Opinion
4:19-cv-653
09-28-2022
RACHEL SIMS PLAINTIFF v. LITTLE ROCK PLASTIC SURGERY, P.A.; MICHAEL L. SPANN, M.D.; AND KRISTY SPANN DEFENDANTS
ORDER
After Rachel Sims left her job at Little Rock Plastic Surgery, P.A., she sued it and Defendants Michael and Kristy Spann (collectively “LRPS”) under numerous theories, and they responded with a battery of counterclaims. The Court previously granted LRPS's motion to dismiss Sims's claims for violation of the Federal Wiretap Act, outrage, sexual harassment, and for failure to pay commissions. LRPS now moves for summary judgment on the remaining claims of Sims's Second Amended Complaint: violations of the Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701 and 2707, defamation, tortious interference with contractual relations or business expectancy, intrusion upon seclusion, false light, conversion, computer trespass, and failure to pay last paycheck. Sims has likewise moved for summary judgment on the counterclaim against her for breach of contract, interference with a business expectancy, conversion, computer trespass, defamation, Arkansas Deceptive Trade Practices Act, misappropriation of trade secrets, and a demand for accounting.As discussed below, the Court finds that LRPS is entitled to summary judgment on the only remaining federal claim, violations of the SCA, and declines to exercise jurisdiction on the remaining state law claims of both the second amended complaint and the counterclaim.
Doc. No. 29.
Doc. No. 40.
Doc. No. 42.
Standard
Summary judgment is appropriate only when the evidence, when viewed in the light most favorable to the nonmoving party, shows that there is no genuine issue of material fact and that the defendant is entitled to entry of judgment as a matter of law. Fed.R.Civ.P. 56; CelotexCorp. v. Catrett, 477 U.S. 317, 322 (1986). The initial burden is on the moving party to demonstrate the absence of a genuine issue of material fact. Celotex Corp., at 323. The burden then shifts to the nonmoving party to establish that there is a genuine issue to be determined at trial. Prudential Ins. Co. v. Hinkel, 121 F.3d 364, 366 (8th Cir. 1997). “[T]here is no issue for trial unless there is sufficient evidence favoring the nonmoving party for a jury to return a verdict for that party. If the evidence is merely colorable or is not significantly probative, summary judgment may be granted.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 249-50, 106 S.Ct. 2505, 2511, 91 L.Ed.2d 202 (1986) (internal citations omitted).
Background Facts
The relevant facts for purposes of analyzing Sims's SCA claim are as follows. LRPS is owned by Dr. Michael Spann. His wife, Kristy Spann, is the practice's office manager. Rachel Sims was hired as a clinic nurse in August of 2012 and later trained as an aesthetic nurse injector and laser and skincare specialist. During her employment, Sims was provided a work laptop. She was occasionally permitted to take the work laptop home.
These facts are primarily taken from Doc. No. 71, Sim's response to LRPS's statement of material facts.
Kristy Spann testified that Sims was only allowed to use the laptop at home for a couple of months before she was told she could not any longer; Sims testified that she did not recall being told she could no longer take the laptop home.
LRPS took photographs of its patients, both before-and-after photos as well as photos of patients who had post-procedure concerns to send to Dr. Spann if he was out of the office. LRPS had a camera to take the photos, and reading the evidence most favorably to Sims, sometimes nurses used their personal cell phones to send pictures to Dr. Spann. Sims was also asked to prepare a photobook of patient outcomes to display in the office. She used her cell phone to take those pictures because that is the only way she knew how to edit photos. In preparing the photobook, it was her practice to email photographs from herself to herself using her personal Gmail account. In order to transfer these photos to the LRPS server, she eventually emailed the photos to her work email. Sims also emailed LRPS patient lists to her Gmail so she could prepare social media eblasts. Sims accessed her personal email and her work email from her work laptop. Viewing the facts most favorably to Sims, LRPS was aware that Sims regularly used her cell phone and her Gmail account for work purposes.
Sometime before the end of 2014, an Instagram account-@lrpscosmeticnurse-was set up. It was created with the LRPS's nurse@littlerockplasticsurgery.com email address. LRPS had a contract with HBaker Media (“HBaker”) to provide content for all their social media platforms, including email and Instagram. HBaker created graphics for monthly specials or giveaways at LRPS to post on its social media. Part of Sims's job was to coordinate social media blasts with HBaker, including email and Instagram. Sims created the majority of the Instagram posts.
By at least March of 2019, the working relationship between Sims and the Spanns had deteriorated. One point of contention was LRPS's dissatisfaction with the content of Sims's Instagram posts, which LRPS believed had become more social, including some photos with alcoholic drinks, and less professional. On March 16, 2019, Sims's co-worker Denise Peterson asked what Sims's husband, an attorney, had to say about the ownership of the Instagram account in light of the parties' difficulties. In response, Sims messaged Peterson stating that “technically” LRPS could take the Instagram account “even though it's ours because it was done at LRPS.”
Referring to herself and Ms. Peterson. See Doc. 59, p. 34.
In early April of 2019, Sims and the Spanns had a meeting. Dr. Spann's notes from this meeting state that “I'm at this time discontinuing @lrpscosmeticnurse and have instructed that all content be removed.” On April 11, 2019, Sims texted her sister-in-law that “. . . I was supposed to shut down my Instagram account. Instead, I changed the name and deleted all patient pictures.” Sims changed the name on the Instagram account to @rachelsimscosmeticnurse. She also changed the password to the Instagram account and did not provide the password to LRPS.
Referring to the @lrpscosmeticnurse account.
Hereinafter both @lrpscosmeticnurse and @lrpscosmeticnurse will be referred to as “the Instagram account” or “the account.”
On June 27, 2019, Sims submitted her resignation to LRPS and indicated that her last day of employment would be July 19, 2019. After Sims submitted her resignation but while she was still employed by LRPS, Ms. Spann got on Sims's work laptop at LRPS (“the work laptop”). Ms. Spann testified that she and Dr. Spann were suspicious of Sims because of the issues they had been having with her “demeanor” and her imminent departure. Ms. Spann testified that when she opened Exel on the work laptop there was a recent file titled “Wedding Budget.” When she clicked on the file, it opened Sims's “Google account” which contained LRPS pricing information, not a wedding budget. Ms. Spann was able to access Sims's Gmail account on July 3,2019 because it was on Sims's work laptop at her workstation and when she opened Gmail, the password and user information auto populated. Sims had never given LRPS her Gmail password. Ms. Spann further testified that once she was in Sims's Gmail account, she saw a folder in the inbox labeled “Work.” When she opened the Work folder, she saw it contained “our patient downloaded information, our PHI, our entire database downloaded, our ads, our paperwork, patient pictures.”
Ms. Spann again accessed Sims's Gmail account on the work laptop at LRPS on July 7, 2019, at which time she deleted emails with patient photos and also the Excel spreadsheet with patient information. These were emails sent to Sims's personal Gmail account from her personal Gmail account tied to her phone. Ms. Spann used her cell phone to take a video of herself accessing Sims's Gmail account, and she took screen shots of the emails and attachments that she deleted. All of the emails and attachments that were accessed were sent during Sims's employment with LRPS and were accessed on the work laptop.
After Sims refused to sign an exit agreement presented to her by LRPS, her last day of employment was accelerated to July 15, 2019. Ms. Spann testified that Sims's work laptop was at the office, and they checked her emails on it on a regular basis looking for patient correspondence. On September 6, 2019, fifty-three days after Sims's departure, Ms. Spann was able to access the Instagram account from the work laptop previously used by Sims. On that day Ms. Spann used the work laptop to pull up the Instagram account, which was still logged in. This was the first time LRPS had accessed the account since Sims's departure. The Spanns had asked Sims for the new password after Sims had changed it, but Sims had not provided it before her departure. Until September 6, Ms. Spann was unaware that the account was still logged in on the work laptop. On September 7, 2019, Ms. Span again opened the Instagram account. This time she deleted content from the account, changed the password, and set up two-factor authentication for security. Exactly what content was deleted is not known; it may have included some private messages directed to Sims. There were still LRPS proprietary images on the Instagram account at the time Ms. Spann accessed it, including the adds created by H. Baker Media. There was also content personal to Sims on the account, which she had continued using after she left LRPS. Once Sims lost access to the Instagram account, she created a new account, @little rock beauty nurse, to develop her business with her new employer, Franks Dermatology.
Analysis
The SCA is violated when someone “intentionally accesses without authorization a facility through which an electronic communication service is provided” or “intentionally exceeds an authorization to access that facility” and, in either instance, “thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage.” 18 U.S.C. §2701; Anzaldua v. Ne. Ambulance & Fire Prot. Dist., 793 F.3d 822, 838 (8th Cir. 2015). Section 2707 allows a civil action to be brought for a violation of §2701 when the violation was “engaged in with a knowing or intentional state of mind.” 18 U.S.C.A. § 2707. “The SCA is not a catch-all statute designed to protect the privacy of stored Internet communications; instead it is narrowly tailored to provide a set of Fourth Amendment-like protections for computer networks.” Anzaldua, 793 F.3d at 839 (quoting A User's Guide to the Stored Communications Act, and A Legislator's Guide to Amending It, 72 Geo. Wash.L.Rev. 1208, 1214 (2004)). Electronic storage is defined by the SCA as “(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and (B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication.” 18 U.S.C. § 2510(17)(A), (B).
A district court in Colorado has noted that “[t]his is a confusingly worded statute. For example, how does one “intentionally access[ ]” something “without authorization” and “thereby obtain[ ]...authorized access”? Cloudpath Networks, Inc. v. SecureW2 B.V., 157 F.Supp.3d 961, 986 (D. Colo. 2016).
The Court will first address the question of whether Ms. Spann intentionally accessed without authorization or intentionally exceeded an authorization when she accessed the Gmail account and the Instagram account. The “without authorization” and “exceeds authorization” language of the SCA is similar to that of the Computer Fraud and Abuse Act, (“CFAA”) 18 U.S.C. §1030 et seq., and these provisions have frequently been interpreted together. Since the SCA does not define “authorization,” the word is given its ordinary meaning. See Sartori v. Schrodt, No. 19-15114, 2021 WL 6060975, at *3 (11th Cir. Dec. 20, 2021) (“Merriam-Webster explains that term to mean ‘the state of being authorized' and goes on to explain ‘authorize' to mean ‘to endorse, empower, justify, or permit by or as if by some recognized or proper authority.;”); andLVRCHoldings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009) (“[A] person who uses a [facility] ‘without authorization' has no rights, limited or otherwise, to access the [facility] in question.” Id. at 1133.
See e.g., Sartori v. Schrodt, No. 19-15114, 2021 WL 6060975, at *2 (11th Cir. Dec. 20, 2021) (“The CFAA makes it unlawful to “intentionally access[ ] a computer without authorization” and “obtain[ ] ... information” from that computer. 18 U.S.C. § 1030(a)(2)(C). ... The SCA similarly makes it unlawful to “intentionally access[ ] without authorization a facility through which an electronic communication service is provided” and thereby obtain “access to a wire or electronic communication while it is in electronic storage.” 18 U.S.C. § 2701(a).”) and hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1200 (9th Cir. 2022) (finding the provisions “nearly identical”).
The Gmail Account.
As outlined above, Ms. Spann accessed Sims's personal Gmail account from the work laptop on July 3rd and 7th of 2019. Sims had saved her password for the Gmail account, and it auto populated as a result of Ms. Spann opening the “Wedding Budget” Excel spreadsheet. At this time Sims had already announced her intention to leave LRSD, but she had not deleted her saved Gmail password. According to Sims, she regularly used her Gmail account for work and the Spanns were aware that she did so. Patient photos, LRPS pricing details, and other information were readily accessible on the work laptop through the Sims's Gmail account.
Under these circumstances, the Court finds that Ms. Spann's access of Sims's Gmail account does not meet the SCA's requirement that the access be “without authorization” or “exceeds authorization.” These facts are distinguishable from the case of Pure Power Boot Camp v. Warrior Fitness Boot Camp, 587 F.Supp.2d 548 (S.D.N.Y. 2008) because here, unlike in Pure Power, Sims was using her employer's computer and she did use her personal Gmail account for work purposes.
Furthermore, the Court finds that the emails accessed on the work laptop were not in electronic storage as defined by the SCA. In a case involving an unsent draft of an email, the Eighth Circuit held that even if could be considered a “communication,” the draft did not qualify as being in “temporary, intermediate storage” under the SCA. because its storage on the Gmail server was not “temporary, intermediate,” and “incidental to the electronic transmission thereof.” Anzaldua, 793 F.3d at 840. In so holding, the Court cited a case from the First Circuit and one from the Southern District of New York for the proposition that an email that has been sent but not yet retrieved does qualify as an electronic communication in temporary, intermediate storage:
United States v. Councilman, 418 F.3d 67, 81 (1st Cir.2005) (en banc) (“The first category ... refers to temporary storage, such as when a message sits in an e-mail user's mailbox after transmission but before the user has retrieved the message from the mail server.”); In re DoubleClick Inc. Privacy Litig., 154 F.Supp.2d 497, 512 (S.D.N.Y.2001) (“[The SCA] only protects electronic communications stored ‘for a limited time' in the ‘middle' of a transmission, i.e. when an electronic communication service temporarily stores a communication while waiting to deliver it.”).Id. Judge Timothy Brooks out of the Western District of Arkansas carried this reasoning further in a case involving email messages that had been previously opened by the recipient but not deleted: “The logical extension of the Eighth Circuit's reasoning in Anzaldua to the facts of this case leads this Court to the conclusion that emails delivered to Ms. Thornton's webmail inbox, opened by her and retained in her inbox are not in “electronic storage” as required by 18 U.S.C. § 2701(a)(1) and defined by § 2510(17)(B).” Thornton v. Thornton, No. 5:20-CV-5018, 2021 WL 2172814, at *3 (W.D. Ark. May 27, 2021).
This Court agrees with this analysis. The emails accessed by Ms. Spann from Sims's Gmail account were those Sims had sent to herself. They had been opened by her. Extending Andaldua's reasoning leads the Court to the conclusion that the emails in question were not in electronic storage and do not fall under the SCA.
The Instagram Account.
It is undisputed that the Instagram account was established to promote the non-surgical services of LRPS, those services which were provided by Sims and other nurses. LRPS engaged the services of HBaker Media to help generate content for the account and also tasked Sims with coordinating with HBaker Media and making posts to the account. Sims was aware that while she and Peterson may have considered the account “theirs” by virtue of the time they spent posting for their services, her texts with Peterson make clear that she understood that the account belonged to LRPS as it was created there. While Sims asserts through the testimony of Heather Baker of HBaker Media that Sims was the one that set up the account to promote her injection practice, there is no genuine dispute that the account was set up to benefit LRPS and indeed Sims cites to no statements she herself made claiming ownership of the account by virtue of allegedly being the one to set it up.
LRPS had another Instagram account to promote Dr. Spann's surgical services.
While not seriously challenging that the Instagram account was initiated by and belonged to LRPS, Sims argues as fact that at some point the Spanns instructed her to make it her personal account. In response to a Request for Admission, Sims stated that “the LRPS Instagram account (@lrpscosmeticnurse) was changed to Plaintiff's personal account (@rachelsimscosmeticnurse) after the Spanns instructed Plaintiff to do so.” Reading the full context of the deposition excerpts of Ms. Spann that Sims relies on, this assertion fails. Here is the exchange between Ms. Spann and Sims's counsel:
Q. And did anything change as it relates to the - the social media comment I just read off after the [April 2019] meeting?
A. Yes. She took it upon herself to change passwords and the name of the account.
Q. And when was that?
A. Shortly -- I think it was the same month, April 2019.
Q. And was it not your intent for her to do so?
A. Correct, it was not our intent to do so. In the meeting we actually explicitly told her we did not want the -- like, we wanted it deleted. She needed to refrain from using it. We wanted to promote Michael Spann and his Little Rock Plastic Surgery.
Q. Okay. So, just to be sure I understand correctly, it was the expectation after the meeting that occurred in 20 April of 2019, the expectation of LRPS that the @lrpscosmeticnurse account would no longer be associated with LRPS?
A. So -- so I would not say -- no, we wanted it I guess inactivated but not deleted. We would still have access to it. We could reinstate it any time if we felt that was a direction we wanted to continue. But at that point we did not want to continue in that marketing direction. So we -- I shouldn't say deleted. We wanted to inactivate it. I don't know how that works on Instagram; so I don't know if you can, you know, just -- inactivate it would be the correct term, not delete.
Citing Depo. of K. Spann, at 64:18-65:22; 190:19-21 and Internal Ex. 35 at Bates RS000066. Doc. 59, p. 34.
A jury could not read this as Ms. Spann instructing Sims to make the Instagram account her personal account as Sims argues. As Sims texted her sister-in-law following the April meeting: “I was supposed to shut down my Instagram account.” Instead, as she admitted to her sister-in law, she just changed the name and said she deleted patient photos. She also changed the password.
Referring to the @lrpscosmeticnurse account.
On the agenda for a meeting with Sims dated June 25, 2019, Ms. Spann stated “name [on the Instagram account] was changed but not deleted nor were the pictures removed. We own this and need to be done ASAP” and “LRPS owns all social media pages, pictures, patient list, messages.” Sims does not dispute that she was asked by LRPS to provide the password to the Instagram account after she changed the name and that she did not do so. With no testimony of her own to support her claim that the Spanns instructed her to make this account her personal account, Sims relies on an email sent by Ms. Spann to a LRPS advertising vendor, The Scout Guide, on May 22, 2019. In that email, Ms. Spann wrote: “[G]oing forward, please just tag Michael's page on Instagram. Rachel's page will becoming her personal page and we don't want to tag both. Her post regarding medical for the office will be under Michael.” This email was sent following the Spanns' meeting with Sims in which Sims was told to stop using the Instagram account. Sims had changed the password, blocking the Spanns from accessing the account. This is the context for the email from Ms. Spann to Shively-she was not to tag the Instagram account accessed by Sims and was only to post to Dr. Spann's account. Again, this is not a directive from Ms. Spann telling Sims to make the Instagram account her personal account as Sims argues it is. The Shively email is not sufficient to constitute a material question of fact precluding summary judgment.
The Court cannot find where either party references any actual discussions of the Instagram account(s) at the meeting.
Doc. 48, Exhibit A. p. 64.
As to whether Ms. Spann or LRPS had authorization to access the Instagram account, the Court agrees with the Eleventh Circuit's reasoning applied there to a Skype account:
Sartori asserts that, although Schrodt created and set up the Skype account, she didn't really use it and that, accordingly, she was “without authorization” to access it within the meaning of the CFAA and the SCA. We are unconvinced. One who is the creator and (as here) at least the co-owner of an online account is surely authorized to access it. . . . Who but the creator and co-owner of the Skype account-here, Schrodt-could possibly be the “proper authority”? Schrodt didn't need “authorization” from anyone. End of story.Sartori v. Schrodt, No. 19-15114, 2021 WL 6060975, at *3 (11th Cir. Dec. 20, 2021). Here, LRPS initiated and paid for the development of the Instagram account. While at LRPS, Sims and other LRPS employee posted to the account along with H. Baker, who was under contract with LRPS. LRPS became unhappy with what the Spanns saw as unprofessional posts made by Sims and told her to shut down the account. She did not do so, but rather changed the password and did not provide it to LRPS. When she left LRPS, the Instagram account stood ready to be reclaimed by LRPS through the work laptop. That Sims chose to continue using the account and posting personal items and her new employment situation did not change the fact that LRPS was at the very least a co-owner of the account and, thus, an authorized user.
Conclusion
Therefore, as to both the Gmail account and the Instagram account, the Court finds that Sims cannot establish that Ms. Spann or LRPS violated the SCA by accessing either without authorization or in a way that exceeded authorization. Ms. Spann had the right to access the LRPS work laptop provided to Sims and left at LRPS both during Sims's employment and after. In doing Ms. Spann accessed the Gmail account and subsequently the Instagram account, both of which Sims had left accessible on the work laptop as the Gmail password had been saved and the Instagram account had been left open. Both the Gmail account and the Instagram account were regularly used by Sims in the course of her employment at LRPS. Even upon her departure, Sims made no effort to safeguard communications she contends were personal and to which she claims an expectation of privacy. The Court finds that Sims has not produced evidence from which a jury could find that LRPS was without authorization to access the Gmail account and the Instagram account used by Sims as part of her employment with LRPS. This does not mean that Sims is without recourse-several of her state law claims also address the access of her Gmail account and the Instagram account.
For these reasons, the Court finds that LRPS has established its entitlement to summary judgment on the SCA claims against it. Accordingly, Defendant's motion for summary judgment (Doc. 40) is GRANTED on the claim for violations of the Stored Communications Act. As this is the sole remaining federal claim, the Court declines to exercise supplemental jurisdiction on the remaining state law claims, which will be dismissed without prejudice, and this case is terminated. A separate judgment will enter.
IT IS ORDERED.