Bankr.S.D.N.Y.: E-mails of German debtor protected by ECPA

A bankruptcy court would not enforce a German court order for e-mails in the U.S. as against our public policy. While the German debtor does not have the protection of the Fourth Amendment when he’s not even in the U.S., he does have protection of ECPA. In re Toft, 453 B.R. 186 (Bankr. S.D. N.Y. July 22, 2011):

Electronic communications privacy is subject to comprehensive statutory protection in the United States under (i) the Wiretap Act, 18 U.S.C. § 2511, et. seq., and (ii) the Privacy Act, 18 U.S.C. § 2701, et. seq. Under the Wiretap Act, civil and criminal penalties can be imposed on any person who “intentionally intercepts . . . any wire, oral, or electronic communication.” 18 U.S.C. § 2511(1)(a). A warrant issued in the course of a criminal investigation upon a heightened showing of necessity is required in order to conduct a wiretap lawfully without the consent of one of the parties to the communication. 18 U.S.C. § 2518. Courts that have applied the provisions of the Wiretap Act to e-mails have held that the clandestine interception of e-mails of an individual, occurring contemporaneously with delivery, constitutes an illegal wiretap. See United States v. Councilman, 418 F.3d 67, 80 (1st Cir. 2005) (holding that for purposes of the Wiretap Act, e-mails can be considered “electronic communications,” and the secret redirection of e-mails interception); see also Pure Power Boot Camp v. Warrior Fitness Boot Camp, 587 F. Supp. 2d 548 (S.D.N.Y. 2008). The Foreign Representative argues that the inspection of e-mails is not a wiretap because the e-mails are inspected after their delivery and not while in transit, but no authority has been provided to support this narrow construction of the Wiretap Act.

In any event, once an e-mail has been delivered, unauthorized access to the contents of the communication is governed by the Stored Communications Act, 18 U.S.C. § 2701, et seq.,which is part of the Electronic Communications Privacy Act (“Privacy Act”). See Pure Power Boot Camp, 587 F.Supp.2d at 555. The Privacy Act, which is intended to prevent third parties from “obtaining, altering, or destroying certain stored electronic communications,” imposes criminal and civil penalties when a person “accesses an electronic communication service, or obtains an electronic communication while it is still in storage, without authorization.” Id. at 555. The contents of e-mail communications may be released by an ISP only under the specifically enumerated exceptions found in §§ 2702 and 2703 of the Privacy Act. Those exceptions require a search warrant issued under the Federal Rules of Criminal Procedure or a subpoena issued in the course of a criminal investigation. In re Subpoena Duces Tecum to AOL, LLC, 550 F.Supp.2d 606, 611 (E.D. Va. 2008), citing F.T.C. v. Netscape Communs Corp., 196 F.R.D. 559 (N.D. Cal. 2000) (discovery of e-mails from ISP not available under Fed. R. Civ. P. 45). Indeed, one court has held that the disclosure procedures under the Privacy Act are unconstitutional to the extent they permit warrantless searches of e-mails, because a reasonable expectation of privacy exists and e-mails are subject to the Fourth Amendment’s protection from warrantless searches and seizures. See United States v. Warshak, 631 F.3d 266, 288 (6th Cir. 2010). In this case, the Court does not reach any Fourth Amendment issue — among other things, it is unclear whether the Debtor, a foreign national not located in the United States, would be entitled to claim the protections of the Fourth Amendment. See United States v. Verdugo-Urquidez, 494 U.S. 259, 110 S. Ct. 1056, 108 L. Ed. 2d 222 (1990). Nevertheless, without regard to the Debtor’s constitutional rights under the Fourth Amendment, the Privacy Act has been held to apply irrespective of the foreign nationality of the account holder. See In re § 2703(d) Order, 787 F. Supp. 2d 430 (E.D. Va. 2011) (application of 18 U.S.C. § 2703(d) to foreign users involved in WikiLeaks investigation not an extraterritorial application of U.S. law because statute governs disclosure by the American service provider).