Employer Liable to Employee for Punitive Damages Under the Stored Communications Act for Accessing Employee’s Private Email Account Absent Proof Employee Incurred Actual Damages

In Van Alstyne v. Electronic Scriptorium, Ltd, 560 F.3d 199 (4th Cir. 2009), the United States Court of Appeals for the Fourth Circuit considered the appeal by an employer who had been found by a jury to have violated the Stored Communications Act, 18 U.S.C. § 2707(“the SCA”) when it gained access to a former employee’s private email account in order to obtain evidence relevant to an ongoing employment-related lawsuit between the parties. Although the court held that the employee could not recover the statutory damages authorized by the SCA absent proof of actual damages, the court sustained the employee’s right to recover punitive damages and attorney’s fees under the statute even absent proof of damages. The decision is an important reminder to employers that private email accounts of its employees are off limits.

Background

Defendant Electronic Scriptorium, Ltd (“ESL”) is a small data-conversion company in Virginia. Defendant Edward Leonard (“Leonard”) was a co-owner of ESL. In 2001, ESL hired Bonnie Van Alstyne (“Van Alstyne”) as Vice President of Marketing. Although ESL assigned Van Alstyne a company email account, she occasionally used her private password-protected email account with America On-Line (“AOL”) for business purposes.

Van Alstyne claimed that she was terminated by ESL approximately 5 months after she was sexually propositioned by Leonard. Plaintiff then pursued several claims against ESL in Virginia state court. While these claims were pending ESL commenced an action against Van Alstyne, also in Virginia state court, alleging several business torts against her. During a deposition in that action, ESL’s counsel used several emails from Van Alstyne as exhibits. Van Alstyne became suspicious that Leonard had obtained these emails by breaking into her AOL account. At a subsequent deposition, Leonard admitted that he had accessed the AOL account after Van Alstyne left the company. Leonard ultimately admitted that he had accessed the AOL account on numerous occasions and had taken more than 250 emails from that account.

Van Alstyne then instituted an action against Leonard and ESL in the United States District Court for the Eastern District of Virginia, alleging that Leonard had violated the SCA. Van Alstyne sought actual damages or, alternatively, an award of the SCA’s minimum damages amount. She also sought punitive damages and attorney’s fees. She subsequently withdrew her claim for actual damages.

As the Fourth Circuit noted, the SCA imposes criminal penalties on one who “intentionally accesses without authorization a facility through which an electronic communication service is provided” and by doing so “obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system.” 18 U.S.C. § 2701(a)(1-2). Further, the SCA provides a private cause of action for “any . . . other person aggrieved” by a violation. 18 U.S.C. § 2707(a). Under the statute, a private plaintiff may recover the actual damages suffered and any profits made by the violator as a result of the violation, “but in no case shall a person entitled to recover receive less than the sum of $1,000. A successful plaintiff is also entitled to recovery costs, including a reasonable attorney’s fee. Finally, punitive damages may be awarded for willful or intentional violations.” 18 U.S.C. § 2707(c).

At trial, the jury returned a verdict in favor of Van Alstyne for a total of $175,000 in statutory damages ($1,000 for each violation of the SCA found by the jury) and $100,000 in punitive damages. The trial court also awarded Van Alstyne approximately $136,000 in attorney’s fees and costs.

The Fourth Circuit’s Opinion

On appeal, the defendants argued that the SCA required Van Alstyne to prove actual damages as a predicate to recovering statutory and punitive damages and attorney’s fees. As noted above, prior to trial Van Alstyne had withdrawn her claim for actual damages. The Fourth Circuit agreed with the defendants’ arguments with regard to the statutory damages portion of the jury award but rejected it with regard to the award of punitive damages and attorney’s fees.

As to the award of statutory damages, the court relied heavily on the United States Supreme Court’s interpretation of the statutory damages award provision in the Privacy Act. 5 U.S.C. § 552a(g)(4)(A). Under that provision a successful plaintiff is entitled to recover actual damages, “but in no case shall a person entitled to recovery receive less than the sum of $1,000.” In Doe v. Chao, 540 U.S. 614 (2004), the Supreme Court, in interpreting this provision, concluded that proof of actual damages was a prerequisite to the recovery of statutory damages because to conclude otherwise “simply pays no attention to the fact that the statute does not speak of liability (and consequent entitlement to recovery) in a freestanding, unqualified way, but in a limited way, by reference to enumerated damages.” Id. at 621. The Fourth Circuit reasoned that as the language of the SCA was in all important respects virtually identical to the language of the Privacy Act, “[o]ur answer, it appears, should be obvious: just as the Privacy Act required proof of ‘actual damages’ as a prerequisite to recovering statutory damages, so does the SCA.”

The court, however, reached a different conclusion with regard to Van Alstyne’s recovery of punitive damages and attorney’s fees. The court noted the general rule that, in the absence of statutory language to the contrary, punitive damages are generally not recoverable without proof of actual damages. But the court concluded that the SCA provides the requisite language for the recovery of punitive damages absent actual damages becasue the punitive damages provision’s only limitation is that the violation be “willful or intentional.” In this regard, the court noted its earlier opinions approving awards of punitive damages under the Fair Credit Reporting Act without awards of actual damages.

The court also concluded that Van Alstyne was entitled to an award of attorney’s fees. The court noted that § 2707(b)(3) authorizes such an award “apart from any requirement that damages, actual or otherwise, be recovered.”

Finally, the court remanded the matter to the district court to reconsider the amounts of the punitive damages and attorney’s fees awards in light of Van Alstyne’s lower degree of success in the matter as a result of the court’s ruling on the statutory damages issue.

Conclusion

Employers unaware of the SCA may be tempted to access employees’ private email accounts as part of otherwise legitimate investigations or in furtherance of otherwise legitimate business objectives. The Van Alstyne decision should serve as a reminder that accessing such accounts can have serious consequences, exposing employers to potentially heavy statutory damages and, even in the absence of proof of damages, to significant punitive damages and attorney’s fees.