Tenth Circuit Decision Limits ECPA Liability of Isps for Privacy Violations by Third Party Partner by Mary Ellen Callahan, David A

Privacy and Information Governance

January 8, 2013

Privacy and Information Governance Client Alert

Tenth Circuit Decision Limits ECPA Liability of ISPs for Privacy Violations by Third Party Partner by Mary Ellen Callahan, David A. Handzo and Matthew E. Price

The U.S. court of Appeals for the Tenth Circuit data collected by NebuAd, other than the access it has held that an internet service provider (ISP) had in the ordinary course of its business as an ISP. did not violate privacy laws when it allegedly Thus, regardless of whether NebuAd had engaged allowed a third-party advertising company to gather in prohibited interception, Embarq could not be held information concerning the websites visited by the liable for any such interception under an aiding and ISP’s customers – information that the advertising abetting liability theory. company used to deliver targeted advertisements In reaching that conclusion, the court rejected the The decision has important implications for online plaintiffs’ argument that Embarq could be held advertising and e-commerce. directly liable for interception merely because it had The case, Kirch v. Embarq Management Company, custody and control over the hardware that NebuAd was a putative class action against Embarq, had installed on the network. The court held that, in an ISP, brought by two of its customers. The order to hold Embarq liable, the plaintiffs would need plaintiffs alleged that Embarq had “intercepted” to prove that Embarq had acquired the information their communications in violation of the Electronic collected by that hardware, and the summary Communications Privacy Act (“ECPA”) by allowing judgment record showed that Embarq did not. a third-party advertising network, NebuAd, Inc., to engage in “deep packet inspection” of traffic on Embarq had separately argued for dismissal on Embarq’s network. NebuAd’s technology collected the ground of consent. Embarq disclosed to its information concerning the websites visited by customers in its privacy policy that de-identified data Embarq customers, which NebuAd then used concerning the websites they visit could be used to deliver targeted advertisements to Embarq to deliver targeted advertisements. An ISP based customers. The law firm representing the plaintiffs in Montana, which had also been sued over its had also filed similar class actions against four other relationship with NebuAd, won a dismissal on that ISPs, as well as NebuAd, making similar allegations ground. However, the Tenth Circuit did not need to reach that issue to rule in Embarq’s favor. The Tenth Circuit held that, under the ECPA’s civil liability provision, a defendant cannot be held The decision is significant because it limits the liable for another party’s interception of electronic potential ECPA liability of ISPs and websites for communications. The summary judgment record alleged privacy violations committed by third-party showed that Embarq did not have access to the business partners. However, robust disclosure

©2013 Jenner & Block LLP. 353 N. Clark St. Chicago, IL 60654-3456. Jenner & Block is an Illinois Limited Liability Partnership including professional corporations. This publication is not intended to provide legal advice but to provide information on legal matters. Transmission is not intended to create and receipt does not establish an attorney-client relationship. Readers should seek specific legal advice before taking any action with respect to matters mentioned in this publication. Masthead image from the Collection of the Supreme Court of the United States. Attorney Advertising. Prior results do not guarantee a similar outcome. Privacy and Information Governance Client Alert

practices to ensure user consent remain the best defense against privacy litigation. Embarq was represented by Jenner & Block Partner David A. Handzo and Associate Matthew E. Price.

For further information, please contact: Mary Ellen Callahan David A. Handzo Matthew E. Price Partner Partner Associate Tel: 202 639-6064 Tel: 202 639-6085 Tel: 202 639-6873 Email: [email protected] Email: [email protected] Email: [email protected]