Without even a citation to the New
Jersey Supreme Court’s decision
in Stengart v.
Loving Care Agency, Inc., 990 A.2d 650 (N.J.
2010), and despite an amicus brief by the Electronic Privacy
Information Center, which cited Stengart,
a panel of the Fourth Circuit, Judge Motz writing, held that the Marital
privilege (and, presumably, the attorney-client privilege) was waived where the
husband-employee e-mailed his wife using the employer’s computer at a time when
the employer had no electronic usage policy.
UnitedStates v. Hamilton, No. 11-4847, 2012 U.S. App.LEXIS 25482 (4th Cir. Dec. 13, 2012).
In Hamilton, the
employer, approximately two years after the husband’s e-mail to his wife,
issued an electronic usage policy. That
policy, among other things, stated that the employer could review “stored”
e-mails. Subsequently, the panel held
that defendant had failed to maintain the confidentiality of the
communications, and thereby vitiated the marital privilege, by “communicating
with his wife on his workplace computer, through his work email account, and
subsequently failing to safeguard the emails.”
The Court noted that the marital privilege “should be allowed only when
it is plain that marital confidence cannot otherwise reasonably be preserved” (see Wolfle v. United States, 291 U.S. 7,
14 (1934)) and, reasoning that spousal communication did not require the use of
a work computer or work e-mail account, found that the privilege had been
waived.
The panel did note, in passing, an argument by the
Electronic Privacy Information Center, writing as Amicus Curiae, that it would be “extreme” to “require an employee
to scan all archived e-mails and remove any that are personal and confidential
every time the workplace use policy changes.”
While agreeing that “these arguments caution against lightly finding
waiver of marital privilege by e-mail usage” the Court nevertheless dismissed
this line of reasoning, stating only that “the district court found that
Hamilton did not take any steps to
protect the emails in question[.]”
Unfortunately, the Court’s analysis omits any discussion of
the actual location(s) where Hamilton’s e-mails were stored on the employer’s
systems. As a practical matter, it is
likely that the e-mail was stored on Hamilton’s laptop, as well as the
employer’s servers, back up locations (which may be physical tapes and/or cloud-based
storage), and possibly other locations within the employer’s electronic
systems. This detail takes on enormous
significance due to the legal and practical difficulties presented by deleting
information located on storage media which are, potentially, outside of the
employee’s control. For example,
employers regularly have policies regarding the unauthorized destruction of
data, unauthorized access to certain portions of their data systems (for
example, backups), in addition to the practical question of efficiently
reviewing and redacting years worth or archival e-mails. Furthermore, the Court failed to consider the
potential legal implications posed by the Computer Fraud and Abuse Act to
employees who delete data from their employer’s systems.
In short, because Hamilton did not risk violating company
policy by accessing and wiping his e-mails, the Court found that he had waived
the privilege with respect to the e-mail communication. The Court failed to
squarely address the problem of where the e-mails were stored, whether an
employer would permit an employee to unilaterally wipe e-mails off the
company’s server, or the severe difficulties inherent in successfully and
permanently removing such materials beyond the employer’s ability to retrieve
them. The Court also failed to grapple
with the prospect that, if Hamilton successfully deleted material from his
employer’s systems, that he might well have violated
the provisions
of the Computer Fraud
and Abuse Act or the Virginia Computer Crimes Act, Va. Code § 18.2-152.1. While misusing access or information lawfully
provided to the employee may not violate the CFAA under the Fourth Circuit’s
recent ruling in WEC Carolina Energy
Solutions, LLC v. Miller, 687 F.3d 199 (4th Cir. 2012), attempting to
access backup tapes or cloud storage may well exceed authorized access even
under the standard in Miller. In short, the Court’s suggestion that Hamilton
did not take appropriate measures to remove the stored e-mails, and thus waived
privilege, seems ill-considered.
The decision in Hamilton,
unless set aside en banc, suggests
that the Court would also find the attorney-client privilege waived in similar
circumstances. This contrasts with the
recent decision, which we noted in our recent
blog, of the Canadian
Supreme Court, which has held that employees do indeed have a protectable
privacy interest in their company-issued computers. On that note, it is worth noting Justice
Sotomayor’s concurrence in United States
v. Jones, 132 S. Ct. 945 (2012), in which she opined that “it may be
necessary to reconsider the premise that an individual has no reasonable
expectation of privacy in information voluntarily disclosed to third parties”
as “[t]his approach is ill suited to the digital age, in which people reveal a
great deal of information about themselves to third parties in the course of
carrying out mundane tasks.” 132 S. Ct.
at 957 (discussing locational information provided through the use of GPS
systems).
Here, many courts would have held that, in the absence of an
electronic usage policy, Hamilton had a reasonable expectation of privacy when
he e-mailed his wife back in 2006. The
breathtaking aspect of the Hamilton
decision is the Court’s holding that Hamilton’s reasonable expectation was
defeated years later after the employer issued an electronic policy because
Hamilton did not engage in conduct that no employee lawyer worth his or her
salt would counsel a client to do and conduct that many employers would seize
upon as misconduct and possibly even criminal under the Computer Fraud and
Abuse Act. In short, while this blog
rarely criticizes courts, this is one of those rare instances where, in our
judgment, this decision is plainly wrong and, hopefully, will either be
withdrawn by the panel or set aside en
banc.
Posts
