Gaining Entry Into A Social Networking Account

“Is There a Right of Privacy to Information Posted on FaceBook and MySpace?”

Background

It should come as no surprise that many insurers are examining social networking websites in tandem with their investigation of insurance claims.  In fact, several cases of insurance fraud have been uncovered, surprisingly, because people posted information to their Facebook or MySpace profiles that supplied proof of fraud and, apparently, because they never expected that their social media accounts would be targeted as a possible source for information.  In other cases, people were of the mistaken belief that the security settings on their social media account would bar anyone from being able to view its content without their permission. 

The question becomes, under what circumstances will a court permit someone to gain entry into a person’s social networking account without their permission?  While many courts are playing “catch up” on this techno-legal question, a few states have addressed this issue.  And, a recent case out of New York helps to offer some guidance.

Kathleen Romano v. Steelcase Inc. and Educational & Institutional Cooperative Services, Inc.  Supreme Court of New York, Suffolk County - 2010 NY Slip Op 20388; 30 Misc. 3d 426; 907 N.Y.S.2d 650; 2010 N.Y. Misc. LEXIS 4538

Kathleen Romano claimed that she incurred permanent injuries when she fell off a chair that had allegedly been manufactured and distributed by the defendants.  As a result of the fall, she claimed to have suffered restricted movement in her neck and back, pain and progressive deterioration, injuries that affected her enjoyment of life and claimed to be confined to her home.

At the same time, however, Romano’s Facebook profile page showed her smiling happily in a photograph outside the confines of her home.  In addition, both her Facebook and MySpace pages suggested that she had an active lifestyle, and had traveled to Florida and Pennsylvania during the same period that her injuries supposedly precluded such activity.   

In light of these discrepancies, Steelcase deposed Romano and attempted to question her about the content of her social media accounts, but to no avail.  Following her deposition, Steelcase served her with discovery that requested, among other things, authorization to obtain full access to her Facebook and MySpace accounts.  Steelcase also issued subpoenas to both providers, but Facebook objected on the basis that it couldn’t release a person’s profile information without his or her consent.

Allegedly, Romano refused consent to the release of any content contained in her social media accounts, and she filed a motion to quash the subpoenas on several privacy related grounds.  Therefore, Steelcase filed a motion seeking access to her current and historical Facebook and MySpace pages and accounts, including all deleted pages and related information on the grounds that the public portions of these sites reflected material that was contrary to her alleged injuries and deposition testimony, and on the grounds that the private portions of these sites likely contained evidence that was material and relevant to their defense of her claims.  Steelcase argued that preventing their access to her private postings would be in direct conflict with New York law which states that “there shall be full disclosure of all non-privileged matter which is material and necessary to the defense or prosecution of an action.”
Romano responded by asserting her Constitutional right to privacy.  However, the court noted that the Fourth Amendment’s right to privacy protects people not places.  Thus, what a person knowingly exposes to the public is not a subject of Fourth Amendment protection.  Notwithstanding, the court further noted that in order to determine whether a right to privacy exists, a reasonableness standard must generally be applied.  

Neither Facebook nor MySpace Guarantee Complete Privacy

It is interesting to note at this point that neither Facebook nor MySpace guarantee complete privacy.  For example, MySpace warns users that their profiles are public places; and Facebook’s privacy policy states that:

When you use Facebook, certain information you post or share with third parties (e.g., a friend or someone in your network), such as personal information, comments, messages, photo, videos...may be shared with others in accordance with the privacy settings you select.  All such sharing of information is done at your own risk.  Please keep in mind that if you disclose personal information in your profile or when posting comments, messages, photos, videos, marketplace listing or other items, this information may become publicly available.

Although we allow you to set privacy options that limit access to your pages, please be aware that no security measures are perfect or impenetrable.

On that basis, the court held that when Romano created her Facebook and MySpace accounts, she arguably consented to the fact that her personal information would possibly be shared with others, notwithstanding her privacy settings; and that this is the very nature and purpose of these social networking sites; else they would cease to exist.  The court further held that Steelcase’s need for access to the information outweighed any privacy concerns that may be voiced by Romano. 

To permit a party claiming very substantial damages for loss of enjoyment of life to hide behind self-set privacy controls on a website, the primary purpose of which is to enable people to share information about how they lead their social lives, risks depriving the opposite party of access to material that may be relevant to ensuring a fair trial.

“Fishing Expeditions” into a Person’s Social Network Account is not Allowed

Although no previous New York case addressed the issue of whether a person has a right to privacy regarding information they post on social media such as Facebook and MySpace, other jurisdictions have examined these issues.  For example, the court in this case cited a Canadian court’s ruling in Bishop v. Minichiello, 2009 BCSC 358, CanLII, 2009, which held that the hard drive of a plaintiff’s computer should be produced to the defendant in order to determine how much time the plaintiff spent on Facebook. 

The court also cited to another case (Ledbetter v. Wal Mart Stores, Inc., LEXIS 126859, D Colo 2009), wherein the plaintiff moved for a protective order seeking to bar the production of his social media content.  However, the court denied the plaintiff’s motion and held that the information was reasonably calculated to lead to the discovery of admissible evidence, and was relevant to the issues in the case.  It’s also interesting to note that other courts have required plaintiffs to produce in discovery their passwords and login information to their social networking accounts.  

Not surprisingly, some courts have reached opposite conclusions.  For example, in McCann v. Harleysville Insurance Company of New York, 2010 N.Y. App. Div LEXIS 8396, 2010, the court held that before a defendant will be granted access to the contents of the plaintiff’s social media account, they must provide a specific reason to seek such information, and that a “fishing expedition” will not be tolerated.  In other words, courts generally appear to be in favor of allowing the examination of content within a person’s social networking account, so long as, the request is relevant in scope, and evidence that reflects that the account will likely contain non-privileged matter which is material and necessary to the defense or prosecution of the case. 

Accordingly, when interviewing an insured or claimant as part of a claims investigation, or when deposing a witness or issuing discovery, consideration should be given to asking questions concerning whether a social media account exists and concerning the type of information contained therein. 

That said, in this case, after hearing all of the arguments and evidence presented, the court granted Steelcase’s motion for an order granting access to Romano’s current and historical Facebook and MySpace pages and accounts, including all deleted pages and related information.

Conclusion

It is important to note that information gained by viewing a person’s social networking account should not be considered as conclusive evidence.  Thus, many people embellish their profiles and activities on the internet.  Also, it can be difficult to draw evidentiary conclusions from internet photos or postings that lack a basis to establish their authenticity or the time and date of their creation.  

Insurance investigators should also be cautioned against “friending” someone through the use of impersonation or false information in order to gain access to that person’s social networking account.  Such conduct would likely be viewed as deceptive, a form of misrepresentation and lacking in good faith by a court.  In addition, communication with individuals that are represented by legal counsel, via the use of social media, should also be avoided.  Finally, it is also important to note that many insurers have strict procedural guidelines concerning the proper use of their company computer equipment by employees.  Accordingly, claims investigators should strive to remain in full compliance with their company’s procedural guidelines in regard to these issues.