Can I be sued for failing to secure an email I didn&#39;t request? I work for a company that services schools across the US and we receive email communications from them all the time. On occasion I receive emails with blocks such as the following in their signatures: PRIVACY &amp; CONFIDENTIALITY OF INFORMATION NOTICE: This communication may contain non-public, confidential, or legally privileged information intended for the sole use of the designated recipient (s). If you are not the intended recipient, or have received this communication in error, please notify the sender immediately by reply e-mail or by telephone and delete all copies of the communication, including attachments, without reading them or saving them to disk. If you are the intended recipient, you must secure the contents in accordance with all applicable state or federal requirements related to the privacy and confidentiality of information, including the FERPA and HIPAA Privacy guidelines. Under Florida law, e-mail addresses, and all forms of communications, including e-mail communications, made or received in connection with the transaction of School Board business are public records, which must be retained as required by law and must be disclosed upon receipt of a public records request, except as may be excluded by federal or state laws. If you do not want your e-mail address released in response to a public records request, do not send electronic mail to this entity. Instead, contact this office by phone. My question regards the tail ends of both paragraphs. In both cases is appears that I'd be subject to binding by law or reductions in my privacy due to an email I may never have requested. In particular the first paragraph suggests that a public entity could contact me(provided they intended to) and I can then become responsible for securing the contents of an email I may never have requested or anticipated. The second paragraph seems to suggest that my email address could become public record if I responded to a message sent in error(it lacks the clause about intended recipient). It seems backwards to make my information public based on interacting at all with the sender of an email I received. The precise question is this: Can this school cause me to come under the authority of Florida public records law or make me subject to disclosure agreement regarding the information simply by sending it to me? Is there any requirement for at least implied consent? (In case it matters, I don't have any great need to do so, I'm just curious at the presumptive language used in the notice). Edit: The linked answer provides information for one of the clauses and suggests a possible answer for the rest, but doesn't provide for the disclosure clause regarding my own email. I've edited the question to try to twine them together more clearly. The whole concern is the ability of another entity to essentially opt me into an agreement, wherein the only real consent is opening a communication I received to see what it might be.
The second paragraph actually says that your e-mail address will become public record if you send an e-mail message to them. That's because there's a Florida law that requires this. If you want to communicate with the school without your e-mail address appearing in the public record, you can call on the telephone, send postal mail, or visit in person. The notice is precisely there to inform you of the fact that sending e-mail to the school will have this effect, and it helpfully mentions one of the ways you can avoid that outcome: If you do not want your e-mail address released in response to a public records request, do not send electronic mail to this entity. Instead, contact this office by phone. If you think about the nature and purpose of public records laws, you will perhaps understand why the Florida law does not speak of consent or allow those corresponding with affected entities to opt out. If that were possible, then people who were conducting improper business with the public entities would withhold consent or otherwise opt out, making the public records law useless in the service of its goal of increasing transparency in government.
If law enforcement is actually requesting an encryption key, talk to a real lawyer. To answer your first question, the answer is &quot;the government probably can't demand the password, but might be able to demand the data.&quot; Some courts have ruled that the Fifth Amendment can prevent courts from forcing someone to decrypt data for the government, because the act of decrypting the data conveys information (see United States v. Doe from the 11th Circuit). Other courts have ruled that there are situations where that is not the case (US v. Fricosu, In re Boucher). Boucher is particularly interesting because the government first asked for the password itself, and then (when that subpoena was quashed by the magistrate) narrowed its request to the decrypted data on appeal. In the magistrate's opinion, we see Also, the government concedes that it cannot compel Boucher to disclose the password to the grand jury because the disclosure would be testimonial. It is not generically a violation of the Fifth Amendment to compel production of documents (the 11th Circuit, quoting the Supreme Court, considered this a &quot;settled proposition&quot;). The issue is that the act of producing the documents can be considered testimony -- by producing the documents, the person is showing that they know the documents exist, where they are, how to read them, etc. Possession of the key to decrypt a file links you to that file, because keys are generally kept secret. In the 11th Circuit case, the court found that the government didn't know for a fact that a) Doe could decrypt the files, and b) what files existed on the encrypted drive. In the cases where forced decryption was allowed, the government had seen enough to independently show that the files existed, were authentic, and that the defendant had actual control/possession over them. The 11th Circuit asked for a bit more (the location), based on a standard that is in effect in some circuits but not others. In any event, courts seem to generally consider this to take a court order to force production of anything; the police can't just order you to do it.
Am I correct in arguing that the LHD never really had implied consent to begin with? In other words, does the failure to honour the express refusal inform us about the legitimacy of prior claims of implied consent? No. They had implied consent and had not intent at the outset to dishonor it. They have violated the patient's privacy right when consent was expressly withdrawn, and they discovered that they cannot easily comply and therefore did not comply. The fact that they have made it expensive for themselves to comply with their legal obligations going forward does not imply that they lacked implied consent at the outset, so they should have no liability for the time period from when the training materials started to be used until the time when implied consent ended. They are only responsible going forward for their failure to honor the patient's wishes. It is not at all exceptional for a legal obligation to turn out to be more difficult to comply with when it arises than was anticipated when the systems that make the legal obligation difficult to comply with were implemented. Health care companies aren't expected to be prophets who can foresee the complex confluence of factors that has painted them in a corner, particularly when a situation has never come up before the current one. It is likely that no one person was ever even simultaneously aware of all the facts necessary to know that this could happen. Someone in the IT department will often not be intimately familiar with what is going on in the training part of the operation and what the privacy rules that apply are and even if someone was, that someone may have been in no position to do anything about it at the time. Health care providers aren't supposed to be evaluated with 20-20 hindsight. Given that they almost surely did not and could not easily have known that they had made a future express withdrawal of consent very difficult to effectuate, scienter can't be attributed to it. And, honestly, they are in more than enough trouble simply trying to deal with the problem post-express withdrawal of consent when they did start to violate privacy laws.
If someone sends you something that you did not request, that is &quot;unordered merchandise&quot;, and under US law, can be treated like a gift meaning that you do not have to return the goods or pay for it. Under the circumstances that you describe, this is not classic unordered merchandise. The vendor simply has to claim (and prove) that you did order the merchandise, which could be done in small claims court. What is unclear at present how any person could, out of the blue, decide to send you the same thing a week later. Innocent error is one possibility (slip-up by either party or some communication error by Ebay), as is fraudulent skullduggery (credit card fraud). The point is that the vendor would have to prove that you did indeed order the goods, so if they want to avoid paying for shipping (if we are still talking about a non-litigious response), they would need to provide compelling proof that you did indeed order the goods. This almost certainly will involve Ebay's tech staff (who would be in the best position to say where the order actually came from). So, yes, you could be sued in small claims court, and it really depends on how strong their proof is that you ordered the goods.
I drafted this answer many days ago but did not complete it. My intention is to define red flag notice. However, I'm hitting Submit because I think it's a good question and hope this will inspire other answers. It seems like your immediate question, regarding the DCMA notices which Google is forwarding, is not a legal question. It is a question that can only be answered by Google and is dependent on their practices. Frankly though, it seems to me that Google search results might not be important based on the purpose of your proxy service. However perhaps your user base has evolved. You are a service provider under 17 USC 512(k)(i). If you aren't we need to clear that up! As for the copyright holders, you haven't received notice complying with 17 USC 512 (c)(3)(A)(i-iv). As such you don't have notice. Even if these notices don't qualify then we argue about whether you have red flag notice - based on facts and circumstances. (See Grokster) EDIT TO ADD: 17 U.S. Code § 512 - Limitations on liability relating to material online is one of the sections created by the DMCA. It is sometimes referred to as the safe harbor. You can read about it on Wikipedia® page for the Online Copyright Infringement Liability Limitation Act. If you read that Wikipedia® page you will see a short section on Red Flags. They say it as well as I could: [In addition to notice from a copyright holder, the second way] that an OSP can be put on notice that its system contains infringing material, for purposes of section 512(d), is referred to the "red flag" test. The "red flag" test stems from the language in the statute that requires that an OSP not be “aware of facts or circumstances from which infringing activity is apparent.” The "red flag" test contains both a subjective and an objective element. Subjectively, the OSP must have knowledge that the material resides on its system. Objectively, the "infringing activity would have been apparent to a reasonable person operating under the same or similar circumstances." The reason that notice is important is that the safe harbor provided is only available if you do not know that infringing is happening. Plaintiff's prove knowledge through the letter or through red flags. I am glad that you asked about Grokster, because that was the wrong case! The case to look at is Viacom Int'l, Inc. v. Youtube, Inc., 676 F.3d 19, (2nd Cir., 2012). The difference between actual and red flag knowledge is thus not between specific and generalized knowledge, but instead between a subjective and an objective standard. In other words, the actual knowledge provision turns on whether the provider actually or “subjectively” knew of specific infringement, while the red flag provision turns on whether the provider was subjectively aware of facts that would have made the specific infringement “objectively” obvious to a reasonable person. The red flag provision, because it incorporates an objective standard, is not swallowed up by the actual knowledge provision under our construction of the § 512(c) safe harbor. Both provisions do independent work, and both apply only to specific instances of infringement. In other words, you lose your safe harbor protection if you know of facts and circumstances that would lead an ordinary person to know that infringement is happening. So the question for you is - do the letters forwarded by Google mean that you have knowledge and are outside of the safe harbor? Well that's the question that lawyers fight about! In fact Columbia Pictures Indus., Inc. v. Fung, 710 F.3d 1020 (9th Cir., 2013) is all about that fight. If you read that case you will see that Fung was doing a bunch of shit that totally made it completely obvious that he was infringing. And he was earning money directly from it. He was screwed from the start. Now again, this does not really help you with the google blacklist problem, but it should help you understand what you need to do as a service provider to not be complicit in copryright infringement. You really should read the Fung case and 17 U.S.C. § 512 - they will go a long way to help you understand the analysis a court will apply. EDIT Regarding your legal exposure, I always assume that a cease and desist letter will precede a lawsuit. With that said, only you know how much infringing is coming across your server. Fung made his money directly from the infringement. He attracted website visitors specifically because of the infringement. He had emails and other documents proving this. Diebold is interesting because they attempted to use copyright to control the spread of their emails. First the court said no commercial harm and no diminishment of value of the works. Then the court found that the stuff wasn't even subject to copyright. This is obviously not a typical case. But it sounds like you see yourself as OPG in this case. I don't see how you can become a plaintiff against bona fide copyright holders who follow the links as far as your server. As I understand it, you are a reasonable target of the the notices, that's the result of running the proxy. However, I might be getting out of my technical depth here. As I intimated earlier, you might need to seek out some strategic advice regarding dealing with Google and the specific steps you might take to stay in the right side of their enforcement.
This is not legal advice, It is not even primarily a legal opinion. It is a legal position. The lawyer, acting on behalf of the agency from which you requested information, is giving the reasons why that agency is declining your request. The lawyer is presumably either an employee of the agency, or has the agency as a client. In any case, this is notice of the position that the agency would be likely to adopt if you took further legal action, such as a suit to compel disclosure. Lawyers provide such position statements ion behalf of clients or employers all the time. Such statements indicate why certain action is taken, what basis the client or employer has for taking or not taking certain action, and often indicate the nature of the defenses or theories that will be used should a lawsuit follow, although the client or employer is free to change the theory at the pleading stage. Not only is it not unethical for the lawyer to respond in this way, the agency is, I am fairly sure, required by the law to provide a valid reason when a request is declined. That is what they have done, provide a reason that they claim is valid, with some legal reasoning about why it is valid. Note that I express no view on whether the reason given is in fact valid, or would be sustained in a suit. That would be a different question.
Option 1 is that this is a private school. The school can establish whatever rules they want. There might be a cause of action for breach of contract, but more likely there is some clause saying &quot;You have to do what the principal tells you&quot;. Private organizations are allowed to completely suppress you freedom of expression. Option 2 is that this is a public school, in which case they are bound by the First Amendment (which is a limit on government action). Such a prohibition is legally untenable, but you may have to go to court to get an official ruling on the matter. If speech is objectively disruptive, it can be limited, but your examples are not objectively offensive or disruptive, they are simply somewhat provocative. Here is a summary from the ACLU of what public schools can't do w.r.t. student appearance.
California Penal Code 647f states that being intoxicated in public is prohibited. When the police arrived, they were confronted with probable cause for an arrest. They (presumably) became aware of the matter because the doctor called the police, since she believe that you would drive drunk. (We can inquire into whether that was a reasonable belief, but it doesn't matter, what matters is that she had the belief and acted on it). Now the question is whether the doctor acting on the belief (making the call) was legal. A negative answer does not affect the legality of the arrest. There is also a law imposing on medical professionals a duty to report, which is fairly wordy, but does not seem to directly require reporting the fact that a person is publicly intoxicated. However, attending circumstances could have suggested one of the triggering causes for mandatory reporting (wounds, for example). Again, it does not matter (to a point) if, in the light of close scrutiny, the doctor's conclusions were mistaken. When doctors are required to report facts to the police, reasonable over-reporting is not penalized. There is also no law against calling 911 to report a potential DUI (the usual public-campaign focus is on those actually driving). So calling the police under the circumstances falls between "allowed" and "required". The HIPAA privacy rule could be relevant because that theoretically could block the doctor from making the call. (Note that the doctor, and not the patient, is bound by the confidentiality requirements). §160.203 allows exceptions to the confidentiality requirement if "necessary... For purposes of serving a compelling need related to public health, safety, or welfare", so an exception may have been granted. If this was done within the scope of a mandatory reporting law, it is legal to disclose PHI; under §164.512 it is allowed, "to prevent or lessen a serious and imminent threat to the health or safety of a person or the public". A confidentiality agreement would not increase your chances of being arrested. If the doctor's confidentiality statement were less restrictive than HIPAA, HIPAA prevails (the law trumps contract terms). If it is the same as HIPAA, it has no effect (and simply states what HIPAA says – the normal case). If the agreement were more restrictive, it is possible that the doctor calling the police would be a breach of contract, unless the call was required by law. You would have to see what in the agreement would have prohibited calling the police. But that would not affect the validity of the arrest. To re-phrase the matter: the arrest was because you were found to be intoxicated in public. The police were there and could judge your state (probable cause). They were there by permission of the property owner, so the arrest was not unlawful for lack of a warrant. That is as far as one can go in searching for an illegality to the arrest itself. One might go further and ask whether the doctor has committed an actionable wrong by calling the police with her suspicions. This could go either way: it really depends on the full set of details, regarding your condition. If the doctor suspected that your actions fell under one of the mandatory reporting categories, she had to report, and otherwise it is not prohibited under HIPAA. If a person is intoxicated and answers the question "Would you normally proceed to drive home in this state?" in the affirmative, then it is a reasonable inference that the person will do so. An answer "No, absolutely not", on the other hand would work against the "public danger" inference: that has no effect on the arrest, but could have an effect in a suit against the doctor (violation of the privacy rule). In such a suit, the doctor's defense would presumably be that despite the answer, she still had a reasonable belief that you were a public danger. Then the matter would reduce to what other facts she knew of that would support a public danger conclusion.