Wednesday, January 08, 2014

The Leased Computer, the "Spyware" Software and Privacy


This post examines an opinion a federal District Court judge in Georgia recently issued in a civil case:  Sneed v. SEI/Aaron’s, Inc., 2013 WL 6669276 (U.S. District Court for the Northern District of Georgia 2013). Gwendolyn Sneed brought the action by filing a Complaint in which she alleged that “a computer she leased from [SEI/Aaron’s, Inc.] was secretly equipped with software that allowed [SEI/Aaron’s, Inc.] to remotely access the Plaintiff's private communications and information.”  Sneed v. SEI/Aaron’s, Inc., supra.

More precisely, Sneed, the Plaintiff in the suit, alleged that the computer she leased came with

PC Rental Agent ® pre-installed. That software allows SEI to run `Detective Mode’ on its leased computers. Detective Mode runs like a spyware/malware program and allows SEI to take photographs with the leased computers' cameras, capture keystrokes, take screen shots, and track the physical location of the computer. Detective Mode can send updates on computer activity to SEI up to every two minutes. . . .

The Plaintiff alleges SEI has used Detective Mode on all of its customers' computers to capture personal information ranging from medical records, private emails, social security numbers, financial information, and personal activities as seen through the computer's camera. . . .

Sneed v. SEI/Aaron’s, Inc., supra.  The story you can find here provides a little more background about Detective Mode and another suit filed over its alleged use.

The opinion also explains that Sneed sought to represent a class on behalf of

all [SEI/Aaron’s, Inc.] customers. The Plaintiff alleges that SEI does not disclose to its customers that it installs PC Rental Agent ® on its leased computers or that it uses the software's Detective Mode function to gather information about customers. . . .

The Plaintiff brings claims for common law invasion of privacy/intrusion on seclusion, computer invasion of privacy under [Georgia Code] § 16–9–93(c), and intentional infliction of emotional distress. . . . Her complaint was filed in state court on March 5, 2013, the Defendant removed the complaint to this Court on March 26, 2013. . . .

Sneed v. SEI/Aaron’s, Inc., supra.

As Wikipedia explains, in the U.S. federal court system,

removal jurisdiction refers to the right of a defendant to move a lawsuit filed in state court to the federal district court for the federal judicial district in which the state court sits. This is a general exception to the usual American rule giving the plaintiff the right to make the decision on the proper forum. Removal occurs when a defendant files a "notice of removal" in the state court where the lawsuit is presently filed and the federal court which the defendant would like to remove the case to.

For more on how the process works, check out Wikipedia’s entry on removal jurisdiction. As this article explains, deciding whether to seek removal involves a number of issues implicating litigation tactics.  A defendant may decide to remove a case on the premise that the plaintiff’s lawyer is not familiar with federal court practice and/or on the related premise that the federal court judge may be more objective than a state court judge.

After SEI/Aaron’s, Inc. removed the case to federal court, it filed a motion to dismiss Sneed’s suit under Rule 12(b)(6) of the Federal Rules of Civil Procedure. Sneed v. SEI/Aaron’s, Inc., supra.  As I have noted in prior posts, a Rule 12(b)(6) motion asserts that a cause of action pled in a Complaint is substantively inadequate because it fails “to state a claim upon which relief can be granted.” And as Wikipedia explains, the

Rule 12(b)(6) motion . . . is how lawsuits with insufficient legal theories underlying their cause of action are dismissed from court. For example, assault requires intent, so if the plaintiff has failed to plead intent, the defense can seek dismissal by filing a 12(b)(6) motion. . . .

Or, as the judge in this case explained, a complaint should be dismissed under Rule 12(b)(6)

only where it appears that the facts alleged fail to state a `plausible’ claim for relief. Ashcroft v. Iqbal, 556 U.S. 662 (2009). . . . A complaint may survive a motion to dismiss for failure to state a claim . . . even if it is `improbable’ that a plaintiff would be able to prove those facts. . . . Bell Atlantic v. Twombly, 550 U.S. 544 (2007). In ruling on a motion to dismiss, the court must accept the facts pleaded in the complaint as true and construe them in the light most favorable to the plaintiff. . . .  

Generally, notice pleading is all that is required for a valid complaint. See Lombard's, Inc. v. Prince Mfg., Inc., 753 F.2d 974 (U.S. Court of Appeals for the 11th Circuit 1985). . . .  Under notice pleading, the plaintiff need only give the defendant fair notice of the plaintiff's claim and the grounds upon which it rests. See Erickson v. Pardus, 551 U.S. 89 (2007).

Sneed v. SEI/Aaron’s, Inc., supra.

The judge then took up SEI/Aaron’s, Inc.’s challenges to Sneed’s causes of action, beginning with the invasion of privacy claim. Sneed v. SEI/Aaron’s, Inc., supra.  He noted that SEI/Aaron’s, Inc.’s motion to dismiss

argues that [Sneed’s] claim for invasion of privacy must fail because the allegations supporting that claim are only based upon information and belief and because there are no credible allegations that SEI actually obtained data from [her] computer. [Sneed] counters that her allegations are sufficient and that there is no way for her to know whether SEI did in fact access her computer without engaging in discovery.

Sneed v. SEI/Aaron’s, Inc., supra.

The judge then analyzed both parties’ arguments, noting that Sneed’s

invasion of privacy claim is based upon an intrusion into her seclusion or other private affairs. `The intrusion aspect of this type of invasion of privacy “involves a prying or intrusion, which would be offensive or objectionable to a reasonable person.”’ Everett v. Goodloe, 268 Ga.App. 536, 602 S.E.2d 284 (Georgia Court of Appeals 2004) (quoting Yarbray v. Southern Bell Tel. & Tel. Co., 261 Ga. 703, 409 S.E.2d 835 (GeorgiaSupreme Court 1991)).

Here, [Sneed] alleges that [SEI/Aaron’s, Inc.] leased a computer to her without informing her that the computer was equipped with software that would allow [SEI/Aaron’s, Inc.] to monitor [her] activities. [Sneed] further alleges that [SEI/Aaron’s] accessed financial information, personal information, and even images of [Sneed] at her computer. These are allegations of potential intrusions on privacy that would be `offensive or objectionable to a reasonable person.’ See id.

Sneed v. SEI/Aaron’s, Inc., supra.

The judge also noted that SEI/Aaron’s, Inc. “nevertheless” insisted that Sneed’s

claim must fail because [she] only alleges that, `[u]pon information and belief, the Plaintiff's computer was secretly accessed by Defendant, resulting in her physical location being tracked and her images being taken with the webcam and her communications being stolen, all via PC Rental Agent.’ (Complaint ¶ 35). [SEI/Aaron’s] relies upon Innotex Precision Ltd. v. Horei Image Products, Inc., 679 F.Supp.2d 1356 (U.S. District Court for the Northern District of Georgia 2009), where this Court refused to provide the assumption of truth to pleadings based on information and belief.

However, in that case, the court rejected four paragraphs from the complaint that were `”threadbare recitations” of factors cited by Georgia courts in deciding whether to pierce the corporate veil.’ Id. (quoting Iqbal, supra). Here, on the other hand, the allegation upon information and belief does not recite the elements of a claim or make a conclusory statement. Rather, the allegation states [Sneed] believes [SEI/Aaron’s] has accessed specific aspects of her private information using a specific software program [SEI/Aaron’s] installed on her computer.

Importantly, it is unclear how [she] could know at this time beyond information and belief whether [SEI/Aaron’s] actually accessed [her] computer. See Awbrey v. Great Atlantic & Pac. Tea Co., 505 F.Supp. 604 (U.S. District Court for the Northern District of Georgia 1980) (denying summary judgment to defendant on wiretapping claim and noting that `the fact that most of the plaintiffs have no personal, first-hand knowledge that any particular phone call was tapped is not remarkable. Indeed, it would be unusual if anyone other than defendant, and its employees involved in the wiretapping, had knowledge of the specific incidents of wiretapping’).

Sneed v. SEI/Aaron’s, Inc., supra.  The judge therefore held that because Sneed “has sufficiently alleged facts to sustain a claim for intrusion upon seclusion”, SEI/Aaron’s motion to dismiss that cause of action must be denied. Sneed v. SEI/Aaron’s, Inc., supra.  So, that part of Sneed’s suit survived, at least for a while.

The judge then took up SEI/Aaron’s argument that Sneed had not alleged facts sufficient to plead a claim under Georgia Code § 16–9–93(c), which provides as follows:

Any person who uses a computer or computer network with the intention of examining any employment, medical, salary, credit, or any other financial or personal data relating to any other person with knowledge that such examination is without authority shall be guilty of the crime of computer invasion of privacy.

He also noted that Georgia Code § 16–9–93(g)(1) “further” provides that “`[a]ny person whose property or person is injured by reason of a violation of any provision of this article may sue therefor and recover for any damages sustained and the costs of suit.’” Sneed v. SEI/Aaron’s, Inc., supra.  In its motion to dismiss SEI/Aaron’s argued that

§ 16–9–93(g)(1) requires [Sneed] to allege that she has been injured in order to sustain a claim for Computer Invasion of Privacy, and that [she]  has not done so. However, [Sneed] alleges that [SEI/Aaron’s] accessed her computer and viewed financial and personal information as well as pictures of [her] taken by the computer's webcam.

Additionally, [Sneed] alleges she and potential class members have been injured by [SEI/Aaron’s] use of Detective Mode because their information `may have been possibly transmitted to other third parties thereby placing [the putative class] at an increased risk of fraud and identity theft and causing direct financial expenses associated with credit monitoring, replacement of compromised credit, debit, and bank card numbers.’ . . .  

Sneed v. SEI/Aaron’s, Inc., supra. 

The judge therefore found that Sneed’s allegations were sufficient to show Sneed

has been injured by [SEI/Aaron’s] intrusion on her privacy through the PC Rental Agent ® software. See [Georgia Code] § 16–9–93(g)(1) (`Without limiting the generality of the term, ‘damages' shall include loss of profits and victim expenditure.’). Accordingly, the Court concludes [Sneed] has pled sufficient facts to support a claim under  §§ 16–9–93(c) and (g), and [SEI/Aaron’s] motion to dismiss should be denied in this respect.

Sneed v. SEI/Aaron’s, Inc., supra. 

Finally, the judge took up SEI/Aaron’s argument that Sneed had not adequately stated a claim for intentional infliction of emotional distress in her Complaint. Sneed v. SEI/Aaron’s, Inc., supra.  He explained that to       

`assert a claim for intentional infliction of emotional distress, plaintiffs must show “(1) the conduct giving rise to [the distress] was intentional or reckless; (2) the conduct was extreme and outrageous; (3) the conduct caused emotional distress; and (4) the emotional distress was severe,”’ Peterson v. Merscorp Holdings, Inc., 2012 WL 3961211(U.S. District Court for the Northern District of Georgia 2012) (quoting Blue View Corp. v. Bell, 298 Ga.App. 277, 679 S.E.2d 739 (Georgia Court of Appeals 2009)).

Sneed v. SEI/Aaron’s, Inc., supra.  The judge also noted that

[e]motional distress includes all highly unpleasant mental reactions such as fright, horror, grief, shame, humiliation, embarrassment, anger, chagrin, disappointment, worry, and nausea. It is only where it is extreme that liability arises. The law intervenes only where the distress inflicted is so severe that no reasonable person could be expected to endure it.

Sneed v. SEI/Aaron’s, Inc., supra (emphasis in the original) (quoting Abdul–Malik v. AirTran Airways, Inc., 297 Ga.App. 852, 678 S.E.2d 555 (Georgia Court of Appeals 2009)).

The judge then explained that there were no allegations in the Complaint stating

[Sneed] herself suffered emotional distress, let alone severe emotional distress. The closest allegations are the allegations that `[t]he acts of [SEI/Aaron] constitute a wanton, voluntary, and intentional wrong, which was so terrifying and insulting as naturally to [sic] humiliate, embarrass, and frighten Plaintiff and class members.’ (Complaint ¶ 51). These allegations do not show a sufficiently severe level of emotional stress.

Indeed, allegations of emotional stress more severe than humiliation, embarrassment, and fright have been held insufficient by Georgia courts. See Abdul–Malik v. AirTran Airways, supra (concluding evidence of sleeplessness and weight gain was insufficient for a claim of intentional infliction of emotional distress); Witter v. Delta Airlines, 966 F.Supp. 1193 (U.S. District Court for the Northern District of Georgia 1997) (evidence of anxiety, sleeplessness, overeating, diarrhea, and headaches insufficient to establish severe emotional distress. . . .

[Sneed’s] allegations only state she was subject to humiliation, fear, and embarrassment. She does not allege any physical symptoms or further mental symptoms, or provide any details. There is no indication that she has sought professional help.

Sneed v. SEI/Aaron’s, Inc., supra. 

The judge therefore found that Sneed’s “allegations do not indicate that she suffered sufficiently severe emotional stress to sustain a claim for intentional infliction of emotional distress”, which meant that SEI/Aaron’s “motion to dismiss should be granted in this respect.”  Sneed v. SEI/Aaron’s, Inc., supra. 

So, he denied the motion to dismiss on Sneed’s first two claims but granted it on the third.  Sneed v. SEI/Aaron’s, Inc., supra.  That may dispose of the intentional infliction of emotional distress cause of action, but Sneed may, if the facts justify such a step, be able to file an amended Complaint under Rule 15 of the Federal Rules of Civil Procedure.  In the Amended Complaint she could, if the facts allow, try to remedy the deficiencies in her initial Complaint.

No comments: