Judge Not Allowed To Hide Google's Report About Shutting Down Gmail Account Per Judge's Order

from the public-scrutiny dept

You may recall, a few years ago, a lawsuit involving Rocky Mountain Bank, who apparently screwed up (badly) and sent confidential and "sensitive" information concerning customers to a gmail email address entirely by mistake. The bank went to court to find out who the recipient was... and the court ordered Google to just shut down the account. We found this troubling that the court could just shut down the account, without even giving the individual whose account it was a chance to respond. Also troubling, was that Google agreed and shut down the account. MediaPost Communications (who reported on the story), represented by Public Citizen, was curious as to why this happened, and asked for the court to make Google's compliance report public. They were (of course) fine with the fact that customer info could be redacted, but the overall report should be made public. Amazingly, the district court judge refused, saying that since he'd asked Google to send him the report directly (rather than file it with the court Clerk's Office), that it had never been filed and thus was not subject to publication.

Thankfully, an appeals court has now said otherwise:

We were concerned that the suit was filed improperly, that without even considering the obvious flaws in the lawsuit the judge had jumped the gun in issuing a restraining order without giving either Google or the anonymous user a chance to respond, that Google had gone along with the TRO far too easily any notice, and that by denying of access to the compliance report Judge Ware was sweeping all these past mistakes under the rug.  Consequently, representing MediaPost Communications, which broke this story in the first place, we appealed this ruling, while agreeing that to the extent that the compliance report disclosed the anonymous user’s identity, that information should be redacted.

The United States Court of Appeals for the Ninth Circuit has now held that the right of public access cannot be so easily evaded.  Having been demanded by the judge so that he, and Rocky Mountain, could be sure that the TRO had been obeyed, "the report in question is a quintessential judicial document," the court said.  The public's right cannot be evaded by labeling the submission process as "lodging" instead of "filing." The court therefore reversed and remanded with instructions to release the document with redaction only for any truly private and confidential information.

Filed Under: email, restraining order
Companies: google, rocky mountain bank

Google Taken To Court To Explain Why It Shut Down Someone's Gmail Over Missent Email

from the explanation-please dept

Paul Alan Levy writes "Last month, you wrote about the travesty perpetrated by Rocky Mountain Bank when it sued Google to shut down the gmail account of a Google customer to whom the bank had mistakenly emailed a pile of customer records. Equally disturbing was the way that Google -- which is usually pretty good about standing up to subpoenas for customer identity -- just rolled over and obeyed the court's order even though a second's review of the company's ex parte arguments to the court showed both that the bank never explained what the Gmail customer did wrong, never explained how Google could be sued in the face of 47 USC 230, and never showed that there was diversity jurisdiction.

So we have gone back to court, representing MediaPost Communications, arguing that Google's report to the Court, showing its compliance, is a judicial record that should have been, and now must be, filed publicly. We agree of course that any actual customer identification in the compliance report should be redacted."

This is a tricky issue. After all, Google, as a private company, has the right to shut down an email account on its own. But, seeing as this was all a part of a legal case, with a number of questionable elements, it does seem like the information that led to the account being shut down should be a part of the public record.

Filed Under: confidential information, court order, deactivated, email
Companies: google, rocky mountain bank

Google Destroyed Missent Bank Info Email Unopened... As More Legal Questions Are Raised

from the still-doesn't-make-sense dept

Last week, Google was ordered to deactivate someone's Gmail account, because Rocky Mountain Bank had totally screwed up and sent the Gmail account holder an email by accident, which contained all sorts of confidential information. It's still not at all clear how Rocky Mountain Bank made such a monumental screw up, but we'll leave that aside for now. On Monday, the two companies asked the judge for permission to restore the email, after they realized that the email in question had never been opened, and Google had deleted it from its servers. Case closed?

Well... not so fast. Paul Alan Levy, from Public Citizen, sees a number of serious problems with the whole episode, starting with the legal complaint in the first place -- which offered no opportunity for the email account user to speak up and argue for his or her own rights, against having the account deactivated. But just the legal proceedings themselves suffered from some serious problems:

First, the complaint. Rocky's complaint is based on the contention that, having botched its obligation to keep its own customers information secret, it was obligated under various state and federal banking regulations to seek to recover the information and prevent its further dissemination. The complaint further alleges that regulatory officials expressed their endorsement of efforts by the Bank to protect the confidentiality of the information. The complaint sought a declaratory judgment that Rocky Mountain was entitled to information about the account holder, and that Google was obligated to prevent use of the information sent to the account. It sought an injunction enjoining Google and the account holder from accessing or distributing the information mistakenly sent to the email account, and compelling Google to identify the account holder. But curiously absent from the complaint was any allegation about how either Google or the owner of the gmail account had violated the plaintiff's rights, or any assertion of a cause of action against either Google or the anonymous account holder, that would form the basis for granting relief against either. Nor did Rocky Mountain's papers explain why section 230 of the Communications Decency Act entitled it to bring an action against Google, or to obtain any relief against Google, even assuming that it had a claim against the gmail account holder. Without a cause of action and without a violation of the plaintiff's rights, why was Rocky Mountain entitled to relief, and why should the defendants be subjected to an injunction? Neither the complaint, nor the brief in support of the TRO, explains this.

Second, the lack of federal court jurisdiction. Although the complaint identified only Google as a defendant, Rocky Mountain asked for relief against the anonymous gmail account holder, which is obviously, therefore, a defendant just as Google was. Indeed, if either Google or the account holder was the right defendant here, it is the account holder. But this poses a serious problem, because the law is clear that a Doe defendant cannot be sued under diversity jurisdiction. If there had been any party with any incentive to protect the Doe's rights in this case, that party could have pointed this jurisdictional defect out to the Court, which would therefore have been obligated to dismiss the case instead of issuing a TRO.

Oops. And, from there, Levy also wonders why Google was so quick to roll over without trying to defend the user's rights:

Rocky Mountain's papers recount that it asked Google for help freezing the account and identifying the account holder but that Google refused to do so without "a valid third party subpoena or other appropriate legal process." Yet despite the filing of plainly defective papers, there is no indication in the publicly filed papers that Google either opposed the requested order or insisted that it be given the opportunity to notify the Doe gmail user so that he or she could obtain counsel and oppose the requested order. Nor do the papers contain any discussion of efforts to notify either Google or the anonymous user about the requested order, even though Rule 65(b)(1) of the Federal Rules of Civil Procedure requires either notice to the parties sought to be enjoined, or a compelling explanation of why notice was not possible. (Because the Bank noticed the problem on August 13, and waited until September 17 to file its suit, it is hard to believe that a few more days' delay to give proper notice would have been catastrophic). And within a day of the issuance of the order (one day before the compliance deadline), Google provided the court with a document explaining how it had complied with the TRO and asked, jointly with Rocky Mountain, that the TRO be vacated.

Indeed. It's certainly understandable why everyone wanted to make sure the data was not compromised, and in this case, it sounds like the account in question was probably inactive or rarely used (or the email went to spam). So everything may have ended up okay. But that's no excuse for potential violations of an individual's rights in trying to correct a mistake by the bank.

Filed Under: confidential information, court order, deactivated, email
Companies: google, rocky mountain bank

Google, Rocky Mountain Bank Ask Judge To Restore Deactivated Gmail Account

from the bring-'er-back dept

Last week, we noted that a court had ordered Google to shut down a Gmail account of a user who had accidentally been emailed confidential information by Rocky Mountain Bank. The two companies have now both asked the judge to reinstate the Gmail account, saying that the original request is now "moot." The article notes that the judge has adjourned the case until next week, so the account will remain deactivated until then. Still, it's not at all clear why the issue is now "moot." Did Google delete the email in question? Was it determined that the account itself was dormant? It would seem like these details are relevant, and not anything that would need to be hidden.

Filed Under: confidential information, court order, deactivated, email
Companies: google, rocky mountain bank

Google Ordered To Shut Down Gmail Account Of User Who Received Unsolicited Banking Info

from the well-that-sucks dept

Yesterday, we wrote about Google being taken to court because Rocky Mountain Bank screwed up and sent confidential information to the wrong person's gmail account. It's still not clear why they were sending confidential info to anyone's gmail account, let alone to the wrong person's. The bank tried to contact the person at the email address, but had no luck. They asked Google about who it was, but Google refused without a court order. However, the court has gone even further, and ordered Google to deactivate the entire account. While you can absolutely understand why the bank wants the account shut down, to protect that info, it's quite troubling that someone's email account just gets deactivated, despite them doing absolutely nothing wrong. Especially in an era when people rely on their email accounts for all sorts of important things, having a judge deactivate the account of someone who did nothing wrong seems quite problematic. Yes, the bank screwed up. And yes, lots of information was potentially exposed, but that should be the bank's problem -- and not the email recipient's.

Filed Under: confidential information, court order, deactivated, email
Companies: google, rocky mountain bank

Bank Sends Confidential Email To Wrong Address, Hauls Google To Court To Figure Out Who Got The Email

from the grab-some-popcorn dept

Everyone does it at some point: you send an email to the wrong person. Hopefully the content isn't that bad or important -- but it happens. However, when a Wyoming bank, Rocky Mountain Bank, accidentally sent confidential and sensitive information to the wrong Gmail account, the bank ended up taking Google to court to find out the identity of the individual. The bank had tried emailing the wrong address again, but got no response. Google, naturally, refused to just give up the name of the person without a court order -- so the bank went to court. It also tried to have the case sealed, but the judge has rejected that idea. You can certainly understand the bank's concern here, but it does seem a bit silly to have to bring someone else to court after you screwed up and sent the wrong email.

Filed Under: bank, email, identity, privacy, security
Companies: google, rocky mountain bank