When I meet with a new client, particularly a corporate executive under criminal investigation, we talk about emails.
I tell him that he should use his personal email account to communicate with me, not his work account, since his employer has the right to review emails sent on his work account. But I also caution him that he should try to email me from a device other than one owned by his employer—his personal phone or his home computer. I’m trying to make sure our emails are private and the privilege is secure.
(Sometimes we talk about how easy it is for the government to subpoena a Gmail account, too, and sometimes we use secure messaging systems away from the government’s prying eyes—but that’s a subject for another post.)
But let’s be realistic. Our clients spend a lot of time at work and that’s where they are going to respond to most of our emails.
A recent Ninth Circuit decision about the former governor of Oregon offered a ray of hope that our clients’ emails—even if saved on their employer’s server—are still privileged.
The Grand Jury Subpoena
The former governor of Oregon, John Kitzhaber, resigned in February 2015 amidst allegations that he used his position to benefit his fiancé. During his time in office, the governor did not use an official state email. Instead, he had several Gmail accounts, one that was “official” and two that were personal.
He checked all three accounts from the same computer at work. When he set up the accounts, he asked that the emails from the official account be archived on the state’s server. The emails from his other personal accounts ended up being stored on the same server, although Mr. Kitzhaber claims he was unaware that this was happening.
During a grand jury investigation, the government issued a fairly broad subpoena to the Oregon Department of Administrative Services, which requested it to turn over all documents to or from Mr. Kitzhaber related to 17 individuals and related to certain business entities.
Mr. Kitzhaber intervened in the grand jury proceedings to file a motion to quash the subpoena, arguing that the subpoena was overbroad and violated his Fourth Amendment rights, as well as attorney-client privilege. He had emails to his personal attorneys in those accounts, as well as emails with lawyers for the state in those accounts.
The government said it had no an interest in Mr. Kitzhaber’s communications with his personal attorneys using his personal email account, but argued that it was entitled to everything else that it subpoenaed. The district court agreed with the government, and Mr. Kitzhaber appealed. He won, mostly.
Why the Subpoena was Overbroad
The Ninth Circuit concluded that the subpoena was overbroad and quashed it. It explained that
When the government crafts subpoenas, it must “make a reasonable effort to request only those documents that are relevant and non-privileged, consistent with the extent of its knowledge about the matter under investigation.” In re Horn, 976 F.2d 1314, 1318 (9th Cir. 1992). A subpoena without such tailoring is “equally indefensible as a search warrant would be if couched in similar terms.” Hale, 201 U.S. at 77. Thus, where a grand jury’s subpoena, given its overbreadth, would itself violate the privacy interests protected by the Fourth Amendment, “[j]udicial supervision is properly exercised in such cases to prevent the wrong before it occurs.”
In this case, because the subpoena requested essentially everything under the sun related to Mr. Kitzhaber, including all of his purely personal emails on the government server, the category of materials requested was insufficiently tailored. As a result, it implicated privacy interests similar to those under a general warrant. (Law school refresher: general warrants are unconstitutional.)
Reasonable Expectation of Privacy
Because he was unaware that the government was archiving emails from his personal accounts and because those emails contained a great deal of highly personal content, Mr. Kitzhaber had a legitimate expectation of privacy in them.
Even though his employer saved his personal emails on its server, the Court emphasized that his Fourth Amendment expectation of privacy remained intact, comparing the personal emails on the state’s server to a “closed container” in the hands of a third party. The Fourth Amendment bars a search of a closed container, even if it isn’t in the owner’s possession.
So, Mr. Kitzhaber’s personal emails won’t have to be turned over to the grand jury.
Were His Emails to Personal Attorneys Saved on Server Privileged?
A large part of the opinion was devoted to analyzing whether the former governor had a privilege over his emails with attorneys for the state or not. It concluded that he did not have a personal privilege over them when their advice involved “official business.” Mr. Kitzhaber was well aware of Oregon’s public records law that grants a general right to the public to inspect writings related to public business.
However, important for us, the Ninth Circuit also concluded that
Kitzhaber is correct, and the government does not dispute, that his communication with privately-retained attorneys is protected by the attorney-client privilege and should not be turned over to the grand jury.
Even though he sent emails from his work computer to his personal attorneys and even though his employer kept a copy of those emails, they were still privileged.
This is a great holding, but it has its limits. First, it’s in the Ninth Circuit, which to some people makes it suspiciously liberal on its face. Second, the government didn’t contest that Mr. Kitzhaber’s emails to his personal lawyers were privileged, no matter where they were stored. Third, the court did not really analyze the issue other than to say that the former Governor “is correct” in his argument. The case cited in support (Horn v. United States, 976 F.2s 1314 (9th Cir. 1992)) has nothing to do with a request for emails saved on the sender’s employer’s system.
But it’s a start, right?
What About Other Jurisdictions?
This was not the first decision regarding the lack of privacy expectation in a work email account. The leading case is likely In re Asia Global Crossing, Ltd., 322 B.R. 247 (S.D.N.Y. 2005). The bankruptcy court there held that emails of employees sent through their employer’s email system were protected by the attorney-client privilege. It defined four factors to consider:
(1) does the corporation maintain a policy banning personal or other objectionable use,
(2) does the company monitor the use of the employee’s computer or e-mail,
(3) do third parties have a right of access to the computer or e-mails, and
(4) did the corporation notify the employee, or was the employee aware, of the use and monitoring policies.
Here are a few other cases for you string-cite folks:
A recent Corporate Counsel article described a New York State case in which the former general counsel of Zara did not have to turn over emails that were on a work laptop that he kept after he left the company and later sued for discrimination. The court did not address the issue directly but said that “[t]he court sees no reason why these documents, created after plaintiff was terminated, may relate to the reasons plaintiff was terminated. It appears defendant is merely trying to gain a litigation advantage by accessing documents that may be privileged.” (Miller v. Zara USA Inc., Case No. 155512-2015 (Sup. Ct. NY))
Fox v. Shinseki, 2013 U.S. Dist. LEXIS 82087 (N.D. Cal. June 10, 2013). The Northern District of California held that communications with an attorney sent using official government email were not privileged.
U.S. v. Hamilton, 701 F.3d 404 (4th Cir. 2012) The Fourth Circuit has held that an employee waived the spousal communications privilege by using a work email account when the employee knew of the employer’s policy permitting inspection.
Holmes v. Petrovich Development Co., LLC, No. C059133 (Cal. Ct. App. Jan. 13, 2011). The court held that the employee had no reasonable expectation of privacy in emails using her employer’s computers because the computer and email account belonged to her employer and because the employee handbook said that emails were not private.
Convertino v. United States Department of Justice, No. 04-0236 (D.D.C. 2009). District court held that an AUSA in Michigan had a reasonable expectation of privacy in emails with his personal attorney over the DOJ system.
What Should You Tell Your Clients?
I like this opinion. I’ll cite it if the government tries to get my client’s emails with me by sending his employer a subpoena. But I’m not changing my standard warning to my clients—use your personal email account, on your personal device, to communicate with me.
Most employers have some sort of policy in place and many employers make that policy crystal clear, such as by displaying a warning every time the employee logs onto her account at work. It’s just not worth the risk of waiving the privilege.