Bank Drops Google Suit Over Errant Gmail

A bank that sued Google after an employee mistakenly e-mailed confidential data to the wrong Gmail address has agreed to the dismissal of its case after Google provided the bank with information about the Gmail account holder.

Rocky Mountain Bank and Google filed a joint motion on Monday to dismiss the temporary restraining order (TRO) obtained by the bank and resolve the case.

"We're pleased the court granted our motion to dismiss the case and allow us to reactivate the user's account," a Google spokesperson said in an e-mailed statement.

Rocky Mountain Bank filed its lawsuit to compel Google to provide information about the Gmail account holder who accidentally received the bank's confidential data -- names, addresses, tax identification numbers, and loan information for 1,325 individual and business accounts.

Google initially refused to provide the information because the bank sought the information without formal legal process.

Rocky Mountain Bank EVP and counsel Tina Martinez did not return a call seeking comment about whether further legal action would be taken against the Gmail user who accidentally received the bank's confidential data, now that the account holder has been identified.

The bank's TRO demanded that Google and the account holder be enjoined from distributing the bank's information, that Google deactivate the account, that Google delete the inadvertently sent e-mail and the attached data file, that Google disclose whether the account is active or dormant, and that Google disclose information about the account holder if the account is active.

The extent of Google's compliance and the disposition of the account remains unclear because a document detailing the steps the company took has not been made available through Pacer.gov, the online court document database for the US.

A Google spokesperson declined to provide information about the Gmail account holder, citing company policy.

Legal experts are divided about whether the judge's decision to grant the TRO last week, deactivating the Gmail account in question, was a good one.

In a blog post, Paul Levy, an attorney with the Public Citizen Litigation Group, questioned why Rocky Mountain Bank's request for a restraining order was granted when the bank showed no legal cause for relief.

"Curiously absent from the complaint was any allegation about how either Google or the owner of the Gmail account had violated the plaintiff's rights, or any assertion of a cause of action against either Google or the anonymous account holder, that would form the basis for granting relief against either," he wrote. "Nor did Rocky Mountain's papers explain why section 230 of the Communications Decency Act entitled it to bring an action against Google, or to obtain any relief against Google, even assuming that it had a claim against the Gmail account holder."

He also suggested that a more vigorous defense might have raised jurisdictional issues that could have prevented the TRO from being issued by the court.

David D. Johnson, an attorney with Jeffer Mangels Butler & Marmaro LLP, defended the judge's actions, arguing in a blog post that the law supports the bank's pursuit of its property rights at the expense of the Google user's privacy rights.

Levy in an e-mail acknowledged that the approach used by the bank to identify a Gmail account holder has the potential to be misused. An organization intent on identifying an individual through an online account could simply send that person "sensitive data," claim the sending was accidental, and subpoena the person's e-mail provider the way Google was subpoenaed, without claiming a cause for action.

"Of course that is a possibility for a future case," said Levy. "It provides one of the reasons to insist on filing in the right court and the provision of notice and an opportunity to respond before an e-mail account is frozen and the identity of its owner revealed."

Google did provide notice to the Gmail user and revealed the account information only after the 20 day deadline for objections passed, according to a source familiar with the case.

Google faces a similar lawsuit brought by a property developer who wants to identify the journalist(s) behind the Gmail address used by TCI Journal, which writes about the Turks and Caicos Islands.

InformationWeek has published an in-depth report on e-discovery. Download the report here (registration required).