H&R Block can proceed with its suit over unauthorized access to customer data

In early 2005, H&R Block noticed a strange new pattern. It began getting an unusual amount of bulk garnishment orders from defendant J&M Securities, a debt buyer, requiring H&R Block to withhold portions of some of its clients’ tax refunds. In light of the detail supporting the garnishment orders, Block believed that J&M “could not possibly have gathered Block’s clients’ income tax information … without improperly accessing and obtaining Block’s confidential information.”

Block filed suit against J&M, alleging several claims, including violations of the Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. §§ 2701 and 2707. (This portion of the Wiretap Act is also commonly referred to as the Stored Communications Act.) J&M moved to dismiss, arguing, among other things, that H&R Block had failed to properly allege its claims under the ECPA. The court denied J&M’s motion to dismiss.

J&M had argued that Block should not be permitted to plead “access by inference” to the confidential stored communications. Applying the liberal pleading standards used in Federal litigation, the court held that Block had sufficiently placed J&M on notice that Block was alleging unauthorized access. The court went on to hold that “finding the fact of ‘access’ or ‘no access’ [was] a task for discovery, summary judgment, and trial.”

The court essentially instructed J&M how to argue a summary judgment motion it could file after discovery. It observed that “[J&M’s] best argument is that [Block] is not a provider of an ‘electronic communication service,’ and thus the ECPA does not regulate access to [Block’s] facility.”

In support of that observation, the court cited to the cases of In re JetBlue Airways Corp. Privacy Litigation, 379 F.Supp.2d 299 (E.D.N.Y. 2005), In re DoubleClick Inc. Privacy Litigation, 154 F.Supp.2d 497 (S.D.N.Y. 2001), and Crowley v. Cybersource Corp., 166 F.Supp.2d 1263 (N.D.Cal. 2001). Each of those cases indicated that a provider of web services is not the same as a provider of an electronic communication service.

Nonetheless, the court fell short of holding that Block was not a provider of an electronic communication service, concluding that such a holding would be “premature,” and would require “speculation about the nature of [Block’s] role in electronic communication.” The court denied the motion to dismiss as to the ECPA claim.

H&R Block Eastern Enterprises, Inc. v. J&M Securities, LLC, (Slip Op.) 2006 WL 1128744 (W.D. Mo., April 24, 2006).