Sergeant Has Privacy Interest In Dropbox Account Created With Employer’s Email

This article appears in the February 2023 issue of our monthly newsletter, Public Safety Labor News, and is a follow-up to the June 2022 article Qualified Immunity Shields Employer From Liability For Illegal Dropbox Search (for subscribers only).

Steven Bowers was a detective sergeant for the Taylor County Sher­iff’s Department in Wisconsin. In February 2017, the Department was working with the television program Cold Justice on a homicide cold case (Murder 1). The Department agreed to provide information to Cold Justice’s producers only about the Murder 1 investigation.

In criminal charges later filed, the State claimed that Bowers shared two additional homicide files (Murder 2 and Murder 3) with Cold Justice without the Department’s permission. Bowers is alleged to have provided Murder 2’s paper file, which includ­ed “one box of reports and one box of medical records” to Cold Justice’s producers. As to the Murder 3 infor­mation, the State alleged that Bowers uploaded the file to his Dropbox account and then used the account to share the file with his girlfriend and two members of Cold Justice’s staff. According to the State, the Department became aware of this unauthorized release of information when another officer overheard Cold Justice’s producers talking about the Murder 2 and Murder 3 cases.

When Bowers admitted that he had shared the files without seeking permission, the Department success­fully sought access to Bowers’ password protected Dropbox account through his official County email address. Bow­ers had used his county email address to set up his Dropbox, although he paid for it with his own funds. An IT employee for the County performed a password reset on Bowers’ account, which then emailed a link to Bowers’ County email address. Given that she had access to Bowers’ county email through her role, the IT employee then entered his email inbox and used that link to change Bowers’ account password, effectively severing Bowers’ access to his Dropbox account.

Bowers’ Dropbox revealed both that the Murder 3 file was in the ac­count and that Bowers had shared the case file with individuals outside the Department. After criminal charges were filed, Bowers filed a motion to suppress the evidence derived from the warrantless search of his Dropbox account on the ground that he had a reasonable expectation of privacy and the search therefore violated his Fourth Amendment rights.

The Wisconsin Court of Appeals agreed with Bowers. The question for the Court was whether Bowers’ expectation of privacy in his Dropbox account was objectively reasonable. The Court noted that “the first two factors cut in Bowers’ favor, those fac­tors being that Bowers had a property interest in his Dropbox account, as he independently set up and paid for it, and that he maintained the account lawfully.

“The State claims that Bowers did not have complete dominion and control over the account as he shared access with other people, including his girlfriend and employees of Cold Justice. Bowers, however, did not share the password to his account or otherwise provide others access to his entire account. Instead, Bowers used his account to share spe­cific documents with third parties. As Bowers argues, ‘he decided who saw what and under what circumstances in his Dropbox.’

“The State also claims the fact that Bowers used his county email address to create the account diminished his dominion and control because ‘law en­forcement was able to gain access using his county-owned email address.’ We agree with Bowers that this is a slippery slope argument. In essence, the State argues that an individual’s expectation of privacy is diminished where a location or an item is accessible or capable of being broken into. We agree that under the circumstances of this case, Bowers maintained dominion and control over his account.

“There is nothing in the record to establish that Bowers shared his Drop­box password with anyone; he shared only specific files. Further, Bowers could not have anticipated that using his county-owned email address would destroy his privacy in a password pro­tected account containing data saved on noncounty property, as he was not given notice of this possibility. The county’s IT policy says nothing about monitoring private accounts that are linked to work email. In the absence of a clearer notice from the county, Bowers was entitled to assume that a private account was private.

“The State focuses on the fact that Bowers created this account with his county-owned email address. Apart from using that email address, howev­er, Bowers created the account on his own. Bowers paid for the account with his own money, and the account was password protected. The Department did not search its own devices to access the information in Bowers’ account; it used the internet as a tool to access the outside server on which the account was located. There are no policies that would destroy Bowers’ reasonable expectation of privacy in his account and allow the Department to access it. In essence, the State does not explain how using a county email address to set up an outside account permits the county to search everything within that private account, absent other factors.

“Use of cloud storage to house an individual’s private information is just the latest technological development seeking to test the boundaries of the Fourth Amendment. Here, we conclude that society is willing to recognize that a user has a legitimate expectation of privacy in his or her Dropbox account. By using a password that is not shared, these users expect their cloud-storage accounts to remain private unless the user shares the files with others, even if the information is stored by a third party.”

State v. Bowers, 2022 WL 17984985 (Wisc. App. 2022).

Also in the February 2023 issue:

• Union Fails To Timely Demand To Bargain Over Pension Changes
• No Religious Freedom Exception To Photographs In Uniform
• Council Member’s Comments Do Not Establish Bias
• Sergeant Has Privacy Interest In Dropbox Account Created With Employer’s Email
• Failure To Discipline Officer Belies Employer’s Claim Of ‘Immediate Threat To Public’
• PTSD Caused By Shooting, Not Gradual Stress
• Officer Loses Job To Facebook Post
• Firefighter’s Case Illustrates Difference Between Summary Judgment And Motions To Dismiss
• Officer’s T-Shirt Was Racially Insensitive But Not Overtly Racist