from The Privacy Times

GOOGLE ‘0-For-2’ TRYING TO ESCAPE PRIVACY CLASS ACTIONS

A federal judge in San Francisco has rejected Google’s motion to dismiss a lawsuit that it violated U.S. wiretap laws when it mined personal data from Gmail messages without the consent of users’ or other people to whom they sent emails.

Tweet

Rejecting the company’s claim it is exempt from wiretap laws, U.S. District Judge Lucy Koh allowed plaintiffs to move forward with claims that Google’s practice of automatically scanning emails to target advertisements violates the federal Electronic Communications Privacy Act and a handful of state privacy laws. She also found that Google violated its own privacy policies.

“The statutory scheme suggests that Congress did not intend to allow electronic communication service providers unlimited leeway to engage in any interception that would benefit their business models, as Google contends,” Judge Koh wrote in a 43-page order.

Moreover, she held that Google’s email scanning may have violated its own privacy policies. The decision was among the first to conclude that California’s Invasion of Privacy Act, passed in 1967, applies to email.

The ruling marks the second time in recent weeks that Google has been tripped up by wiretap laws and could ring alarm bells for other email providers which scan message content to sell targeted advertising. Earlier this month, the U.S. Court of Appeals for the Ninth Circuit ruled that the company can be sued for capturing private Wi-Fi transmissions during its Street View mapping project.

Google’s argued that automatic processing — which enables basic features such as sorting messages or searching inboxes — has become an inescapable part of the email business. The practice is so prevalent, it contended, that even non-Gmail users should have realized their messages were likely to be scanned when sent to Gmail accounts.

A key issue was whether both Gmail and non-Gmail users had adequate notice their communications might be intercepted — and for what purpose. For instance, users might agree to some forms of email processing without giving their email providers free rein. “Consent is not an all-or-nothing proposition,” she wrote.

“There is no dispute that Google’s interception of plaintiffs’ emails … advanced Google’s business interests. But this does not end the inquiry,” Judge Koh wrote.

“The presence of the modifier ‘ordinary’ must mean that not everything Google does in the course of its business would fall within the exception.”

The plaintiffs accused Google of perpetrating a scheme that reaches far beyond email transmission. They alleged in a response brief that Google uses Gmail as “its own secret data mining machine,” constructing secret profiles for its legion of users.

Judge Koh rejected Google’s claim that users allowed their messages to be scanned when they accepted the company’s terms of service. Although Google reserved the right to screen content, the company suggested that its aim was to block explicit sexual material — not to target advertisements or create user profiles, she noted.

“Because the two processes were allegedly separate, consent to one does not equate to consent to the other,” she wrote.

She said the terms of service might alert users that Google is capable of intercepting messages. However, the wording does not suggest that the company actually engages in the practice. In its current terms of service and privacy policy, adopted last year, Google provides a long list of sources from which it may glean users’ information, but Gmail is not among them.

“These privacy policies do not demonstrate explicit consent, and in fact suggest the opposite,” Judge Koh wrote.

Widening the potential class, Judge Koh found that people with other email providers who corresponded with Gmail users do not give Google implicit consent to intercept their messages. She also broke new ground when she declined to grant Google’s motion to dismiss the plaintiffs’ claims under CIPA, California’s invasion-of-privacy law. Few courts have considered the question of whether the statute can be applied to email and there is no binding authority. Concluding that California lawmakers wanted to afford citizens broad protections under the statute, Judge Koh allowed the claims.

Finally, she dismissed the plaintiffs’ Pennsylvania state law claims but let stand claims filed under Florida and Maryland laws.

Follow ACCESS