E-mail Case Ruling Allows Punitive Damages and Attorneys’ Fees
Most privacy litigation faces serious challenge due to the lack of actual damages. (A full discussion of that issue can be found in Section 26:18 of my book.) However, claims that involve statutory penalties, such as the Electronic Communications Privacy Act (ECPA), and other similar statutes, have typically been thought not to require actual damages if only statutory damages are sought by a plaintiff.
In a recent case, Van Alstyne v. Electronic Scriptorium, the Fourth Circuit brought that thinking into question in a action brought under the Stored Communications Act (Title II of ECPA and also known as the SCA). In this case, an executive improperly accessed an employee's personal e-mail account both during, and after, her employment. The account in question was the employee's personal AOL account that she accessed, from time to time, on the company's network. The former employee brought employment-related claims (which did not arise out of improper access to e-mails) and discovered that her AOL account had been improperly accessed. Ultimately, the former employee recovered statutory penalties, attorneys' fees and punitive damages under the SCA due to the improper review of her e-mails.
The defendants argued under a Supreme Court case involving the Privacy Act (a privacy law applicable to the government), Doe v. Chao, which is discussed in sections 5:29 and 26:18 of my book, that the former employee was required to show actual damages as a prerequisite to recovering under the SCA. The Fourth Circuit concluded, given the similarity of the remedial provisions of the SCA to those of the Privacy Act, that statutory penalties could not be recovered under the SCA absent a showing of actual damages. However, the Fourth Circuit concluded that punitive damages and attorneys' fees could be recovered in the absence of a showing of actual damages.
The case is important because it offers defendants the ability to argue that statutory penalties are not typically recoverable under ECPA because in most cases improper review of e-mails does not give rise to actual damages. However, not all courts have accepted this analysis, and there are other Privacy Act cases that could complicate this analysis. Either way, punitive damages and attorneys' fees appear to be recoverable. Finally, this case is yet another example of a court finding that a company accessing an employee's personal e-mail account is questionable, even when the account is accessed via company property.