Cloud Computing Case Clarifies Applicability of US Privacy Law to Non-U.S. Nationals

By Susan Altman

The Ninth Circuit Court of Appeals, in its October 3, 2011 decision in Suzlon Energy Ltd v. Microsoft Corporation, has taken another step in defining the rights of people to protect their emails from being disclosed in civil court proceedings. The question before the Suzlon court was whether a party can require a U.S. electronic communication service provider to produce emails stored on a U.S. server for the account of a non-U.S. national without regard to the safeguards and restrictions imposed by the Electronic Communications Privacy Act of 1986 (ECPA). The court answered with a clear “no,” stating that the protections of the ECPA against unrestricted disclosure of emails by an electronic communication service provider apply to non-U.S. nationals as well as to U.S. citizens.

The Suzlon case originated out of an Australian civil claim by Indian wind energy company Suzlon against Indian citizen Rajagopalan Sridhar, a former employee accused of committing fraud against the Suzlon empire through a multijurisdictional shipping scam. In the course of the Australian action, Suzlon’s lawyers sought to obtain Sridhar’s emails, which resided in a Microsoft Hotmail email account on a server located in the U.S. Sridhar did not consent to the production of his emails (nor did he consent in a related case where Google was the electronic communication service provider). Microsoft objected to the production of the emails and both the U.S. District Court for the Western District of Washington and the Ninth Circuit agreed that Sridhar was protected by the ECPA. (In an interesting procedural sidenote, the court summarized the arguments presented to the lower court relating to assistance to foreign tribunals and outlined how a U.S. federal court ends up in the position of ruling on what is essentially a discovery issue relating to an Australian case.)

The Suzlon case provides useful guidance to electronic communication service providers offering cloud services in the U.S. Certainly those within the jurisdictional reach of the Ninth Circuit, and most likely service providers throughout the U.S., can operate with the expectation that the ECPA will apply to all customers using a U.S. account. The service providers will not have to distinguish between U.S. citizens and non-U.S. nationals in determining rights to stored emails. Litigants will have to follow the same procedures in filing motions to compel production regardless of citizenship. The decision will not affect issues of national security as it does not address law enforcement action in any way. The Suzlon case doesn’t change the world, but it does add a small measure of clarity.