Just WHO is Reading Your Email?

Recent tech-blogs have been debating the issue of privilege and confidentiality due to  the terms of service that Google imposes on the users of the free version of Gmail.  Because Google “reads” the content of each email in order to deliver targeted advertising to the readers, this could constitute the dissemination of attorney-client privileged (“ACP”) material, thus waiving the attorney-client privilege.  Furthermore, such dissemination could be a violation of the ABA Model Rules of Professional Conduct.[1] Numerous issues regarding privacy and privilege are therefore implicated and worthy of discussion.

BACKGROUND

Google uses programs that allow it to “read” the content of a Gmail user’s email in order to send targeted advertisements to the reader.  This is stated in Google’s Terms:

The Gmail service includes relevant advertising and related links based on the IP address, content of messages and other information related to your use of Gmail.

In section 8.1 of the Gmail Terms of Service, Google defines “Content.”

8.1 You understand that all information (such as data files, written text, computer software, music, audio files or other sounds, photographs, videos or other images) which you may have access to as part of, or through your use of, the Services are the sole responsibility of the person from which such content originated. All such information is referred to below as the “Content”.

However, Google assures its readers that the content of each email is not read by humans.

I have targeted ads on Gmail – is someone actually looking at what I write to match the ads with my emails?

Like most email services, Gmail uses software to scan emails for viruses and to filter out spam. Google uses this same kind of software to scan for keywords in users’ emails which we can then use to match ads. When a user opens an email message, computers scan the text and then instantaneously display relevant information that is matched to the text of the message. Once the message is closed, ads are no longer displayed. The whole process is automated and involves no humans.

In section 11, Google maintains that it has perpetual, free license to post or display the content that a user submits.

11. Content license from you

11.1 You retain copyright and any other rights you already hold in Content which you submit, post or display on or through, the Services. By submitting, posting or displaying the content you give Google a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit, post or display on or through, the Services. This license is for the sole purpose of enabling Google to display, distribute and promote the Services and may be revoked for certain Services as defined in the Additional Terms of those Services.

11.2 You agree that this license includes a right for Google to make such Content available to other companies, organizations or individuals with whom Google has relationships for the provision of syndicated services, and to use such Content in connection with the provision of those services.

11.3 You understand that Google, in performing the required technical steps to provide the Services to our users, may (a) transmit or distribute your Content over various public networks and in various media; and (b) make such changes to your Content as are necessary to conform and adapt that Content to the technical requirements of connecting networks, devices, services or media. You agree that this license shall permit Google to take these actions.

11.4 You confirm and warrant to Google that you have all the rights, power and authority necessary to grant the above license.

However, in the Privacy Policy pertaining specifically to Gmail, Google states:

Google does not share or reveal email content or personal information with third parties. Email messages remain strictly between the sender and intended recipients, even when only one of the parties is a Gmail user.

No email content or other personally identifiable information is ever shared with advertisers.

Furthermore, Google insists that the scanning that occurs on each email is commonplace and does not amount to an invasion of privacy.

All email services scan your email. They do this routinely to provide such popular features as spam filtering, virus detection, search, spellchecking, forwarding, auto-responding, flagging urgent mess ages, converting incoming email into cell phone text messages, automatic saving and sorting into folders, converting text URLs to clickable links, and reading messages to the blind. These features are widely accepted, trusted, and used by hundreds of millions of people every day.

Google scans the text of Gmail messages in order to filter spam and detect viruses, just as all major webmail services do. Google also uses this scanning technology to deliver targeted text ads and other related information. This is completely automated and involves no humans.

When a user opens an email message, computers scan the text and then instantaneously display relevant information that is matched to the text of the message. Once the message is closed, ads are no longer displayed. It is important to note that the ads generated by this matching process are dynamically generated each time a message is opened by the user–in other words, Google does not attach particular ads to individual messages or to users’ accounts.

When email messages are fully protected from unwanted disclosure, the automatic scanning of email does not amount to a violation of privacy. Neither email content nor any personal information is ever shared with other parties as a result of our ad-targeting process.

DISCUSSION

Google’s Terms of Service and Privacy Policy seem to be contradictory.  We have emailed Google’s legal department to clarify that the Terms of Service definition of Content does not include the content of email transmissions.  Common sense would dictate that the definition of content does not include the content of emails, but it is better to be specific and safe, than general and sorry.

That said, it is important to ascertain whether the bar associations and the courts believe that hosting email on a server other than an in-house server constitutes the dissemination of attorney-client privileged information.  Furthermore, it is necessary to determine whether the “scanning” of email content by a software program constitutes dissemination of attorney-client privileged information.

1.  Hosting on an Outside Server Does Not Necessarily Waive Privilege

I could not find a single case or ethics opinion directly addressing whether or not hosting email accounts on an outside server with an outside client violates privilege.  However, there are a number of closely related rulings that I think, collectively, demonstrate that the privilege is safe.

The key case is City of Reno v. Reno Police Protective Ass’n, (2002) 59 P.3d 1212, modified, 2003 Nev. LEXIS 25 (Nev. May 14, 2003), which states that privileged information sent via unencrypted email does not destroy the privilege.  There, the Nevada Supreme Court held that a privileged attorney-client communication retained its privileged status despite claims by the opposing side claiming that the privilege had been waived by the fact that the message had been e-mailed. The court relied, in part, on ABA Formal Opinion 99-413 (1999), which held that sending unencrypted internet email does not violate a lawyer’s duty of confidentiality (not an opinion on privilege, as such). The court also noted that both federal and California statutes say that unlawfully intercepted electronic communications do not lose their privileged status. In this vein, I would think that a website storing privileged information, subject to a nondisclosure privacy policy, is even more secure and should be fine from a privilege standpoint.  Additionally, under ABA Formal Op. 398, when a lawyer has client files stored by a third party warehouse, the lawyer needs to obtain reasonable assurances that the warehouse will protect confidentiality.  Similarly, an email host, with a privacy policy protecting the email content from prying eyes, would also seem to clear this “reasonable assurances” hurdle.

Thus, because Google explicitly states in its Privacy Policy that email content will not be disclosed to outside parties, one can clear the “reasonable assurances hurdle and be safe in the knowledge that they are not disseminating confidential, privileged information.

Other opinions given in legal symposia state that attorneys should analyze whether he will receive notice of third party requests for data stored on outside systems known as Alternative Service Providers (ASPs). For example, if a subpoena is issued to the ASP that requires the ASP to allow access to third-party litigants or law enforcement officials, will the lawyer be notified prior to the disclosure occurring? Further, in some circumstances law enforcement officials have seized entire computer systems containing the sought-after information as well as that belonging to third-parties. In the appropriate case, lawyers may consider asking the ASP to store the lawyer’s data on separate storage devices to avoid the lawyer’s data being sequestered away solely because it shared the same device as other data.

Because it is likely that Google hosts your data along with other parties data on the same server, there is a likelihood that, in the event of a subpoena, your information may be seized by law enforcement, even if the subpoena is not issued for your information.  Google provides no indication as to whether you will be notified prior to the disclosure of this information.

2.  Scanning of Email Content Probably Does Not Waive Privilege

The New York State Bar Association concluded that lawyers could use Gmail and comply with the duty of confidentiality despite the fact that email is ’scanned’ by Google to place contextual ads. The committee warned that this sort of unthinking, automated review was proper, but not human review. N.Y. St. B. Ass’n. Comm. Prof. Eth. Op. 820 (Feb. 8, 2008).  They reasoned that they would reach the opposite conclusion if the e-mails were reviewed by human beings or if the service provider reserved the right to disclose the e-mails or the substance of the communications to third parties without the sender’s permission (or a lawful judicial order).  However, merely scanning the content of e-mails by computer to generate computer advertising, however, does not pose a threat to client confidentiality, because the practice does not increase the risk of others obtaining knowledge of the e-mails or access to the e-mails’ content.  I have found no analogous opinions or cases in California.  I have found no definitive opinion from the American Bar Association.

FINAL VERDICT

Based on the authorities cited above, a law firm may use the free Gmail service without fear of waiving the attorney-client privilege or violating the Rules of Professional Conduct.  However, because these are emerging issues in the law, it may be prudent to consider alternatives to the free Gmail service or other free email service in the event that legal opinions on the issue change.

Tags: attorneys, law clerks, Lawyer, legal resources, legal services, legal technology, virtual law practice, virtual legal practice, virtualization

This entry was posted on Monday, September 28th, 2009 at 10:25 pm and is filed under Technology & Legal Practice. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.