The U.S. Congress has enacted several statutes addressing unauthorized access to computer systems, commonly known as “hacking.” These statutes include both civil and criminal components. The Stored Communications Act (SCA), 18 U.S.C. § 2701 et seq., deals with digital information stored by third parties, usually internet service providers (ISPs). It comes into play when someone accesses another person’s email or other stored communications data without authorization. The statute allows civil claims in certain cases. 18 U.S.C. § 2707. When an employer accesses an employee’s online information without permission, it could be liable to the employee for damages under the SCA.
Third-party ISPs include companies that provide internet access, email servers, and social media services. The use of a third-party ISP involves voluntarily entrusting personal information to someone else’s care. The SCA seeks to protect people’s privacy rights with regard to this information against both the government and private individuals and entities. The Fourth Amendment to the U.S. Constitution guarantees people’s right to “be secure in their…papers and effects,” but voluntarily turning materials over to a third party can negate the Fourth Amendment’s protection. The SCA extends Fourth Amendment-like protections against government access to stored communications. Since non-government actors are not constrained by the Fourth Amendment, the SCA also prohibits unauthorized access by private actors.
The same principle that excludes voluntarily disclosed information from Fourth Amendment protection also applies to the SCA. The “authorized user exception” states that SCA protection does not apply to “conduct authorized…by a user of that service with respect to a communication of or intended for that user.” 18 U.S.C. § 2701(c).