Facebook Fights Virginia's Demand For User Account Data

(CBS/Facebook)

On Monday, CBSNews.com has learned, the Virginia's Workers Compensation Commission said it was no longer going to levy a $200-a-day fine on the social networking site for refusing to comply with a subpoena from an airline that previously employed a flight attendant named Shana Hensley.

Facebook had objected to the June 4, 2009 subpoena from Colgan Air -- the Manassas, Va.-based company that operates under the names United Express, US Airways Express, and Continental Connection -- on privacy grounds. It said federal law prohibits divulging user data in response to a subpoena, and promised to "further litigate this issue by seeking, among other things, an injunction from the federal courts."

In principle, this isn't a novel concept: employers and insurance companies have long used private investigators to ferret out fraud and show that someone who claims to be a virtual cripple actually participates in waterskiing competitions.

Because social networking sites offer such information-rich glimpses into a person's private life, insurers and employers have begun eyeing them. A personal injury lawyer in Elmira, N.Y. noted in July that an accident victim claiming to be severely injured was, thanks to Facebook, revealed to be playing in soccer games. An article last week in Business Insurance said that social networking sites revealed exaggerated claims of injuries from a judo instructor, a bowler, and a rodeo bronco rider.

In the Colgan Air case, Facebook says it's happy that privacy rights prevailed. "We're pleased with the outcome and that our users' information will be protected," said Facebook spokesman Barry Schnitt.

Colgan Air, which is owned by the publicly-traded Pinnacle Airlines Corp., initially paid Hensley's disability benefits that were related to a back injury while on the job (she was diagnosed with a herniated disc but did not want surgery). After about 18 months, however, Colgan Air claimed that Hensley was not cooperating with its efforts to find her a desk job, and appears to have concluded that Hensley's holiday vacation photos posted on her Facebook account would demonstrate that any back problems were not severe.

The airline's June 4 subpoena from Virginia attorney Charles Midkiff demands "all documents, electronic or otherwise, related directly or indirectly, to all activities, writings, photos, comments, e-mails, and/or postings" on Hensley's Facebook account.

Six days later, Facebook responded, saying that the request must come from a California court, and that it was "overly broad" because the federal Electronic Communications Privacy Act (ECPA) protects the privacy of user accounts. Midkiff, the airline's lawyer, replied by requesting a "contempt citation against Facebook" from the Virginia's Workers Compensation Commission.

Randolph Tabb, a deputy worker's compensation commissioner, granted it. On August 28, Tabb held Facebook in contempt for "a failure to comply" and ordered a $200-a-day fine "until such time as compliance is satisfied by the production of said documentation."

Facebook's response to Tabb sent last week says that "users such as Ms. Hensley rely on Facebook to protect their data and vigorously enforce the privacy decisions they make on Facebook." It adds: "Courts have interpreted the ECPA to prohibit services such as Facebook from producing a non-consenting subscriber's communications even when those communications are sought pursuant to a court order or subpoena."

Put another way: Unless you change your mind, we'll see you in federal court.

It worked. Tabb backed down, reversing his previous ruling and fine, and claimed that Facebook should have made the full scope of its objections clear earlier.

James Szablewicz, Virginia's chief deputy worker's compensation commissioner, said in an interview on Monday that he didn't know of any other case involving Facebook that his colleagues have faced. "I think it's a pretty good chance that this is a case of first impression for us," he said.

Privacy advocates applauded Monday's decision, likening it to Google's mostly-successful effort to fend off a subpoena from the Justice Department three years ago. Jim Dempsey, a vice president of the Center for Democracy and Technology, said: "Too often, lawyers in civil cases are turning to service providers like Facebook, AOL and Google with fishing requests. The law is clear -- service providers cannot turn over content in civil cases."

Kevin Bankston, a senior staff attorney at the Electronic Frontier Foundation, said the principles are similar to the one involving Apple Computer's efforts to unmask product leakers (the case is O'Grady v. Superior Court). "We were very glad to see that the rule of law we helped to establish in the O'Grady case is being used to ensure that Facebook content is not disclosed in violation of federal privacy statutes."

There's an ironic ending to this story. Julie Heiden, a Virginia personal injury lawyer representing the former flight attendant, Shana Hensley, said in an interview on Monday that the subpoena won't be necessary after all.

"We agreed to sign a release," Heiden said, meaning a document that authorizes Facebook to disclose the contents of Hensley's account to her former employer. "Shana has executed the release... She has nothing to hide."

Update 9/15/2009: Colgan Air spokesman Joe Williams says: "As you might expect, we do not comment on pending litigation."