SCA protects private Facebook posts, but not if friends share them to others

We’ve written about the discovery of social media in the context of labor and employment law several times in the past, but a case from last week in New Jersey offers a fresh spin on this issue. In Ehling v. Monmouth-Ocean Hospital Service Corp., the plaintiff was a nurse and worked for defendant’s “non-profit hospital service corporation” (hereinafter “MONCO”), and after a few years, became President of an employee union.

The case focuses on what is referred to as “The Facebook Incident”. On June 8 2009, Ehling posted this status update:

An 88 yr old sociopath white supremacist opened fire in the Wash D.C. Holocaust Museum this morning and killed an innocent guard (leaving children). Other guards opened fire. The 88 yr old was shot. He survived. I blame the DC paramedics. I want to say 2 things to the DC medics. 1. WHAT WERE YOU THINKING? and 2. This was your opportunity to really make a difference! WTF!!!! And to the other guards….go to target practice.

Ehling’s Facebook profile was kept private – she did not befriend any of her supervisors or managers, but was Facebook friends with a few coworkers. Unbeknownst to her, one of these coworkers was taking screenshots of Ehling’s profile, and passing them on – unsolicited – to her superiors at MONCO. After the above status update, plaintiff was “temporarily suspended with pay” (emphasis in original). She filed a complaint with the NLRB, who found no violation of the National Labor Relations Act. This appeal followed.

What sets Ehling’s case apart from the other NLRB/social media discovery cases we’ve addressed previously, is that her primary argument is based on the Stored Communications Act, alleging that “Defendants violated the SCA by improperly accessing her Facebook wall post about the museum shooting.” So, the first question for the instant court to address is whether the SCA even applies to private Facebook wall posts. Acknowledging that the SCA was passed in 1986, Judge Martini observes that ”task of adapting the Act’s language to modern technology has fallen largely upon the courts.”

So, let’s get adapting:

The SCA provides that whoever “(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters or prevents the authorized access to a wire or electronic communication while in electronic storage in such a system” shall be liable for damages… The statute further provides that “[i]t shall not be unlawful . . . [to] access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public.”… In other words, the SCA covers: (1) electronic communications, (2) that were transmitted via an electronic communication service, (3) that are in electronic storage, and (4) that are not public.

(Internal citations omitted)

After element-by-element analysis, the court concludes that the SCA does indeed apply to private Facebook wall posts. The fact that the poster has taken affirmative steps to limit the visibility of her profile is key to satisfying the fourth point. Since Ehling’s posting was only intended to be seen by her personally-selected Facebook friends, it is held that the SCA should protect it.

Unfortunately for Ehling, there are exceptions to the SCA, and one of those – the “authorized user exception” – provides that:

The SCA “does not apply with respect to conduct authorized (1) by the person or entity providing a wire or electronic communications service; [or] (2) by a user of that service with respect to a communication of or intended for that user.”

…

The authorized user exception applies where (1) access to the communication was “authorized,” (2) “by a user of that service,” (3) “with respect to a communication . . . intended for that user.”

Ehling’s coworker was had “authorized” access to the status update, as he was a Facebook friend of Ehling. But there was no evidence that Defendant itself had solicited or sought out the update – by all accounts, the friend had been feeding Ehling’s Facebook content to management of his own volition.

The undisputed evidence establishes that [coworker] Ronco voluntarily provided Plaintiff’s Facebook posts to MONOC management without any coercion or pressure. [Manager] Caruso testified at his deposition that Plaintiff’s Facebook friend Ronco voluntarily took screenshots of Plaintiff’s Facebook page and either emailed those screenshots to Caruso or printed them out for him… This information was completely unsolicited. Caruso never asked Ronco for any information about Plaintiff and never requested that Ronco keep him apprised of Plaintiff’s Facebook activity; in fact, Caruso was surprised that Ronco showed him Plaintiff’s Facebook postings.

Since Ronco was an authorized user and the communication was intended for him, the court dismisses plaintiff’s SCA. Among her other allegations is one for invasion of privacy, but the court finds, at worst, “a violation of trust, but… not a violation of privacy.”

The evidence does not show that Defendants obtained access to Plaintiff’s Facebook page by, say, logging into her account, logging into another employee’s account, or asking another employee to log into Facebook. Instead, the evidence shows that Defendants were the passive recipients of information that they did not seek out or ask for. Plaintiff voluntarily gave information to her Facebook friend, and her Facebook friend voluntarily gave that information to someone else.