Case: Chelsea Chaney v. Fayette County Public School District1
Facts: Chelsea Chaney was a seventeen-year-old high school student in Fayette County, Georgia. At a
county-wide Internet safety seminar, Curtis Cearley, the District’s technology director, presented a
PowerPoint slideshow to illustrate the permanent and often-embarrassing nature of social media
postings. The first slide features a cartoon of a curious daughter who discovers her mother’s old
Facebook page, listing her hobbies as “body art, bad boys, and jello shooters.” The next slide showed
Chaney in a bikini posing with a life-size cutout of rapper Snoop Dogg making the point that “Once It’s
There, It’s There to Stay”. The slide included Chaney’s full name. Cearley distributed copies to
everyone in attendance. Cearley had found Chaney’s photo while searching Facebook for materials to
use in his presentation. Her page had a semi-private setting that allowed her Facebook “friends” and
“friends of friends” to view her page. Neither Chaney nor her parents consented to the use of her
picture.
Chaney was embarrassed and humiliated. In her view, Cearley had publicly implied that she was a
sexually promiscuous abuser of alcohol who should be more careful about her Internet postings. In fact,
she contended, the picture was taken on a family vacation that did not involve sex or alcohol.
Chaney sued, claiming that Cearley and the District violated her constitutional right to privacy under
the Fourth Amendment. The District filed a motion to dismiss.
Issue: Did Chaney have a reasonable expectation of privacy in her bikini Facebook picture?
Excerpts from Judge Batten’s Decision: Chaney argues that she had a reasonable expectation in the
privacy of her Facebook picture, and that the District violated this expectation when Cearley used her
photo in his presentation.
In establishing a reasonable expectation of privacy, a person must show that she had a subjective
expectation of privacy and must show a willingness of society to recognize that expectation as
legitimate. Even if she had a subjective expectation of privacy in her Facebook photos, Chaney cannot
show that her expectation is legitimate.
Chaney contends that her privacy-setting choice of “friends and friends of friends” was “semi-private”
and that her Facebook page was accessible “only to those people she had specifically approved.”
However, Chaney fails to acknowledge the lack of privacy afforded her by her selected Facebook
setting. While Chaney may select her Facebook friends, she cannot select her Facebook friends’
friends. By intentionally selecting the broadest privacy setting available to her at that time, Chaney
made her page available to potentially hundreds, if not thousands, of people whom she did not know
(i.e., the friends of her Facebook friends).
The Supreme Court consistently has held that a person has no legitimate expectation of privacy in
information he voluntarily turns over to third parties. Chaney not only voluntarily turned over the
picture to her Facebook friends, but she also chose to share the picture with an additional audience of
unknown size, likely comprised of people Chaney did not know, subject to continuous expansion
without Chaney’s approval.
When an individual shares a photograph with his friends on Facebook, that individual has no justifiable
expectation that his ‘friends’ would keep his profile private. Chaney shared her Facebook page, which
includes her pictures, not only with her friends but their friends, too. By doing so, Chaney surrendered
any reasonable expectation of privacy. Thus, Chaney cannot show that society would be willing to
recognize her expectation of privacy as legitimate.
The fact that the photo was of Chaney in a bikini does not require a different result. People have a
reasonable expectation not to be unclothed involuntarily and/or not to be observed unclothed. However,
this case involves Chaney voluntarily posting a picture of herself in a bikini and sharing that picture on
a social media website with the broadest audience possible for a Facebook user her age.
1 2013 U.S. Dist. LEXIS 143030; 2013 WL 5486829 U.S. District Court for the Northern District of Georgia,
2013.
Because Chaney cannot show a violation of her Fourth Amendment rights, the Court will grant
Defendants’ motion on this claim.
Question: What does a person need to show to establish a reasonable expectation of privacy?
Question: Was Chaney able to prove either of these elements?
Intrusion
The tort of intrusion requires the plaintiff to show that the defendant (1) intentionally intruded,
physically or otherwise, (2) upon the solitude or seclusion of another or on his private affairs or
concerns, (3) in a manner highly offensive to a reasonable person.2
Case: Ehling v. Monmouth-Ocean Hosp. Serv. Corp.3Facts: Deborah Ehling,
a registered nurse and paramedic who worked at the Monmouth-Ocean Hospital Service Corporation
(MONOC) reacted on her Facebook page to a shooting. Her Facebook privacy settings limited access
to just “friends.” Management members were not included on her list of friend connections. A hospital
supervisor forced a coworker and friend of Ehling to access his account so that she could view
Ehling’s Facebook wall. The supervisor copied Ehling’s postings, including the following one regarding
the shooting:
An 88 yr old sociopath white supremacist opened fire in the Wash D.C. Holocaust Museum this
morning and killed an innocent guard (leaving children). Other guards opened fire. The 88 yr old
was shot. He survived. I blame the DC paramedics. I want to say 2 things to the DC medics. 1.
WHAT WERE YOU THINKING? and 2. This was your opportunity to really make a difference!
WTF!!!! And to the other guards go to target practice.
MONOC sent letters with this posting to the boards that regulate nursing and paramedics in New
Jersey. MONOC told the boards that it was concerned that this posting showed a disregard for patient
safety.
Ehling alleged that these letters were sent in a malicious attempt to damage her reputation and
possibly cause her to lose her license. She filed suit against MONOC, alleging a violation of the tort of
intrusion. The hospital filed a motion to dismiss, arguing that she did not have a reasonable expectation
of privacy in her Facebook posting.
Issue: Did Ehling have a reasonable expectation of privacy in her Facebook comment?
Excerpts from Judge Martini’s Decision: Under New Jersey law, to state a claim for intrusion, a
plaintiff must allege sufficient facts to demonstrate that (1) her solitude, seclusion, or private affairs
were intentionally infringed upon, and that (2) this infringement would highly offend a reasonable
person. Expectations of privacy are established by general social norms and must be objectively
reasonable—a plaintiff’s subjective belief that something is private is irrelevant.
Although most courts hold that a communication is not necessarily public just because it is
accessible to a number of people, courts differ dramatically in how far they think this theory extends.
[M]ost courts have adopted the concept of “limited privacy,” which is the idea that when an individual
reveals private information about herself to one or more persons, she may retain a reasonable
expectation that the recipients of the information will not disseminate it further. [In one case,]
plaintiff’s disclosure of facts to sixty people did not render them public, [but in another,] plaintiff’s
disclosure of facts to two coworkers deprived her of a reasonable expectation of privacy.
What is clear is that privacy determinations are made on a case-by-case basis, in light of all the
facts presented. In this case, Plaintiff argues that she had a reasonable expectation of privacy in her
Facebook posting because her comment was disclosed to a limited number of people who she had
2Restatement (Second) of Torts §652B (1977).
3 872 F. Supp. 2d 369 United States District Court for the District of New Jersey, 2012.
individually invited to view a restricted access webpage. Defendants argue that Plaintiff cannot have a
reasonable expectation of privacy because the comment was disclosed to dozens, if not hundreds, of
people.
The Court finds that Plaintiff has stated a plausible claim for invasion of privacy, considering that she
actively took steps to protect her Facebook page from public viewing. More importantly, however, the
question of the reasonableness of the Plaintiffs’ expectations of privacy is a question of fact for the jury
to decide. Accordingly, the motion to dismiss the Complaint is denied.
Question: What are the elements for a claim of intrusion in this case?
Answer: Plaintiff must allege sufficient facts to demonstrate that (1) her solitude, seclusion, or private
Question: Are expectations of privacy governed by subjective or objective standards?
Question: What is the concept of “limited privacy?”
Answer: the idea that when an individual reveals private information about herself to one or more
Federal Privacy Statutes
Today, instead of having a single comprehensive data privacy law, the United States has a collection of
federal privacy laws that apply to particular types of personal data. Different federal laws apply to your
consumer credit information, your medical data, and even the movies you rent.
Electronic Communications Privacy Act of 1986 (ECPA)
The ECPA prohibits unauthorized interception or disclosure of wire and electronic communications or
unauthorized access to stored communications. These are the major provisions of the ECPA:
Any intended recipient of an electronic communication has the right to disclose it.
Internet service providers are generally prohibited from disclosing electronic messages to
anyone other than the addressee, unless this disclosure is necessary for the performance of
their service or for the protection of their own rights or property.
An employer has the right to monitor workers’ electronic communications if (1) the employee
consents, (2) the monitoring occurs in the ordinary course of business, or (3) the employer
provides the computer system (in the case of email). But one thing employers cannot do is
access an employee’s social media profile by trickery or coercion.
The government has the right to access electronic communication if it first obtains a search
warrant or court order.
Children’s Online Privacy Protection Act of 1998
The Children’s Online Privacy Protection Act of 1998 (COPPA) prohibits Internet operators from
collecting information from children younger than 13 without parental permission. It also requires sites
to disclose how they will use any information they acquire.
Foreign Intelligence Surveillance Act
The Foreign Intelligence Surveillance Act (FISA) sets out the rules for the use of electronic
surveillance to collect foreign intelligence (otherwise known as spying) within the United States. In the
aftermath of the 9/11 terrorist attacks, FISA’s provisions were weakened. Now, the FISA provides
that:
To spy on people located in the United States who are communicating abroad, the government
does not need a warrant but it must obtain permission from a secret Foreign Intelligence
Surveillance Court (FISC).
Government agencies must delete irrelevant and personally identifying data before providing it
to other agencies.
The government must notify defendants if the evidence being used against them in court was
gathered in FISA surveillance.
Multiple Choice Questions
1. The following agency is charged with the regulation of electronic communications:
(a) National Security Agency
(b) Federal Trade Commission
(c) Federal Communications Commission
(d) None of the above
2. Because Blaine Blogger reviews movies on his blog, cinemas allow him in for free. Nellie
Newspaper Reporter also gets free admission to movies. Blaine ________ disclose on his blog
that he receives free tickets. Nellie _________ disclose in her articles that she receives free
tickets.
(a) must/must
(b) need not/need not
(c) must/need not
(d) need not/must
3. An employer has the right to monitor workers’ electronic communications if
(a) The employee consents
(b) The monitoring occurs in the ordinary course of business
(c) The employer provides the computer system
(d) All of the above
(e) None of the above
4. Spiro Spammer sends millions of emails a day asking people to donate to his college tuition
fund. Oddly enough, many people do. Everything in the emails is accurate (including his 1.9
GPA). Which of the following statements is true?
(a) Spiro has violated the Can-Spam Act because he has sent unsolicited commercial emails.
(b) Spiro has violated the Can-Spam Act if he has not offered recipients an opportunity to
unsubscribe.
(c) Spiro has violated the Can-Spam Act because he is asking for money.
(d) Spiro has violated the Can-Spam Act unless the recipients have granted permission to him
to send these emails.
5. Sushila suspects that her boyfriend is being unfaithful. While he is asleep, she takes his iPod
out from under his pillow and goes through all his playlists. Then she finds what she has been
looking for: Plum’s Playlist. It is full of romantic songs. Sushila sends Plum an email that says,
“You are the most evil person in the universe!” Which law has Sushila violated?
(a) The First Amendment
(b) The CDA
(c) The ECPA
(d) The CFAA
(e) None
Case Questions
1. ETHICS Chitika, Inc. provided online tracking tools on websites. When consumers clicked the
“opt-out” button, indicating that they did not want to be tracked, they were not – for ten days.
After that, the software would resume tracking. Is there a legal problem with Chitika’s system? An
ethical problem? What Life Principles were operating here?
Answer: The FTC found that this system was unfair and deceptive under Section 5 of the FTC
2. You Be the Judge: WRITING PROBLEM Jerome Schneider wrote several books
on how to avoid taxes. These books were sold on Amazon.com. Amazon permits visitors to post
comments about items for sale. Amazon’s policy suggests that these comments should be civil (e.g.,
no profanity or spiteful remarks). The comments about Schneider’s books were not so kind. One
person alleged Schneider was a felon. When Schneider complained, an Amazon representative
agreed that some of the postings violated its guidelines and promised that they would be removed
within one to two business days. Two days later, the posting had not been removed. Schneider filed
suit. Argument for Schneider: Amazon has editorial discretion over the posted comments: It both
establishes guidelines and then monitors the comments to ensure that they comply with the
guidelines. These activities make Amazon an information content provider, not protected by the
Communications Decency Act. Also, Amazon violated its promise to take down the content.
Argument for Amazon: The right to edit material is not the same thing as creating the material in
the first place.
Answer: The court held for Amazon. Editing material does not create liability under the CDA.
The court also ruled that Amazon was not liable for failing to remove the offending comments –
3. Over the course of 10 months, Joseph Melle sent more than 60 million unsolicited email
advertisements to AOL members. What charges could be brought against him? Would you need
more information before deciding?
4. Roommates.com operated a website designed to match people renting spare rooms with
those looking for a place to live. Before subscribers could search listings or post housing
opportunities on Roommate’s website, they had to create profiles, a process that required
them to answer a series of questions that included the subscriber’s sex, sexual orientation,
and whether he would bring children to a household. The site also encouraged subscribers to
provide “Additional Comments,” describing themselves and their desired roommate in an
open-ended essay. Here are some typical ads:
“I am not looking for Muslims.”
“Not acceptable: freaks, geeks, prostitutes (male or female), druggies, pet cobras, drama
queens, or mortgage brokers.”
“Must be a black gay male!”
We are 3 Christian females who Love our Lord Jesus Christ. . . . We have weekly bible
studies and bi-weekly times of fellowship.”
Many of the ads violated the Fair Housing Act. Is Roommates.com liable?
Answer: The Ninth Circuit Court of Appeals ruled that the website was liable because it
created the discriminatory questions and designed its website registration process around
5. Barrow was a government employee. Because he shared his office computer with another worker,
he brought in his personal computer from home to use for office work. No other employee accessed
it, but it was connected to the office network. The computer was not password protected, nor was
it regularly turned off. When another networked computer was reported to be running slowly, an
employee looked at Barrow’s machine to see if it was the source of the problem. He found material
that led to Barrow’s termination. Had Barrow’s Fourth Amendment rights been violated?
Discussion Questions
1. Marina Stengart used her company laptop to communicate with her lawyer via her personal,
password-protected, web-based e-mail account. The company’s policy stated:
E-mail and voice mail messages, internet use and communication and computer files are
considered part of the company’s business and client records. Such communications are not to be
considered private or personal to any individual employee. Occasional personal use is
permitted; however, the system should not be used to solicit for outside business ventures,
charitable organizations, or for any political or religious purpose, unless authorized by the
Director of Human Resources.
After she filed an employment lawsuit against her employer, the company hired an expert to access
her emails that had been automatically stored on the laptop. Are these emails protected by the
attorney client privilege? How does this case compare with Scott v. Beth Israel earlier in the
chapter?
Answer: The court ruled the attorney client privilege protected these emails. Stengart had a
reasonable expectation of privacy because she had taken steps to protect the privacy of those
2. Eric Schmidt, former CEO of Google, has written:
The communication technologies we use today are invasive by design, collecting our
photos, comments and friends into giant databases that are searchable and, in the
absence of outside regulation, fair game for employers, university admissions
personnel and town gossips. We are what we tweet.
Do you consider this a problem? If so, can the law fix it?
3. ETHICS Matt Drudge published a report on his website (http://www.drudgereport.com) that
White House aide Sidney Blumenthal “has a spousal abuse past that has been effectively covered
up…. There are court records of Blumenthal’s violence against his wife.” The Drudge Report is an
electronic publication focusing on Hollywood and Washington gossip. AOL paid Drudge $3,000 a
month to make the Drudge Report available to AOL subscribers. Drudge emailed his reports to
AOL, which then posted them. Before posting, however, AOL had the right to edit content. Drudge
ultimately retracted his allegations against Blumenthal, who sued AOL. He alleged that under the
Communications Decency Act of 1996, AOL was a “content provider” because it paid Drudge and
edited what he wrote. Do you agree? Putting liability aside, what moral obligation did AOL have to
its members? To Blumenthal? Should AOL be liable for content it bought and provided to its
members?
Answer: The court was sympathetic to Blumenthal, writing that, if it were starting with a “clean
slate” it would find for him. However, the Court continued, Congress made a different policy
4. Some European nations are considering the creation of a “right to delete” or “right to be
forgotten” online. This right would allow anyone to request that websites take down their
personal information, as long as it is not in the public interest. For example, a person would
be able to request that Facebook delete her unflattering photograph, provided the image is
not newsworthy. Is this law a good idea? Do you think it would work? Would U.S.
lawmakers ever consider a law like this? Why or why not?
5. Tracking tools provide benefits to consumers but they also carry risks. Should Congress regulate
them? If so, what should the law provide?