By Lydia A. Jones When you type up a racy email to a loved one, do you consider the details private? Most of us would probably ...
By Lydia
A. Jones
When you type up a racy email to
a loved one, do you consider the details private?
Most of us would probably say
yes, even though such messages often end up filtered through intelligence
agencies and service providers.
On the other hand, as the digital
world becomes more personalized, consumers have begun to accept, appreciate and
apparently request relevant connections between their online behavior and
displayed advertisements.
It’s fairly commonplace now. Type
camping gear into your browser, and for the next few weeks you’ll see online
ads for shoes, stoves, shirts and even fashion accessories, all specially
designed for camping.
But when you send an email to a
family member, or when you receive an email from a friend, do you expect the
same type of follow-on advertising as you do from internet searches?
Or do you expect some different
level of privacy simply because the information is cloaked in an email?
That’s the issue at stake in a
pending lawsuit against Yahoo! Inc.
The case against Yahoo
Plaintiffs filed an email privacy
lawsuit against Yahoo in the US District Court for the Northern District of
California under several privacy laws, including the Stored Communications Act
(SCA) – a federal law that prohibits an email service provider from knowingly
divulging to any person or entity the contents of a communication while in
electronic storage.
Under the SCA, an email service
provider may, however, properly disclose the contents of such communications
with the lawful consent of the originator or an addressee or the intended
recipient of such communication.
Earlier this year in May, Judge
Lucy Koh granted plaintiffs' request to proceed in the lawsuit as a nationwide
class action.
Class actions allow plaintiffs
with identical or similar claims to come together as a group in one lawsuit
against a common defendant, rather than each plaintiff bringing his or her own
individual lawsuit against the same defendant. Typically, many of the claimants
would not have the resources to pursue their individual claims for oftentimes
relatively modest economic damages. A class action allows them to pool their
resources, hire attorneys on a contingency basis to limit or eliminate
plaintiffs’ out-of-pocket expenses and seek potentially larger awards than
would likely result from a series of individual lawsuits.
Koh is the same judge who denied
class action certification in a similar email privacy case against Google last
year. The key difference, as Judge Koh noted in her May ruling, is that the
plaintiffs in the Yahoo case sought to include in the class of plaintiffs only
non-Yahoo Mail subscribers, while the plaintiffs in the Google case tried to
include subscribers as well.
This is important because of the
issue of notice and consent: did non-Yahoo Mail subscribers have notice of (and
thereby consent to) Yahoo’s publicly disclosed policy of scanning, and possibly
sharing, emails simply by corresponding with a subscriber?
Given the express language in the
SCA that lawful consent of the originator or an addressee or the intended
recipient of such communication is sufficient, and given Judge Koh’s prior
ruling that Yahoo’s terms of service establishes consent of the Yahoo Mail
subscribers – the answer appears to be yes.
In its request to the Ninth
Circuit Court of Appeals for permission to appeal Judge Koh’s class action
order, Yahoo argued in part that the court improperly decided that the issue of
consent could be analyzed within a class action. Yahoo argued that since
consent is an issue that is specific to each potential plaintiff’s behavior and
action, it would not be appropriate to examine it on a “class” basis, but
rather it should be looked at on an “individual” basis. Yahoo’s request was
denied without discussion. A preliminary trial date for the Yahoo case has been
set for February 8.
Consumer expectations of privacy
Consumer expectations of privacy
At first blush, it’s tempting to
say that emails are different from online behavior and internet search
histories, and therefore deserve a heightened level of privacy. An email, like
its offline counterpart US mail, is personal, private and akin to a confidential
one-on-one conversation written with a specific recipient in mind.
And recent lawsuits underscore
this temptation. A new case filed a few weeks ago in California federal court
alleges that Twitter is “eavesdropping" on users’ private messages in violation
of federal and state privacy laws. Another suit filed earlier in September in
the Northern District of California alleges that Google unlawfully diverted
non-Gmail users’ email messages to extract content.
But one of the key issues in the
case against Yahoo is whether email users – specifically those who do not
subscribe to Yahoo Mail – consented to Yahoo’s publicly stated policy that
emails sent through its service are scanned and analyzed by the company.
Yes, Yahoo’s publicly available
web pages, including the Yahoo Mail page, disclose its scanning practices and
the possible sharing of email content with third parities, yet the plaintiffs
argue that before sending an email to a Yahoo user or before receiving an email
from a Yahoo user, they were not given notice of that policy and therefore did
give their consent to it.
The plaintiffs' argument, while
superficially plausible, will be a challenging one to make. Companies such as
Yahoo and Google have long provided notices and disclosures to consumers, yet
consumers rarely read privacy policies or terms of use.
So given this persistent choice
either to not read or to disregard privacy disclosures, can plaintiffs (whether
as individuals or as a group) really object to scanning emails for targeted advertising
– whether they’re subscribers or not?
Leaving aside the issue of
consent for the moment, is our online behavior or our internet searches really
any less personal – or any less private – than the content of messages sent by
users of a free email service that publicly discloses that their emails will be
scanned and possibly shared with third parties?
No, they really aren’t.
As The New York Times noted in
April 2014 in Sweeping Away a Search History:
Your search history contains some
of the most personal information you will ever reveal online: your health,
mental state, interests, travel locations, fears and shopping habits. And that
is information most people would want to keep private.
Given the intensely private
nature of internet searches and email messages, it’s hard to think that
consumers would somehow expect more privacy in one than in the other,
especially when they use Yahoo Mail, Gmail or other services that users know
rely on advertising to support the product. And neither should we expect
complete privacy if we use a paid email service to send a personal message to a
user of one of the free services.
Realistic levels of privacy
It’s clear from Judge Koh’s
earlier rulings that Yahoo users do not have a right to privacy in the messages
that they send to or receive from a Yahoo email user given the respective terms
of service governing Yahoo Mail.
But do the non-Yahoo users who
willingly sent an email to a Yahoo account holder (and presumably received
some) have a right to privacy when the account holder has none?
The plaintiffs allege that Yahoo
intercepts and scans subscribers’ incoming and outgoing emails for content,
including the content of emails to and from non-subscribers. The plaintiffs
further allege that Yahoo copies the entirety of such emails and:
extracts keywords from the body
of the email, reviews and extracts links and attachments, classifies the email
based on its content[,] … [and] subjects the copied email and extracted
information to additional analysis to create targeted advertising for its
subscribers, and stores it for later use.
Plaintiffs allege that Yahoo
intercepts, reads and learns the content of non-Yahoo subscribers' email
communications without the non-Yahoo subscribers' consent. The plaintiffs say
such conduct violates the California Invasion of Privacy Act (CIPA). Judge Koh
certified the nationwide class action with regard to the SCA claim and a
California-only subclass with regard to the California state law claim under
CIPA.
Unlike the Google case, in which
Koh denied the plaintiffs’ request for class action certification, the alleged
privacy claims in the class action against Yahoo are no longer for money
damages (since plaintiffs abandoned their claim for money damages when they
moved the court for class action certification). Rather, it is about asking the
court to determine that Yahoo’s acts violate the SCA and, if so, that Yahoo be
prohibited from engaging in that practice in the future.
The plaintiffs won a short-term
victory in achieving class action certification, but this bigger issue over
whether they can object to the scanning process – based on a right to privacy –
given Yahoo’s disclosure of its scanning and possible sharing practices and
given that they chose to send and/or receive an email to a Yahoo user, is far
from being decided in their favor.
And they’ll have a tough road
ahead making their case, because an important lesson we’ll all learn eventually
is that email privacy can sometimes be a digital paradox.
About The Author
About The Author
Lydia Jones has 20 years of
business and legal experience in the Internet media space and was one of the
first civil lawyers in the country to practice in the fields of internet law
and online privacy. After earning law degrees from both New York University and
Boston University, Jones was a partner in a 100-lawyer law firm in Phoenix,
Arizona, where she led the Internet Law Practice Group in both commercial
litigation and corporate transactions. She is founding president of
Nashville-based InSage, which helps companies balance their commercial
interests in leveraging acquired consumer data with privacy rights and
regulations. Lydia also teaches Information Privacy Law at Vanderbilt Law
School.
This article was first published at The Conversation US website on October 13, 2015 and licensed under Creative Commons
