Hall v. Florida Dept. of Corrections
Hall v. Florida Dept. of Corrections
2018 WL 3134440 (N.D. Fla. 2018)
May 23, 2018

Hinkle, Robert L.,  United States District Judge

Stored Communications Act
Privacy
Cloud Computing
Download PDF
To Cite List
Summary
The Florida Department of Corrections and its employees were sued for accessing an employee's personal email account in violation of the Stored Communications Act. The court granted the Department's motion to dismiss, finding that Congress did not make its intention to abrogate the Department's immunity from the Act clear and that abrogation would have exceeded its power under the Fourteenth Amendment.
Rita HALL, Plaintiff,
v.
FLORIDA DEPARTMENT OF CORRECTIONS et al., Defendants
Case No.: 4:17cv467 RH-CAS
United States District Court, N.D. Florida, Tallahassee Division
Signed May 23, 2018

Counsel

Brian O'Shea Finnerty, Steven R. Andrews, Ryan Joshua Andrews, Law Offices of Steven R. Andrews PA, Stephen G. Webster, Law Offices of Stephen G. Webster LLC, Tallahassee, FL, for Plaintiff.
Kevin Charles Kostelnik, Michael Robert Fidrych, Michael Patrick Spellman, Robert Jacob Sniffen, Sniffen & Spellman PA, Tallahassee, FL, for Defendants.
Hinkle, Robert L., United States District Judge

ORDER DISMISSING THE CLAIMS AGAINST THE DEPARTMENT

*1 The plaintiff Rita Hall is an employee of the Florida Department of Corrections. She alleges that other Department employees accessed her personal email account in violation of the Stored Communications Act, 18 U.S.C. § 2701 et seq. Ms. Hall asserts claims under that act against the employees who accessed her account and against the Department. The Department has moved to dismiss based on Eleventh Amendment immunity. This order grants the motion.
I
The Department issued Ms. Hall a cellular phone as part of her employment. She synched her personal Gmail account to that phone until she learned that Department policy restricts the use of work phones to access personal email. She then un-synched her Gmail account.
She later became the subject of a Department administrative investigation, she says in retaliation for a whistleblower memorandum. Whatever the reason, investigators seized her work phone. Ms. Hall received notice while the phone was in the Department's possession that someone accessed her Gmail account from the phone. Although she had un-synched the Gmail account, it was apparently still possible to log into the account from the phone. The Department and its agents did not have her permission to access the account.
When she checked her account, all her messages were marked unread. Nonetheless, Ms. Hall alleges the Department investigators may have read her emails and then marked them as unread. She also notes that Gmail displays the first few lines of a message, meaning the defendants could have read a portion of the emails without opening them. The account contained personal medical information and privileged correspondence with her attorney.
Ms. Hall contends this conduct violated the Stored Communications Act, which prohibits intentionally accessing electronic communication in electronic storage without authorization. 18 U.S.C. § 2701(a); see Vista Marketing, LLC v. Burkett, 812 F.3d 954, 963-64 (11th Cir. 2016) (holding that accessing emails stored by an online host violates the Stored Communications Act). The Act gives a person who is “aggrieved by any violation” of the statute a civil cause of action against “the person or entity, other than the United States, which engaged in that violation.” Id. at § 2707(a).
II
A state ordinarily has Eleventh Amendment immunity from an action brought by an individual in federal court. See Seminole Tribe of Florida v. Florida, 517 U.S. 44, 55 (1996). The state's immunity extends to “arms of the state,” including state agencies like the Department. See Will v. Michigan Dept. of State Police, 491 U.S. 58, 71 (1989); Manders v. Lee, 338 F.3d 1304, 1308 (11th Cir. 2003). As recognized in Seminole Tribe and an unbroken line of cases, the Department cannot be sued in federal court unless its immunity has been waived or validly abrogated by Congress.
Neither condition is met. Ms. Hall concedes that Florida has not consented to suits of this kind. See Fla. Stat. §§ 768.28(1), (18) (waiving sovereign immunity for a limited class of cases but not waiving Eleventh Amendment immunity). She argues instead that Congress abrogated the Department's immunity from claims under the Stored Communications Act. But Congress did not make “its intention to abrogate unmistakably clear in the language of the statute,” and abrogation would have exceeded its power under Section 5 of the Fourteenth Amendment. See Nevada Dept. of Human Res. v. Hibbs, 538 U.S. 721, 726 (2003).
A
*2 The Stored Communications Act creates a private right of action against “the person or entity, other than the United States,” who commits a violation. 18 U.S.C. § 2707. The statute defines a “person” as “any employee, or agent of the United States or any State or political subdivision thereof, and any individual, partnership, association, joint stock company, trust, or corporation.” Id. § 2510. The Act does not define “entity,” but it was amended in 2006 to define a “governmental entity” as “a department or agency of the United States or any State or political subdivision thereof.” Pub. L. 109-177 § 107 (2006). That definition does not assist in interpreting the civil-liability provision, which allows suits against “entities,” not “governmental entities.” See BFP v. Resolution Trust Corp., 511 U.S. 531, 537 (1994) (“[I]t is generally presumed that Congress acts intentionally and purposely when it includes particular language in one section of a statute but omits it in another.”).
These provisions evince an intent to make state employees and agents liable for violations. They also demonstrate that Congress wanted the States to abide by some of the statute's substantive requirements. See, e.g., 18 U.S.C. § 2703 (requiring “governmental entities” to obtain warrants before requiring disclosure of a consumer's electronic communications records from a third party). What they do not show is an unmistakable intent to make a state or its agencies civilly liable for violations.
To be sure, there are indications Congress might have intended that result. A committee report says that “governmental entities” should be liable for violations. See S. Rep. No. 99-541 at 43 (1986). And the definition of “person” includes corporations and other business entities, so by authorizing an action against a “person or entity,” Congress apparently meant to extend liability beyond just business entities. Or so the canon against surplusage suggests. The reference to an “entity” could easily be read to include a state or state agency.
Whatever might be said in the typical case of statutory interpretation, these suggestions do not satisfy the Supreme Court's longstanding rule that Congress must use the “most express language” to abrogate Eleventh Amendment immunity. Edelman v. Jordan, 415 U.S. 651, 673 (1974). Legislative history cannot bring clarity where a statute's text does not. That the statute defines “governmental entities” to include states does not unmistakably mean Congress intended to give “entity” an identical definition.
Reading “entity” as referring to entities other than states would not necessarily render it surplusage, either. It might refer to local government entities, which are not included in the statute's definition of a “person” and which do not enjoy Eleventh Amendment immunity. See, e.g., Abusaid v. Hillsborough Cty. Bd. of Cty. Com'rs, 405 F.3d 1298 (11th Cir. 2005) (holding that Florida sheriffs do not have Eleventh Amendment immunity when enforcing county ordinances); cf. Monell v. Dept. of Soc. Servs., 436 U.S. 658, 690 (1978) (holding that local governments are “persons” for purposes of 42 U.S.C. § 1983). Indeed, some courts have interpreted “entity” to include municipalities. See, e.g., Seitz v. City of Elgin, 719 F.3d 654, 657 (7th Cir. 2013) (collecting cases).
Congress knows how to speak clearly when it intends to abrogate immunity. See, e.g., 29 U.S.C. § 630(b) (defining “employers” liable for age discrimination to include “a State or political subdivision of a state and any agency or instrumentality of a state”); 42 U.S.C. § 12202 (“A State shall not be immune under the eleventh amendment to the Constitution of the United States from an action in Federal or State court of competent jurisdiction for a violation of the” Americans with Disabilities Act.). It did not do so here.
B
Even if Congress had spoken with the requisite clarity, abrogation of a state's immunity from a Stored Communications Act suit would exceed its Section 5 power. Congress may undoubtedly impose liability on the States to enforce the Fourteenth Amendment's substantive guarantees, including the right against unreasonable searches. See Mapp v. Ohio, 367 U.S. 643 (1961) (incorporating the Fourth Amendment against the states through the Fourteenth Amendment due process clause). To be a valid exercise of Section 5 power, however, abrogation “must exhibit ‘congruence and proportionality between the injury to be prevented or remedied and the means adopted to that end.’ ” Hibbs, 538 U.S. at 728 (quoting City of Boerne v. Flores, 521 U.S. 507, 520 (1997) ).
*3 This means abrogation must be an “appropriate remedy for identified constitutional violations, not an attempt to substantively redefine the States' legal obligations.” Id. The tailoring need not be perfect. Congress may enact legislation that “proscribes facially constitutionally conduct, in order to prevent and deter unconstitutional conduct.” Id. But it cannot impose liability out of all proportion to actual constitutional violations.
Subjecting the states to liability for Stored Communications Act violations is not a congruent and proportional remedy to identified Fourth Amendment violations—quite the contrary. The Act's substantive provisions create statutory protections for users of electronic communications technology precisely because those users may not have a Fourth Amendment interest in information disclosed to third parties. See Smith v. Maryland, 442 U.S. 735 (1979). This “third-party doctrine” has been criticized as “ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.” United States v. Jones, 565 U.S. 400, 417 (2012) (Sotomayor, J., concurring). But the doctrine remains the law, at least for now. See United States v. Davis, 785 F.3d 498, 507-09 (11th Cir. 2015) (en banc) (adhering to the third-party doctrine); see also Carpenter v. United States, 137 S. Ct. 2211 (2017) (granting certiorari in a case implicating the third-party doctrine's vitality).
The provision Ms. Hall claims was violated prohibits accessing electronic communication while in electronic storage—while it is in a third party's possession. 18 U.S.C. § 2701(a). Under current law, “it's an open question whether the Supreme Court's so-called ‘third-party doctrine’ might undermine any claim to Fourth Amendment protections when someone ... engages a private agent” such as Gmail “to deliver his correspondence.” United States v. Ackerman, 831 F.3d 1292, 1304 (10th Cir. 2016) (Gorsuch, J.) (noting uncertainty about the application of the third-party doctrine to email); see also Orin Kerr, A User's Guide to the Stored Communications Act, and a Legislator's Guide to Amending It, 72 Geo. Wash. L. Rev. 1208, 1211-12 (2004) (discussing uncertainty about the third-party doctrine and electronic communication).
The courts of appeals have not reached consensus about the third-party doctrine's scope when it comes to stored electronic communications. Some have held that users enjoy a reasonable expectation of privacy in the contents of emails. See United States v. Warshak, 631 F.3d 266, 283-88 (6th Cir. 2010); see also United States v. Forrester, 512 F.3d 500, 511 (9th Cir. 2007) (suggesting in dicta that email contents deserve Fourth Amendment protection). Others have expressed doubt about that. SeeUnited States v. Bach, 310 F.3d 1063, 1066 (8th Cir. 2002) (“While it is clear to this court that Congress intended to create a statutory expectation of privacy in e-mail files, it is less clear that an analogous expectation of privacy derives from the Constitution.”). The extent of any privacy expectation is also unsettled. See Forrester, 512 F.3d at 510-11 (holding no Fourth Amendment protection in to and from addresses of email messages); Guest v. Leis, 255 F.3d 325 (6th Cir. 2001) (“Courts have applied [the third-party doctrine] to computer searches and seizures to conclude that computer users do not have a legitimate expectation of privacy in their subscriber information [such as a username or password] because they have conveyed it to another person—the system operator.”). Notably, most of these cases postdate the Stored Communications Act by decades. Congress enacted the Act considering even less-developed Fourth Amendment law.
*4 This backdrop of uncertainty precludes Congress from legislating pursuant to Section 5. The Supreme Court, not Congress, has the ultimate responsibility “to define the substance of constitutional guarantees.” Hibbs, 538 U.S. at 729. The very fact that the Fourth Amendment's scope in this context remains unsettled means that the Stored Communication Act does not enforce a constitutional right. Rather, it creates a statutory right where the Constitution may offer limited protection.
The legislative history supports the conclusion that Congress intended to supplement the Fourth Amendment, not enforce it. The impetus for the Stored Communications Act came from a 1984 Justice Department letter to Senator Leahy. The letter gave the opinion that users would not necessarily have a reasonable expectation of privacy in then-emerging technology—from “cellular non-wire telephone connection” and “electronic mail” to “microwave-fed computer terminals.” See S. Rep. No. 99-541 at 3-4 (1986). Congressional concern about this legal gap prompted action, not a record of rampant Fourth Amendment violations. See Shelby Cty. v. Holder, 570 U.S. 529 (2013) (noting the need for a record of constitutional violations to legislate pursuant to the Fifteenth Amendment's enforcement clause); see also S. Rep. 99-541 at 4 (noting a government report concluding that “current legal protections for electronic mail are weak, ambiguous, or non-existent”).
Some of the Act's substantive guarantees might sometimes overlap with the Constitution. But it sweeps far broader than the Fourth Amendment. If indeed Congress intended to abrogate immunity, that was beyond its power.
III
For these reasons,
IT IS ORDERED:
The Department's motion to dismiss, ECF No. 20, is granted. The claims against the Department are dismissed based on Eleventh Amendment immunity. I do not direct the entry of judgment under Federal Rule of Civil Procedure 54(b).
SO ORDERED on May 23, 2018.