Holland et al v. Yahoo! Inc.

RESPONSE

N.D. Cal.March 26, 2014

PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Daniel C. Girard (SBN 114826) Amanda M. Steiner (SBN 190047) Matthew B. George (SBN 239322) Jennifer L. McIntosh (SBN 264903) GIRARD GIBBS LLP 601 California Street, 14th Floor San Francisco, CA 94104 Telephone: (415) 981-4800 Facsimile: (415) 981-4846 dcg@girardgibbs.com ast@girardgibbs.com mbg@girardgibbs.com jlm@girardgibbs.com Laurence D. King (SBN 206423) KAPLAN FOX & KILSHEIMER LLP 350 Sansome Street, Suite 400 San Francisco, California 94104 Telephone: (415) 772-4700 Facsimile: (415) 772-4707 lking@kaplanfox.com Co-Lead Interim Class Counsel Frederic S. Fox (admitted pro hac vice) David A. Straite (admitted pro hac vice) KAPLAN FOX & KILSHEIMER LLP 850 Third Avenue, 14th Floor New York, New York 10022 Telephone: (212) 687-1980 Facsimile: (212) 687-7714 ffox@kaplanfox.com dstraite@kaplanfox.com UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION IN RE YAHOO MAIL LITIGATION Consolidated Case No.: 5:13-cv-04980-LHK PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS Date: August 7, 2014 Time: 1:30 p.m. Place: Courtroom 8 Judge: The Honorable Lucy H. Koh Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page1 of 32 i PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 TABLE OF CONTENTS I. INTRODUCTION .......................................................................................................................... 1 II. ISSUES TO BE DECIDED ............................................................................................................ 2 III. FACTUAL BACKGROUND ......................................................................................................... 2 IV. ARGUMENT .................................................................................................................................. 2 A. Plaintiffs State a Wiretap Act Claim ................................................................................... 3 1. The Wiretap Act Applies to Yahoo’s Interception of Its Users’ Email .................. 3 2. Yahoo Does Not Obtain Consent for Its Practices ................................................ 10 3. Yahoo Is Not Protected By the Ordinary Course of Business Defense ................ 12 B. Plaintiffs State a Claim for Violation of the Stored Communications Act ....................... 14 C. The “Good Faith” Defense Does Not Excuse Yahoo’s Conduct As a Matter of Law ..... 15 D. Plaintiffs State a California Invasion of Privacy Act Claim ............................................. 16 1. Section 631 Applies to Yahoo’s Conduct ............................................................. 16 2. Enforcing the CIPA Does Not Lead to Absurd Results ........................................ 18 3. Plaintiffs’ CIPA Claim Is Not Preempted ............................................................. 19 E. Plaintiffs State a Claim for Violation of Their Constitutional Right to Privacy ............... 23 V. CONCLUSION ............................................................................................................................. 25 Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page2 of 32 ii PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 TABLE OF AUTHORITIES Federal Cases Arias v. Mutual Central Alarm Service, Inc. 202 F.3d 553 (2d Cir. 2000)......................................................................................................... 14 Ashcroft v. Iqbal 556 U.S. 662 (2009) ................................................................................................................... 2, 3 Bell Atlantic Corp. v. Twombly 550 U.S. 544 (2007) ....................................................................................................................... 2 Belluomini v. Citigroup, Inc. No. CV 13-01743 CRB, 2013 WL 3855589 (N.D. Cal. July 24, 2013) ...................................... 25 Berry v. Funk 146 F.3d 1003 (D.C. Cir. 1998) ................................................................................................... 14 Bunnell v. Motion Picture Association of America 567 F. Supp. 2d 1148 (C.D. Cal. 2007) ....................................................................................... 21 Faulkner v. ADT Sec. Services, Inc. 706 F.3d 1017 (9th Cir. 2013) ....................................................................................................... 3 Florida Lime & Avocado Growers, Inc. v. Paul 373 U.S. 132 (1963) ..................................................................................................................... 20 Fraser v. Nationwide Mutual Ins. Co. 352 F.3d 107 (3d Cir. 2003)........................................................................................................... 9 Gilday v. Dubois 124 F.3d 277 (1st Cir. 1997) ........................................................................................................ 10 Griggs-Ryan v. Smith 904 F.2d 112 (1st Cir. 1990) ........................................................................................................ 10 Hall v. EarthLink Network, Inc. 396 F.3d 500 (2d Cir. 2005)......................................................................................................... 13 Heggy v. Heggy 944 F.2d 1537 (10th Cir. 1991) ................................................................................................... 15 In re Google Inc. Gmail Litig. Case No. 13-MD-02430-LHK, 2013 WL 5423918 (N.D. Cal. Sept. 26, 2013) ................... passim In re Google Inc. Privacy Policy Litigation Case No. C-12-01382-PSG, 2013 WL 6248499 (N.D. Cal. Dec. 3, 2013) ................................. 13 In re Google Inc. Street View Electronic Communications Litig. 794 F. Supp. 2d 1067 (N.D. Cal. 2011) ................................................................................. 21, 22 In re iPhone Application Litig. 844 F. Supp. 2d 1040 (N.D. Cal. 2012) ................................................................................. 23, 25 Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page3 of 32 iii PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 In re NSA Telecommunications Records Litig. 483 F. Supp. 2d 934 (N.D. Cal. 2007) ......................................................................................... 21 In re Pharmatrak, Inc. 329 F.3d 9 (1st Cir. 2003) ............................................................................................................ 10 Jacobson v. Rose 592 F.2d 515 (9th Cir. 1978) ....................................................................................................... 16 Joffe v. Google, Inc. 729 F.3d 1262 (9th Cir. 2013) ..................................................................................................... 21 Jones v. Bock 549 U.S. 199 (2007) ..................................................................................................................... 15 Kirch v. Embarq Management Co. 702 F.3d 1245 (10th Cir. 2012) ................................................................................................... 13 Klayman v. Obama 957 F. Supp. 2d 1, 29-42 (D.D.C. 2013) ...................................................................................... 25 Konop v. Hawaiian Airlines, Inc. 302 F.3d 868 (9th Cir. 2002) ........................................................................................... 3, 4, 5, 24 Lane v. CBS Broadcasting, Inc. 612 F. Supp. 2d 623 (E.D. Pa. 2009) ........................................................................................... 22 Leong v. Carrier IQ Inc. No. CV 12-01562 GAF (MRWx), 2012 WL 1463313 (C.D. Cal. Apr. 27, 2012) ................ 21, 22 Murray v. Financial Visions, Inc. No. CV-07-2578-PHX-FJM, 2008 WL 4850328 (D. Ariz. Nov. 7, 2008) ............................ 10, 12 Quon v. Arch Wireless Operating Co., Inc. 445 F. Supp. 2d 1116 (C.D. Cal. 2006) ....................................................................................... 21 Rivera v. Peri & Sons Farms, Inc. 735 F.3d 892 (9th Cir. 2013) ....................................................................................................... 15 Sams v. Yahoo! Inc. 713 F.3d 1175 (9th Cir. 2013) ............................................................................................... 15, 16 Shively v. Carrier IQ, Inc. MDL Case No. C-12-md-2330 EMC, 2012 WL 3026553 (N.D. Cal. July 24, 2012) ..... 21, 22, 23 Steven Jackson Games, Inc. v. U.S. Secret Service 36 F.3d 457 (5th Cir. 1994) ................................................................................................... 4, 5, 9 Theofel v. Farey-Jones 359 F.3d 1066 (9th Cir. 2003) ....................................................................................................... 4 U.S. v. Councilman 418 F.3d 67 (1st Cir. 2005) .............................................................................................. 5, 6, 7, 16 U.S. v. Forrester 512 F.3d 500 (9th Cir. 2007) ....................................................................................................... 25 Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page4 of 32 iv PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 U.S. v. Maynard 615 F.3d 544 (D.C. Cir. 2010) ..................................................................................................... 25 U.S. v. Steiger 318 F.3d 1039 (11th Cir. 2003) ..................................................................................................... 9 U.S. v. Szymuszkiewicz 622 F.3d 701 (7th Cir. 2010) ......................................................................................................... 8 U.S. v. Warshak 631 F.3d 266 (6th Cir. 2010) ....................................................................................................... 25 Valentine v. NebuAd, Inc. 804 F. Supp. 2d 1022 (N.D. Cal. 2011) ................................................................................. 21, 22 Watkins v. L.M. Berry & Co. 704 F.2d 577 (11th Cir. 1983) ............................................................................................... 10, 14 Wayne v. DHL Worldwide Express 294 F.3d 1179 (9th Cir. 2002) ..................................................................................................... 22 State Cases Hill v. Nat’l Collegiate Athletic Assn. 7 Cal. 4th 1 (1994) ...................................................................................................................... 23 Kearney v. Salomon Smith Barney, Inc. 39 Cal.4th 95 (2006) .................................................................................................................... 20 People v. Conklin 12 Cal.3d 259 (1974) ....................................................................................................... 17, 19, 20 People v. Wilson 17 Cal. App. 3d 598 (1971) ................................................................................................... 17, 18 Ribas v. Clark 38 Cal.3d 355 (1985) ................................................................................................. 17, 18, 19, 23 Ung v. Facebook, Inc. Santa Clara County Superior Court Case No. 1-12-cv-217244, Dkt. No. 54 (July 2, 2012) ................................................................................................................................................. 24, 25 Federal Statutes 18 U.S.C. § 2511(2)(a)(i) .......................................................................................................................... 13 18 U.S.C. § 2516 ....................................................................................................................................... 19 18 U.S.C. § 2702(a)(1) .............................................................................................................................. 14 18 U.S.C. § 2707(e) .................................................................................................................................. 15 Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page5 of 32 v PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 State Statutes Cal. Penal Code § 630 ......................................................................................................................... 17, 24 Cal. Penal Code § 631 ......................................................................................................................... 16, 18 Cal. Penal Code § 637 ............................................................................................................................... 18 Other Authorities Cal. Const., Art. I Section 1 ...................................................................................................................... 23 H. Marshall Jarret, et al., Prosecuting Computer Crimes (Department of Justice Office of Legal Education 2d ed. 2010) ................................................................................................................... 9 Nathan Judish et al., Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations (Department of Justice Office of Legal Education, 3d ed. 2009) ............................ 9 S. Rep. No. 90-1097 (1968) ...................................................................................................................... 19 S. Rep. No. 99-541 (1986) .................................................................................................................. 14, 23 U.S. v. Councilman, Brief on Rehearing En Banc for Senator Patrick J. Leahy as Amicus Curiae Supporting the United States and Urging Reversal, 2004 WL 2707307 (Nov. 12, 2004) .............. 6 Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page6 of 32 1 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 I. INTRODUCTION Plaintiffs are individuals whose emails have been intercepted and scanned for content by Yahoo even though they do not use Yahoo Mail and have not consented to Yahoo’s practices. Simply because they have emailed with users of Yahoo Mail, plaintiffs’ personal communications are now being held in indefinite storage by Yahoo. Currently, Yahoo says that it collects the emails to provide personalized content and targeted advertising to Yahoo Mail users, but plaintiffs allege that Yahoo is also using the emails to create user profiles of both Yahoo Mail users and anyone who emails with them. Yahoo also says that it shares some of the information it collects with third parties and is storing the email content “for future use.” Plaintiffs allege that Yahoo’s conduct violates the federal Wiretap Act or, in the alternative, the Stored Communications Act, as well as the California Invasion of Privacy Act and plaintiffs’ constitutional right to privacy. Yahoo has moved to dismiss plaintiffs’ claims. Yahoo asks the Court to resolve the factual issue of when it scans email as a matter of law, contending, based on a footnote in a Ninth Circuit case, that plaintiffs’ Wiretap Act and California Invasion of Privacy Act (CIPA) claims must be dismissed because once an email “hits” a Yahoo server it is no longer an electronic communication capable of being intercepted for the purposes of either Act. Not only are the Ninth Circuit cases Yahoo cites factually distinguishable because they involve electronic communications that have already arrived at their destination, subsequent Circuit courts have carefully examined the legislative history of the statute and concluded that Congress intended the Wiretap Act to apply to electronic communications throughout their transmission from sender to recipient. There is no reason to assume that the California Supreme Court would interpret the CIPA any differently, particularly since the Legislature intended it to provide more stringent privacy protections than the federal Wiretap Act. Yahoo also argues that the Court should disregard CIPA’s requirement that all parties must consent to an interception for it to be lawful, presenting some purportedly “absurd results” that do not withstand scrutiny. Yahoo’s argument that CIPA is preempted by the Wiretap Act is equally unsound, as Congress expressly recognized that states may enact their own parallel statutes so long as they are equally or more restrictive. Because Yahoo’s arguments for dismissing these claims and plaintiffs’ constitutional privacy claim lack merit, Yahoo’s motion should be denied in its entirety. Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page7 of 32 2 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 II. ISSUES TO BE DECIDED 1. Whether plaintiffs state a claim for violation of the Wiretap Act. 2. Whether plaintiffs state a claim for violation of the Stored Communications Act. 3. Whether plaintiffs state a claim for violation of the California Invasion of Privacy Act. 4. Whether plaintiffs state a claim for violation of their constitutional right to privacy. III. FACTUAL BACKGROUND Plaintiffs are four individuals who use email provided by companies other than Yahoo to correspond with users of Yahoo Mail. ¶¶ 15-18.1 Yahoo intercepts plaintiffs’ email with Yahoo Mail users, both incoming and outgoing, while it is in transit and scans the content. ¶¶ 24-25. Yahoo analyzes the content for keywords, patterns and “key elements of meaning,” collects and categorizes the information it extracts, and stores the information for “future use.” ¶¶ 26, 46-48. Yahoo uses the email content to provide targeted advertising and product features to Yahoo Mail users, to create user profiles of the parties to the email, and for other undisclosed purposes. ¶¶ 27, 29, 37, 41, 49. Yahoo also provides some of the information it obtains from the emails (though it is not clear what information) to unidentified “trusted partners” and other third parties. ¶¶ 37, 49. Yahoo contends that Yahoo Mail users agree to Yahoo’s Communications Terms of Service and Privacy Policy when they create a Yahoo Mail account. ¶ 32. Yahoo claims that its Yahoo Mail users consent to its practices based on a single paragraph in the Communications Terms of Service, but that paragraph does not disclose all of Yahoo’s practices. ¶ 41. Some additional information about Yahoo’s practices appears in other documents scattered on Yahoo’s website. ¶¶ 37, 46-50. Yahoo does not obtain consent from non-users of Yahoo Mail to scan, store, and share the content of their email, though it attempts to put the onus on its own users to obtain non-users’ consent. ¶ 51. IV. ARGUMENT A motion to dismiss should be denied if the complaint “state[s] a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct 1 “¶ ” refers to paragraphs in plaintiffs’ Consolidated Class Action Complaint. Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page8 of 32 3 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 alleged.” Id. The court must accept “[a]ll well-plead allegations of material fact in the complaint” as true and construe them “in the light most favorable to the non-moving party.” Faulkner v. ADT Sec. Services, Inc., 706 F.3d 1017, 1019 (9th Cir. 2013). The court’s analysis is “a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679. A. Plaintiffs State a Wiretap Act Claim Congress enacted the Electronic Communications Privacy Act “to afford privacy protection to electronic communications.” Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 874 (9th Cir. 2002). Title I of the ECPA is the Wiretap Act, which governs the unlawful interception of communications while they are in transit. 18 U.S.C. §§ 2510-2522. Title II is the Stored Communications Act, which governs the unlawful access of communications that have already been transmitted and are in storage. 18 U.S.C. §§ 2701-2711. Plaintiffs allege that Yahoo intercepts their emails while they are in transit, a violation of the Wiretap Act. ¶¶ 1, 3, 24, 25, 51, 56, 71, 80. Plaintiffs have asserted a violated of the Stored Communications Act in the alternative, in the event the Court concludes that Yahoo accesses plaintiffs’ emails after they have been delivered to the recipients. 1. The Wiretap Act Applies to Yahoo’s Interception of Its Users’ Email Yahoo contends that plaintiffs’ Wiretap Act must be dismissed as a matter of law because emails cease to be “electronic communications” and are in storage rather than in transit the moment they arrive at Yahoo’s servers for delivery. Not only does this argument contradict plaintiffs’ allegation that Yahoo intercepts its users’ incoming and outgoing emails while they are in transit, but it is not supported by the Ninth Circuit cases Yahoo cites. Moreover, accepting Yahoo’s argument would require the Court to find that emails shift in and out of the Wiretap Act’s protection during their journey from sender to recipient, a result that is contrary to both the plain language of the statute and its legislative history. Yahoo does not disclose when or how it scans its users’ incoming and outgoing email, an issue that will be the subject of discovery and expert opinion in this case, as it has been in the Google Gmail case pending before this Court. Like Google, Yahoo treats the technology it uses to scan users’ email as a closely guarded secret, one plaintiffs are not yet privy to. For purposes of this motion, however, the Court must accept as true plaintiffs’ allegation that Yahoo scans emails while they are in transit between plaintiffs and Yahoo Mail users. See Faulkner, 706 F.3d at 1019. And Yahoo’s statement in its Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page9 of 32 4 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Communications Terms of Service that it scans both “incoming and outgoing” email as well as email “stored in your account” is fully consistent with plaintiffs’ allegation that Yahoo intercepts email while it is in transit. ¶ 41. In both of the Ninth Circuit cases Yahoo cites, the defendants gained unauthorized access to the plaintiffs’ communications when they were in electronic storage, having reached their destinations. In Theofel v. Farey-Jones, the defendants served a subpoena on NetGate, the internet service provider for the plaintiff’s company, seeking all emails sent and received by anyone at the company. 359 F.3d 1066, 1071 (9th Cir. 2003). NetGate provided the defendants with emails that had already been delivered to the company and were stored on NetGate’s servers. Id. at 1075 & n.3, 1077. The Ninth Circuit held that the defendants did not violate the Wiretap Act because the emails were in electronic storage when NetGate accessed them, not in transit. Id. at 1077. In Konop, a Hawaiian Airlines pilot created a website critical of the airline and its labor policies. He allowed only people on a list of other pilots and employees to access the website and required them to log in with a user name and password. The company’s vice president logged in using the names of pilots who had been granted access and read postings on the website. 302 F.3d at 872-73. The Ninth Circuit held that there was no “interception” of an electronic communication because the vice president accessed documents that were in storage on a server and not in transit. Id. at 878-79. The court explained that “website owners such as Konop transmit electronic documents to servers, where the documents are stored,” and that users who view the website “request[] that the server transmit a copy of the document to the user’s computer.” Id. at 876. Thus, in both Theofel and Konop, the unlawfully accessed communications had already reached their destination and were no longer in transit. In reaching its decision in Konop, the Ninth Circuit endorsed the view of a Fifth Circuit case holding that a Wiretap Act violation occurs only when the acquisition of the communication is “contemporaneous with transmission.” 302 F.3d at 876-78 (citing Steven Jackson Games, Inc. v. U.S. Secret Service, 36 F.3d 457, 460 (5th Cir. 1994)). The Fifth Circuit’s holding in Steven Jackson turned on differences between the definitions of “wire communications” and “electronic communications.” At the time of the court’s decision, the definition of “wire communications” expressly included electronic storage while the definition of “electronic communications” did not. 36 F.3d at 461-62. Thus, the Fifth Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page10 of 32 5 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Circuit held, “Congress did not intend for ‘intercept’ to apply to ‘electronic communications’ when those communications are in ‘electronic storage.’” Id. at 462. The Ninth Circuit agreed and saw Congress’s subsequent deletion of “electronic storage” from the definition of “wire communications” as evincing its intent to “reinstate[] the pre-ECPA definition of ‘intercept’—acquisition contemporaneous with transmission—with respect to wire communications.” Konop, 302 F.3d at 878. In a footnote, the Ninth Circuit addressed an argument made by the dissent, amici, and law review articles that “the term ‘intercept’ must apply to the acquisition of electronic communications in storage because storage is a necessary incident to the transmission of electronic communications” and if “the term ‘intercept’ does not apply to the en route storage of electronic communications, the Wiretap Act’s prohibition against ‘intercepting’ electronic communications would have virtually no effect.” Id. at 878 n.6. While acknowledging that “this argument is not without appeal,” the court said that “Congress understood that electronic storage was an inherent part of electronic communication” because it defined “electronic storage” as “any temporary, intermediate storage of a wire or electronic communication, incidental to the electronic transmission thereof.” Id. Three years later, the First Circuit, sitting en banc, reached the opposite conclusion, holding that “the term ‘electronic communication’ includes transient electronic storage that is intrinsic to the communication process, and hence that interception of an e-mail message in such storage is an offense under the Wiretap Act.” U.S. v. Councilman, 418 F.3d 67, 85 (1st Cir. 2005). The facts of Councilman are far more similar to this case than the Konop and Theofel cases, where the defendants unlawfully accessed communications that had already been delivered and were in electronic storage. Councilman was the vice president of Interloc, Inc., an online rare book listing service. Id. at 70. Book dealers who used Interloc’s service were given an email address at “Interloc.com” and Interloc acted as the email provider. Id. One of Interloc’s competitors was Amazon. Councilman had his employees modify the email server’s mail delivery agent to copy all incoming emails to Interloc’s dealers from Amazon and divert the copies to a separate mailbox before the emails were delivered to the dealers. Id. The First Circuit began its analysis of the applicability of the Wiretap Act to Councilman’s conduct with the text of the statute. It observed that “the statutory definition of ‘electronic communication’ is broad and, taken alone, would appear to cover incoming e-mail messages while the Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page11 of 32 6 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 messages are being processed” by Interloc’s mail transfer agent. Id. at 72-73. It rejected Councilman’s argument—based on the Ninth Circuit’s reasoning in Konop—that the inclusion of “electronic storage” in the definition of “wire communications” but not “electronic communications” meant that Congress did not intend electronic communications to include electronic storage, characterizing it as an unhelpful application of the expressio unius canon of construction. Id. at 73-76. Concluding that the plain text of the statute was ambiguous, the court turned to the legislative history. Id. at 76. Unlike the Ninth Circuit, the First Circuit had the benefit of an amicus curiae brief from Senator Patrick Leahy, the original sponsor of the Senate version of the ECPA. See U.S. v. Councilman, Brief on Rehearing En Banc for Senator Patrick J. Leahy as Amicus Curiae Supporting the United States and Urging Reversal, 2004 WL 2707307 (Nov. 12, 2004) (attached as Exhibit A to plaintiffs’ RJN). Senator Leahy explained that Congress intended for [the Wiretap Act] to protect electronic communications, like telephone calls, during the entirety of the transmission phase. ECPA’s legislative history fully rebuts defendant’s contention that electronic communications move in and out of [the Wiretap Act’s] umbrella depending on whether, at a precise moment in time, they are between or within the computers transmitting them to the user’s mailbox. Id. at 4. Citing the bills, committee reports, and hearing testimony, Senator Leahy said that “absolutely nothing in the legislative record supports the view that electronic communications in transmission, prior to the delivery to the user’s mailbox, pass in and out of [the Wiretap Act’s] protection,” id. at 8, and that “among the many discussions of transmission and storage during the ECPA hearings, there is no reference to the possibility that intermittent storage during the transmission phase makes a message any less in transmission, and thus [Wiretap Act]-protected, than it otherwise would be.” Id. at 9. Senator Leahy also addressed the interplay between the Wiretap Act and the Stored Communications Act, noting that the SCA’s “protection for stored communications was designed to address concerns about the security of providers’ systems, not to disrupt or supplant the transmission phase protection achieved by extending [the Wiretap Act] to electronic communications.” Id. at 10. He also rejected Councilman’s argument—based on the Ninth Circuit’s reasoning in Konop—that the definition of “electronic storage” revealed Congress’s intent that electronic communications would cease to be protected by the Wiretap Act when they were in transient storage during transmission, saying Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page12 of 32 7 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 that Councilman “fundamentally misunderstands the significance of the ‘incidental to transmission’ language.” Id. at 9. “That language,” Leahy said, “was added to the electronic storage definition to eliminate overlap between ECPA and existing and proposed computer crime statutes, a subject of concern throughout the hearings.” Id. “In other words, the inclusion of storage ‘incidental to transmission’ in the electronic storage definition was not designed to provide shifting [Wiretap Act] and SCA protection for communications during transmission; it was simply designed to distinguish the SCA from ordinary computer crime statutes covering unauthorized system access unrelated to the communications process.” Id. at 9-10. Drawing on the legislative sources cited in Senator Leahy’s amicus brief, the First Circuit concluded that “the purpose of the broad definition of electronic storage was to enlarge privacy protections for stored data under the Wiretap Act, not to exclude e-mail messages stored during transmission from those strong protections.” Councilman, 418 F.3d at 76. It therefore held that “an e- mail message does not cease to be an ‘electronic communication’ during the momentary intervals, intrinsic to the communication process, at which the message resides in transient electronic storage.” Id. at 79. The court did not view the former distinction between the definition of “wire communication” and “electronic communication” to be persuasive because “the legislative history indicates that Congress included the electronic storage clause in the definition of ‘wire communication’ provision for the sole reason that, without it, access to voice mail would have been regulated solely by the Stored Communications Act”—which “is exactly what happened when Congress later removed the explicit reference to ‘electronic storage’ from the definition of ‘wire communication.’” Id. at 78-79. And finally, while the First Circuit did not have to decide whether the term “intercept” applies only to acquisitions that are “contemporaneous with transmission” as required by the Ninth Circuit, it noted that any interception would be contemporaneous unless the transmission was complete at the time of acquisition. Id. at 80. In other words, it would be impossible to show that the interception was not contemporaneous with the transmission “since we have concluded that the messages were electronic communications, and it is undisputed that they were acquired while they were still en route to the intended recipients.” Id. In 2010, the Seventh Circuit adopted the First Circuit’s reasoning in Councilman in holding that an IRS employee who set up a forwarding rule on his employer’s Microsoft Outlook email account Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page13 of 32 8 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 violated the Wiretap Act. U.S. v. Szymuszkiewicz, 622 F.3d 701, 703, 705 (7th Cir. 2010). The employee (Szymuszkiewicz) argued that his conduct violated the SCA, not the Wiretap Act, because “he says, he did not ‘intercept’ anything, for (at least in football) ‘interception’ means catching a thing in flight, and any message would have reached its destination ([his employer’s] inbox) before a copy was made for him.” Id.at 703. But the evidence showed that the copying occurred when the messages arrived at the IRS’s Kansas City server, which sent a copy to both Szymuszkiewicz and his employer “within the same second.” Id. at 704. The Seventh Circuit noted that “it does not matter which computer did the copying” because “[t]he Wiretap Act’s definition of ‘interception’ comprises packet-switch technology”—the routing of electronic messages in packets over a network—“as well as circuit-switch technology”—the telephone company’s routing of communications over a circuit established between one telephone and another. Id. at 704-05. “The difference between circuit-switch and packet-switch transmission methods thus is irrelevant under § 2510,” and the Wiretap Act governs interceptions that occur at any point during the transmission of email from sender to recipient. Id. at 705. The Seventh Circuit acknowledged that some Circuits require that the interception be “contemporaneous with transmission,” but said that requirement is actually consistent with its holding: Either the server in Kansas City or [the employer’s] computer made copies of the messages for Szymuszkiewicz within a second of each message’s arrival and assembly; if both Szymuszkiewicz and [his employer] were sitting at their computers at the same time, they would have received each message with no more than an eyeblink in between. That’s contemporaneous by any standard. Id. at 706. Thus, even if it was the employer’s computer that did the copying, “it was effectively acting as just another router, sending packets along to their destination, and Councilman’s conclusion that the Wiretap Act applies to messages that reside briefly in the memory of packet-switch routers shows that the Act has been violated.” Id. Yahoo fails to mention Szymuszkiewicz and argues that with Councilman the First Circuit “has split with other Circuits” in holding that the Wiretap Act applies to the interception of emails at any point in their path from sender to recipient, citing for support a manual published in 2009 by the DOJ’s Office of Legal Education. See Nathan Judish et al., Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations (Department of Justice Office of Legal Education, 3d ed. Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page14 of 32 9 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 2009) at 165-67.2 The cases from other Circuits cited in the manual, however, all predate the First Circuit’s 2005 Councilman decision. See id. (citing Fraser v. Nationwide Mutual Ins. Co., 352 F.3d 107, 113-14 (3d Cir. 2003); U.S. v. Steiger, 318 F.3d 1039, 1047-50 (11th Cir. 2003); Steven Jackson, 36 F.3d at 460-63). And the publication predates Szymuszkiewicz. A more recent DOJ manual includes a discussion of Szymuszkiewicz and notes that “[e]xactly how close in time an acquisition must be to a transmission remains an open question,” though “[i]t is clear that ‘contemporaneous’ cannot mean ‘simultaneous.’” H. Marshall Jarret, et al., Prosecuting Computer Crimes (Department of Justice Office of Legal Education 2d ed. 2010) at 64.3 This newer manual says that “[i]t is difficult to imagine that Congress would differentiate its protection of communications by the nanosecond, protecting them as they travel as electrical or optical impulses along a cable but then immediately ceasing protection the moment they are recorded in any fashion.” Id. After discussing the facts of Councilman, the manual advises that “[w]hen a defendant has interfered with the way that a computer system processes incoming or outgoing messages, causing copies to be stored or forwarded to him at approximately the same time that the computer handled them, then it is safe to argue that the contemporaneity element [of the Wiretap Act] has been satisfied,” but “if a defendant appears to have simply accessed a computer system and obtained previously stored copies of a message, then the defendant might not have violated the Wiretap Act.” Id. at 65. The Court should reject Yahoo’s argument that plaintiffs’ Wiretap Act must be dismissed as a matter of law because once emails “hit” one of Yahoo’s servers they are no longer subject to the Act.4 Both Konop and Theofel are distinguishable on their facts, and the Ninth Circuit’s footnoted discussion of whether the Wiretap Act applies to emails that pause in transient storage while still in transmission from sender to recipient is arguably dicta. More importantly, Yahoo’s interpretation of the application of the Wiretap Act is contrary to Congress’s intent that the Wiretap Act apply to interceptions of electronic communications throughout their transmission from sender to recipient, as explained in Senator Leahy’s 2 Available at http://www.justice.gov/criminal/cybercrime/docs/ssmanual2009.pdf. 3 Available at http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf. 4 Yahoo’s theory that Yahoo Mail users’ incoming emails are no longer subject to the Wiretap Act once they “hit” a Yahoo server ignores plaintiffs’ allegation (and its own acknowledgment) that it scans Yahoo Mail users’ outgoing emails, which may include non-users’ emails as part of an email chain. Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page15 of 32 10 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 amicus brief and Councilman. And applying this correct construction of the statute to Yahoo’s conduct is also consistent with the Ninth Circuit’s requirement that the interception be “contemporaneous with transmission,” as the Seventh Circuit explained in Szymuszkiewicz. To decide otherwise would give Yahoo and other email service providers a roadmap to evade federal law. By designing a system that shuttles email to a server for a fraction of a second prior to delivery, Yahoo could read incoming emails with impunity. As Senator Leahy explained, this would be contrary to the intent of Congress. 2. Yahoo Does Not Obtain Consent for Its Practices Yahoo argues that its conduct does not violate the Wiretap Act because users of its email service consent to Yahoo’s interception of their email through their acceptance of the Communications Terms of Service. While it is true that only one party to the email must provide consent, that consent must be “actual” and “explicit.” In re Google Inc. Gmail Litig., Case No. 13-MD-02430-LHK, 2013 WL 5423918, at *12, 13 (N.D. Cal. Sept. 26, 2013). “Consent ‘should not be casually inferred.’” In re Pharmatrak, Inc., 329 F.3d 9, 20 (1st Cir. 2003) (quoting Griggs-Ryan v. Smith, 904 F.2d 112, 117-18 (1st Cir. 1990)). And courts “must inquire into the dimensions of the consent and then ascertain whether the interception exceeded those boundaries.” Id. at 19 (quoting Gilday v. Dubois, 124 F.3d 277, 297 (1st Cir. 1997); see also Watkins v. L.M. Berry & Co., 704 F.2d 577, 582 (11th Cir. 1983) (“[C]onsent within the meaning of section 2511(2)(d) is not necessarily an all or nothing proposition; it can be limited.”). As the Eleventh Circuit explained, “[i]t is the task of the trier of fact to determine the scope of the consent and to decide whether and to what extent the interception exceeded that consent.” Watkins, 704 F.2d at 582; see also Murray v. Financial Visions, Inc., No. CV-07-2578-PHX-FJM, 2008 WL 4850328, at *4 (D. Ariz. Nov. 7, 2008) (“The question of consent, either express or implied, is often a fact- intensive inquiry and may vary with the circumstances of the parties.”). Plaintiffs’ Wiretap Act claim should not be dismissed on the grounds that Yahoo obtains its users’ consent because a trier of fact must decide the scope of Yahoo Mail users’ consent and whether Yahoo exceeds that consent. The statement in Yahoo’s Communications Terms of Service provides only a broad and imprecise description of Yahoo’s practices. It says: Please note that your Yahoo Messenger account is tied to your Yahoo Mail account. Therefore, your use of Yahoo Messenger and all Yahoo Messenger services will be subject to the TOS and laws applicable to the Applicable Yahoo Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page16 of 32 11 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Company in Section 10. Yahoo’s automated systems scan and analyze all incoming and outgoing communications content sent and received from your account (such as Mail and Messenger content including instant messages and SMS messages) including those stored in your account to, without limitation, provide personally relevant product features and content, to match and serve targeted advertising and for spam and malware detection and abuse protection. Unless expressly stated otherwise, you will not be allowed to opt out of this feature. If you consent to this ATOS and communicate with non-Yahoo users using the Services, you are responsible for notifying those users about this feature. ¶ 41. Even setting aside the fact that the paragraph confusingly starts with a discussion of Yahoo! Messenger and contains stilted legalese and non-grammatical phrasing, this statement is inadequate to obtain the explicit consent of Yahoo Mail users. “Scan” and “analyze” are amorphous terms that do not explicitly inform Yahoo Mail users what Yahoo does with the contents of its users’ email. And while Yahoo says that it scans and analyzes email to provide personally relevant features and content, provide targeted advertising, and scan for malware, these are merely examples of what Yahoo may be doing with the content of its users’ email, as evidenced by Yahoo’s use of the term “without limitation.” The other documents that comprise the agreement between Yahoo and its users say nothing about the scanning and analysis of email and instead give users the impression that Yahoo only collects basic demographic information about its users. The Terms of Service says that Yahoo collects registration data and “certain other information about you,” and references the Yahoo Privacy Policy. ¶ 34; Ex. A at ¶ 4. The Privacy Policy says that it “covers how Yahoo treats personal information that Yahoo collects and receives, including information related to your past use of Yahoo products and services,” and that “[p]ersonal information is information about you that is personally identifiable like your name, address, email address, or phone number, and that is not otherwise publicly available.” ¶ 36. In other documents that are not part of the agreement between Yahoo and Yahoo Mail users Yahoo provides some additional information about what it does with the content of its users’ emails. In a document called “Yahoo Mail FAQ,” Yahoo says that its scanning technology “looks for patterns, keywords, and files” in email “in order to personalize your experience.” ¶ 48. The same document says that “Yahoo may anonymously share specific objects from a message with a 3rd party,” and “[f]or example, Yahoo may share a package tracking number with the shipping company so that you can easily see when your package will arrive, or may share your flight number with your airlines to enable flight Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page17 of 32 12 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 notifications within your inbox.” ¶¶ 48-49. In one of its 54 “privacy practices” documents, Yahoo says, “For instance, we scan and analyze email messages to identify key elements of meaning and then categorize this information for immediate and future use.” ¶ 46. The additional information in these documents about Yahoo’s practices illustrates how incomplete the paragraph in Yahoo’s Communications Terms of Service is, and that Yahoo does not obtain actual and explicit consent from either party to the emails it intercepts. Yet it is clear that even these statements are still not a fulsome disclosure of Yahoo’s practices because of Yahoo’s use of “for example” and “for instance”—not to mention the ominous and unexplained reference to Yahoo’s storage of the information for “future use.” Yahoo Mail users would have to dig to find these documents and the additional information they provide about Yahoo’s practices. They are not linked from the “Create Account” page and are only accessible by searching for them or clicking on multiple nonobvious links. ¶¶ 44, 47, 50. Yahoo may claim that Yahoo Mail users have impliedly consented to the practices it discloses in these other documents, but that is an issue that should be reserved for a factfinder and not resolved in the context of this motion. See, e.g., Murray, 2008 WL 4850328, at *4. There are also practices of which Yahoo provides no notice. At some point during the class period, Yahoo revised the Communications Terms of Service to include this statement: “By scanning and analyzing such communications content, Yahoo collects and stores the data.” ¶¶ 41-42. Thus, for some portion of the class period, Yahoo did not obtain Yahoo Mail users’ consent to collect and store the content of their emails. And even once Yahoo added the statement, it failed to explain what data it collects and stores, how long it stores the data, and what it does with the data (or plans to do with it in the future). Yahoo also does not obtain its users’ consent to intercept and scan email for the purpose of creating user profiles of both Yahoo Mail users and non-users of Yahoo Mail, as plaintiffs allege. ¶¶ 27, 29. Nowhere in its agreement with Yahoo Mail users, or even in other documents scattered across Yahoo’s website, does Yahoo inform users that it uses the content of their email to create user profiles. The consent defense therefore provides no basis for dismissing plaintiffs Wiretap Act claim. 3. Yahoo Is Not Protected By the Ordinary Course of Business Defense Yahoo also contends that the “ordinary course of business” exception protects it from liability under the Wiretap Act. In the Gmail case, this Court explained that “[t]he presence of the modifier Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page18 of 32 13 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 ‘ordinary’ must mean that not everything Google does in the course of its business would fall within the exception.” Gmail, 2013 WL 5423918, at *8. After analyzing the text of the statute, case law, the statutory scheme, and legislative history, the Court held that the exception “is narrow and designed only to protect electronic communication service providers against a finding of liability under the Wiretap Act where the interception facilitated or was incidental to provision of the electronic communication service at issue.” Id. at *11. The Court concluded that the plaintiffs had plausibly alleged that Google’s interception of emails for the purpose of creating user profiles and delivering targeted advertising was “not instrumental to Google’s ability to transmit emails.” Id. The same is true in this case, but Yahoo argues that the Court’s holding in Gmail was wrong and that the Court should change its mind. Yahoo relies primarily on cases the Court considered and distinguished in the Gmail case, Hall v. EarthLink Network, Inc., 396 F.3d 500 (2d Cir. 2005), and Kirch v. Embarq Management Co., 702 F.3d 1245 (10th Cir. 2012). Yahoo also cites In re Google Inc. Privacy Policy Litigation, in which Magistrate Judge Grewal disagreed with this Court’s interpretation of Hall and Kirch and held that the exception should be interpreted broadly to include any “customary and routine business practices” the provider engages in. Case No. C-12-01382-PSG, 2013 WL 6248499, at *10-11 (N.D. Cal. Dec. 3, 2013). But Magistrate Grewal’s discussion of Hall, id. at *11, fails to take into account the fact that Earthlink “did not have the ability to bounce e-mail back to senders after the termination of an account,” which this Court found persuasive in concluding that Earthlink’s “alleged interceptions were a necessary part of its ability to provide email services.” Gmail, 2013 WL 5423918, at *9. And Magistrate Grewal’s analysis of Kirch focuses on a discussion in the district court’s opinion that the Tenth Circuit did not adopt when it concluded that the defendant ISP had intercepted only data incidental to its provision of internet service. Google Privacy, 2013 WL 6248499, at *11. Yahoo also argues that the communication provider exception in 18 U.S.C. § 2511(2)(a)(i) requires this Court to change its view, since that provision includes a restriction on wire communications providers’ monitoring of communications that is not imposed on electronic communications providers. But the Court considered the import of this provision in the Gmail case and found that it supported a narrow interpretation of the ordinary course of business exception. Gmail, 2013 WL 5423918, at *9-10. The 1986 Senate report explained that there was a purely technical reason for prohibiting only wire Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page19 of 32 14 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 communication service providers from using “service observing or random monitoring”—providers of electronic communication services “may have to monitor a stream of transmissions in order to properly route, terminate, and otherwise manage the individual messages they contain.” S. Rep. 99-541 at 20 (1986) , reprinted in 1986 U.S.C.C.A.N. 3555 (and attached as Exhibit B to Yahoo’s RJN). The explanation also notes that those functions “do not involve humans listening in on voice communications,” id., which Yahoo argues supports its argument because its scanning and analysis of email does not involve humans listening to voice communications. But the distinction is clearly not intended to give electronic service providers free reign over their users’ emails, merely to allow them to properly “route, terminate, and otherwise manage” emails. Finally, Yahoo argues that the rule of lenity requires the Court to interpret the ordinary course of business exception in its favor because ambiguities in criminal statutes should be resolved in favor of the defendant. But the fact that Magistrate Grewal reached a different conclusion than this Court (one that plaintiffs contend was erroneous) does not mean that the exception is ambiguous. Courts have been interpreting and applying this exception for decades, holding that it “cannot be expanded to mean anything that interests a company,” Watkins, 704 F.2d at 582, that it includes only a “legitimate business purpose,” Arias v. Mutual Central Alarm Service, Inc., 202 F.3d 553, 558-59 (2d Cir. 2000), and that the actions taken must be “justified by a valid business purpose,” Berry v. Funk, 146 F.3d 1003, 1009 (D.C. Cir. 1998) (citation omitted). The body of law involving employers eavesdropping on employees’ phone calls cited by the Court in Gmail also confirms that courts have applied the exception in alignment with this Court’s interpretation. See Gmail, 2013 WL 5423918, at *10 (citing cases). Yahoo argues that the Court’s narrow interpretation creates uncertainty about what conduct is covered, but the Court already addressed and dismissed that “slippery slope” argument when Google made it. See id. at *11 n.4. B. Plaintiffs State a Claim for Violation of the Stored Communications Act Plaintiffs assert an SCA claim in the alternative. While the SCA immunizes electronic service providers like Yahoo from liability for accessing emails that are in its users’ mailboxes or in the service providers’ “backup protection,” they are still prohibited from disclosing the contents of their customers’ emails to any person or entity. 18 U.S.C. § 2702(a)(1). Plaintiffs allege that Yahoo provides some of the information it collects through its scanning and analysis of email content to unidentified “trusted Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page20 of 32 15 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 partners” and other third parties. ¶¶ 26, 37, 49, 71. These allegations are not conclusory, as plaintiffs do not merely assert the bald allegations required to allege the claim. They do not contain extensive detail because Yahoo does not reveal who it discloses the content to and for what purposes and discovery is at an early stage. Nor are the allegations unsupported, as Yahoo contends. Rather, they are based on Yahoo’s own statements about its practices in its Privacy Policy and Yahoo Mail FAQ. ¶¶ 37, 49; Exs. B & G. Plaintiffs have stated a claim for violation of the SCA and Yahoo’s motion to dismiss the claim should be denied. C. The “Good Faith” Defense Does Not Excuse Yahoo’s Conduct As a Matter of Law Yahoo contends that plaintiffs’ Wiretap Act and SCA claims must be dismissed because it acted in the “good faith” belief that its conduct was permitted by the express terms of ECPA and by Konop and Theofel. As an initial matter, “there is no ‘good faith’ defense based on a misunderstanding of the law,” which is what Yahoo argues. Heggy v. Heggy, 944 F.2d 1537, 1542 (10th Cir. 1991). In addition, an affirmative defense may only serve as a basis for dismissal when “the ‘allegations in the complaint suffice to establish’ the defense.” Sams v. Yahoo! Inc., 713 F.3d 1175, 1179 (9th Cir. 2013) (quoting Jones v. Bock, 549 U.S. 199, 215 (2007)). Yahoo argues that Sams holds that a plaintiff must plead facts showing lack of good faith, but that is a misreading of the case and contravenes established case law that plaintiffs are not required to plead facts to avoid potential affirmative defenses. See, e.g., Rivera v. Peri & Sons Farms, Inc., 735 F.3d 892, 902 (9th Cir. 2013). In Sams, the plaintiff alleged that Yahoo violated the SCA when it disclosed her subscriber information to the government pursuant to allegedly invalid grand jury subpoenas. 713 F.2d at 1177. The statute “provides that ‘good faith reliance … on a grand jury subpoena’ is ‘a complete defense.’” Id. at 1180 (quoting 18 U.S.C. § 2707(e)). The plaintiff alleged that Yahoo acted pursuant to grand jury subpoenas so the allegations in the complaint established the defense. The only way for the plaintiff to avoid application of the defense was to allege facts that led to a plausible inference that Yahoo knew the subpoena was invalid, but she failed to do so. Id. at 1181. The Ninth Circuit also held that Yahoo’s conduct was “objectively reasonable as a matter of law” because the subpoenas “bore all of the indicia of lawful authority.” Id. Plaintiffs’ complaint does not establish that Yahoo is entitled to a good faith defense, and plaintiffs are therefore not required to allege that Yahoo did not act in good faith. Under Sams, the Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page21 of 32 16 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 question of whether Yahoo “satisfies the requirements to establish ‘good faith reliance’ is a mixed question of law and fact.” Id. There are factual issues about what Yahoo knew and what it did (and does) that must be developed through discovery and preclude dismissal on this ground as a matter of law. Id. Moreover, Yahoo will have to prove that it had a subjective good faith belief that it was acting legally. See, e.g., Jacobson v. Rose, 592 F.2d 515, 523 (9th Cir. 1978). Yahoo’s conduct is also not objectively reasonable as a matter of law. As discussed in section A.1. above, Konop and Theofel are factually distinguishable and do not support Yahoo’s argument that its users’ emails cease to be governed by the Wiretap Act once the emails “hit” a Yahoo server. It was also unreasonable for Yahoo to rely on the footnoted discussion in Konop after the First Circuit issued Councilman, which was decided with the benefit of Senator Leahy’s explanation of the legislative history, and the Seventh Circuit issued Szymuszkiewicz. The First Circuit’s rejection of Councilman’s argument that principles of “fair warning” required dismissal of his indictment is also instructive. While noting that Councilman was free to argue the good faith defense in subsequent proceedings (since he had not raised it on appeal), the First Circuit found that the statute was not so confusing that “fair warning” principles applied, since it was able to construe the statute using traditional tools of construction, “a person of average intelligence would, at the very least, be on notice that” Councilman’s conduct violated the statute, and its holding did not unforeseeably expand the scope of the statute because “[t]he simplest reading of the statute is that the e-mail messages were ‘electronic communications’ under the statute at the point where they were intercepted.” Councilman, 418 F.3d at 82-85. D. Plaintiffs State a California Invasion of Privacy Act Claim 1. Section 631 Applies to Yahoo’s Conduct Section 631 of the California Invasion of Privacy Act makes it illegal to “willfully and without the consent of all parties to the communication, or in any unauthorized manner, read[], or attempt[] to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state.” Cal. Penal Code § 631. Yahoo contends that it has not violated section 631 because “emails that a provider receives and stores en route to a user are in electronic storage and not ‘in transit’ under wiretapping laws,” citing Konop. As discussed in section A.1 above, plaintiffs allege that Yahoo Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page22 of 32 17 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 intercepts their emails while they are in transit, and Konop holds only that the interception must be contemporaneous with transmission. Konop does not support the broad proposition that once an email “hits” a Yahoo server it ceases to be in transit to the recipient, and subsequent case law clarifies that Congress never intended emails to pass in and out of the protection of the Wiretap Act while they paused in transient storage along their journey from sender to recipient. While Yahoo urges the Court to find that the California Supreme Court would follow Konop’s footnote suggesting that electronic communications in transient storage during transmission are not protected by the Wiretap Act, it is far more likely that the California Supreme Court would follow more recent decisions like Councilman and Szymuszkiewicz, which were decided with the benefit of Senator Leahy’s explanation of Congress’s intent. This is particularly true because that the California Legislature chose to enact a statute that is more protective of privacy rights than the Wiretap Act. See People v. Conklin, 12 Cal.3d 259, 270 (1974). The Legislature explained that its intent in enacting the CIPA was to “protect the right of privacy of the people of this state” in the face of “the development of new devices and techniques for the purpose of eavesdropping upon private communications” that “create[] a serious threat to the free exercise of personal liberties and cannot be tolerated in a free and civilized society.” Cal. Penal Code § 630. “This philosophy appears to lie at the heart of virtually all the decisions construing the Privacy Act.” Ribas v. Clark, 38 Cal.3d 355, 359 (1985). It is thus unlikely that the California Supreme Court would adopt a narrow interpretation of the CIPA that essentially renders its application to electronic communications a “dead letter.” See Senator Leahy’s Amicus Brief at 5. The case Yahoo cites, People v. Wilson, 17 Cal. App. 3d 598 (1971), stands for the unremarkable proposition that once communications reach their intended recipient they are no longer in transit. In Wilson, the defendant subscribed to a telephone answering service that received messages for him and wrote them down on a form called a “green slip” for the defendant to pick up in the office or over the telephone. Id. at 600-01. The court held that a narcotics agent who obtained some of the defendant’s “green slip” messages from the answering service did not violate section 631 because the answering service received the message with the consent of all parties to the communication and because “the information received by the answering service was not obtained while the communications from Tijuana were in transit or passing over any wire, but was obtained after and not ‘while’ they were in transit or Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page23 of 32 18 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 passing ‘over’ the telephone wire.” Id. at 603. The court further explained that “[t]he answering service was a party to the telephonic communications originating in Tijuana” and “was the addressee of those communications,” while the Tijuana caller “addressed those message to the answering service.” Id. Presumably Yahoo views itself as analogous to the answering service in Wilson, but that analogy does not fit the facts of this case. In Wilson, the transmission was complete once the message reached its intended recipient: the answering service. Plaintiffs do not address their communications to Yahoo in the way that the Tijuana caller addressed his messages to the answering service. Plaintiffs address their communications to individuals who happen to use Yahoo Mail as an email service, and Yahoo intercepts them while during their transmission to the Yahoo Mail user. Unlike Wilson, the transmission of plaintiffs’ emails over the wires does not cease once the emails reach a Yahoo server. Wilson is inapplicable, and Yahoo’s interception of plaintiffs’ emails in transit violates the CIPA. 2. Enforcing the CIPA Does Not Lead to Absurd Results Section 631 prohibits third parties from intercepting or reading or attempt to read or learn the contents of a communication while it is in transit without the consent of all parties. Cal. Penal Code § 631. That’s the law. It is not plaintiffs’ interpretation of the law, as Yahoo contends. And it has been the law for many decades. The Court should disregard Yahoo’s impassioned plea that the Court ignore this established law and allow it to intercept emails without the consent of both parties to the email. As the California Supreme Court noted in addressing an argument that its reading of the CIPA could lead to absurd results, “to the extent that the broad language and purpose of the Privacy Act may encompass conduct that some people believe should not be proscribed, their remedy is to ask the Legislature to draft a statute they find more palatable.” Ribas, 38 Cal.3d at 362 n.4. Yahoo’s fears about administrative assistants being prosecuted are easily assuaged. Section 631 applies only to the interception of communications in transmission. It does not apply to communications that have already reached their intended recipient. An administrative assistant who has her boss’s authorization should not be prosecuted under section 631 for listening to her boss’s telephone messages because those communications have reached their recipient. In fact, section 637 makes it a crime for any person who is not a party to a telephonic message to disclose its contents, and thus allows a boss to disclose the contents of her voice mails to her assistant. Cal. Penal Code § 637; see also Ribas, 38 Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page24 of 32 19 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Cal.3d at 359 n.2 (under section 637, “disclosure is unlawful unless, as here, it has the approval of the person to whom the communication was addressed”). The same should be true for emails that have been delivered to the recipient; since they are no longer in transit, the administrative assistant’s review of her boss’s emails does not implicate section 631. But Yahoo makes quite a leap in arguing that because an administrative assistant should be able to review emails in her boss’s mailbox Yahoo should be able to intercept emails to and from people like plaintiffs who have never consented to Yahoo grabbing and storing the content of their emails “for immediate and future use.” Mot. at 17; ¶ 46. There is a reason why CIPA distinguishes between the interception of a communication in transit and a party’s disclosure of the communication one the transmission is complete. As the California Supreme Court explained, “While one who imparts private information risks the betrayal of his confidence by the other party, a substantial distinction has been recognized between the secondhand repetition of the contents of a conversation and its simultaneous dissemination to an unannounced second auditor, whether that auditor be a person or mechanical device.” Ribas, 389 Cal.3d at 360-61. Just because the sender of an email takes a risk that the recipient may share it with another person does not mean that corporations like Yahoo should be able to scoop up substantial portions of the nation’s email communications and store them indefinitely for their own financial benefit in violation of CIPA’s consent requirement. 3. Plaintiffs’ CIPA Claim Is Not Preempted Yahoo’s argument that plaintiffs’ CIPA claim is preempted by the ECPA is belied by the ECPA’s legislative history. The Omnibus Crime Control and Safe Streets Act of 1968 amended the Wiretap Act to authorize the interception of wire or oral communications under court order pursuant to the authorization of the appropriate federal, state or local prosecutor. See 18 U.S.C. § 2516. The Senate Report said, “The proposed provision envisions that States would be free to adopt more restrictive legislation, or no legislation at all, but not less restrictive legislation.” S. Rep. No. 90-1097 (1968), reprinted in 1968 U.S.C.C.A.N. 2112, 2187 (attached as Exhibit B to plaintiffs’ RJN); see also Conklin, 12 Cal.3d at 270-73 (holding that section 631 is not preempted by the Wiretap Act). In Conklin, the California Supreme Court explained that “[t]he settled mandate governing this inquiry, in deference to the fact that a state regulation of this kind is an exercise of the ‘historic police powers of the States,’ is Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page25 of 32 20 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 not to decree such a federal displacement ‘unless that was the clear and manifest purpose of Congress.’ In other words, we are not to conclude that Congress legislated the ouster of [a state] statute … in the absence of an unambiguous congressional mandate to that effect.” Id. at 265 (alterations in original) (quoting Florida Lime & Avocado Growers, Inc. v. Paul, 373 U.S. 132, 146-47 (1963)). The court recognized that ordinarily where Congress enacts a statute to impose uniform standards “it is expressing an intent to occupy the entire field,” but the Senate Report confirmed that “Congress did not intend to occupy the entire field of electronic surveillance to the exclusion of state regulation.” Id. at 269. The California Supreme Court then considered whether there is a conflict between the two regulatory schemes that precluded both from “stand[ing] in the same area.” Id. (citation omitted). It noted that the federal and state acts share the common purpose of guaranteeing the privacy of communications. Id. at 270. With respect to the differences between the consent provisions, it said: [U]nder the legal rules we have explicated, the mere existence of a different state standard does not inevitably lead to a conflict with federal law; rather, the challenged state law must in some manner impair the attainment of federal objectives. We do not perceive that federal objectives are impeded here. To the contrary, we believe that section 631 is consistent with federal purposes and that its more restrictive rule concerning consent was anticipated by Congress. Id. at 270-71. In addition, “Congress anticipated state regulation in the field of intercepting communications,” and “left room for the states to supplement the law in certain areas, provided the regulations are not more permissive.” Id. at 272. In 2006, the California Supreme Court reaffirmed that section 631 is not preempted by the Wiretap Act, rejecting the U.S. Chamber of Commerce’s argument that Conklin should be reconsidered because the Chamber “fails to point to any developments in the almost four decades since Conklin that would warrant such reconsideration, and omits reference to the numerous sister-state and federal decisions that have reached the same conclusion as Conklin with regard to the preemption issue.” Kearney v. Salomon Smith Barney, Inc., 39 Cal.4th 95, 105-06 (2006). There are a few federal district courts in California that have found that CIPA is preempted, but those cases are far less persuasive than the majority of cases that found no preemption. Yahoo relies primarily on Quon v. Arch Wireless Operating Co., Inc., where the court held that the SCA expressly preempted the plaintiffs’ claim under Penal Code section 629.86 claim (which is not part of CIPA and governs authorized interceptions of electronic communications) because section 2708 of the SCA says Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page26 of 32 21 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 that the remedies outlined in the SCA are the only remedies a party may pursue for conduct covered by the statute. 445 F. Supp. 2d 1116, 1138 (C.D. Cal. 2006). The plaintiff in Quon did not assert a CIPA claim, see Second Amended Complaint, 2003 WL 25598965 (May 6, 2003), and the Ninth Circuit did not address preemption when it affirmed in part and reversed in part. 529 F.3d 892 (9th Cir. 2008). In Bunnell v. Motion Picture Association of America, the court cited Quon in holding that the ECPA preempts the CIPA (even though Quon did not address the CIPA), and also found that section 2518(10)(c) of the Wiretap Act, which parallels section 2708 of the SCA, was an express preemption clause. 567 F. Supp. 2d 1148, 1154-55 (C.D. Cal. 2007). Judge Walker later noted that section 2708 of the SCA and section 2518(10)(c) of the Wiretap Act were passed for the limited purpose of making clear that in criminal cases evidence suppression is not a remedy for an ECPA violation without an underlying Fourth Amendment violation. In re NSA Telecommunications Records Litig., 483 F. Supp. 2d 934, 939 (N.D. Cal. 2007). Subsequent courts considering those provisions have agreed that they are not express preemption clauses. See Shively v. Carrier IQ, Inc., MDL Case No. C-12-md-2330 EMC, 2012 WL 3026553, at *2-5 (N.D. Cal. July 24, 2012) (Chen, J.); Leong v. Carrier IQ Inc., No. CV 12-01562 GAF (MRWx), 2012 WL 1463313, at *4 (C.D. Cal. Apr. 27, 2012); Valentine v. NebuAd, Inc., 804 F. Supp. 2d 1022, 1029 (N.D. Cal. 2011) (Henderson, J.); In re Google Inc. Street View Electronic Communications Litig., 794 F. Supp. 2d 1067, 1084 n.12 (N.D. Cal. 2011) (Ware, J.). In Google Street View, the court found that “the ECPA was intended to comprehensively regulate the interception of electronic communications such that the scheme leaves no room in which the states may further regulate.” 794 F. Supp. 2d at 1085. The court noted that “the ECPA was enacted, in part, to provide legal certainty to users and developers of innovative communications technologies with bright line rules for liability,” and that “Congress struck a balance between the right to the privacy of one’s electronic communications against the ability of users to access communications against the ability of users to access communications technologies without fear of liability for inadvertent interception.” Id. at 1085. Competing state regulation could “obscure the legislative scheme” or “upset the fragile balance” that Congress struck. Id. The Ninth Circuit affirmed but did not address the preemption holding. Joffe v. Google, Inc., 729 F.3d 1262 (9th Cir. 2013). Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page27 of 32 22 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 In Valentine, Judge Henderson held that CIPA is not preempted because “the mere fact that a federal scheme is comprehensive is insufficient for a finding of field preemption, which ‘arises only in extraordinary situations.’” 804 F. Supp. 2d at 1029 (quoting Wayne v. DHL Worldwide Express, 294 F.3d 1179, 1184 (9th Cir. 2002)). The court was “far more persuaded by the California Supreme Court’s contrary holdings that the ECPA does not preempt the CIPA.” Id. In Leong, the court noted that “since 1974, the California Supreme Court and the other state and federal district courts have come out strongly against preemption” and Bunnell and Google Street View “are, by far, in the minority.” 2012 WL 1463313, at *3. Citing provisions of the 1968 and 1986 Senate Reports that said state regulations had to be at least as restrictive as the federal law, the court found that “Congress expressly authorized states to legislate in this field.” Id. at *4 (quoting Lane v. CBS Broadcasting, Inc., 612 F. Supp. 2d 623, 637 (E.D. Pa. 2009)). The court also cited the California Supreme Court’s Conklin and Kearney decisions with approval. Id. The court said that the analysis in Bunnell and Google Street View “ignores the great weight of authority holding that one of the principal purposes of the federal statute was to establish minimum standards with which states must comply” and “reflect a marked departure from the preemption analysis of courts in this and other districts and circuits in the more than four decades since the Federal Wiretap Act was enacted.” Id. at *5. Judge Chen’s analysis in Shively was similar to that of Leong. 2012 WL 3026553, at *5-9. Ultimately, the court concluded that it “finds Leong and Valentine to be more persuasive than Bunnell and Google, particularly because the latter cases do not address the legislative history referenced by the courts in the former cases and because complete preemption is a rarity that ‘arises only in ‘extraordinary’ situations,’—i.e., it occurs only where ‘Congress has unmistakably so ordained.’” Id. at *8 (citations omitted). The court added that it “respectfully disagrees with Judge Ware that the Federal Wiretap Act, as amended by the ECPA, reflects a preemptive balancing by Congress ‘between the right to the privacy of one’s electronic communications against the ability of users to access communications technologies without fear of liability for inadvertent interception’” because “[t]hat balance is only one narrow aspect of the Act.” Id. (quoting Google Street View, 794 F.Supp.2d at 1085). “[T]he Senate Report explains that the overarching purpose of ECPA was to strike ‘a fair balance between the privacy expectations of American citizens and the legitimate needs of law enforcement agencies,’” which “does Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page28 of 32 23 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 not require broad and complete preemption of state law, including state laws which regulate private conduct.” Id. (quoting S. Rep. No. 99–541, at 3555(a)). The reasoning of Valentine, Leong and Shively, as well as the reasoning of the California Supreme Court in Conklin and Kearney, persuasively establishes that the CIPA is not preempted by the ECPA. Yahoo argues that none of these cases considered whether the ECPA preempts state legislation “regulating the conduct of email providers when accessing emails on their servers.” Mot. at 19. But Yahoo’s assertion that the SCA authorizes it to access “emails in intermediate storage while they are in transit” is contrary to the legislative history. As Senator Leahy explained, the SCA was enacted to protect electronic communications once they reach the recipient, not while they are still in transit en route to the recipient. Senator Leahy Amicus Brief at 9-10. And none of Yahoo’s arguments changes the legislative history that expressly anticipated that states may and could enact more restrictive laws governing the interception of electronic communications. Yahoo’s recourse, if it does not want to comply with the more stringent California law, is to “ask the Legislature to draft a statute they find more palatable,” Ribas, 389 Cal.3d at 362 n.4, not to urge this Court to ignore the law. E. Plaintiffs State a Claim for Violation of Their Constitutional Right to Privacy The California Constitution provides a private right of action against non-government actors for violations of the right of privacy: “All people are by nature free and independent and have inalienable rights. Among these are … pursuing and obtaining … privacy.” Cal. Const., Art. I Section 1. The ballot argument for the initiative that created the right to privacy said that the law “prevents government and business interests from collecting and stockpiling unnecessary information about us and or misusing information gathered for one purpose in order to serve other purposes or to embarrass us.” Hill v. Nat’l Collegiate Athletic Assn., 7 Cal. 4th 1, 27 (1994) (emphasis added). Yahoo’s scanning and storage of the private content of emails without plaintiffs’ consent for Yahoo’s own financial gain is precisely the type of practice the constitutional right to privacy was meant to prohibit. Plaintiffs allege all three requirements for asserting the claim: “(1) a legally protected privacy interest; (2) a reasonable expectation of privacy under the circumstances; and (3) conduct by the defendant that amounts to a serious invasion of the protected privacy interest.” In re iPhone Application Litig., 844 F. Supp. 2d 1040, 1063 (N.D. Cal. 2012). Plaintiffs allege that they have a legally protected Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page29 of 32 24 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 privacy interest in the content of emails they send to Yahoo Mail users and reasonably expect their email to be private because they have not consented to Yahoo’s interception, scanning, collection and storage of the content of their emails, and Yahoo’s use of the content for its own financial benefit. ¶¶ 3-5, 6, 15- 18, 24-29, 51, 57, 69-71. The Wiretap Act and CIPA establish that plaintiffs have a legally protected privacy interest and a reasonable expectation of privacy in the content of their emails, since both statutes prohibit the interception of email by third parties without consent for privacy reasons. See Cal. Penal Code § 630; Konop, 302 F.3d at 874. This Court has cautioned that it “would eviscerate the rule against interception” to hold that a non-Yahoo Mail user has consented to Yahoo’s interception of the emails for any purposes by merely emailing with a Yahoo Mail user. Gmail, 2013 WL 5423918, at *14. Yahoo’s argument that plaintiffs must allege that each of their emails contained confidential information misses the point. The constitutional right to privacy was adopted in part to protect the public from stockpiling of personal information, and it is Yahoo’s wholesale scanning of emails and storage of their data that plaintiffs allege violates their reasonable expectation of privacy. A state court recently held that Facebook users had a privacy interest in their browsing history because “Facebook’s cookies exist on millions of websites” and “can paint a comprehensive picture of a person’s life.” Ung v. Facebook, Inc., Santa Clara County Superior Court Case No. 1-12-cv-217244, Dkt. No. 54 (July 2, 2012) at 2 (attached as Exhibit C to plaintiffs’ RJN). The court quoted the D.C. Circuit’s warning of the privacy threat of prolonged surveillance, which collects aggregated information about people: Prolonged surveillance reveals types of information not revealed by short-term surveillance, such as what a person does repeatedly, what he does not do, and what he does ensemble. These types of information can each reveal more about a person than does any individual trip viewed in isolation. Repeated visits to a church, a gym, a bar, or a bookie tell a story not told by any single visit, as does one’s not visiting any of these places over the course of a month. The sequence of a person’s movements can reveal still more; a single trip to a gynecologist’s office tells little about a woman, but that trip followed a few weeks later by a visit to a baby supply store tells a different story. A person who knows all of another’s travels can deduce whether he is a weekly church goer, a heavy drinker, a regular at the gym, an unfaithful husband, an outpatient receiving medical treatment, an associate of particular individuals or political groups—and not just one such fact about a person, but all such facts. Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page30 of 32 25 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Id. (quoting U.S. v. Maynard, 615 F.3d 544, 562 (D.C. Cir. 2010), aff’d in part sub nom U.S. v. Jones, 132 S. Ct. 945 (2012)). Similarly, in Klayman v. Obama, the court found that while an individual may not have a reasonable expectation of privacy in the phone numbers he dialed, the plaintiffs had “a very significant expectation of privacy in an aggregated collection of their telephony metadata covering the last five years” and the NSA’s collection and searching of that metadata “significantly intrudes on that expectation.” 957 F. Supp. 2d 1, 29-42 (D.D.C. 2013). Yahoo’s conduct is even more egregious because it collects email content, not just metadata. See U.S. v. Warshak, 631 F.3d 266, 284 (6th Cir. 2010) (“People are now able to send sensitive and intimate information, instantaneously, to friends, family, and colleagues half a world away. … In short, ‘account’ is an apt word for the conglomeration of stored messages that comprises an email account, as it provides an account of its owner’s life.”); see also U.S. v. Forrester, 512 F.3d 500, 511 (9th Cir. 2007) (finding that the privacy interest in the content of email is the same as in the content of physical mail). While in Gmail this Court recognized that the recipient of an email may “easily transmit the communication to anyone else who has access to the internet or print the communications,” 2013 WL 5423918, at *23, Congress, state legislatures, and the courts have always treated the unlawful interception of communications by a third party differently. This is not a case like iPhone in which the defendants obtained only “the unique device identifier number, personal data, and geolocation information from Plaintiffs’ iDevices,” 844 F. Supp. 2d at 1063, or where the defendants allowed another to view unidentified information relating to bank accounts as in Belluomini v. Citigroup, Inc., No. CV 13-01743 CRB, 2013 WL 3855589, at *6 (N.D. Cal. July 24, 2013). What Yahoo does is a far more serious invasion of privacy. Yahoo intercepts plaintiffs’ emails before they reach their recipients, scans the content, analyzes it for various purposes, some of which it discloses and some of which it does not, shares the information with unidentified third parties, and aggregates the information for “future use.” The Court should deny Yahoo’s motion to dismiss plaintiffs’ constitutional privacy claim. V. CONCLUSION Plaintiffs request that the Court deny Yahoo’s motion to dismiss. Should the Court be inclined to grant Yahoo’s motion in any respect, plaintiffs request leave to amend. Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page31 of 32 26 PLAINTIFFS’ OPPOSITION TO DEFENDANT YAHOO! INC.’S MOTION TO DISMISS CONSOLIDATED CASE NO. 5:13-CV-04980-LHK 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 DATED: March 26, 2014 GIRARD GIBBS LLP /s/ Daniel C. Girard Daniel C. Girard (SBN 114826) Amanda M. Steiner (SBN 190047) Jennifer McIntosh (SBN 264903) Matthew B. George (SBN 239322) 601 California Street, 14th Floor San Francisco, California 94104 Telephone: (415) 981-4800 Facsimile: (415) 981-4846 dcg@girardgibbs.com ast@girardgibbs.com mbg@girardgibbs.com jlm@girardgibbs.com Co-Lead Interim Class Counsel KAPLAN FOX & KILSHEIMER LLP /s/ Laurence D. King Laurence D. King (SBN 206423) 350 Sansome Street, Suite 400 San Francisco, California 94104 Telephone: (415) 772-4700 Facsimile: (415) 772-4707 lking@kaplanfox.com and Frederic S. Fox (admitted pro hac vice) David A. Straite (admitted pro hac vice) 850 Third Avenue, 14th Floor New York, New York 10022 Telephone: (212) 687-1980 Facsimile: (212) 687-7714 ffox@kaplanfox.com dstraite@kaplanfox.com Co-Lead Interim Class Counsel Case5:13-cv-04980-LHK Document39 Filed03/26/14 Page32 of 32