Trade secret theft is an ongoing concern for employers given the high rate of employee mobility in today’s workforce. Employee turnover can be rapid – the average employee stays at his or her job for 4.6 years according to the most recent available data from the Bureau of Labor Statistics.1 With the rate of employee separations continuing to grow, the threat of an employer losing highly valuable trade secrets is real and not a matter of if, but when. Rogue employees often use their personal email accounts to forward valuable information belonging to their employer and believe that this theft will never be discovered. The Stored Communications Act (SCA) is frequently cited by those employees to prevent discovery of content information in those personal emails.

On October 21, 2014, the California Court of Appeals for the Sixth District issued an opinion which allows an employer, under certain circumstances, to obtain a defecting employee’s personal emails directly from the email service provider through discovery in trade secret litigation. In Negro v. Superior Court (Navalimpianti USA, Inc.), 230 Cal.App.4th 879 (Cal. 6th Oct. 21, 2014), the court held that an email account holder’s court-ordered consent to the production of his personal emails permits an  email service provider to disclose the information in compliance with a civil subpoena without violating the SCA. Thus, under Negro, email service providers may no longer invoke the SCA as a blanket immunity from compliance with civil discovery requests. Instead, email service providers may be required to disclose personal email content where the user has provided “lawful consent” to disclosure through a court order.

Importance of Personal Email in Employee Mobility Cases

Savvy employees who are looking to leave their current employers aren’t likely to use their work email to discuss new employment. Additionally, on the way out, employees are more likely to use personal email accounts, the cloud, or small personal devices such as flash drives to take proprietary documents and data with them when they leave the company.

Sometimes, the content of an employee’s personal email is the only evidence of the misappropriation in a trade secret case. This becomes a problem when the rogue employee refuses to hand over personal emails and/or when the employee has tried to cover his or her tracks by deleting potentially incriminating emails from a personal account. Under either circumstance, the evidence of the theft may only be obtained from the servers of the email service provider. However, an email service provider’s ability to disclose the content of personal emails, even when served with a civil subpoena, is limited by the privacy protections of the SCA.

The SCA

The SCA provides that an “electronic communications service” is prohibited from “knowingly divulg(ing) to any person or entity (other than the addressee or intended recipient) the contents of a communication while in electronic storage by that service.” 18 USC § 2702(a). The computer systems of an email provider, a bulletin board system or an internet service provider are examples of facilities that provide electronic communication service under the SCA. In re iPhone Application Litig., 844 F.Supp.2d 1040, 1057–58 (N.D. Cal. 2012). The SCA also covers email messages stored on a server pending delivery or  remaining on the server after delivery or deletion by the user for “backup protection.” See Theofel v. Farey–Jones, 359 F.3d 1066, 1075 (9th Cir. 2004).

Finally, the SCA does not protect a user’s non-content metadata from disclosure (such as the sender, date, and time associated with an email); it only protects the substance of the communication. 18 USC § 2702(c)(6).

An email service provider cannot be compelled to disclose the content of a user’s personal email if the disclosure would require the provider to violate the SCA. See Negro, 230 Cal.App.4th at 889; O’Grady v. Superior Court, 139 Cal.App.4th 1423, 1441 (2006). But there are several exceptions to the statute under which a court may enforce a subpoena and compel disclosure, including disclosures made with the “lawful consent” of a party to the communication. See 18 USC § 2702(b)(3) (stating that consent is effective if given by “the originator or an addressee or intended recipient of such communication”). The SCA, however, does not specify the meaning or requirements of the “lawful consent” exception.

Negro v. Superior Court

Negro v. Superior Court resolved the issue of whether a court’s order requiring a party to provide consent for an email provider to disclose personal email content satisfied the “lawful consent” exception of the SCA. Under Negro, “lawful consent” includes court-ordered consent.

In Negro, Matteo Negro (Negro) and other former employees of Navalimpianti USA, Inc. (Navalimpianti), a marine equipment manufacturer, were accused of misappropriating Navalimpianti’s trade secrets to start their own competing business. The ship manufacturer sought discovery of emails exchanged between Negro and fourteen other former employees allegedly involved in the conspiracy. The case was venued in Florida.

During discovery, Navalimpianti subpoenaed an email service provider in California, seeking emails from Negro’s personal email account which Navalimpianti alleged was used to misappropriate trade secrets and further the conspiracy. The email service provider objected to the disclosure and filed a motion to quash  the subpoena in California state court on the grounds that it was prohibited from disclosing the content of the emails under the SCA. Perhaps in response to the email service provider’s objection, Navalimpianti obtained an order in the Florida court directing Negro “to execute an Authorization to Release Electronic Communications in a form acceptable to [the email service provider].” The authorization was then sent to the email service provider as directed by the Florida court.

The California Superior Court thereafter denied the motion to quash and directed the email service provider to produce the messages. Negro then filed a petition for writ of mandate with the Sixth District Court of Appeals to set aside the order denying the motion to quash, arguing that the court-ordered consent was not “lawful consent” as required by the SCA. Negro contended that his consent could not be considered “lawful” under the statute because it was both involuntary and judicially coerced.

The Court of Appeals affirmed the denial of the motion to quash, holding that the court-ordered authorization was “lawful consent” that vitiated the protections of the SCA. The court noted that the “lawful consent” exception to the SCA is not satisfied by consent that is “merely constructive, implied by law, or otherwise imputed to the user by a court.” The court reasoned, however, that this does not mean that a court lacks the power to compel the actual consent of a user: “where users are also parties to civil litigation, the court has the means to compel them to give their actual consent. Those observations came in response to a contention that the SCA cannot have been intended to categorically foreclose the discovery of email messages in civil litigation.” Furthermore, according to the court, the consent given by Negro pursuant to a court-order was not judicially coerced and constituted “lawful consent” because Negro was not deprived of volition in complying with the court order – Negro had a choice between providing the authorization and risking discovery sanctions by defying the order. Accordingly, the court held that court-ordered consent is effective to satisfy the “lawful consent” exception to the SCA and permits service providers to make disclosures as required by subpoena.

Practical Implications for Employers

The court’s decision in Negro provides an additional tool for employers bringing trade secret claims against their former employees, especially where there is reason to believe an employee may have used his or her personal email to misappropriate confidential or proprietary information. Although rights to privacy can still be respected, under Negro, the content of emails is not necessarily immune from civil discovery merely because the emails are kept in a “personal” email account. Also, emails deleted locally by the user may still be recovered through a subpoena to the email service provider.

However, caution should be used. Negro is the first California opinion on this subject and the California Supreme Court has not addressed this issue.2 Further, although Negro removes an absolute bar on discovering email content through a court order, disclosure is not inevitable given the involvement of a somewhat unpredictable variable: the court must first agree to issue an order requiring the user to give consent.