Stored Communications Act limits Gmail information obtainable pursuant to subpoena

Beluga Shipping GMBH & Co. KS Beluga Fantastic v. Suzlon Energy LTD., 2010 WL 3749279 (N.D. Cal., Sept. 23, 2010)

Court rules that under the Stored Communications Act, account holder consent is required to obtain copies of emails in Google’s possession. Before you issue a subpoena seeking copies of emails, read Beluga Shipping.

Suzlon is the third largest wind turbine manufacturer in the world. In an action pending in the Federal Court in New South Wales Australia, Suzlon brought cross claims for fraud and breach of fiduciary duty against several of its former employees who were imprisoned in India.

Suzlon believed that its former employees used internet mail accounts hosted by Google to perpetrate their fraud. Therefore, it filed a petition under 28 U.S.C. §1782 to obtain discovery from Google. 28 U.S.C. §1782 provides the means by which parties to a foreign proceeding can obtain discovery in the United States for use in that proceeding. The Federal Rules of Civil Procedure apply in §1782 proceedings unless the court prescribes a different procedure to follow. In Beluga Shipping, the district court applied the Federal Rules of Civil Procedure.

In its §1782 petition, Suzlon sought leave to issue subpoenas to Google to obtain all emails sent or received by its former employees using specific Gmail accounts. Suzlon also sought any records establishing when those Gmail accounts were created, the name provided to Google by the user of each account during the account creation process, the country in which each account was created, how Google stores or saves emails in its Gmail accounts and how information regarding when emails sent to and from a Gmail account is recorded and stored.

The district court permitted Google to intervene and oppose Suzlon’s petition. Google argued that under the Stored Communications Act, 18 U.S.C. §§2701-2712, consent of the individual account holders is required, and that unless their consent is obtained, it could not lawfully comply with Suzlon’s subpoena.

In response, Suzlon cited Zheng v. Yahoo, Inc., 2009 U.S. Dist. LEXIS 111886 (N.D. Cal., Dec. 2, 2009), and argued that the Stored Communications Act does not apply to foreign citizens. Therefore, Suzlon argued that Google was obligated to comply with its subpoena. However, the district court found Zheng inapplicable because “the email interceptions and disclosures occurred outside of the United States by a company whose servers were located outside the United States.” In the court’s view, these factors led to Zheng’s conclusion that the Stored Communications Act does not apply to foreign nationals. However, because Google and its servers are located in the United States, the district court concluded that the Stored Communications Act was applicable in the case before it.

Because Suzlon had not obtained the consent of its former employees, the district court denied, its petition to subpoena the emails of those employees, without prejudice to a renewed showing that the account holders’ consent had been obtained. The court did direct Google to produce documents which established when the specific Gmail accounts in question were created, the actual names of the email account holders provided to Google during the account creation process and the countries from which the specific Gmail accounts were created. The court further directed Google to continue to preserve the emails contained in the specific Gmail accounts in question pending a showing of consent by the account holders.

Despite the unusual procedural context in which this decision arose, the Beluga Shipping decision is significant for any litigant who seeks information from a provider of internet email service such as Google, Yahoo or Hotmail. Without the consent of the account holder, parties may be unable to obtain by subpoena emails that were sent or received by the account holder. So, first seek the consent of the account holder and if that fails, consider a motion asking the court to compel the account holder’s assent. Additionally, when communications occur through applications found in the “cloud,” the Stored Communications Act can raise a similar impediment to obtaining communications stored in the cloud.

Privilege not waived where son of technologically unskilled parties opened email attachments

Green v. Beer, No. 06-4156, 2010 WL 3422723 (S.D.N.Y. August 24, 2010)

Plaintiffs were not computer savvy and did not know how to open email attachments. But their son was not so lacking in proficiency. So plaintiffs’ lawyers sent certain communications and documents to plaintiffs’ son, who then conveyed those materials to his parents.

In the course of litigation, defendants sought production of the information plaintiffs’ counsel had transmitted to them via their son. Plaintiffs objected by asserting the attorney-client privilege. But the magistrate granted the defendants’ motion to compel. Plaintiffs sought review of the magistrate’s order.

Finding the magistrate’s order on this point to be clearly erroneous, the district judge reversed as to the information transmitted through plaintiffs’ son. Because federal jurisdiction in this case was based on diversity, Fed. R. Evid. 501 was triggered, and the court looked to New York law as it related to attorney-client privilege. Under this analysis, although communications that include third-parties outside of the attorney-client relationship are generally not privileged, an exception to that waiver applies when:

• the client has a reasonable expectation of confidentiality with respect to the communication at issue, and
• disclosure to a third party is necessary for the client to obtain informed legal advice.

Adding to this second point, the attorney-client privilege is not waived where a confidential communication is disclosed to a party serving merely as an agent of either the attorney or the client.

New York also has a statute directed at this issue. N.Y. C.P.L.R. § 4548 says that:

No communication … shall lose its privileged character for the sole reason that it is communicated by electronic means or because persons necessary for the delivery or facilitation of such electronic communication may have access to the content of the communication.

In this case, the court found that the magistrate erred for two reasons. First, the magistrate judge erred when he failed to include Section 4548’s guidance in the analysis. Second, the magistrate erred by not finding that plaintiffs’ son served as an agent for plaintiffs, and that his involvement in the delivery of the otherwise confidential communications would not constitute a waiver of privilege.

Public policy also guided the court’s conclusion: “A client lacking proficiency in Internet technology should not be prevented from enjoying the advantages of email correspondence for fear that the necessary assistance of a third party — here, the [plaintiffs’] son — in sending or receiving such correspondence will lead to the forfeiture of the attorney-client privilege.”

State court practitioners beware: sanctions can be entered against your clients for failing to preserve emails, even if your state has not adopted a set of ediscovery rules

Einstein v. 357 LLC, et. al. (N.Y. Supreme Court, October 21, 2009)

In Einstein, a trial judge in the Supreme Court of the State of New York recently entered sanctions against several defendants for their failure to implement a litigation hold which resulted in the loss of emails relating to the presale condition of a condominium unit purchased by the plaintiffs in Brooklyn, New York. The trial judge recognized that even though New York had not yet enacted any rules addressing electronic discovery, and that its Civil Practice Law Rules and common law decisions were silent on the need to institute a litigation hold, New York courts have turned to the Federal Rules of Civil Procedure and case law interpreting them for guidance in other contexts.

The crux of the problem in Einstein was the limited storage capacity of the company’s email server. Each of the company’s brokers were allocated 200 megabytes of space, and once that limit was reached, a broker could not send or receive emails until that space was cleared for more email traffic. As a result, brokers had to clear old emails from the system in the ordinary course of their business. Unfortunately, a litigation hold was never instituted, and as a result, emails (several of which the plaintiff’s produced to the defendants) were not preserved. While emails were forwarded through a central server, the company’s email system was configured in such a way that once an email was deleted by an individual user from the user’s inbox, it was also deleted on the central server. While daily, weekly and monthly backup tapes were made of the email server, the daily and weekly backups were periodically reused. Thus, if emails sent or received during a particular month were also deleted during that month, the monthly backup would not capture those deleted emails.

The court concluded the defendants’ counsel and the company’s IT director failed to investigate the basic mechanics of the company’s email system and its retention practices until 11 months after plaintiffs first served their document demands upon the defendants. The court further concluded that defendants were aware of the fact that the contents of their emails would be relevant to the litigation and recalled that it had repeatedly warned defendants about the need to make a complete production of those emails. Accordingly, the court ruled that the defendants’ failure to take any steps “to implement a litigation hold, relying instead on backup tapes that a reasonable investigation would have revealed failed to capture relevant emails deleted manually by individual users,” constituted gross negligence, and warranted a finding of spoliation.

Therefore, the court imposed sanctions in the form of an adverse inference instruction relating to the missing emails, and awarded attorneys’ fees as well as expert costs associated with the review of the defendants’ hard drives.

While admittedly, a trial court decision lacks any precedential value, Einstein amply demonstrates that parties who are sued in state court, even in those states which have not enacted their own set of ediscovery rules, are not immune from ediscovery sanctions. One of our recent posts identified those states which had adopted their own set of ediscovery rules. Outside counsel would be wise to advise their clients of the need to impose a litigation hold in every case in which they are retained, even state-court proceedings, and seek to preserve ESI in state-court litigation. Counsel also would be wise to investigate the client’s email and information systems as well as its paper and electronic retention/destruction policies. Companies and their counsel can no longer safely assume that because a particular state has not enacted its own set of ediscovery rules that the client has no obligation to preserve and produce relevant electronically stored information.

Photo courtesy Flickr user Mike Licht under this Creative Commons license.

View the opinion below or by clicking here.

Einstein_v_357

Avoiding ethical pitfalls of communicating with clients via email

Leor Exploration & Production, LLC v. Aguiar, 2009 WL 3097207 (S.D. Fla. Sept. 23, 2009)

The twentieth century Spanish philosopher and poet George Santayana once wrote: “Those who cannot learn from history are doomed to repeat it.” The Leor decision proves that philosophy is especially true when it comes to the realm of ediscovery. Leor is another example of a growing body of caselaw addressing whether emails sent or received by an employee through his employer’s email server are protected by attorney-client privilege. In a prior blog post we discussed several decisions that have addressed this issue and attempted to reconcile their holdings.

Guma Aguiar was the CEO and Vice Chairman of Leor Exploration & Production LLC (“Leor”). He retained a “trusts and estates attorney” to document his interests in certain entities. Subsequently, that attorney sent an email to Aguiar’s personal advisor and agent, Garrett Smith, who also happened to be the Vice President and In-House General Counsel of Leor, which memorialized a conversation involving the three of them. The email was sent to Mr. Smith’s work email address at Leor. After a series of lawsuits erupted between Aguiar, his uncle and related entities involved in oil and gas exploration, the attorney’s email surfaced in discovery and the issue presented to the court was whether it was protected by the attorney-client privilege.

Leor held that the attorney’s email to his client’s personal advisor and agent was not privileged because the client lacked a reasonable expectation of privacy in emails transmitted through his employer’s (the company’s) email server. In reaching that conclusion, the court identified four factors that should be considered in determining whether an employee has an expectation of privacy in email communications:

• Does the corporation maintain a policy banning personal or objectionable use;
• Does the corporation monitor the use of the employee’s computer or e-mail;
• Do third parties have a right of access to the computer or e-mails; and
• Did the corporation notify the employee or was the employee aware of the use and monitoring policies?

Because each of the four factors were present, the court in Leor had little difficulty in concluding that plaintiff did not meet his burden of establishing the applicability of the attorney-client privilege. However, the privilege belongs to the client not the lawyer, and the decision fails to address how an attorney can waive the privilege belonging to the client without the client’s consent. When the client sends an email to his attorney with knowledge of the four factors noted above, one can argue the client impliedly waived any right to assert the privilege, but the converse is not necessarily true. However, the decision follows the approach taken in Scott v. Beth Israel, and lawyers must take care not to run afoul of the decision.

In our prior blog post addressing this issue, we discussed how some courts have ruled that email communications retained their privileged character when they were encrypted or involved password protected web-based email notwithstanding the fact that they were sent or received via a company issued computer. While that post focused on the duties and responsibilities of a company’s attorney who receives or reviews employee emails, Leor highlights the responsibilities of any attorney communicating with his client via email.

Reasonable communication between an attorney and his or her client is necessary under Rule 1.4 of the Model Rules of Professional Conduct. Rule 1.6 of the Model Rules further requires that an attorney act competently to safeguard confidential information relating to the representation of a client against its inadvertent or unauthorized disclosure. Under Rule 1.6, a lawyer is obligated to take reasonable precautions to prevent information from coming into the hands of unintended recipients. That does not necessarily require that a lawyer use special security measures, such as encrypting emails, where the mode of communication affords a reasonable expectation of privacy. However, special circumstances can require that special precautions be taken.

While the decisions are not uniform in their holding, given the growing body of caselaw addressing the waiver of attorney-client privilege involving workplace email communications, an attorney should consider whether special precautions may be warranted in this scenario, especially if you practice in a jurisdiction where you would have reason to believe a court may find a waiver occurred. An attorney should consider addressing this issue at the outset of any representation with his client. Lawyers would be wise to follow the age-old adage: an ounce of prevention is worth a pound of cure. If the risk of privilege loss is to be avoided, then neither the attorney nor the client should communicate with one another through any email server or by any means in which they lack a reasonable expectation of privacy. While that does not mean that an attorney cannot communicate via email with his client, the attorney should endeavor to avoid emailing the client at the client’s place of business and should consider advising the client to not communicate with him through a company-issued computer, Blackberry or other communication device. Consider alternative methods of communication. While a client may consent to the use of a mode of communication that would be prohibited by Rule 1.6, that consent must be “informed.”

So before you send that next email to a client, stop and assess whether there are any privilege issues implicated by your communication. Don’t let convenience trump confidentiality. Where appropriate, clients should be advised of the risks of communication via company-issued computers or Blackberries in order to avoid a waiver of privilege as in Leor.

Photo courtesy Flickr user Michael Licht under this Creative Commons license.

Email cc’d to non-lawyer forfeited attorney-client privilege, but work product doctrine saved the day

Schanfield v. Sojitz Corp. of America, 2009 WL 577659 (S.D.N.Y. March 6, 2009).

Sojitz Corporation fired its employee Schanfield. Six months later, Schanfield sued for wrongful termination. As many litigants do prior to filing suit, Schanfield sought the advice – via email – of two attorneys in his family. These communications discussed the facts of the case, underlying strategy, and thoughts on retaining counsel. Schanfield copied his non-lawyer sister on these messages.

Schanfield withheld these emails from production. Sojits moved to compel. Schanfield argued that the messages were protected by the attorney-client privilege because they were “confidential and explicitly for the purpose of procuring legal advice about his claims in [the] litigation and the retention of counsel.”

The court found that by copying his non-lawyer sister on these communications, Schanfield forfeited the attorney-client privilege. However, the court also found that the emails were protected by the work product doctrine. The messages were “clearly prepared in anticipation of litigation,” and by sending them to his close relatives, Schanfield did not significantly increase the likelihood that Sojitz would obtain the information. Absent a showing of substantial need for the messages, the court denied Sojitz’s motion to compel.

The obvious lesson to be learned from the case is that one must use discretion in deciding who to copy on email messages. Lawyers are expected to understand the contours of the attorney-client privilege and avoid unnecessary cc-ing. But prudent counsel will instruct and remind his or her clients of how easy the protection of the attorney-client privilege can be destroyed, as this case demonstrates. This is an issue which should be included in any corporate email risk management training or program.

Email Routes and Locations

When we provide training on ediscovery, one of the issues we address is the various places where emails can be found, and the routes which they can take to get to those repositories. Because a picture is worth a thousand words, we worked with the head of our firm’s IT department to develop a PowerPoint slide that visually depicts this information which we now use in our training sessions.

We have attached our slide below, and if you click on the image, it will enlarge for your ease of reference. Admittedly, not every email system will have all of the various features shown on our slide, and there can be other repositories in some systems that we did not include, but our slide does provide a fairly comprehensive overview of the various “nooks and crannies” where emails can be found.

While it is not as complex as a map of New Orleans, our slide shows that the world wide web is not exactly an information superhighway. Rather, it’s more like a medieval European city where you can easily get lost if you can’t read the signs or know where you are going. Hopefully our slide will prevent you from getting lost, and will help you find what you are looking for.

[Click image to enlarge]

If you want to use this slide for any reason, just drop Steve or Evan a note.