Russo v. Microsoft Corporation

Background

Frank D. Russo, Koonan Litigation Consulting, LLC, and Sumner M. Davenport & Associates, LLC brought a proposed class action against Microsoft Corporation. They alleged that Microsoft shared business customers’ data with Facebook, third-party developers, and subcontractors, and used customer data to develop or sell products and services without consent. The complaint asserted claims under the Wiretap Act, the Stored Communications Act, the Washington Consumer Protection Act, the Washington Privacy Act, and Washington’s tort of intrusion upon seclusion.

The plaintiffs used Microsoft 365 products for business purposes. Their allegations referred to several Microsoft features, including Facebook Contact Sync, Microsoft Graph, Security Graph, Microsoft Audience Network, and Cortana. The court granted Microsoft’s request for judicial notice of documents that formed the basis of the plaintiffs’ allegations and were incorporated into the complaint by reference.

Standing and pleading standard

Microsoft moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), which permits dismissal when a complaint does not state a legally sufficient claim. The court also considered whether the plaintiffs had standing, meaning a personal injury that was caused by the defendant and could be remedied by the court.

The court held that the plaintiffs had not alleged enough facts to show that Microsoft’s conduct injured them personally. For Facebook Contact Sync, they did not allege that they used Outlook or added contacts who could have been disclosed to Facebook. For third-party developers, they did not identify a person with whom they communicated who had given consent for Microsoft Graph to scan emails. For subcontractors and other Microsoft products, they did not provide facts showing that Microsoft 365 customers were affected. The court dismissed the complaint for failure to allege facts demonstrating standing.

Wiretap Act and Stored Communications Act

The court separately examined whether the complaint stated claims under the Wiretap Act and the Stored Communications Act. It concluded that the allegations plausibly described the scanning of email contents for the Graph and Security Graph features. The complaint did not provide enough information to determine at the dismissal stage whether the emails were scanned while being transmitted or after they were stored. Because that information was not generally known and was in Microsoft’s possession, the court allowed the plaintiffs to plead the theories in the alternative and left the timing of any scanning for possible later proceedings.

The court held that contact-list information involved in Facebook Contact Sync was not the contents of communications for purposes of the Wiretap Act. It also held that the allegations concerning Cortana’s scanning of documents, contacts, and calendar information did not concern communications. The court further found that the ordinary-business exception applied to Cortana and Advanced Threat Protection because the plaintiffs alleged those features were part of the Office 365 service. By contrast, the plaintiffs alleged that Microsoft sold the Graph and Security Graph application programming interfaces to developers, so the court did not treat alleged data interception for those features as necessarily part of providing services to the plaintiffs.

Accordingly, the Wiretap Act and Stored Communications Act claims based on the Graph and Security Graph features could potentially state claims if the plaintiffs alleged that their specific emails were scanned. Claims based on the other features were dismissed with prejudice, meaning the order barred those claims from being reasserted in the case.

Washington Consumer Protection Act

The court found that the plaintiffs plausibly alleged an overpayment theory under the Washington Consumer Protection Act: they claimed they paid for subscriptions advertised as protecting privacy and might have paid less if the service lacked those qualities. However, the court held that the complaint did not satisfy Federal Rule of Civil Procedure 9(b), which requires fraud-based allegations to be stated with particular detail. The complaint did not adequately explain how the accused features worked, who used them, what data was provided, or how the alleged misuse occurred.

The court dismissed the Washington Consumer Protection Act claim without prejudice, meaning the plaintiffs could attempt to replead it.

Washington Privacy Act

The court held that the plaintiffs had not alleged that their own private communications were intercepted, so they lacked standing to bring a Washington Privacy Act claim. The court rejected Microsoft’s arguments that corporations could not be liable under the statute and that the statute could not apply based on where the communications originated. The location of any interception was an issue better addressed through discovery.

The court stated that, if the plaintiffs could allege that their private communications were intercepted, they could state a Washington Privacy Act claim based on the Graph and Security Graph features.

Intrusion upon seclusion

The court held that a corporation has no personal privacy right and therefore cannot bring an intrusion-upon-seclusion claim. Mr. Russo also did not allege that he used Microsoft’s products for his own private affairs; the complaint said he used them in his business and at most suggested that the products contained his clients’ private information. The court dismissed Mr. Russo’s claim without prejudice and dismissed the other plaintiffs’ claims with prejudice.

Disposition

The order states that the motion to dismiss was granted in part and denied in part. In its conclusion, the court stated that Microsoft’s motion to dismiss was granted and that the dismissal was without prejudice unless the order stated otherwise. The plaintiffs were permitted to file an amended complaint within twenty-one days. The order was signed by Judge Yvonne Gonzalez Rogers on June 30, 2021.