In Court? Be Careful What You Post On Facebook

mbone writes "Going to court? Seeking damages for injuries? Be careful what you post on Facebook (and, presumably, elsewhere). In the first case of its kind (analyzed in the Courtroom Strategy blog), a Suffolk County, NY Judge allowed a defendant in a personal injury lawsuit to obtain access to the Facebook profile of the plaintiff suing them, saying 'Plaintiff has no legitimate reasonable expectation of privacy.' You have been warned. I am not a lawyer, and this is not legal advice, but I would expect this to become common." Readers might be reminded of the Canadian case reported last year of a woman whose cheerful Facebook pictures led an insurance company to yank coverage.

Comments

if you dont want anyone on the internet to know

[sakura the mc]

then stop posting shit on the internet.

Re:if you dont want anyone on the internet to know

[TheRaven64]

But Facebook has all sorts of privacy controls so that only my friends can see stuff!

bullshit

[moxley]

Of course he has a reasonable expectation of privacy.

Unless the person was on his friend's list and permitted to see particular posts, the ONLY thing the court should be able to see are things that are viewable by everyone - everything else is SPECIFICALLY set up to be private by way of the passwords and permissions system inherent in having a Facebook account.

Re:bullshit

[Anonymous Coward]

This is a personal injury case. The plaintiff has put their health at issue. By going to the courthouse and claiming that your health was injured you've put your health at issue and the opposing side is given more power to find out about your health.

These slashdot stories about the screwed up law are often the real bullshit here. If we had a story about someone on facebook sending messages suggesting that she wasn't really injured, and then the court didn't allow that evidence into a personal injury hearing, then you'd all be screaming about how stupid the court is.

Re:bullshit

[boxwood]

Uh no.

If I tell all my friends that I'm faking my injury, and the person or company I'm suing hears of it, they can put my friend on the stand and my friend has to tell the court what I said, or risk being charged for perjury.

The company can even hire a PI and can submit photos of you doing activities that you wouldn't be able to do if you were uninjured, as long os the PI doesn't break any laws in getting them.

The courts have always been able to do this, and they've always been able to subpoena things like phone records and emails. Why should it be any different for facebook?

Bottom line, don't sue someone for personal injury if you're not really injured.

Re:bullshit

[causality]

Uh no.

If I tell all my friends that I'm faking my injury, and the person or company I'm suing hears of it, they can put my friend on the stand and my friend has to tell the court what I said, or risk being charged for perjury.

The company can even hire a PI and can submit photos of you doing activities that you wouldn't be able to do if you were uninjured, as long os the PI doesn't break any laws in getting them.

The courts have always been able to do this, and they've always been able to subpoena things like phone records and emails. Why should it be any different for facebook?

Bottom line, don't sue someone for personal injury if you're not really injured.

I always find it amusing whenever there's a story that sums to "social networking sites are like everything else you have ever experienced in your life -- irresponsible/thoughtless use can bite you in the ass" and the people involved seem shocked to discover this.

Re:bullshit

[cynyr]

If i ask the court to look as i feel the plaintiff feels contrary to the suit IRL. So I ask the court to look on facebook to see if he/she has been posting contrary to their position on court. The court looks at my reasons for wanting that information, and in this case decided to let me "discover" what is there. Seems fine to me. Don't be claiming you are injured in court and then brag that you are sueing some guy in court over your paper cut on FB.

Re:bullshit

[morgan_greywolf]

You have to be kidding. From Facebook's TOS:

You hereby grant Facebook an irrevocable, perpetual, non-exclusive, transferable, fully paid, worldwide license (with the right to sublicense) to (a) use, copy, publish, stream, store, retain, publicly perform or display, transmit, scan, reformat, modify, edit, frame, translate, excerpt, adapt, create derivative works and distribute (through multiple tiers), any User Content you (i) Post on or in connection with the Facebook Service or the promotion thereof subject only to your privacy settings or (ii) enable a user to Post, including by offering a Share Link on your website and (b) to use your name, likeness and image for any purpose, including commercial or advertising, each of (a) and (b) on or in connection with the Facebook Service or the promotion thereof.

Does that look like Facebook gives a damn about your rights or your privacy?

Re:bullshit

[demonlapin]

"Reasonable expectation of privacy" is a legal term of art that bears very little relation to what a reasonable person might reasonably expect to be private. For starters, and in general (IANAL) if you've told anyone your secret, you no longer have a reasonable expectation of privacy in that information. So even if you post it as visible only to your friends, you've already felt comfortable sharing it with Facebook and with all those friends. It's no longer a secret. Getting the info from Facebook is just faster than subpoenaing your Facebook friends and compelling them to testify about what they saw there.

Re:bullshit

[koick]

IANAL so don't know full ramifications of the "subject only to your privacy settings", but seems to me that means if I set something as private then it's private between myself and the person(s) I shared it with.

Re:bullshit

[rickb928]

In the 80s, a good friend of mine retired from police work and went into PI work for insurance companies. He related one of his early close calls to me...

He went out into the woods a bit to videotape a man who was collecting worker's comp for a back injury for a few years. He taped him for a half hour chopping wood in his backyard. After a moment's break looking around (it was deer hunting season), the subject put down the axe, walkd over and picked up his rifle, and looked to be sighting a deer.

My friend is still taping, and he zooms in for a moment, sighting right down the scope. He can see the subject's eye in the scope.

The first round hit 2 feet to his right. He moved out.

The subject spent the next two weeks looking for my friend. At the next administrative hearing, he got to see the tape. My friend is a patient and kind man. He offered to refuse to testify at a trial for attempted murder if the subject gave up his claim and went back to work. Sadly, the subject balked, and went to jail for aggravated assault. And this cost him his job. Apparently, at the nearing, he railed on about how the PI was trespassing. He was filmed from a public logging road.

BJ went on a long career catching people doing all kinds of bad things. His PI work turned his opinion of people sour much more than his police work did. He was even more disappointed at the things people would do for just money, and not very much at that.

Discovery sucks, but being guilty sucks more.

Re:bullshit

[bws111]

The Fifth Amendment only says you can't be compelled to testify against YOURSELF. There is no 'right not to answer' for any other reason.

Re:The Plaintiff?

[boxwood]

Yeah its almost as is the Defendant was trying to defend himself by proving the Plaintiff wasn't really injured.

Court doesn't work like that...

[Oxford_Comma_Lover]

You can get access to a huge amount of non-public data about the other party. It's called "discovery," and in civil cases you are supposed to turn over even things that will clearly make the other side win. (Nothing like the fifth Amendment right against compelled self-incrimination applies).

That being said, the discovery requests theoretically are supposed to have something to do with the case. Depending on the case, FB information may or may not be relevant. But keep in mind that Judge's also don't *Want* to get involved in fights over discovery, as a rule, so if the lawyers can't work it out he might just rule against the party that is being the most stubborn.

Incidentally, discovery is a huge part of the reason our justice system is as bad as it is. It has advantages--makes it easier to go after a corporation that has done something evil, for example--but it makes going to court *a LOT* more expensive, which makes the courts less accessible to small and medium-sized businesses and to individuals.

Re:Court doesn't work like that...

[Anonymous Coward]

Discovery makes a justice system bad? Discovery is nothing more than how we deal with the fact that people are people. If people were completely honest, and fair, then yeah, discovery wouldn't be necessary, but then neither would be a court of law.

Even if somebody isn't lying deliberately, people are more than capable of distorting the truth just because they are biased in favor of their own interests.

I don't know what problem you think Discovery causes, but the lack of it would be far far worse.

Re:Court doesn't work like that...

[saihung]

Endless discovery is what allows huge corporations to bury people who have done nothing wrong. It is what allowed Montsanto to bankrupt unknown numbers of farmers, seed cleaners, and other people who likely did nothing wrong, because it's discover that allowed Montsanto to keep dragging these people to pointless depositions, one after the other. And because the judges in the USA don't usually interest themselves in this process unless someone objects, and since you need a lawyer to do that, it means that the guy with the deepest pockets can just harass the hell out of you until you die.

That's what problems your precious discovery costs you "justice" system. That's not the only flaw with America's adversarial system, but it sure as hell doesn't help. In many other countries, a magistrate judge oversees this process and ensures that it doesn't unfairly burden anyone.

Re:Privacy Policy?

[causality]

It seems to me that this completely nullifies any privacy policy in force on any website. If you have no "legitimate reasonable expectation of privacy" with a privacy policy in force, than how can an employee of the website in question, or the management themselves, get in trouble for violating said policy? Judges really need to be careful what garbage they spew out, lest they set the wrong precedent.

Had you read the article, you'd have seen where the court actually referenced the privacy policy. From that thing you didn't read:

Supreme Court Judge Allen Spinner reasoned -I think completely correctly – that social networking sites are not private lockboxes where you store your most intimate secrets; in fact their privacy policies tell you that they are public spaces. Therefore he said:

“Plaintiff has no legitimate reasonable expectation of privacy.”

Re:Privacy Policy?

[boxwood]

The Privacy Policy is between you and Facebook. There is no privacy policy between you and everyone in the world.

If an employee of Facebook violates the privacy policy between you and Facebook then they can be sued. If Facebook gets a subpoena requesting information from their servers then they have to comply or the judge can throw them in jail. You cannot sue Facebook for complying with a subpoena. Because not complying with a subpoena would be against the law. Contracts cannot compel someone to break the law.

So yeah, a subpoena or search warrant trumps any privacy policy or contract you may have.

So Facebook has to abide by its privacy policy, but the courts do not have to abide by Facebook's privacy policy. You could say the courts are above the law, but its more accurate to say that the courts ARE the law.

Re:The Plaintiff?

[x_IamSpartacus_x]

I agree with you and think this isn't that big of a deal.

I've tried to look into the details of this and this is what I've come up with.
A woman named "Romano" is suing Steelcase Inc for some kind of personal injury and is seeking damages to pay her for "loss of enjoyment of life". The judge granted Steelcase Inc the ability to look into Romano's personal files to show that she's not telling the truth in her claims of injury "especially her claims for loss of enjoyment of life". Here's the court order.

The present application was brought on by Order to Show Cause. The Court has reviewed the submissions both in favor of and in opposition to the relief sought, as well as the applicable federal statutory law, specifically the Stored [*2]Communications Act, 18 U.S.C. 2701 et seq., which prohibits an entity, such as Facebook and MySpace from disclosing such information without the consent of the owner of the account (see, 18 U.S.C. 2702(b)(3); Flagg v City of Detroit, 252 FRD 352 [ED Mich 2008]).

In the "Stored Communications Act 18 U.S.C section 2701 subsection (a) article (1) basically says you can't go snooping around in other people's facebook/myspace/emails but subsection (c) article (3) says section 2703 shows some exceptions. Here's 2701.
Hop over to section 2703 and in subsection (b) article (1) subsection (B) subsection (ii) says you can get a court order as long as you follow article 2703 subsection (d) which give the rules for a court order. Basically if the plaintiff “specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation” then they can go for it.
Now the only thing that I can see that can derail this is if this isn’t a criminal investigation. Otherwise this isn’t a revolutionary ruling and it’s completely within the bounds of the letter of the law.
Here's 2703.

If you’re going to sue someone for personal injury don’t post things online that contradict what you’re claiming in court. Not that hard to figure that out.

Re:This is a disaster

[hedwards]

No, the decision was correct. A social networking site is indeed a public place for all intents and purposes. Considering that emails are usually made available during discovery, I don't think this was unreasonable. And really, the plaintiff should have turned over those pages anyways as they're apparently relevant to the case at hand.

Additionally, email providers and other sites of similar purpose typically include language to allow themselves to provide your information in response to lawfully granted subpoenas.

Re:This is a disaster

[Americano]

Facebook's privacy policy specifically states the following:

Facebook is about sharing information with others — friends and people in your communities — while providing you with privacy settings that you can use to restrict other users from accessing some of your information. We share your information with third parties when we believe the sharing is permitted by you, reasonably necessary to offer our services, or when legally required to do so.

Further on, in the context of "when we might share your data:"

To respond to legal requests and prevent harm. We may disclose information pursuant to subpoenas, court orders, or other requests (including criminal and civil matters) if we have a good faith belief that the response is required by law. This may include respecting requests from jurisdictions outside of the United States where we have a good faith belief that the response is required by law under the local laws in that jurisdiction, apply to users from that jurisdiction, and are consistent with generally accepted international standards. We may also share information when we have a good faith belief it is necessary to prevent fraud or other illegal activity, to prevent imminent bodily harm, or to protect ourselves and you from people violating our Statement of Rights and Responsibilities. This may include sharing information with other companies, lawyers, courts or other government entities.

And still further down:

Risks inherent in sharing information. Although we allow you to set privacy options that limit access to your information, please be aware that no security measures are perfect or impenetrable. We cannot control the actions of other users with whom you share your information. We cannot guarantee that only authorized persons will view your information. We cannot ensure that information you share on Facebook will not become publicly available. We are not responsible for third party circumvention of any privacy settings or security measures on Facebook. You can reduce these risks by using common sense security practices such as choosing a strong password, using different passwords for different services, and using up to date antivirus software.

In other words: If it's a secret and needs to remain so, you don't share it with your 20 closest Facebook friends on the Internet, because you have no reasonable expectation that those people (or others who manage to get elevated access privileges) will keep your secret safe. The court's reasoning is entirely consistent with the privacy policy Facebook has laid out. As far as "if you put it online, even for only one person to see," yes, and that's always been the case. A subpoena can (and often will) result in this information being disclosed, and anybody who thinks that Facebook is magically exempt from subpoenas because "it's a social network with a privacy policy and stuff," is foolish.

Re:Privacy Policy?

[causality]

I did read the article. The courts can get a search warrant to come into my home and take whatever they want, but I doubt that any judge would ever say about my home that I have "no legitimate reasonable expectation of privacy.” If you have a profile, and you set it to private, than there is a reasonable expectation of privacy. There is not now, nor has there ever been, any privacy against the actions of the courts. Maybe I'm arguing semantics, I just think it was poorly phrased on the part of the judge.

Another user did a good job of summing up why the court made this decision. That agreement makes it clear that you lose control over any data you submit to Facebook. Even if they provide privacy controls, they apparently have no obligation to make sure they work as the user intended since the data submitted now belongs to Facebook. Personally, I find the arrangement unappealing in the extreme; that's why I don't use Facebook.

The idea that anything you post to a social networking site is going to remain confidential and private is a false one, of which it seems many need to be disabused. The common sense rule still applies: don't ever post anything that you wouldn't want to be fully public. I never understood what was so difficult about this that motivates people to keep trying to find ways around it.

Re:hmmm

[Americano]

Pro tip: If you're trying to hide your diabetes from your insurance company, don't tag pictures of yourself on Facebook titled, "HERE I AM IN DIABETIC SHOCK - DON'T TELL BLUE CROSS LOL!"

Re:The Plaintiff?

[Jurily]

Hop over to section 2703 and in subsection (b) article (1) subsection (B) subsection (ii) says you can get a court order as long as you follow article 2703 subsection (d)

No, at this point you give up and ask a lawyer. Wanna bet there's another text somewhere that further qualifies this?

This could also be used in reverse

[Schemat1c]

What if I decide to commit a crime and I 'arrange' a nice alibi with pictures and well timed postings on my FB page?
Could I use that to defend myself in court?

Re:This could also be used in reverse

[causality]

What if I decide to commit a crime and I 'arrange' a nice alibi with pictures and well timed postings on my FB page? Could I use that to defend myself in court?

It'd be up to the prosecution to prove that your alibi is not valid. The fact that the pictures were posted to Facebook doesn't change anything.

Sort of like the way fraud is not some strange new crime requiring new laws merely because a computer was involved (think phishing scam) instead of a telephone or a face-to-face con man.

Just subpoena the people on tfriends list

[petes_PoV]

And have them testify as to what the plaintiff had said. You get the same information, but it takes longer, costs more and inconveniences more people (as well as honking off your "friends").

The information will come out, it's just how much extra effort people have to go to, to get it. This seems to me like an efficient way of finding out what the truth (yes, yes I know: what's truth got to do with the law?) is.

p.s. I'm constantly surprised that anyone thinks anything they post anywhere on the internet has, in practice, any degree of privacy or confidentiality - under any circumstances. If you want to keep something confidential DON'T TELL ANYONE.

Re:Privacy Policy?

[Americano]

Yes, you are just arguing semantics.

An "expectation of privacy" has a context, and in this case, the context for that "expectation of privacy" is posts made on Facebook. Given FB's privacy policy, it is not reasonable to assume that your data on FB is private, because FB makes it quite clear that your data isn't really "private," though they "make efforts to keep it private," but specifically call out that it may be disclosed accidentally, or by friends, FB applications, or to properly-constructed and applicable legal requests (subpoenas, etc.)

If your bank offered "social features" that allowed you to link your accounts with a bunch of your friends' accounts, and said "We can't promise other people won't find out how much money you have"... would you bank there? I sure wouldn't, because I want my financial information to be private and secure - and so I wouldn't put my money into a bank that shared my financial info with others.

(And even with a "reasonable expectation of privacy" from a bank... that information is still subject to subpoena and other discovery methods.)

Re:hmmm

[TheRaven64]

stupid people are unlikely to harm someone other than themselves while proceeding to apply a metaphorical firearm to their foot. This is bad? Why?

Because it's only a metaphorical firearm?

Re:This is a disaster

[Kijori]

I'm not sure I can agree with you.

The most important elements of this decision seem to me to be:

-The public portion of the respondent's FB profile shows her smiling outside her house, which would appear to contradict her claim that she has lost all enjoyment in life and cannot leave the house
-It is likely based on this that further relevant evidence is contained in the private section of her FB account
-It would be against the interests of justice to allow a respondent to hide relevant evidence behind self-administered privacy settings

Regarding the privacy issues:
-Both a subjective and an objective expectation of privacy are required under NY law
-Materials that have been distributed to third parties are prima facie not subject to an expectation of privacy since the respondent no longer has control over their distribution.

This seems reasonable to me, and on the facts of this case - the woman is alleged to be committing fraud and is attempting to suppress the discovery of further evidence - the outcome would appear to be just.

What we have is a can of worms

[BrokenHalo]

Trouble is, Facebook doesn't have much (apart from a dodgy honour system) in the way of identification of individuals. I have often wondered (hypothetically) how things would pan out if I were a defendant in court where evidence from Facebook posts were presented against me.

I do not have a Facebook account, and for a variety of reasons never will, but I often wonder how I would convince a court of that, given that I can find half a dozen individuals there who share the same name as myself.

Re:What we have is a can of worms

[MysteriousPreacher]

I'd imagine it'd be up to the plaintiff to prove to a reasonable extent that the posts are yours - perhaps including a subpoena or two sent to facebook, and forensic analysis of the computers you use.

Facebook really should close allow an option for people to validate themselves. Right now there's a kind of crude web of trust model, but this doesn't really work unless the people inviting you are already connected and known to people you already know and trust. I think some other companies have validated identities through small charges to credit cards. It's not perfect, but at least it leaves a paper trail if someone is playing silly buggers and it ends in court. Stolen cards could be used, but then the account is only going to be useful until the fraud investigation begins, and people would need a pretty good reason to risk the legal consequence of committing credit card fraud.

Re:This is a disaster

[Americano]

Who's "setting public policy"?

The court is looking at the facts of the matter before it: The plaintiff posted some stuff on Facebook, and the defendant has requested access to that stuff, claiming that it is relevant to the case. This request might be denied if there were sufficient privacy concerns to show that the request would violate the defendant's reasonable expectation of privacy.

The court looks at the type of service (social networking, a public space where people connect with one another); the privacy policy of the site (which states that FB "cannot control the actions of other users [ . . . and . . . ] cannot ensure that information you share on FB will not become publicly available"); From this, he draws a conclusion that you have no reasonable expectation of privacy for posts made on Facebook.

Please explain why you WOULD have a *reasonable expectation* of privacy, in light of the fact that Facebook specifically tells you that anything you post could be revealed to the public? You may have a deep *desire* for privacy... you may wish very hard for it, in fact, but Facebook specifically and completely disavows any responsibility for keeping your secrets.

You: "I really want someplace online where I can store my deepest darkest secrets, and I think Facebook is the place to do it."
Facebook: "Well, anything you post here could be revealed to the public."
You: "But you have these privacy controls!"
Facebook: "Yes, but they're not guaranteed to work properly, and besides, if you share your secrets with friends, they can share them with anybody else without your permission."
You: "I don't care. I want to poke people."
Facebook: "Okay... but just so long as you're clear that everything you say or post could end up being revealed to the public."
You: "Yeah yeah, I know, everything I say is private."
Facebook: "No, that's not what we said at all. That's completely the opposite of what we said, in fact."
You: "LOL FARMVILLE!"

Re:The Plaintiff?

[cheekyjohnson]

"Yeah its almost as is the Defendant was trying to defend himself by proving the Plaintiff wasn't really injured."

Odd, I thought it was "innocent until proven guilty." Shouldn't the plaintiff be the one who proves that the defendant injured them? The defendant shouldn't have to prove that they didn't injure them.

Re:The Plaintiff?

[fractoid]

This is a civil, not criminal, hearing, right? In that case there's none of this 'beyond reasonable doubt' and 'innocent until proven guilty' stuff, you just have to show that you've got a bit of a point. That's why ridiculous things happen like some sports star being charged of rape, successfully defending the charge in criminal court, and then being immediately sued in a civil court for damages over the 'emotional trauma' caused by the rape that no-one could prove even happened.

Regardless, if you're being charged with permanently injuring someone, while the onus of proof is on them to show that you did it, it may well be quicker, cheaper easier to show that they're not, in fact, injured, than it would be to wait for them to produce some sort of evidence and then rebut that evidence.

Re:This is a disaster

[Americano]

I have a reasonable expectation of privacy due to the fact that access to my profile is limited to those who are authorized to see it.

You are wrong. You have an unreasonable *wish* for privacy. Facebook's privacy policy does not prevent a subpoena of records, nor do they make any guarantees against disclosure of your data. Their policy tells you up front that your data *may* be disclosed to the public, and that they WILL cooperate with legal requests they consider to be "good faith".

If you can read those two items in their policy and still think you have any expectation that your data will not be disclosed, you are engaging in - as the judge stated - "wishful thinking".

Facebook's privacy policy is an agreement between you and Facebook which dictates the terms and conditions under which your data may be disclosed to the public (or third parties) by Facebook, and their privacy policy more or less states "if we think we need to, or we screw up, or your friends don't have any discretion we or they will disclose your data." You may consider the information private. In that case, the privacy policy is pretty clear that it doesn't belong on Facebook.