Right to Privacy: Do You Have Standing?

As a case in point, consider People v. Harris, 2011NY080152. In April 2012, the New York City Criminal Court found a user did not own his personal information and self-generated content in part because of Twitter's then-Terms of Service agreement. The case involved Malcolm Harris, an Occupy Wall Street protester who had been charged with disorderly conduct after allegedly marching onto the roadway of the Brooklyn Bridge. Twitter was subpoenaed for his account information and Tweets for their relevance to the ongoing criminal investigation. When Twitter informed the defendant of this, Harris conveyed that he intended to file a motion to quash the subpoena, and Twitter decided that it would not comply with the subpoena until the court ruled on the motion.

The court rejected the motion on the basis that Harris had no standing to challenge third-party disclosure requests under the Terms of Service that existed during the dates in question. The court stated that Harris had 'no proprietary interests in [his] user information and Tweets.' Twitter's Terms of Service had stated, in part, the following:

By submitting, posting or displaying content on or through the services, you grant us a worldwide, non-exclusive, royalty-free license to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such content in any and all media or distribution methods (now known or later developed). [emphasis added]

Terms of Service, https://twitter.com/tos.

The issue here was simply whether or not the defendant had standing to make his case, not whether he was likely to win on the merits. Thus, the case came down to whether or not the defendant had abandoned his proprietary interests, not whether a public or semipublic Tweet might be considered private. Certainly one cannot make a case that user-generated content is private if one is not taken to have standing; this issue is as applicable to health records as it is to Tweets.

The court stated that there had been no prior jurisprudence in New York on whether a criminal defendant has standing to quash a subpoena issued to a third-party online social networking service seeking to obtain the defendant's user information and postings. The opinion, treating Tweets as business records, drew analogies to bank record cases, in which individuals do not have standing to challenge subpoenas issued against third-party banks because business records are property of the bank and a defendant cannot assert ownership of them. In so arguing, the court held the defendant in this case also had no proprietary interest in user information and Tweets because he had agreed to allow Twitter to post his Tweets in 'any and all distribution methods' as stated in the Terms of Service. The court stated the 'defendant's inability to preclude Twitter's use of his tweets demonstrates a lack of proprietary interests in his [T]weets.'

The analogy to bank records in this case is problematic because bank records are created by the bank, not by the client, whereas Tweets are composed by the user and not by Twitter. A better analogy for this case may be telecommunications. The records of which calls or IP packets were sent is different than the content of the messages. It is difficult to imagine labeling the content of a phone call to be part of a legitimate business record. It is equally difficult to imagine that one would not have standing to challenge a subpoena regarding the content of one's own phone call. By making a distinction between legitimate business records and user-generated content, one can differentiate where standing may or may not make more sense.

A Book of Tweets

In 2012, Steve Martin published a book of his Tweets. The copyright is not owned by Twitter, but rather by 40 Share Productions Inc. The book states that it 'has not been prepared, authorized, or endorsed by Twitter, Inc.' In fact, by the nature of the Terms of Service, it is difficult to see how a user has given up his or her rights by granting 'non-exclusive' rights to Twitter. If the user had no copyright over his or her Tweets, there would be no meaning in such a license ' one cannot grant what one does not own. Assuming the user has rights, the Terms of Service would need to state the user has given up those rights in order to lose any proprietary interest. But no'such divestiture of rights is mentioned. One imagines that Martin did not give up his property interests in his Tweets, even though he has millions of Twitter followers, and likely neither did the defendant. It is hard to see how the Terms of Service could have led to a lack of standing in this case.

This ruling implies users do not own their own self-generated content, which could have repercussions in many social media and IP disputes. It also creates a burden on companies because it requires social networking websites to bear more responsibility in protecting user information if a defendant cannot intervene. To err on the side of caution, and to highlight its concern for user privacy, Twitter's reaction to this ruling was to change its Terms of Service to include: 'You retain your rights to any Content you submit, post or display on or through the Services.' In August 2012, Twitter's legal counsel, Ben Lee, affirmed the company's stance on user content by tweeting the following: 'Twitter users own their Tweets. They have a right to fight invalid government requests, and we continue to stand with them in that fight.'

Conclusion

The practical message to attorneys in this case is to work with clients in considering the benefits of maintaining a license to their user-generated content, while guaranteeing ongoing user ownership of it to establish a 'right of standing' as a basic privacy right.

Ron Dolin, J.D., Ph.D., teaches legal technology and informatics at Stanford Law School. Dolin is also an adviser to the UC-Hastings Privacy and Technology Project as well as its Science and Technology Law Journal. He is a member of the executive committee of the LPMT section of the California Bar. Nancy Situ is a J.D. candidate at Osgoode Hall Law School. She is interested in intellectual property and technology law issues and has previously written for Osgoode's IPilogue and The Court.

The legal framework of data privacy, though certainly in flux, has come a long way over the past few decades. Looking across the international spectrum, we see common themes such as notification and consent, how or whether to limit onward transfers of personal data, the right to correct (or delete) erroneous information, etc. Given a recent New York court decision, perhaps we should consider another right one might reasonably associate with privacy: the right of standing.

From a corporate perspective, there is little downside in trying to facilitate the right of standing for customers and clients. This is in contrast with the trade-offs of limiting onward transfers, which may impact a company's ability to monetize personal information. This trade-off between monetization and privacy may well lead many attorneys to suggest to their corporate clients that they limit their users' privacy rights in their privacy policy and/or Terms of Service. In the case of facilitating a user's right to attempt to quash a subpoena, however, the company has little to lose, and much to gain in terms of its customers' trust, and general business goodwill.

Who Owns Tweets?

As a case in point, consider People v. Harris, 2011NY080152. In April 2012, the New York City Criminal Court found a user did not own his personal information and self-generated content in part because of Twitter's then-Terms of Service agreement. The case involved Malcolm Harris, an Occupy Wall Street protester who had been charged with disorderly conduct after allegedly marching onto the roadway of the Brooklyn Bridge. Twitter was subpoenaed for his account information and Tweets for their relevance to the ongoing criminal investigation. When Twitter informed the defendant of this, Harris conveyed that he intended to file a motion to quash the subpoena, and Twitter decided that it would not comply with the subpoena until the court ruled on the motion.

The court rejected the motion on the basis that Harris had no standing to challenge third-party disclosure requests under the Terms of Service that existed during the dates in question. The court stated that Harris had 'no proprietary interests in [his] user information and Tweets.' Twitter's Terms of Service had stated, in part, the following:

By submitting, posting or displaying content on or through the services, you grant us a worldwide, non-exclusive, royalty-free license to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such content in any and all media or distribution methods (now known or later developed). [emphasis added]

Terms of Service, https://twitter.com/tos.

The issue here was simply whether or not the defendant had standing to make his case, not whether he was likely to win on the merits. Thus, the case came down to whether or not the defendant had abandoned his proprietary interests, not whether a public or semipublic Tweet might be considered private. Certainly one cannot make a case that user-generated content is private if one is not taken to have standing; this issue is as applicable to health records as it is to Tweets.

The court stated that there had been no prior jurisprudence in New York on whether a criminal defendant has standing to quash a subpoena issued to a third-party online social networking service seeking to obtain the defendant's user information and postings. The opinion, treating Tweets as business records, drew analogies to bank record cases, in which individuals do not have standing to challenge subpoenas issued against third-party banks because business records are property of the bank and a defendant cannot assert ownership of them. In so arguing, the court held the defendant in this case also had no proprietary interest in user information and Tweets because he had agreed to allow Twitter to post his Tweets in 'any and all distribution methods' as stated in the Terms of Service. The court stated the 'defendant's inability to preclude Twitter's use of his tweets demonstrates a lack of proprietary interests in his [T]weets.'

The analogy to bank records in this case is problematic because bank records are created by the bank, not by the client, whereas Tweets are composed by the user and not by Twitter. A better analogy for this case may be telecommunications. The records of which calls or IP packets were sent is different than the content of the messages. It is difficult to imagine labeling the content of a phone call to be part of a legitimate business record. It is equally difficult to imagine that one would not have standing to challenge a subpoena regarding the content of one's own phone call. By making a distinction between legitimate business records and user-generated content, one can differentiate where standing may or may not make more sense.

A Book of Tweets

In 2012, Steve Martin published a book of his Tweets. The copyright is not owned by Twitter, but rather by 40 Share Productions Inc. The book states that it 'has not been prepared, authorized, or endorsed by Twitter, Inc.' In fact, by the nature of the Terms of Service, it is difficult to see how a user has given up his or her rights by granting 'non-exclusive' rights to Twitter. If the user had no copyright over his or her Tweets, there would be no meaning in such a license ' one cannot grant what one does not own. Assuming the user has rights, the Terms of Service would need to state the user has given up those rights in order to lose any proprietary interest. But no'such divestiture of rights is mentioned. One imagines that Martin did not give up his property interests in his Tweets, even though he has millions of Twitter followers, and likely neither did the defendant. It is hard to see how the Terms of Service could have led to a lack of standing in this case.

This ruling implies users do not own their own self-generated content, which could have repercussions in many social media and IP disputes. It also creates a burden on companies because it requires social networking websites to bear more responsibility in protecting user information if a defendant cannot intervene. To err on the side of caution, and to highlight its concern for user privacy, Twitter's reaction to this ruling was to change its Terms of Service to include: 'You retain your rights to any Content you submit, post or display on or through the Services.' In August 2012, Twitter's legal counsel, Ben Lee, affirmed the company's stance on user content by tweeting the following: 'Twitter users own their Tweets. They have a right to fight invalid government requests, and we continue to stand with them in that fight.'

Conclusion

The practical message to attorneys in this case is to work with clients in considering the benefits of maintaining a license to their user-generated content, while guaranteeing ongoing user ownership of it to establish a 'right of standing' as a basic privacy right.

Ron Dolin, J.D., Ph.D., teaches legal technology and informatics at Stanford Law School. Dolin is also an adviser to the UC-Hastings Privacy and Technology Project as well as its Science and Technology Law Journal. He is a member of the executive committee of the LPMT section of the California Bar. Nancy Situ is a J.D. candidate at Osgoode Hall Law School. She is interested in intellectual property and technology law issues and has previously written for Osgoode's IPilogue and The Court.