Can a data breach victim sue under federal privacy law?

What the Law Says

The Stored Communications Act (SCA), part of the Electronic Communications Privacy Act of 1986, creates a private right of action for individuals whose stored electronic communications are accessed without authorization.

The SCA prohibits unauthorized access to electronic communications held in storage by service providers — such as emails on a server, cloud-stored messages, or backup files. It applies to both intentional and reckless violations, but only 'willful' violations trigger civil liability.

To sue successfully, a plaintiff must show: (1) the defendant accessed stored communications without authorization; (2) the defendant acted willfully; and (3) the plaintiff suffered damages — which can include actual losses or statutory damages starting at $1,000 per violation.

Courts have interpreted 'stored communications' narrowly — typically excluding opened emails left on a provider’s server after reading, unless they remain in a designated storage area (e.g., 'drafts' or 'sent' folders).

Statutory Text

Whoever intentionally accesses without authorization a facility through which an electronic communication service is provided; or intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished...

— 18 U.S.C. § 2701(a) — Unlawful access to stored communications

Statutory Text

The owner or lawful user of the contents of a wire or electronic communication may, in a civil action, recover from the person or entity... damages... not less than $1,000 for each violation...

— 18 U.S.C. § 2707(c) — Civil remedies

Sources