In January 2011, David Cheng (Plaintiff) filed a lawsuit against his former co-worker and fellow radiologist, Laura Romo (Defendant), alleging a violation of the Stored Communications Act (SCA) and Massachusetts privacy law. After the U.S District Court of Massachusetts denied Defendant’s motion for summary judgment on both counts, the case went to trial and the verdict came down at the end of April. The jury found that Defendant violated both the SCA and Massachusetts privacy law, and awarded Plaintiff damages totaling $325,000. This case is significant in that courts have struggled to interpret the language of the SCA yet the jury very clearly decided in favor of Plaintiff.
By way of background, Plaintiff, Defendant and Defendant’s husband worked at Advanced Radiology (“Advanced”), a medical practice that provides medical imaging services. Advanced did not provide its employees with email accounts so, in 2000, when Plaintiff joined Advanced, he set up a Yahoo! email account that he used for both personal and professional purposes. In July 2000, Plaintiff gave Defendant the password to his Yahoo! email account so that she could review images in connection with their duties at Advanced. Plaintiff did not in any way limit Defendant’s access to his email account. At her deposition, Defendant testified that she had accessed Plaintiff’s email about ten times per year to review consultant’s reports, but that she did not remember accessing Plaintiff’s email account from 2002-07.
By 2008, Defendant and her husband’s relationship with Advanced had deteriorated and they each filed a lawsuit against Advanced. Prior to filing, Defendant accessed Plaintiff’s Yahoo! email account and provided at least ten emails to her husband, which were then produced in his lawsuit against Advanced. Some of these emails contained content personal to Plaintiff, including information related to a relationship Plaintiff had with a non-manager level employee at Advanced.
The District Court denied Defendant’s motion for summary judgment both with respect to her alleged violation of the SCA and her alleged violation of Massachusetts privacy laws.
The SCA prohibits intentionally accessing without authorization a facility through which an electronic communication service is provided or intentionally exceeding an authorization to access that facility. 18 U.S.C. § 2701(a). With respect to Plaintiff’s claim that Defendant violated the SCA, the District Court noted that “courts have struggled with what it means for a person to ‘access without authorization’ and ‘exceed[] an authorization to access’ a facility.” But the District Court denied to resolve the issue on summary judgment, stating that “there is a disputed issue of material fact for the factfinder to resolve as to whether [Defendant] was authorized to access [Plaintiff’s] account.”
M.G. L. chap. 214, § 1B states that a “person shall have a right against unreasonable, substantial or serious interference with his privacy.” With respect to Plaintiff’s claim that Defendant violated Massachusetts privacy law, the District Court denied Defendant’s motion for summary judgment, noting that “there [were] disputed issues of material fact as to whether [Defendant] had a reasonable expectation of privacy in his email messages and whether [Plaintiff’s] actions in reading these messages and in providing them to her husband were an unreasonable, substantial or serious interference with [Plaintiff’s] privacy.”
The jury resolved both allegations in Plaintiff’s favor, awarding $325,000 in damages – including $50,000 to compensate Plaintiff for his actual damages; $150,000 for the dissemination of emails from his account; and $125,000 in punitive damages. But the case is not over yet, as the District Court must decide two pending motions, including Plaintiff’s motion for attorney’s fees and costs and Defendant’s motion for judgment as a matter of law. Both decisions will be instructive in terms of the impact this case will have on privacy litigation in Massachusetts.