Federal Court Holds Opened Emails Not Protected By Stored Communications Act

Privacy/Cyber Risk & Data Security

On June 5, the U.S. District Court for the Northern District of Ohio held that emails the intended recipient opened but did not delete were not covered by the Stored Communications Act because they were not being kept for the purposes of backup protection. Lazette v. Kulmatycki, No. 12-02416, 2013 WL 2455937 (N.D. Ohio Jun. 5, 2013). In this case, an individual alleged, among other things, that her former employer and supervisor violated the Stored Communications Act when the supervisor read numerous emails in the employees personal email account, which the supervisor accessed through the employer-issued mobile device the employee surrendered upon leaving the company. Some of these emails previously had been opened by the intended recipient, while others had not. The court held that emails in the personal account that had been opened first by the intended recipient but not deleted were not in “backup” status or “electronic storage” as those terms are defined in the SCA. The court granted the employer’s motion to dismiss with regard to such previously opened emails. The court declined to dismiss the intended recipient’s claim with respect to the emails which were first opened by the supervisor. The court rejected several other of the employer’s SCA-related arguments, holding that (i) the SCA was not designed only to apply to computer hackers and generally does apply to the supervisor’s actions, (ii) the mobile device was not the “facility” under the SCA, rather the server for the personal email service was the facility, and (iii) the employee did not implicitly consent to having her emails read by not deleting or logging out of the personal account before surrendering the employer-issued mobile device.