Fourth Circuit Issues Startling Waiver Decision

Without even a citation to the New Jersey Supreme Court’s decision in Stengart v. Loving Care Agency, Inc., 990 A.2d 650 (N.J. 2010), and despite an amicus brief by the Electronic Privacy Information Center, which cited Stengart, a panel of the Fourth Circuit, Judge Motz writing, held that the Marital privilege (and, presumably, the attorney-client privilege) was waived where the husband-employee e-mailed his wife using the employer’s computer at a time when the employer had no electronic usage policy.  UnitedStates v. Hamilton, No. 11-4847, 2012 U.S. App.LEXIS 25482 (4th Cir. Dec. 13, 2012). 

In Hamilton, the employer, approximately two years after the husband’s e-mail to his wife, issued an electronic usage policy.  That policy, among other things, stated that the employer could review “stored” e-mails.  Subsequently, the panel held that defendant had failed to maintain the confidentiality of the communications, and thereby vitiated the marital privilege, by “communicating with his wife on his workplace computer, through his work email account, and subsequently failing to safeguard the emails.”  The Court noted that the marital privilege “should be allowed only when it is plain that marital confidence cannot otherwise reasonably be preserved” (see Wolfle v. United States, 291 U.S. 7, 14 (1934)) and, reasoning that spousal communication did not require the use of a work computer or work e-mail account, found that the privilege had been waived.  

The panel did note, in passing, an argument by the Electronic Privacy Information Center, writing as Amicus Curiae, that it would be “extreme” to “require an employee to scan all archived e-mails and remove any that are personal and confidential every time the workplace use policy changes.”  While agreeing that “these arguments caution against lightly finding waiver of marital privilege by e-mail usage” the Court nevertheless dismissed this line of reasoning, stating only that “the district court found that Hamilton did not take any steps to protect the emails in question[.]”  

Unfortunately, the Court’s analysis omits any discussion of the actual location(s) where Hamilton’s e-mails were stored on the employer’s systems.  As a practical matter, it is likely that the e-mail was stored on Hamilton’s laptop, as well as the employer’s servers, back up locations (which may be physical tapes and/or cloud-based storage), and possibly other locations within the employer’s electronic systems.  This detail takes on enormous significance due to the legal and practical difficulties presented by deleting information located on storage media which are, potentially, outside of the employee’s control.  For example, employers regularly have policies regarding the unauthorized destruction of data, unauthorized access to certain portions of their data systems (for example, backups), in addition to the practical question of efficiently reviewing and redacting years worth or archival e-mails.  Furthermore, the Court failed to consider the potential legal implications posed by the Computer Fraud and Abuse Act to employees who delete data from their employer’s systems.  

In short, because Hamilton did not risk violating company policy by accessing and wiping his e-mails, the Court found that he had waived the privilege with respect to the e-mail communication. The Court failed to squarely address the problem of where the e-mails were stored, whether an employer would permit an employee to unilaterally wipe e-mails off the company’s server, or the severe difficulties inherent in successfully and permanently removing such materials beyond the employer’s ability to retrieve them.  The Court also failed to grapple with the prospect that, if Hamilton successfully deleted material from his employer’s systems, that he might well have violated the provisions of the Computer Fraud and Abuse Act or the Virginia Computer Crimes Act, Va. Code § 18.2-152.1.  While misusing access or information lawfully provided to the employee may not violate the CFAA under the Fourth Circuit’s recent ruling in WEC Carolina Energy Solutions, LLC v. Miller, 687 F.3d 199 (4th Cir. 2012), attempting to access backup tapes or cloud storage may well exceed authorized access even under the standard in Miller.  In short, the Court’s suggestion that Hamilton did not take appropriate measures to remove the stored e-mails, and thus waived privilege, seems ill-considered.  

The decision in Hamilton, unless set aside en banc, suggests that the Court would also find the attorney-client privilege waived in similar circumstances.  This contrasts with the recent decision, which we noted in our recent blog, of the Canadian Supreme Court, which has held that employees do indeed have a protectable privacy interest in their company-issued computers.  On that note, it is worth noting Justice Sotomayor’s concurrence in United States v. Jones, 132 S. Ct. 945 (2012), in which she opined that “it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties” as “[t]his approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.”  132 S. Ct. at 957 (discussing locational information provided through the use of GPS systems).  

Here, many courts would have held that, in the absence of an electronic usage policy, Hamilton had a reasonable expectation of privacy when he e-mailed his wife back in 2006.  The breathtaking aspect of the Hamilton decision is the Court’s holding that Hamilton’s reasonable expectation was defeated years later after the employer issued an electronic policy because Hamilton did not engage in conduct that no employee lawyer worth his or her salt would counsel a client to do and conduct that many employers would seize upon as misconduct and possibly even criminal under the Computer Fraud and Abuse Act.  In short, while this blog rarely criticizes courts, this is one of those rare instances where, in our judgment, this decision is plainly wrong and, hopefully, will either be withdrawn by the panel or set aside en banc.