Hately v. Watts

• Decision Date: 06 March 2019
• Docket Number: No. 18-1306,18-1306
• Citation: 917 F.3d 770
• Parties: Patrick HATELY, an Individual, Plaintiff – Appellant, v. Dr. David WATTS, an Individual, Defendant – Appellee. The Center for Democracy & Technology; The Electronic Frontier Foundation; New America’s Open Technology Institute, Amici Supporting Appellant, Digital Justice Foundation, Amicus Supporting Appellee.
• Court: U.S. Court of Appeals — Fourth Circuit

917 F.3d 770

Patrick HATELY, an Individual, Plaintiff – Appellant,

v. Dr. David WATTS, an Individual, Defendant – Appellee.The Center for Democracy & Technology; The Electronic Frontier Foundation; New America’s Open Technology Institute, Amici Supporting Appellant,Digital Justice Foundation, Amicus Supporting Appellee.

No. 18-1306

United States Court of Appeals, Fourth Circuit.

Argued: October 30, 2018

Decided: March 6, 2019

ARGUED: Eric James Menhart, LEXERO LAW, Washington, D.C., for Appellant. Jonathan David Frieden, ODIN, FELDMAN & PITTLEMAN, P.C., Reston, Virginia, for Appellee. ON BRIEF: James P. Miller, ODIN, FELDMAN & PITTLEMAN, P.C., Reston, Virginia, for Appellee. Marta F. Belcher, James R. Batchelder, Monica A. Ortel, James H. Rickard, East Palo Alto, California, Evan Gourvitz, Lance W. Shapiro, New York, New York, Kathryn C. Thornton, ROPES & GRAY LLP, Washington, D.C.; Gregory T. Nojeim, CENTER FOR DEMOCRACY & TECHNOLOGY, Washington, D.C.; Andrew Crocker, ELECTRONIC FRONTIER FOUNDATION, San Francisco, California; Kevin Bankston, NEW AMERICA’S OPEN TECHNOLOGY INSTITUTE, Washington, D.C., for Amici The Center for Democracy & Technology, The Electronic Frontier Foundation, and New America’s Open Technology Institute. Andrew Grimm, DIGITAL JUSTICE FOUNDATION, Omaha, Nebraska, for Amicus The Digital Justice Foundation.

Before GREGORY, Chief Judge, MOTZ and WYNN, Circuit Judges.

Reversed and remanded by published opinion. Judge Wynn wrote the opinion, in which Chief Judge Gregory and Judge Motz joined.

WYNN, Circuit Judge:

Patrick Hately brought this action alleging that David Watts unlawfully accessed messages in Hately’s web-based email account in violation of the Virginia Computer Crimes Act and the federal Stored Communications Act. But the district court found that Hately failed to demonstrate the requisite statutory injury under state law, and that Hately’s previously opened and delivered emails stored by a web-based email service were not in statutorily protected "electronic storage" under federal law. We disagree with both determinations and therefore reverse and remand this case to the district court for further proceedings consistent with this opinion.

I.

A.

In August 2008, Hately enrolled at Blue Ridge Community College ("Blue Ridge College"), a constituent institution of the Virginia Community College System. At Blue Ridge College, Hately had a student email account that he continued to use after he graduated in 2013.

Blue Ridge College uses a web-based email client with branding specific for Blue Ridge College. Google hosts all emails.¹

Account holders can access the copies stored on their web-based email page as long as the student does not delete those copies. Blue Ridge College also stores at least one additional copy of all student emails, which can be used to recover any email that is accidentally deleted. Students may access these stored copies only by requesting them from Blue Ridge College’s technical support personnel.

From August 2011 to February 2015, Hately had an intimate relationship with Nicole Torrenzano ("Nicole"), with whom Hately has two children. During their relationship, Hately and Nicole shared login and password information for their email accounts—including Hately’s Blue Ridge College email account. But when, about March 2015, Nicole informed Hately that she also was involved in an intimate relationship with Watts, who was her co-worker and married to Audrey Hallinan Watts ("Audrey"), Hately and Nicole separated. Pertinent to this action, Hately did not change the password that he shared with Nicole for his Blue Ridge College email account.

Watts and Nicole continued their personal relationship, and during the fall of 2015, Watts and Audrey initiated divorce proceedings. In an effort to help Watts in his divorce proceedings, Nicole told Watts that Hately and Audrey were having an affair. Nicole said she knew of emails between Hately and Audrey that Watts could obtain by using the password that she had to Hately’s Blue Ridge College email account.

Watts stated that he used the password Nicole gave him to browse through Hately’s emails but contended that he "did not open or view any email that was unopened, marked as unread, previously deleted, or in the [student email account]’s ‘trash’ folder." J.A. 506. Watts also said that he did not "change the status of, or modify, any email in any way." Id.

B.

In September 2016, Hately filed his first lawsuit against Watts and Nicole in the United States District Court for the Eastern District of Virginia ("Hately I "), alleging that they unlawfully accessed his email, in violation of: (1) the federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030 ; (2) the federal Stored Communications Act, 18 U.S.C. § 2701, et seq. ; and (3) the Virginia Computer Crimes Act, Va. Code Ann. § 18.2-152.1, et seq. Shortly after filing suit, Hately voluntarily dismissed his claims against Watts, without prejudice, and amended his complaint against Nicole. In his amended complaint, Hately alleged that he "incurred actual damages by the illicit access because [he] was forced to incur damages in time invested, software purchases to track and prevent future access, and more[.]" J.A. 39 ¶ 93. He further alleged that he had "incurred many hours of valuable time away from day-to-day responsibilities in attempting to determine the source of the computer breach." J.A. 37 ¶ 76.

In an order dated December 2, 2016, the district court in Hately I dismissed "without prejudice" Hately’s Computer Fraud and Abuse Act and Virginia Computer Crimes Act claims against Nicole. The order provided no explanation as to why the court dismissed those claims. But in a subsequent opinion addressing a different issue, the court explained: "[a]lthough [Nicole] moved to dismiss the [Virginia Computer Crimes Act] Claims on multiple grounds, the Court dismissed the [Virginia Computer Crimes Act] Claims because [Hately] failed to sufficiently allege how he sustained any injury to person or property by reason of a violation of the [Virginia Computer Crimes Act]." Hately v. Torrenzano , No. 1:116-CV-01143 (GBL/MSN), 2017 WL 2274326, at *3 (E.D. Va. May 23, 2017). The district court did not dismiss Hately’s Stored Communications Act claim.

On February 13, 2017, Hately moved to amend his complaint for a second time. This time, Hately sought to rename Watts as a defendant and to reinstate his Computer Fraud and Abuse Act and Virginia Computer Crimes Act claims against Nicole. The district court denied the motion solely on grounds that Hately’s "attempt to amend the complaint would cause undue prejudice to [Nicole]." Hately v. Torrenzano , No. 1:16-CV-01143 (GBL/MSN), 2017 WL 1428712, at *1 (E.D. Va. Apr. 20, 2017). According to the court, amending the complaint "would certainly require the Court to reopen discovery for Watts" and would "change the nature of this litigation" by "add[ing claims] to what would otherwise be a narrow case involving a single cause of action under the Stored Communications Act[.]" Id. Hately did not appeal the Hately I court’s denial of his motion to amend.

C.

In April 2017, Hately refiled his action against Watts, again alleging that Watts unlawfully accessed his email, in violation of the Computer Fraud and Abuse Act, the Stored Communications Act, and the Virginia Computer Crimes Act.

Unlike his initial action against Watts, which was voluntarily dismissed without prejudice, Hately’s refiled action supported his Virginia Computer Crimes Act claims by reciting additional factual allegations bearing on damages. Hately , 2017 WL 2274326, at *3. For example, whereas Hately’s initial complaint alleged that Hately "incurred many hours of valuable time away from day-to-day responsibilities in attempting to determine the source of the computer breach," J.A. 37 ¶ 76, Hately’s complaint in the refiled action provided greater detail as to the time he lost as a result of the breach, alleging that he "was forced to identify" and make "several calls to" Blue Ridge College’s technical support personnel "in order to ascertain the individual(s) that owns the domain for his school-related email account, as well as the individual(s) that manages the exchange servers for his school-related email account." J.A. 165 ¶¶ 94–96. And Hately’s refiled complaint alleged that he "review[ed]" "hundreds or thousands of email messages" and "restore[d]" "deleted but unread email messages" that "were previously unknown to [Hately]." J.A. 166 ¶¶ 97–98. Also, the refiled complaint alleged that Hately was "forced to download and run programs that scanned his mobile telephone for viruses." J.A. 170 ¶ 115.

After conducting a hearing on July 6, 2017, the district court dismissed the Virginia Computer Crimes Act claims against Watts for two independent reasons.² First, the court held that the Virginia Computer Crimes Act claims were barred by collateral estoppel. The court explained in an oral ruling that "[a]ll of the damages that [Hately] alleges in this [instant] action ... were the subject of [a prior motion to dismiss in Hately I ], and that issue was fully briefed and argued in open court in the prior proceedings." J.A. 377. Even though the Hately I court dismissed the Virginia Computer Crimes Act claims "without prejudice," the district court concluded that the previous dismissal had "finally determined" that Hately had not "sustained injury to person or property" under the Virginia Computer Crimes Act. J.A. 382. Accordingly, the district court held that Hately was "estopped from relitigating those injury claims." Id. Second, the district court concluded that, even if collateral estoppel did not apply, Hately failed to plausibly allege statutory injury, notwithstanding that Hately’s new complaint included additional factual allegations bearing on injury. J.A. 383 (holding that Hately had "not alleged facts that make plausible his claim that he has sustained injury to person or property as those terms have...