A California appellate court has rejected Google’s contention that the Stored Communications Act provides a blanket exemption or immunity on service providers against compulsory civil discovery process.
A ship manufacturer, Navalimpianti USA Inc., sued Matteo Negro, a former employee, for breach of duty in Florida State Court. After several failed attempts to compel Negro to turn over relevant emails stored on Google’s servers, plaintiff’s attorneys sought a court order compelling Google to produce Negro’s communications. The Florida Court granted the order, and allowed a subpoena to be issued by a California State Court. The issue of whether the subpoena should have been allowed, and whether Google could be compelled to comply with it, was eventually adjudicated by a California appellate court.
The appellate court, as well as all the parties to the dispute, agreed that the Stored Communications Act (“SCA”) prohibits the production of emails in response to a civil subpoena absent a qualifying exception in the SCA. At issue in the case was whether the user – Negro – had given “lawful consent.” The California appellate court considered two key issues in this case: (1) what qualifies as “lawful consent,” and (2) once lawful consent is established, whether a service provider can be compelled to produce content.
First, the appellate court refused to read the SCA to permit implied in law consent to qualify as lawful consent. The Florida court initially had allowed the subpoena on the theory that Negro implicitly consented to disclosure by having control over the emails and failing to produce them. The appellate court, referring to case law on the same issue under the Wiretap Act, stated that the exception “is not satisfied by consent that is merely constructive, implied in law, or otherwise imputed to the user by a court.” Moreover, the court took pains to explain that such an outcome was entirely consistent with – indeed compelled by – its prior decision in O’Grady, 139 Cal.App.4th 1423 (2006). There, in a similar circumstance in which one party sought emails of another party to the lawsuit, the court stated, “Copies may still be sought from the intermediary [the service provider] if the discovery can be brought within one of the statutory exceptions—most obviously, a disclosure with the consent of a party to the communication. (18 U.S.C. § 2702(b)(3).) Where a party to the communication is also a party to the litigation, it would seem within the power of a court to require his consent to disclosure on pain of discovery sanctions.” Importantly, the court noted that it was not commenting on whether it was within the power of a court to compel a non-party to consent to disclosure. And, Negro’s conduct did not give the court reason to address whether implied in fact consent is legal consent under the SCA.
Instead, the court found that lawful consent existed because the Florida court had directed Negro to email Google from his user account explicitly consenting to the transfer of all relevant communications to opposing counsel, and he had done so. Negro argued that such “consent” was not “lawful consent” under the SCA, as it was “judicially coerced” by threats of sanctions if he did not cooperate. In addressing this argument, the court noted that allowing a user to retroactively challenge the sufficiency of the express consent with such an argument (and even more egregiously seeking to hold liable the service provider for producing records when express consent was given) would be contrary to the SCA’s intent. “The SCA’s requirement of ‘lawful consent’ is manifestly intended to invest users with the final say regarding disclosure of the contents of their stored messages while limiting the burdens placed on service providers by the Act. (See O’Grady, supra, 139 Cal.App.3d at pp. 1446-1447.) The latter interest is obviously diminished to the extent that the Act is applied in such a way as to embroil service providers in disputes between users and those seeking discovery over the legal sufficiency of a user’s conduct to constitute consent.” The court further noted that the case law almost universally allows compelled consent in a number of circumstances, concluding:
The simple fact is that Negro was not deprived of volition in this matter. He was presented with a choice between facilitating the discovery sought by Navalimpianti, or risking such sanctions as the Florida court might elect to impose. He seeks to have the best of both worlds by complying with the court’s order while denying that his decision to do so should be given legal effect. We reject this contention and hold that the consent expressly given by him pursuant to court order constituted “lawful consent” under the SCA. (§ 2702(b)(3).)
This did not end the inquiry, however, because Google argued that although a finding of “lawful consent” allows it to produce the records, under the SCA it cannot be compelled to do so. First, Google argued that the SCA puts a service provider outside the reach of civil discovery completely. The court found no basis in the act for such a blanket immunity:
The Act does not declare civil subpoenas unenforceable; it does not mention them at all. As we have said, it preempts state discovery laws insofar as they would otherwise compel a service provider to violate the Act. It is this preemption that excuses service providers from complying with process seeking disclosures forbidden by the Act. But nothing in the Act suggests that service providers remain shielded from state discovery laws when the disclosures sought are not forbidden by the Act.
Second, Google relied on the permissive phrasing in the statute (a service provider “may divulge the contents of a communication” where a user has given their lawful consent) to argue that it is within the service provider’s discretion whether to produce the records in response to a subpoena. Google cited the Northern District of California’s 2012 decision in In re Facebook as direct support for its position. There, the court stated, “Under the plain language of Section 2702, while consent may permit production by a provider, it may not require such a production.” The instant court disagreed, stating: “The subdivision where ‘may’ appears is framed not as a grant of discretionary power or as the imposition of a mandatory duty but as a special exception to a general prohibition. In such a context all ‘may’ means is that the actor is excused from the duty, liability, or disability otherwise imposed by the prohibition.” Neither did the court find any weight in the heading of the section (“Voluntary disclosure of customer communications or records”) because “[s]tatutory headings are rarely given much weight to begin with, but a heading is not evidence of congressional intent if [as was the case here] it ‘was not part of the statute as passed by Congress . . . , but was added subsequent to enactment by those responsible for codification of the legislation.’” In conclusion, the court found “no sound basis for the proposition that the Act empowers service providers to defy civil subpoenas seeking discovery of materials that are excepted from the Act’s prohibitions on disclosure. Insofar as the Act permits a given disclosure, it permits a court to compel that disclosure under state law.”
ECPA practitioners have long debated whether the SCA allows for the compulsory disclosure of otherwise protected information where an exception allowing voluntary disclosure is present – that is, whether a subpoena + consent is valid compulsory process for disclosure of user data. This case says it is, at least with regard to civil process. It is unclear (and unlikely), however, whether the same analysis would hold true for criminal process, where the statute specifically sets forth the ways in which law enforcement can compel providers to provide user data. The outcome of this case is a mixed bag for service providers. On the one hand, the court’s holding with respect to “lawful consent” should reduce the instances in which providers get involved in costly discovery disputes over whether a user’s consent under the SCA is valid. On the other hand though, if this court’s holding on the applicability of civil process to the SCA wins the day, providers may see an uptick – perhaps significant – in direct demands for information. Such an outcome would be unfortunate and, in most cases, unnecessary, as the court could compel the party itself to access the requested records and produce them, rather than run the circuitous route of compelling consent and requiring the service provider to produce the records. Moreover, it remains to be seen how courts will handle the issue – not addressed here – of whether courts can compel non-parties to a lawsuit to consent to production.