One unanticipated cost of e-business is the expense of responding to subpoenas and proceedings designed to compel companies to disclose confidential data in their possession, such as private consumer information or identifying information as to anonymous posters at company blogs, bulletin boards or Web sites. In such cases, the company is not the target of the legal proceedings by private litigants or government prosecutors but the conduit for the identification of, or evidence against, the target.

Under such circumstances, a business faces a Hobson’s choice. It can disclose data it may have received in exchange for a promise to keep it private or a company may try to honor anonymity and, perhaps, individual First Amendment rights by refusing to respond to legal process.

Either way, there is both expense and potential exposure to the company. Courts have increasingly established guidelines that may help businesses to determine their responsibilities under these circumstances.

One common situation arises when a plaintiff seeks to compel an Internet service provider to disclose the identity of a Doe defendant who wishes to remain anonymous.[FOOTNOTE 1] Courts have adopted several approaches in these circumstances, with the weight of authority holding that courts must implement procedures that strike a balance between a plaintiff’s need to know the Doe’s identity and the anonymous speaker’s First Amendment rights.[FOOTNOTE 2]

Under the approach taken in In re Subpoena Duces Tecum to America Online Inc.,[FOOTNOTE 3] disclosure will only be compelled if the evidence is required for the case and “the party requesting the subpoena has a legitimate, good faith basis to contend that it may be the victim of conduct actionable in the jurisdiction where suit was filed.”[FOOTNOTE 4]

A second approach requires the court to evaluate the plaintiff’s need to identify the speaker, and requires that the plaintiff’s allegations of illegality be able to withstand a motion to dismiss.[FOOTNOTE 5]

A third, more demanding approach, initially applied to defamation actions, requires a plaintiff to submit evidence sufficient to overcome a limited motion for summary judgment attacking the viability of the claim.[FOOTNOTE 6] One early version of this standard requires a plaintiff:

1. to undertake efforts to notify the anonymous poster that he or she is the subject of a subpoena or application for an order of disclosure, and to withhold action to afford the anonymous defendant a reasonable opportunity to anonymously oppose the application. In the internet context, the plaintiff’s efforts should include posting a message of notification of the discovery request to the anonymous defendant on the same message board as the original allegedly defamatory posting;

2. to set forth the exact statements purportedly made by the anonymous poster that allegedly constitute defamatory speech;

3. to satisfy the prima facie or “summary judgment standard”; and

4. to balance the defendant’s First Amendment right of anonymous free speech against the strength of the prima facie case presented and the necessity for the disclosure of the anonymous defendant’s identity in determining whether to allow the plaintiff to properly proceed.[FOOTNOTE 7]

In Doe v. Cahill, the Delaware Supreme Court shortened the test, retaining the notice requirement but opining that the second and fourth requirements both should be considered implicit in the third requirement. Thus, Cahill required that the plaintiff give notice, or attempt to do so, and that the plaintiff satisfy a “prima facie or ‘summary judgment standard.’”[FOOTNOTE 8]

Finally, Matrixx Initiatives Inc. v. Doe[FOOTNOTE 9] allowed discovery to proceed without inquiring into the protections required by the First Amendment on the basis that the party who opposed discovery was not, or at least did not admit to being, the anonymous author. There, the plaintiff traced postings made under two pseudonyms on an Internet financial bulletin board to a hedge fund, and the hedge fund’s manager refused to answer any questions regarding the identities of the anonymous authors at his deposition on the grounds that their anonymity was protected by the First Amendment. The California appellate court held that under these circumstances the nonparty lacked standing to raise the issue of the anonymous speaker’s First Amendment rights.

CRIMINAL ACTION

The New Jersey Supreme Court recently had the opportunity to address the question of the discoverability of online information in a criminal action, State of New Jersey v. Reid.[FOOTNOTE 10]

In this case, the defendant allegedly used her home computer to log onto a Web site belonging to a company that supplied material to her employer’s business. While there, the defendant allegedly changed her employer’s password and shipping address to a nonexistent address. The supplier’s site captured the defendant’s IP address and the supplier told the defendant’s employer what had occurred. The employer, in turn, reported the IP address to the authorities, which issued a subpoena duces tecum to the ISP.

The ISP revealed that the IP address was assigned to the defendant, who was indicted for second-degree computer theft. The defendant successfully moved to suppress the subscriber information obtained via the subpoena when the court concluded that the defendant had an expectation of privacy in her subscriber information on file with her ISP, and the dispute reached New Jersey’s highest court.

The court held that citizens have a “reasonable expectation of privacy,” protected by Article I, Paragraph 7, of the New Jersey Constitution, in the subscriber information they provide to their ISP, akin to their privacy interest in bank records stored by banks and telephone records kept by phone companies. The court added that law enforcement officials can satisfy that constitutional protection and obtain subscriber information by serving a grand jury subpoena on an ISP – without notice to the subscriber.

In this case, the court found, because the police had used a deficient subpoena to obtain protected subscriber information, the defendant’s motion to suppress had been properly granted. However, because the records of the protected subscriber information existed independently of the faulty process the police used, and the conduct of the police did not affect that information, the government could seek to reacquire the subscriber information with a proper grand jury subpoena.

NEW YORK DECISION

Even more recently, Supreme Court, Westchester County, was faced with a dispute over the discoverability of certain online information relating to postings on a newspaper’s blog. In Matter of Ottinger v. Non-Party The Journal News,[FOOTNOTE 11] the court relied on Cahill and Dendrite to explore when identifying information about anonymous blog posters can be revealed.

The complaint in this case alleged that certain defamatory statements were made concerning the plaintiff in posts to “LoHUD,” a blog hosted by The Journal News. The suit named John Doe 1-100 and Jane Doe 1-100 as defendants. The plaintiffs served a subpoena on the newspaper seeking disclosure of the bloggers’ identity. The Journal News responded with a motion to quash. The plaintiffs cross-moved to compel.

The court noted that one of the emerging legal issues being created by the Internet is the identification of anonymous bloggers who post allegedly defamatory statements. It recognized that the First Amendment protected the right of a person to speak anonymously, but noted that that protection was no greater than the right of a person to speak when his identity was known. The court then declared that it found both the Dendrite and Cahill decisions helpful in reaching its decision.

First, the Westchester Supreme Court noted that the plaintiffs had set forth the exact alleged defamatory statements made by each anonymous poster. It found that the complaint and the information provided to the court established that the plaintiffs had set forth a prima facie case against the fictitious defendants as to each of the required elements for a defamation claim, except that of constitutional malice.

With respect to constitutional malice, the court noted that in Cahill the Delaware Supreme Court held that a plaintiff must produce evidence on all elements of a defamation claim within the plaintiff’s control. The Westchester court determined that, especially in the case of anonymous speech, the constitutional malice element was “not within a plaintiff’s control.” Accordingly, it concluded that the plaintiffs did not have to prove that element to obtain pre-action disclosure.

Applying the fourth prong of Dendrite, the Westchester court found that the balance in this case weighed in favor of the plaintiffs. It therefore denied the motion of The Journal News, granted the plaintiffs’ cross-motion, and ordered the newspaper to disclose such information it had, if any, that could reasonably lead to the identification of the posters including the posters’ names, postal and e-mail addresses, IP addresses from which the blogs were posted and corresponding ISPs, and other such information that would allow the plaintiffs to identify the person(s) posting the blog entries.

CONCLUSION

When faced with requests for confidential or anonymous data that have been entrusted to companies through their Internet activities, companies must determine their legal obligations — and the rights, if any, of the individuals whose data are sought.

This is no mere academic exercise, as the decision to comply or defend against the request can have a real impact on the company’s resources and bottom line.

Further guidelines from the courts will provide needed clarity, and predictability about what a company can and should do under such circumstances.

Shari Claire Lewis, a partner at Rivkin Radler, specializes in litigation in the areas of Internet, domain name and computer Law. She can be reached at [email protected].

::::FOOTNOTES::::

FN 1. See generally Krinsky v. Doe 6, 159 Cal. App. 4th 1154 (6th Dist. 2008) (collecting and reviewing cases).

FN 2. See generally Quixtar Inc. v. Signature Management Team, LLC, 2008 U.S. Dist. Lexis 56593 (D. Nev. July 7, 2008).

FN 3. In re Subpoena Duces Tecum to America Online Inc., 2000 WL 1210372 (2000), rev’d on other grounds by Am. Online v. Anonymous Publically Traded Co., 542 S.E.2d 377 (Va. 2001).

FN 4. This approach has been faulted for “offer[ing] no practical, reliable way to determine the plaintiff’s good faith and leav[ing] the speaker with little protection.” Krinsky, 159 Cal. App. 4th at 1167.

FN 5. See, e.g., Columbia Ins. Co. v. Seescandy.com, 185 F.R.D. 573, 578-80 (N.D.Cal. 1999).

FN 6. See, e.g., Doe v. Cahill, 884 A.2d 451 (Del. 2005).

FN 7. See Dendrite International Inc. v. Doe No. 3, 775 A.2d 756 (N.J. Super. Ct. App. Div. 2001); see also Highfields Capital Mgmt., L.P., v. Doe, 385 F. Supp. 2d 969 (N.D.Cal. 2005) (relying on Dendrite).

FN 8. See, also, Best Western Int’l. Inc. v. Doe, 2007 U.S. Dist. Lexis 61678 (D.Ariz. 2006) (following Cahill); Krinsky, supra (reviewing authority and adopting a “prima facie” test equivalent to that in Cahill).

FN 9. Matrixx Initiatives Inc. v. Doe, 138 Cal. App. 4th 872 (6th Dist. 2006).

FN 10. 945 A.2d 26 (N.J. 2008).

FN 11. 2008 N.Y. Misc. Lexis 4579 (June 27, 2008).