U.S. Privacy Law Protects Non-U.S. Citizens
On October 3, 2011, the United States Court of Appeals for the Ninth Circuit determined that the Electronic Communications Privacy Act of 1986 (“ECPA”), 18 U.S.C. §§ 2510 2522, applies to foreign citizens, giving them the same privacy protections Congress afforded U.S. citizens in connection with the disclosure of electronic data by third-parties service providers.
The facts of Suzlon Energy Ltd v. Microsoft Corporation demonstrate how U.S. law can be used both as a sword and a shield with respect to gathering information abroad.The case arose because of a civil fraud proceeding in the Federal Court of Australia by Suzlon Energy against a citizen of India named Rajagopalan Sridhar. Mr. Sridhar maintained a Microsoft Hotmail email account, and his emails were stored on a domestic server by Microsoft. Suzlon sought Sridhar’s emails from Microsoft by having issued a subpoena in accordance with 28 U.S.C. § 1782, which allows the gathering of evidence for use in a foreign proceeding.The Court was tasked with resolving whether Microsoft would be required to produce Mr. Sridhar’s emails notwithstanding language in the ECPA providing that “a person or entity providing an electronic communication service to the public shall not knowingly divulge to any person or entity the contents of communication while in electronic storage by that service.” 18 U.S.C. § 2702(a)(1). Microsoft is an “electronic communication service” because it “provides to users . . . the ability to send or receive wire or electronic communications.” “Users,” in turn, constitute “any person” who uses the service.
The Ninth Circuit, affirming the lower district court, concluded that the language of the ECPA — which defines a “user” as “any person” — clearly included foreign citizens, and thus protected Mr. Sridhar’s emails from disclosure by Microsoft. The Court reached no conclusions regarding whether the ECPA also applied to data residing abroad, but held that data residing in the U.S. was subject to the law and “any person” enjoyed the benefit of the law’s protection.
The Suzlon case provides clear guidance to electronic communications service providers and relieves them of having to ascertain the citizenship of their users before determining whether the ECPA prevents disclosure to third parties. The case also demonstrates the interesting interplay that can occur between U.S. rules that allow for evidence to be gathered for use in a foreign proceeding and the protections that U.S. law may afford to foreign citizens subject to those proceedings. It is also somewhat ironic that U.S. courts often give little weight to foreign privacy laws when it comes to discovery proceedings against foreign nationals in U.S. courts, but appear quite willing to afford those same foreign nationals, in a foreign proceeding, the privacy protections embedded in U.S. laws.