South Carolina Employment Law & Labor Law Firm - Employment & Labor Lawyers | Gignilliat, Savitz & Bettis - GS&B

News

Court of Appeals Decision Imposes Liability On Employer and Supervisor for Unauthorized Access of Emails

March, 27 2009

In Van Alstyne v. Electronic Scriptorium, Ltd., No. 07-1892 (4th Cir. Mar. 18, 2009), the Fourth Circuit Court of Appeals held that employees pursuing claims under the Stored Communications Act (“SCA”), 18 U.S.C. § 2707(a) must prove a loss of actual damages in order to recover an award of statutory damages under the Act, but punitive damages, attorney’s fees and costs are recoverable without proving actual damages.

Electronic Scriptorium Limited (“ESL”), a small data-conversion company, hired Bonnie Van Alstyne as the company’s Vice President of Marketing. Thereafter, the President and owner of ESL, Edward Leonard, began accessing Van Alstyne’s personal AOL e-mail account, which she occasionally used to conduct business although she had an assigned company e-mail account. Van Alstyne alleged Leonard also sexually propositioned her, and she refused his advances.

During the discovery phase of a lawsuit ESL instituted against Van Alstyne for several “business torts,” Van Alstyne began suspecting that Leonard had broken into her AOL account. In a subsequent deposition, he admitted to doing so “at all hours of the day,” and ultimately produced copies of 258 e-mails taken from her account. Leonard accessed the account during and after the termination of Van Alstyne’s employment with ESL.

Van Alstyne sued Leonard and ESL for violating the SCA and sought statutory and punitive damages. At trial, the jury awarded Van Alstyne $150,000 in compensatory damages and $75,000 in punitive damages against Leonard and $25,000 compensatory damages and $25,000 punitive damages against ESL. Defendants appealed the verdict arguing Van Alstyne had not proved she suffered any actual damages.

The SCA provides a civil (and criminal) cause of action against “whoever”

(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or
(2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system.

18 U.S.C. § 2701(a). The Act allows an award of actual damages, and in no case less than the statutory minimum of $1,000. 18 U.S.C. § 2707(c). If the violation is willful or intentional, the court may award punitive damages. Costs and attorneys’ fees are available to successful plaintiffs. The jury awarded Van Alstyne statutory damages even though she had not proved that the unlawful access of her AOL e-mail account caused her actual damages.

The Fourth Circuit reversed the verdict and stated that Van Alstyne must prove actual damages before recovering statutory damages under the SCA. On the other hand, the court ruled Van Alstyne could recover punitive damages (upon a finding of willful or intentional behavior) and attorneys’ fees and costs even if she had not suffered actual damages.

In the background of the case is Leonard’s alleged romantic interest in Van Alstyne, which may have been his motive for allegedly breaking into Van Alstyne’s personal e-mail account. This case should remind employers of the wide-ranging sources of liability “romances gone wrong” can create in a workplace. The Fourth Circuit’s ruling providing for the award of attorney’s fees and costs to a successful plaintiff without proof of actual damages also provides an incentive for employees’ lawyers to file suit under the SCA.

Although the facts of this case reflect a blatant violation of the SCA, the Act can be violated in other, more obscure ways. Accordingly, it is important for employers to have well-drafted privacy policies and to understand the limitations on viewing employee e-mail accounts, including company-provided accounts.
 
If you have questions about privacy and technology in the workplace, or if you would like to discuss your organization's privacy policies, please contact us.

Back to News Listing