State high court weighs access to social media posts

A murder defendant subpoenas social media posts by the victim and a prosecution witness to show that the victim had threatened the defendant and that the witness had a motivation to lie. But the federal Stored Communications Act says that the social media provider can't disclose stored electronic communications -- which everyone agrees include posts on social media platforms -- unless the user consents, or a law enforcement agency serves a search warrant through other specified paths. Consent is unlikely; the victim is dead and the witness cannot be found. And although the prosecution did obtain some social media posts by the persons in question, and turned over to the defendants any posts it viewed as potentially exculpatory Brady material, the prosecution declines to use its power to seek the additional information that the defense wants to review.

What's a social media provider to do in this situation? And what is a court to do about it? Those are the questions the California Supreme Court confronted in deciding Facebook v. Superior Court, 2018 DJDAR 4883, late last month.

The social media providers in Facebook -- who included Twitter and Instagram -- maintained that, in the absence of user consent, they couldn't disclose any of the communications at issue unless the government sought them through a warrant or other process specified in the SCA. The criminal defendants did not challenge this view, but insisted that the Fifth Amendment right to due process and the Sixth Amendment right to the effective assistance of counsel prevailed over the terms of the statute, which they asked to be declared unconstitutional to the extent it conflicted with those rights. The trial court agreed with the defendants; the Court of Appeal agreed with the providers.

The California Supreme Court found a middle ground on its own initiative. After calling for supplemental briefing on the point, the court held that account holders had implicitly consented to the disclosure of any communications that were configured to be available to the general public. This took a little fancy footwork. There was a provision that relieved individuals of criminal liability under the SCA for accessing information configured to be available to the general public, but that provision (which is not included in the SCA) said nothing about the prohibition on disclosure by providers. The court relied on some statements in the SCA's legislative history suggesting that configuring a communication to be available to the general public implicitly amounted to consent within the meaning of the SCA's anti-disclosure provisions.

The court remanded the case for further development of the factual record, both to determine whether any of the posts at issue were configured to be available to the general public, and, as to any communications not so configured, whether defendants could obtain the communications from addressees or others with the right to view or receive them. After 20 pages of legal discussion to arrive at its holding, however, the court delivered another 20 pages discussing "issues regarding the statutory question that have been raised by the parties in their supplemental briefs."

First, the court rejected the criminal defendants' effort to expand the public configuration loophole to include communications that were made accessible only to a specified group of people. Those configurations were effectively public, the defendants claimed, because each recipient could forward or re-post any communication received.

On the other hand, the court rejected the social media providers' argument that the SCA allowed them discretion to decide whether to comply with a subpoena, even if the sought-after information was not subject to the SCA's disclosure prohibitions, whether because of consent or otherwise. The court found no congressional intent to override the discovery process generally.

The court declined to assess the effect of a user's deletion of a communication, or reconfiguration from public to private, on the anti-disclosure prohibition. It did hold, however, that providers must have an opportunity to prove that a particular communication or account was configured as public by someone other than an account holder. The court recognized various legal bases for relieving providers of discovery obligations that imposed an undue burden, but also left that issue for further development and resolution on remand. Of further interest, the court invited the parties on remand to address two issues presented in a later but fully briefed Facebook v. Superior Court, S243203: "whether a trial court may compel a witness to consent to disclosure by a provider," subject to appropriate limitations, and "whether a trial court may compel the prosecution to issue a search warrant under the [SCA], on behalf of a defendant." Yet it would seem unlikely that these issues could be resolved by the trial court and court of appeal before the California Supreme Court decides the queued, fully briefed case.

The court's core holding rests on a weak legal foundation in light of the seemingly contrary plain text of the SCA; that holding is also suspect as a matter of fact. While some users familiarize themselves with privacy settings, and many providers routinely users to do so, it is not at all clear as a matter of common sense that privacy settings should be equated with consent to disclosure by service providers.

Yet the practical significance of the court's decision is tough to gauge. Communications that are configured to be available to the public should be available to criminal defendants and everyone else without judicial assistance. And the California Supreme Court did not resolve the status of communications that had been deleted or reconfigured to be restricted -- or of communications within accounts that had been deleted, closed, or reconfigured. The toughest questions seem to be ahead of the court, not behind it.