Summary
denying defendant's motion for summary judgment on plaintiff's SCA claim because plaintiff may have been entitled to attorney's fees even though plaintiff could not establish actual damages
Summary of this case from Kamel v. 5Church, Inc.Opinion
Case No. 1:16-cv-01143 (GBL/MSN)
05-23-2017
PATRICK HATELY, Plaintiff, v. NICOLE TORRENZANO, Defendant.
MEMORANDUM OPINION AND ORDER
THIS MATTER is before the Court on Plaintiff Patrick Hately's Motion for Summary Judgment (Dkt. No. 78) and Defendant Nicole Torrenzano's Motion for Summary Judgment (Dkt. No. 79). This case concerns Plaintiff's claim against Defendant under the Stored Communications Act ("SCA"), 18 U.S.C. § 2701 et seq., which stems from Defendant's alleged unauthorized access to Plaintiff's email accounts during a difficult time period when the parties were ending their romantic relationship and disputing custody of their children.
There are three key issues before the Court. The first issue is whether Plaintiff's evidence—including his declaration, the parties' deposition testimony, and third-party subpoena responses—should be part of the summary judgment record, where Defendant objects to consideration of this evidence but does not negate the accuracy of Plaintiff's proffered facts. The Court finds that Plaintiff's supporting materials are properly part of the summary judgment record because even if some materials would not be admissible at trial, Plaintiff can put the substance of the materials into admissible form.
The second issue is whether obtaining unauthorized access to emails stored on an email server and resetting the password satisfies the essential elements of an SCA violation, such that Plaintiff has presented a triable factual dispute. The Court denies Defendant's Motion for Summary Judgment because Plaintiff has provided sufficient evidence to support an SCA claim. The Court also denies Plaintiff's Motion for Summary Judgment because a triable factual dispute exists as to whether Defendant violated the SCA and whether she did so willfully or intentionally.
The third issue is whether the time that Plaintiff spent investigating the alleged intrusion qualifies as "actual damages" under the SCA, where Plaintiff is an information technology ("IT") professional who investigated the intrusion and seeks actual damages based on his purported hourly rate, but where Plaintiff did not provide evidence of incurring any out-of-pocket expenses or pecuniary loss. The Court finds that Plaintiff lacks evidentiary support for an award of actual damages and statutory damages. However, Plaintiff is not precluded from proceeding to trial because he may receive punitive damages and attorney's fees, even though he is not entitled to actual or statutory damages.
I. BACKGROUND
A. Factual Background
At the outset, the Court notes that the parties dispute virtually every fact. Defendant's motion for summary judgment proffers no undisputed facts, and although Plaintiff's motion for summary judgment proffers many undisputed facts, Defendant either objects to such facts, disputes them, or both. Therefore, the following background section summarizes Plaintiff's theory of the case. In the analysis section below, the Court will evaluate whether Plaintiff's evidence sufficiently supports this theory and creates a triable factual dispute.
Plaintiff Patrick Hately is employed by the Virginia Community College System ("VCCS"). Defendant Nicole Torrenzano is employed by Valley Health, also known as Winchester Medical Center. Plaintiff and Defendant were involved in a romantic relationship for approximately five years and have two children together. In March or April 2015, Plaintiff and Defendant separated. Plaintiff alleges that Defendant was also in a relationship with non-party David Watts ("Watts"). In or around November 2015, Defendant filed a petition for custody and child support in a separate court proceeding.
Plaintiff never shared any passwords with Defendant and told Defendant not to access his online accounts. Plaintiff's Google email account (i.e., Gmail) and his VCCS email accounts are one and the same. While available via the VCCS.edu domain, the email account is hosted by Google.
Plaintiff alleges that on October 13, 2015, Defendant intentionally accessed Plaintiff's email accounts without authorization. On that date, Defendant had a cell phone number ending in 6379. Around that same time, Watts had a phone number ending 2782. According to phone records, on the night of October 12, 2015, Watts communicated with Defendant by phone for several hours. At approximately 1:47 a.m. on October 13, 2015, Plaintiff received a notification informing him that his password for his VCCS email account had been reset. Plaintiff received a separate notification that his Google password had been reset by a device utilizing an IP address for an iPhone Plaintiff alleges that was in Defendant's control at the time. Defendant's phone records during the time of the unauthorized access of Plaintiff's accounts indicate that Defendant owned an iPhone with the phone number ending in 6379.
Records from the Frederick County Sheriff's Office, which were requested by the Sheriff's Office directly from Comcast, demonstrate that Watts was the user of the IP address associated with a MacBook, and a MacBook utilizing the same IP address accessed Plaintiff's Google account. On March 22, 2016, Defendant was deposed as part of the divorce proceedings of Watts and his then wife in the Frederick County Circuit Court of Virginia. During her deposition, Defendant admitted that she has accessed Defendant's email accounts.
Plaintiff also alleges that on November 2, 2015, Defendant intentionally accessed Plaintiff's email accounts without authorization. When Plaintiff viewed a "recently used devices" page, it demonstrated that a device not belonging to Plaintiff had accessed his Google account on November 2, 2015 at approximately 10:05 p.m. near Winchester, VA. Plaintiff researched the IP address that accessed his account and discovered that it belongs to Winchester Medical Center, where Defendant is employed. Records subpoenaed from Winchester Medical Center indicate that user "ntorrenz" accessed the URL "http://mail.email.vccs.edu" on November 2, 2015. According to Plaintiff, the subpoena response also demonstrates that, at the exact same time, the VCCS email account requests data from Google to display via the VCCS portal. Therefore, according to Plaintiff, Defendant had accessed both the VCCS account and the Google account at the same time.
B. Procedural Background
On September 7, 2016, Plaintiff filed a five-count Complaint against Defendant Torrenzano and David Watts. (Dkt. No. 1, Compl.) On October 6, 2016, Plaintiff moved to voluntarily dismiss Watts, and this Court dismissed Watts without prejudice on October 25, 2016. (Dkt. Nos. 7 & 12.) On October 24, 2016, Defendant Torrenzano filed a motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6) (Dkt. No. 10), which was denied as moot on November 7, 2016 because Plaintiff had filed an amended complaint ("First Amended Complaint") on November 4, 2016. (See Dkt. Nos. 21, 22.)
Plaintiff's First Amended Complaint—brought against Defendant but not Watts—asserts five causes of action: (1) violation of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030; (2) violation of the SCA; (3) Virginia Computer Fraud under Va. Code § 18.2-152.3; (4) Virginia Computer Trespass under Va. Code § 18.2-152.4(A); and (5) Virginia Computer Invasion of Privacy under Va. Code § 18.2-152.5. (Dkt. No. 21, Am. Compl.) The latter three claims under Virginia law are hereinafter collectively referred to as the "Virginia Computer Crime Claims."
On November 11, 2016, Defendant filed a second motion to dismiss the First Amended Complaint. (Dkt. No. 23.) The Court granted Defendant's second motion to dismiss without prejudice as to the CFAA claim (Count I) and the three Virginia Computer Crime Claims (Counts III, IV, and V). The Court dismissed the CFAA claim because Plaintiff failed to sufficiently allege that he incurred over $5,000 in losses or damages compensable under the CFAA, which pursuant to 18 U.S.C. § 1030(g) is the statutory threshold for bringing a CFAA action. Although defendant moved to dismiss the Virginia Computer Crime Claims on multiple grounds, the Court dismissed the Virginia Computer Crime Claims because Plaintiff failed to sufficiently allege how he sustained any injury to person or property by reason of a violation of the Virginia Computer Crimes Act ("VCCA"). By contrast, Defendant did not move to dismiss the SCA claim (Count II) based on a lack of pleading damages; Defendant moved to dismiss the SCA claim based on the server storing Plaintiff's information not operating as an "electronic storage" communication service for purposes of backup protection. (See Dkt. Nos. 23 & 24.) The Court denied Defendant's second motion to dismiss on that ground. (See Dkt. No. 30.)
On February 13, 2017, Plaintiff moved to amend the complaint by re-pleading Counts I, III, IV, and V against Defendant Torrenzano, and renaming Watts as a defendant with respect to all five counts. (Dkt. No. 33.) On March 17, 2017, United States Magistrate Judge Michael Nachmanoff heard oral argument from counsel for Plaintiff, Defendant, and Watts regarding Plaintiff's Motion to Amend. (See Dkt. No. 48.) On March 24, 2016, the Magistrate Judge issued a Report and Recommendation, which recommended that the Court deny Plaintiff's Motion to Amend based on the grounds that amending the complaint would prejudice Defendant and Watts, and that amending the complaint would be futile. (See Dkt. No. 58.) On April 20, 2017, the Court adopted the Magistrate Judge's recommendation by denying Plaintiff's Motion to Amend based on the ground that granting such motion would unduly prejudice Defendant. (See Dkt. No. 86.)
Four days after filing the Motion to Amend, on February 17, 2017, Plaintiff moved to extend the discovery deadline. (See Dkt. No. 35.) After the Magistrate Judge denied Plaintiff's Motion to Amend, Plaintiff withdrew his motion to extend discovery. (See Dkt. No. 48; Dkt. No. 73 at 22.)
Based on the above procedural posture, Count II of Plaintiff's First Amended Complaint—alleging a violation under the SCA—is the only claim that remains in this case. On April 14, 2017, both parties filed motions for summary judgment on the SCA claim. (Dkt. Nos. 78, 79.)
II. DISCUSSION
A. Standard of Review
Under Federal Rule of Civil Procedure 56, the Court must grant summary judgment "if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed. R. Civ. P. 56(a). In reviewing a motion for summary judgment, the Court views the facts in a light most favorable to the non-moving party. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 255 (1986); Askew v. HRFC, LLC, 810 F.3d 263, 266 (4th Cir. 2016).
Once a motion for summary judgment is properly made and supported, the opposing party has the burden of showing that a genuine dispute exists. Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 586-87 (1986); Dash v. Mayweather, 731 F.3d 303, 311 (4th Cir. 2013). "[T]he mere existence of some alleged factual dispute between the parties will not defeat an otherwise properly supported motion for summary judgment; the requirement is that there be no genuine issue of material fact." Anderson, 477 U.S. at 247-48. A fact is "material" if it "might affect the outcome of the suit under the governing law." Id.; Libertarian Party of Va. v. Judd, 718 F.3d 308, 313 (4th Cir. 2013) (citations omitted). A dispute is "genuine" if "a reasonable jury could return a verdict for the nonmoving party." Libertarian Party of Va., 718 F.3d at 313 (citation omitted). If a party fails to properly address another party's assertion of fact as required by Rule 56(c), the court may "consider the fact undisputed for purposes of the motion." Fed. R. Civ. P. 56(e)(2).
When parties file cross-motions for summary judgment, a court considers "each motion separately on its own merits to determine whether either of the parties deserves judgment as a matter of law." Defs. of Wildlife v. N. Carolina Dep't of Transp., 762 F.3d 374, 392-93 (4th Cir. 2014) (citation and internal quotation marks omitted).
B. Analysis
The Court denies both Plaintiff's and Defendant's Motion for Summary Judgment for three reasons. First, the evidence provided by Plaintiff that is relevant to resolving the parties' motions is properly part of the summary judgment record. Second, a triable factual dispute exists because Plaintiff has put forth sufficient evidence to support the essential elements of an SCA claim. Third, even though Plaintiff is not entitled to actual damages or statutory damages, Plaintiff may recover punitive damages and attorney's fees.
1. Whether the Court May Consider Plaintiff's Evidence
Plaintiff's supporting materials—including Plaintiff's declaration, third-party subpoena responses, and the parties' deposition testimony—are properly part of the summary judgment record. Defendant argues that Plaintiff fails to offer sufficient evidence to establish the elements of an SCA claim because, at the summary judgment stage, Plaintiff may not rely on unauthenticated documents and lay opinions about IP addresses. (See Dkt. No. 88 at 9; Dkt. No. 90 at 2.) In doing so, Defendant relies on cases decided prior to the 2010 Amendments to Rule 56, and therefore many of Defendant's contentions are misplaced.
The court and the parties have great flexibility with regard to the evidence that may be used on a summary judgment proceeding. Humphreys & Partners Architects, L.P. v. Lessard Design, Inc., 790 F.3d 532, 538-39 (4th Cir. 2015) (citation and internal quotation marks omitted). Generally, Rule 56 permits a court to consider "materials in the record, including depositions, documents, electronically stored information, affidavits or declarations, stipulations . . . admissions, interrogatory answers, or other materials." Fed. R. Civ. P. 56(c)(1)(A). The court may consider materials that would themselves be admissible at trial, and the content or substance of otherwise inadmissible materials where the party submitting the evidence shows that it will be possible to put the information into an admissible form. Humphreys, 790 F.3d at 538-39. If a party objects to the court's consideration of material cited to support or dispute a fact, the proponent has the burden "to show that the material is admissible as presented or to explain the admissible form that is anticipated." Id. (citing Fed. R. Civ. P. 56(c)(2) advisory committee's note).
In this matter, three key sources of information are at issue. First, the Court may consider the parts of Plaintiff's declaration that are based on personal knowledge. A declarant of facts used to support or oppose a motion for summary judgment must demonstrate that he or she has personal knowledge of the facts and is competent to testify to them. Fed. R. Civ. P. 56(c)(4); Boyer-Liberto v. Fontainebleau Corp., 752 F.3d 350, 355 (4th Cir. 2014), on reh'g en banc , 786 F.3d 264 (4th Cir. 2015). A court may consider part of a submission even if the court may not consider other parts that are not based on personal knowledge. See Ondo v. City of Cleveland, 795 F.3d 597, 605 (6th Cir. 2015). Here, Plaintiff has expressed his intent to testify, and he would be competent to testify about the notifications he received concerning someone logging into his account and changing his password. Plaintiff also would likely be competent to testify about the IP addresses for his electronic devices and the steps he took in responding to the alleged unauthorized access to his email accounts.
Second, the Court may consider third-party subpoena responses as part of the summary judgment record. Plaintiff subpoenaed records from Winchester Medical Center—Defendant's purported employer—and those records appear to catalogue when user "ntorrenz" visited certain websites and appear to list the user's IP address. (See Dkt. No. 78-10.) If accurate, records from Winchester Medical Center are relevant to linking user "ntorrenz" to Defendant Nicole Torrenzano, and thus linking Defendant to accessing Plaintiff's email accounts. Among other things, Plaintiff also subpoenaed phone records, which according to Plaintiff, illustrates how Defendant had conversations with Watts around the times when Defendant accessed Plaintiff's email accounts. Plaintiff provided a list of trial witnesses (Dkt. No. 66), and he intends to call witnesses to testify about their subpoena responses (Dkt. No. 89 at 11). Because Plaintiff has demonstrated that it will be possible to put the substance of the subpoena responses into an admissible form at trial, the Court may consider such evidence.
Third, the Court may consider the deposition testimony of the parties. (Dkt. Nos. 78-3, 78-4.) With respect to Plaintiff's deposition, it will be possible for him to testify at trial about the substance of what he testified about during his deposition—to extent his deposition testimony is based on personal knowledge or would otherwise be admissible. With respect to Defendant's deposition, the transcript includes a signed reporter's certificate but does not include Defendant's signed acknowledgment certifying the accuracy of the transcript. In any event, Plaintiff has expressed his intent to call Defendant as a witness. (See Dkt. No. 66.) During Defendant's deposition, she invoked her Fifth Amendment privilege against self-incrimination at least fifteen times, including to questions concerning her phone number and her use of email. (See Dkt. No. 78-4.) However, during a civil trial, "a fact-finder is entitled to draw adverse inferences from a defendant's invocation of the privilege against self incrimination." ePlus Tech., Inc. v. Aboud, 313 F.3d 166, 179 (4th Cir. 2002). Because Plaintiff has demonstrated that it will be possible to put the substance of the deposition testimony into an admissible form at trial, the Court may consider such evidence.
In sum, the Court will consider the aforementioned supporting materials as part of the summary judgment record, except for parts of those materials that not based on personal knowledge.
The Court takes no position on whether it is possible for Plaintiff to put every source of cited evidence into an admissible form at trial. At this juncture, the Court evaluates only the evidence sufficient for Plaintiff to create a triable factual dispute. --------
2. Whether a Triable Factual Dispute Exists
A triable factual dispute exists because Plaintiff has put forth sufficient evidence to support the essential elements of an SCA claim, and genuine disputes of material fact exists.
"Prior to 1986, the United States Code provided no protection for stored communications in remote computing operations and large data banks that stored e-mails." Garcia v. City of Laredo, 702 F.3d 788, 791 (5th Cir. 2012) (citation omitted). "In response, Congress passed the SCA as part of the Electronic Communications Privacy Act to protect potential intrusions on individual privacy that the Fourth Amendment did not address." Id. The SCA criminalizes unauthorized access to electronic communications under certain circumstances. See 18 U.S.C. § 2701(a). The SCA also provides a civil cause of action for any person aggrieved by an SCA violation. 18 U.S.C. § 2707(a).
The SCA provides, in relevant part:
(a) Offense. Except as provided in subsection (c) of this section whoever—
18 U.S.C. § 2701(a) (emphasis added).(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or
(2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section.
The four key terms pertinent to this matter are "facility", "electronic communication service", "electronic communication", and "electronic storage". The SCA does not define "facility" and technology has evolved since Congress passed the SCA in 1986, but courts interpreting the meaning of "facility" have indicated the term applies to systems operated by internet service or email service providers. See In re Google Inc. Cookie Placement Consumer Privacy Litig., 806 F.3d 125, 146 (3d Cir. 2015); Garcia v. City of Laredo, 702 F.3d 788, 792 (5th Cir. 2012). The statutory definition of "electronic communication service" includes "any service which provides . . . the ability to send or receive . . . electronic communications." 18 U.S.C. § 2510(15). The definition of "electronic communication" includes "any transfer of . . . data . . . transmitted . . . by a wire, radio, electromagnetic, photoelectronic or photooptical system," absent certain exceptions not applicable here. See id. § 2510(12). The term "electronic storage" means "(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and (B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication." See id. § 2510(17) (emphasis added).
Put differently, Plaintiff can establish an SCA violation by proving three elements. First, Plaintiff must prove that without authorization, Defendant accessed a system through which electronic communication service is provided (or accessed a system through which electronic communication service is provided with authorization, but exceeded that authority in accessing the information in question). See Leonard Sand, et al., Model Federal Jury Instructions ¶ 65.06 (2016). Second, Plaintiff must prove that Defendant obtained (or altered or prevented access to) a wire or electronic communication while it was in electronic storage in such system. See id. Third, Plaintiff must prove that Defendant acted intentionally. See id.
Defendant argues that Plaintiff fails to provide sufficient evidentiary support for his SCA claim based on the following three contentions,. (See Dkt. Nos. 80, 88.) First, Defendant argues there is an absence of a showing that Defendant accessed a facility through which an electronic communications service was provided because Plaintiff has not offered competent evidence identifying what facility Defendant accessed. Plaintiff responds that the facilities accessed by Defendant were Google's and VCCS's email servers. Plaintiff has submitted records subpoenaed from VCCS to establish that its email system is hosted by Google, and that someone other than Plaintiff logged into his email accounts. To the extent Plaintiff will need to authenticate the records at trial, among Plaintiff's list of trial witnesses are representatives from VCCS and Google.
Second, Defendant argues that there is an absence of a showing that Defendant accessed any of Plaintiff's emails. Plaintiff points out that in the Answer, Defendant admitted "that she has in the past read emails between Plaintiff and his family," but Defendant stated she lacked "sufficient information to form a belief as to whether she read such emails on October 13, 2015." (Dkt. No. 32 at 5 ¶ 33.) Further, Plaintiff provided subpoena records indicating that a user account allegedly linked to Defendant accessed the web address for VCCS's email server on November 2, 2015. (See Dkt. No. 78-10 at 24 (bates stamped Hately 1074).) Defendant also admitted during a deposition in Watts' divorce proceedings that she accessed Plaintiff's email accounts. (See Dkt. No. 78-9 at 23-24 (bates stamped Hately 803-04).) Moreover, Plaintiff does not necessarily have to prove that Defendant obtained and read Plaintiff's emails to establish an SCA violation. Defendant committed an SCA violation if she prevented authorized access to an electronic communication, and Plaintiff offered evidence to establish that Defendant reset the password to Plaintiff's account. (See Dkt. No. 78-13 at 8 (bates stamped Hately 2125).)
Third, Defendant argues there is an absence of a showing that any of the allegedly accessed emails were in "electronic storage" at the time of the access. In support of this argument, Defendant cites cases from other circuits to show that once the user of an entirely web-based email service opens an email, that email is no longer in "electronic storage" on an electronic communication service. The key case relied upon by Defendant from the Second Circuit mentions in a footnote that "although we ourselves have not addressed the issue, the majority view is that, once the user of an entirely web-based email service . . . opens an email he has received, that email is no longer 'in electronic storage' on an electronic communication service." See Matter of Warrant to Search a Certain E-Mail Account Controlled & Maintained by Microsoft Corp., 829 F.3d 197, 227 n.4 (2d Cir. 2016). The Second Circuit also pointed out cases that reached a different conclusion and recognized that emails not yet opened by the recipient are clearly "in electronic storage." See id. Further, several other courts have ruled in favor plaintiffs under circumstances similar to this case. See, e.g., Theofel v. Farey-Jones, 359 F.3d 1066, 1075 (9th Cir. 2004) (holding that "messages remaining on NetGate's server after delivery are stored "by an electronic communication service" within the meaning of 18 U.S.C. § 2510(17)(B)); Hoofnagle v. Smyth-Wythe Airport Comm'n, No. 1:15CV00008, 2016 WL 3014702, at *10 (W.D. Va. May 24, 2016) (denying defendants' motion for summary judgment where Plaintiff had already opened emails stored on service provider's server because emails were in "electronic storage" for purposes of the SCA); Cheng v. Romo, No. 11-10007, 2013 WL 6814691, at *3 (D. Mass. Dec, 20, 2013) (upholding a jury verdict as reasonable because an email on a Yahoo Server was in "electronic storage," even after being opened, and was stored "for purposes of backup protection" because it was stored on Yahoo's server after delivery). Although the Fourth Circuit has not directly addressed the issue, the Fourth Circuit upheld a district court's award of punitive damages when the SCA violation involved a defendant accessing an employee's personal email account with America On-Line ("AOL"). See Van Alstyne v. Elec. Scriptorium, Ltd., 560 F.3d 199, 202, 209 (4th Cir. 2009).
Here, judgment as a matter of law in Defendant's favor is not appropriate for two reasons. If Plaintiff can prove that he did not open some of the emails stored on VCCS's or Google's servers when Defendant accessed his email, or if Plaintiff can prove that emails remained on the servers for purposes of backup protection even after he opened the emails, then Plaintiff can establish the "electronic storage" element of an SCA claim. A factual dispute exists for trial because Plaintiff has put forth sufficient evidence to support an SCA claim and material facts remain contested,.
3. Whether Plaintiff's Alleged Damages are Compensable Under the SCA
The Court finds that Plaintiff lacks evidentiary support for an award actual damages and statutory damages. However, Plaintiff is not precluded from proceeding to trial because Plaintiff may recover punitive damages and attorney's fees.
The damages provision of the SCA provides:
The court may assess as damages in a civil action under this section the sum of the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation, but in no case shall a person entitled to recover receive less than the sum of $1,000. If the violation is willful or intentional, the court may assess punitive damages. In the case of a successful action to enforce liability under this section, the court may assess the costs of the action, together with reasonable attorney fees determined by the court.18 U.S.C. § 2707(c) (emphasis added). The SCA itself does not define "actual damages."
The Fourth Circuit has analyzed the requirements for supporting an award of "actual damages" in the context of claims brought under the Privacy Act, 5 U.S.C. § 552 et seq. See Doe v. Chao, 306 F.3d 170, 181 (4th Cir. 2002), aff'd , 540 U.S. 614 (2004). The Fourth Circuit held that the "actual damages" requirement under the Privacy Act is "more rigorous" than requiring an "injury in fact" or an "adverse effect." See id. at 180-81. The Supreme Court affirmed the Fourth Circuit's decision in Chao on the grounds that entitlement to the $1,000 statutory minimum under the Privacy Act requires plaintiffs to have suffered actual damages. Doe v. Chao, 540 U.S. 614, 627 (2004). Although the Supreme Court did not address the definition of "actual damages," the Supreme Court noted that "Courts of Appeals are divided on the precise definition." Id . at 627 n.12. The Supreme Court stated in dicta that "[w]e do not suggest that out-of-pocket expenses are necessary for recovery of the $1,000 minimum; only that they suffice to qualify under any view of actual damages." Id.
Subsequent to Chao, the Fourth Circuit in Van Alstyne held that "plaintiffs pursuing claims under the SCA must prove actual damages in order to be eligible for an award of statutory damages." Van Alstyne v. Electronic Scriptorium, Ltd., 560 F.3d 199, 202 (4th Cir. 2009). In doing so, the Fourth Circuit relied on the Supreme Court's interpretation of the damages provision under the Privacy Act, 5 U.S.C. § 552a(g)(4)(A), which is worded similar to the damages provision under the SCA, 18 U.S.C. § 2707(c). Based on the similar language in the two statutes and the Fourth Circuit's reliance on Privacy Act cases in an SCA case, this Court has interpreted the SCA damages provision consistent with how the Fourth Circuit has interpreted the Privacy Act damages provision. See Global Policy Partners, LLC v. Yessin, 686 F. Supp. 2d 642, 654 (E.D. Va. 2010) (Ellis, J.). In Global Policy Partners, this Court denied the defendant's motion for summary judgment because plaintiffs adequately supported a triable issue as to consequential economic damages under the SCA resulting from unauthorized access to an email account. See id. In that case, the plaintiffs provided an invoice to show that they incurred costs in migrating a domain name and email accounts as a result of the alleged unauthorized access. See id. at 650, 654.
As in Global Policy Partners and in this case, litigants oftentimes bring a CFAA claim along with an SCA claim (although the Court dismissed Plaintiff's CFAA claim). The CFAA defines "loss" as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring . . . the system . . . to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630, 646 (4th Cir. 2009) (quoting 18 U.S.C. § 1030(e)(11)). Plaintiff argues that the CFAA's definition of "loss" should be applied to the SCA's definition of "actual damages." (Dkt. No. 87 at 9-10.) However, even if this Court were to apply the CFAA definition of "loss" and rely on cases analyzing that word, the cases cited by Plaintiff are distinguishable. The "loss" identified by plaintiffs asserting CFAA claims typically involve some out-of-pocket expense or pecuniary loss. See, e.g., iParadigms, LLC, 562 F.3d at 646 (holding that "loss" may encompass costs incurred by online plagiarism detection company to reassign employees from day-to-day work in order to investigate the CFAA offense).
Here, Plaintiff seeks $24,004.75 in actual damages based on spending 75.25 hours of time at an hourly rate of $319 per hour. (See Dkt. No. 78 at 9; Dkt. No. 78-6.) The only reference to Plaintiff's out-of-pocket expenses is a spreadsheet mentioning the "costs to reproduce documents [and] gas expended driving all over Virginia for consultations." (See Dkt. No. 78-6.) Plaintiff's spreadsheet describes various activities that can be categorized into the following three buckets:
(1) time spent researching laws, meeting with prospective attorneys, and meeting with the attorney Plaintiff eventually hired;(See id.)
(2) time spent reporting the incident to and communicating with law enforcement officials; and
(3) time spent reviewing online activity logs, restoring emails that had been deleted, changing passwords, and contacting various vendors to discuss unauthorized account access.
Here, like the Fourth Circuit's decision in Chao, the Court need not reach the issue of whether the term "actual damages" encompasses non-pecuniary losses because, regardless of the disposition of that issue, Plaintiff lacks evidentiary support for an award of "actual damages." Although Plaintiff purports to be an IT professional with formal education in "network security," only the third category bears any relation to network security. The first two categories are activities that any litigant might encounter. Plaintiff also presented no evidence indicating that, as an IT professional, he lost any revenue or missed any time from work as a result of Plaintiff's alleged SCA violations. In addition, the only evidence offered by Plaintiff to support an hourly rate of $319 is Plaintiff's own deposition testimony. (See Dkt. No. 78 at 9 ¶ 59.) However, during Plaintiff's deposition, he stated he had never been paid $319 an hour for any of his services. (See Dkt. No. 78-3 at 9 (Hately Depo Tr. 153:18-154:9).)
Because Plaintiff lacks sufficient evidentiary support, he is not entitled to an award of actual damages. Because a plaintiff "pursuing claims under the SCA must prove actual damages in order to be eligible for an award of statutory damages." Van Alstyne, 560 F.3d at 202, Plaintiff also is not entitled to statutory damages. Nevertheless, proof of actual damages is not required before an award of either punitive damages or attorney's fees. Id. at 209. The Fourth Circuit held that if the SCA violation is "willful or intentional," the court may assess punitive damages and award attorney's fees. Id.
III. CONCLUSION
For the foregoing reasons, a triable factual dispute exists as to whether Defendant violated the SCA, and if Defendant's actions were willful or intentional, Plaintiff may receive punitive damages and attorney's fees.
Accordingly, it is hereby
ORDERED that Plaintiff Patrick Hately's Motion for Summary Judgment (Dkt. No. 78) is DENIED; it is further
ORDERED that Defendant Nicole Torrenzano's Motion for Summary Judgment (Dkt. No. 79) is DENIED.
IT IS SO ORDERED.
ENTERED this 23rd day of May, 2017. Alexandria, Virginia
/s/_________
Gerald Bruce Lee
United States District Judge