Whose Space? Discoverability of Social Networking Web Sites

Peggy's battle to keep her MyFazer page private did not end there. INC quickly became suspicious of her “injury” and began an internal investigation into her work station Internet use, including a review of her password-protected MyFazer page. Peggy did not realize that because she was using her INC computer to access her MyFazer page, INC was able to access the page.

Expectation of Privacy?

Does Peggy have a reasonable expectation that she can protect the content of her MyFazer page from discovery by the trampoline manufacturer's counsel? Did
INC violate Peggy's right to privacy by accessing her MyFazer page without her permission? If the sought information is discoverable, can it be admissible as evidence?

The answers to these questions lie in the largely unchartered legal territory of social networking sites, in which standards of privacy have not yet been defined or adequately tested. This article explores a social networking site user's right to privacy, an adversary's right to obtain information from that site, and the admissibility of the information.

Before asserting an invasion of privacy claim as against her employer, Peggy's counsel should check whether INC had a publicized policy that INC's employees have no privacy interest in any materials created or accessed on company computers. With such a policy in place, an employer generally can review with impunity an employee's activities on the company's computer system. Even if Peggy's MyFazer page is “password-protected,” INC may be able to access it if the company's Web browser memorizes users' passwords so that each time Peggy logged onto her MyFazer page from work, she did not have to enter her password. By using INC's computer to access her MyFazer account, Peggy unknowingly granted INC full access to it, and, in so doing, arguably waived any right to privacy in the content therein that she may otherwise have possessed.

Whether the trampoline manufacturer can obtain information from Peggy's MyFazer page is less certain because specific rules governing the discoverability of online personal information have not kept pace with new opportunities for online expression, which are being developed faster than regulations can be revised or promulgated.

Because traditional tort law does not recognize invasions of privacy that occur in public, arguments that information posted on social networking sites should not be discoverable because it is “private” face an uphill battle. To determine whether a litigant has an expectation of privacy in an Internet posting, courts will generally first ask whether the person had a “subjective expectation of privacy.” In trying to prove a subjective expectation of privacy in a user's profile, the inherent nature of the profile or its everyday use works against any notion of an expectation of privacy.

Going Public

Users of such sites “logically lack a legitimate expectation of privacy in the materials intended for publication or public posting.” Steven Guest et al. v. Simon L. Leis et al., 255 F.3d 325 (6th Cir. 2001). For this reason, “e-mail messages are afforded more privacy than similar messages on the Internet.” United States v. James A. Maxwell, Jr. et al., 45 M.J. 406 (C.A.A.F. 1996).

By providing personal information for others to see on a social networking site, a user is not seeking to preserve this information as private, but rather is making a conscious choice to publicize it. To prove a subjective expectation of privacy, users have to first overcome the inherent assumption that they intended to publicize their information. To attempt to overcome that assumption, a user may argue that he or she restricted the privacy settings on the site only to allow those whom he or she accepted as “friends” to view it. Generally, to restrict access, the user must actively change the site's settings. This active step may show the requisite intent to keep the posted information private. However, whether taking this step overcomes the presumption that a user who posts personal
information on a Web page can have a reasonable expectation that that information will remain private is questionable.

The United States District Court of New Jersey set the limits of a person's reasonable expectation of privacy at the point where content on a Web page is shared with other people. In the consolidated cases Beye v. Horizon, 06-Civ.-5337 (D. N.J. filed 2006), and Foley v. Horizon, 06-Civ.-6219 (D. N.J. filed Dec. 26, 2006) (litigation involving an insurer's refusal to pay health benefits for children's eating disorders), the court ordered the plaintiffs to turn over the children's e-mails, diaries and other writings that were “shared with other people” about their eating disorders, including entries on Web sites such as Facebook or MySpace. The court's proclivity for ordering production of online personal information emphasizes both the idea of individual responsibility when using social networking sites and a lowered expectation of privacy where the person asserting a right to privacy is the same person who made the information public in the first place.

This is not to say, however, that a request for production will always prevail. A New Jersey Superior Court denied a request for access to a plaintiff's MySpace and FaceBook sites when a township's school board asked for the disclosure in a student's suit seeking emotional distress damages. T.V. v. Union Twp. Board of Education, UNN-L-4479-04 (N.J. Super. Ct. filed Dec. 22, 2004). The court held that the student's privacy interests prevailed absent a particularized showing of relevance, but left open the possibility that ongoing discovery might provide a basis for the court to reconsider its decision. The United States District Court, in Mackelprang v. Fidelity National Title Agency of Nevada, Inc., 2007 WL 119149 (D. Nev. Jan. 9, 2007), also left the door open to the possibility of future discovery. In Mackelprang, the court denied the defendant's motion to compel production of private messages on the plaintiff's MySpace page, which defense counsel claimed constituted “the same types of electronic and physical relationships she [the plaintiff] characterized as sexual harassment in her Complaint.” The court reasoned that “at the time of the request,” defense counsel had “nothing more than suspicion or speculation as to what information might be contained in the private messages.” However, the court did allow discovery into e-mail messages that would be relevant to assessing the credibility of her emotional distress claims. Notably, nothing in the court's order prevented the defendants from serving discovery requests on the plaintiff demanding production of her MySpace messages that contained information regarding her sexual harassment allegations in the lawsuit or which discussed her alleged emotional distress.

The presumption that a user does not have a reasonable expectation of privacy to information posted on a social networking site is strengthened by the fact that the privacy policies of some of the most popular of these sites generally disclaim responsibility for circumvention of privacy measures and state that by posting on their site, the user grants the networking site the right to access or disclose the user's content for a variety of purposes. In fact, Facebook's policy actually states: “Please keep in mind that if you disclose personal information [on your page] ' this information may become publicly available.” See, www.facebook.com/policy.php. Since these sites' privacy policies recognize and even caution that any posted information may become public, a user may not be able to contend reasonably that such information is private and in the case of litigation, non-discoverable.

Making Information Discoverable

Given the increasing prominence of social networking sites, defense counsel for a manufacturer should consider the following practice tips at the inception of discovery:

1. Search (through Google or other search engine) individual plaintiffs and key witnesses (“Key Players”) to discover their Internet activities.
2. Demand that Key Players identify their e-mail accounts.
3. Investigate whether and which Key Players have, or are users of, social networking sites:

a. If any have, or are users of, a social networking site:

1.) demand to view it; and
2.) analyze the relevance of its content.

b. If relevant:

1.) demand that the relevant
content be produced; and
2.) the site be preserved.

c. Production may depend upon: