day period that its former employees had taken customer lists, training and instruction materials, and solicited Pure Power customers. The e-mails were from four personal accounts belonging to the former employees’  – Hotmail, Gmail, Warrior Fitness, and an unrelated corporate account. Pure Power was able to access these accounts because the former employees stored their usernames and passwords on its computers; when Pure Power accessed the particular site, the username and password automatically populated.

The former employees learned of Pure Power’s accessing their personal e-mail accounts and filed counterclaims, including allegations of violations of the Stored Communications Act.

The court ruled in the non-compete action that accessing the former employees’ four accounts violated the SCA. Two of the issues before Judge Theodore H. Katz were whether statutory damages could be recovered in the absence of actual damages and, if so, how to calculate those damages. The SCA provides that “in no case shall a person entitled to recover receive less than the sum of $1,000,” but there is little guidance as to whether this minimum should be awarded for each violation, or what constitutes distinct and independent violations as opposed to a single continuous violation.

SCA Statutory Damages Without Actual Damages. Judge Katz disagreed with a ruling by the Fourth Circuit of the U.S. Court of Appeal, Van Alstyne v. Elec. Scriptorium, Ltd. 560 F.3d 199 (4th Cir. 2009), which held that statutory damages under the SCA can be recovered only where the plaintiff also has suffered actual damages.

Van Alstyne based its holding (i) on a decision by the U.S. Supreme Court in Doe v. Chao, 540 U.S. 614 (2004), which reached a similar conclusion for statutory damages under the Privacy Act of 1974, and (2) on the fact that the language concerning damages in these two statutes (SCA and Privacy Act) were nearly identical.

However, Judge Katz cited a number of other federal court decisions holding that while the language in the two statutes are similar, they are different statutes with different purposes and penalize different behaviors. Rejecting the Doe analysis, he concluded statutory damages were recoverable for SCA violations in the absence of actual damages.

Calculating Statutory Damages. Judge Katz said the SCA punishes anyone who “intentionally accesses without authorization a facility through which an electronic communication service is provided . . . and thereby obtains . . . access to a wire or electronic communication while it is in electronic storage.” 18 U.S.C. Section 2701(a). Based on this language, he rejected the two former employees’ argument that the number of violations should be measured by the number of e-mails accessed, 546, adopting Pure Power’s argument, instead. Accordingly, when an account is accessed multiple times over a short period of time, it should constitute only a single violation of the SCA. Noting the SCA targets the unauthorized access of an electronic communication facility (not the e-mails themselves), and because there was nothing to indicate the number of times each of the four accounts were accessed over the short nine-day period, the court found four violations.
 

Tags: Gmail, Hotmail, monitoring, personal email account, Stored Communications Act, Yahoo
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Joseph J. Lazzarotti Joseph J. Lazzarotti

Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP)…

Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and management of data, as well as the impact and regulation of social media. He also counsels companies on compliance, fiduciary, taxation, and administrative matters with respect to employee benefit plans.

Privacy and cybersecurity experience – Joe counsels multinational, national and regional companies in all industries on the broad array of laws, regulations, best practices, and preventive safeguards. The following are examples of areas of focus in his practice:

  • Advising health care providers, business associates, and group health plan sponsors concerning HIPAA/HITECH compliance, including risk assessments, policies and procedures, incident response plan development, vendor assessment and management programs, and training.
  • Coached hundreds of companies through the investigation, remediation, notification, and overall response to data breaches of all kinds – PHI, PII, payment card, etc.
  • Helping organizations address questions about the application, implementation, and overall compliance with European Union’s General Data Protection Regulation (GDPR) and, in particular, its implications in the U.S., together with preparing for the California Consumer Privacy Act.
  • Working with organizations to develop and implement video, audio, and data-driven monitoring and surveillance programs. For instance, in the transportation and related industries, Joe has worked with numerous clients on fleet management programs involving the use of telematics, dash-cams, event data recorders (EDR), and related technologies. He also has advised many clients in the use of biometrics including with regard to consent, data security, and retention issues under BIPA and other laws.
  • Assisting clients with growing state data security mandates to safeguard personal information, including steering clients through detailed risk assessments and converting those assessments into practical “best practice” risk management solutions, including written information security programs (WISPs). Related work includes compliance advice concerning FTC Act, Regulation S-P, GLBA, and New York Reg. 500.
  • Advising clients about best practices for electronic communications, including in social media, as well as when communicating under a “bring your own device” (BYOD) or “company owned personally enabled device” (COPE) environment.
  • Conducting various levels of privacy and data security training for executives and employees
  • Supports organizations through mergers, acquisitions, and reorganizations with regard to the handling of employee and customer data, and the safeguarding of that data during the transaction.
  • Representing organizations in matters involving inquiries into privacy and data security compliance before federal and state agencies including the HHS Office of Civil Rights, Federal Trade Commission, and various state Attorneys General.

Benefits counseling experience – Joe’s work in the benefits counseling area covers many areas of employee benefits law. Below are some examples of that work:

  • As part of the Firm’s Health Care Reform Team, he advises employers and plan sponsors regarding the establishment, administration and operation of fully insured and self-funded health and welfare plans to comply with ERISA, IRC, ACA/PPACA, HIPAA, COBRA, ADA, GINA, and other related laws.
  • Guiding clients through the selection of plan service providers, along with negotiating service agreements with vendors to address plan compliance and operations, while leveraging data security experience to ensure plan data is safeguarded.
  • Counsels plan sponsors on day-to-day compliance and administrative issues affecting plans.
  • Assists in the design and drafting of benefit plan documents, including severance and fringe benefit plans.
  • Advises plan sponsors concerning employee benefit plan operation, administration and correcting errors in operation.

Joe speaks and writes regularly on current employee benefits and data privacy and cybersecurity topics and his work has been published in leading business and legal journals and media outlets, such as The Washington Post, Inside Counsel, Bloomberg, The National Law Journal, Financial Times, Business Insurance, HR Magazine and NPR, as well as the ABA Journal, The American Lawyer, Law360, Bender’s Labor and Employment Bulletin, the Australian Privacy Law Bulletin and the Privacy, and Data Security Law Journal.

Joe served as a judicial law clerk for the Honorable Laura Denvir Stith on the Missouri Court of Appeals.

Read more about Joseph J. Lazzarotti
Show more Show less
Related Posts
Doctor Holding Cell Phone. Cell phones and other kinds of mobile devices and communications technologies are of increasing importance in the delivery of health care. Photographer Daniel Sone
National Cancer Institute, Unsplash
Getting Healthcare in 2023 and Beyond…Virtually…and Securely
January 16, 2023
Fruitful - Free WordPress Responsive theme source code displayed on this photo, you can download it for free on wordpress.org or purchase PRO version here https://goo.gl/hYGXcj
Ilya Pavlov, Unsplash
HIPAA Regulated Entities: Website or App Tracking Technologies, Pixels Can Create Significant Compliance and Litigation Risks
January 2, 2023
image
California Tightens Rules on Vehicle Tracking, Fleet Management
October 28, 2022
Jackson Lewis JacksonLewis.com

Stay Connected

Subscribe to this blog via RSS Follow Us on Twitter Add us on Facebook View Our LinkedIn Profile

Topics

Archives

Editors

  • Jason C. Gavejian
  • Joseph J. Lazzarotti

Contributors

  • Christopher E. Hoyme
  • Damon W. Silver
  • Michael R. Bertoncini
  • Marlo Johnson Roebuck
  • Nathan W. Austin
  • Nicky Jatana
  • Jeffrey M. Schlossberg

Blog Authors Show/Hide

  • Joseph J. Lazzarotti
  • Jason C. Gavejian
  • Maya Atrakchi
  • Jackson Lewis P.C.
  • Mary T. Costigan
  • Damon W. Silver
  • Jeffrey M. Schlossberg
  • Michael R. Bertoncini
  • Robert Yang
  • Christopher E. Hoyme
  • Rachel E. Ehlers
  • Frank J. Fanshawe
  • Sean Paisan
  • Jody Kahn Mason
  • Delonie A. Plummer
  • Richard I. Greenberg
  • Jerel Pacis Agatep
  • Catherine R. Tucciarello
  • Cecilie E. Read
  • Ronald V. Sgambati
  • Nathan W. Austin
  • Joshua D. Allen
  • Michelle T. Hackim
  • Gregory C. Brown Jr.
  • Daniel J. Moses
  • Yvonne Arvanitis Fossati
  • Todd R. Dobry
  • Susan M. Corcoran
  • Paul A. Friedman
  • Marlo Johnson Roebuck
  • Joseph J. Lynett
  • Jennifer Shoaf Richardson
  • Francis P. Alvarez
  • Amy L. Peck
  • Zachary A. Ahonen
  • John A. Snyder
  • Stephanie L. Adler-Paindiris
  • Richard F. Vitarelli
  • Kathryn J. Russo
  • Melissa Pascualini
  • Laura A. Mitchell
  • Michael D. Ridenour
  • Kevin D. Holden
  • Joshua M. Henderson
  • Jonathan J. Spitz
  • Jason Selvey
  • Valerie K. Jackson
  • Jackson Biesecker
  • Howard M. Bloom
  • Erik J. Winton
  • Eric J. Felsberg
  • Elizabeth S. Walsh
  • David R. Golder
  • Craig W. Wiley
  • Clifford R. Atlas
  • Christopher T. Patrick
  • Chad P. Richter
  • Ashley Solowan
  • Regan Harrison
  • Paige
  • Nicky Jatana
  • Melissa Ostrower
  • Mei Fung So
  • Lara Hamm
  • Kourtney Goebel
  • Kendall Melidosian
  • Gayla Kirkland
  • Kelly
  • Katy Admirand
  • Katharine C. Weber
  • Jessica Poot
  • Jenifer M. Bologna
  • Jonathan L. Crook
  • Haley Nystrom
  • foxtemplate
  • Brendan Ward
  • Ann Albertson

Recent Upates

  • Iowa’s Governor Signs Comprehensive Consumer Privacy Law
  • FTC Focuses on Pixel Tracking, and Not Just at Healthcare Companies
  • CFPB and NLRB Sign Information Sharing Agreement to Target Employer Surveillance and “Debt Traps” for Employees
  • Iowa to Be Sixth State to Pass a Consumer Privacy Statute
  • CPPA Starts Rulemaking on Cybersecurity, Risk Assessments, and Automated Decision-making

Jackson Lewis

Subscribe to this blog via RSS Follow Us on Twitter Add us on Facebook View Our LinkedIn Profile
Privacy PolicyDisclaimer

About Jackson Lewis

Focused on labor and employment law since 1958, Jackson Lewis P.C.’s 950+ attorneys located in major cities nationwide consistently identify and respond to new ways workplace law intersects business. We help employers develop proactive strategies, strong policies and business-oriented solutions to cultivate high-functioning workforces that are engaged, stable and diverse, and share our clients’ goals to emphasize inclusivity and respect for the contribution of every employee.

Read More...
Copyright © 2023, Jackson Lewis P.C. All Rights Reserved.
Law blog design & platform by LexBlog LexBlog Logo