14 DAY TRIAL // A bank is seeking a subpoena that will force Google to reveal information about a Gmail account, including the identity of its owner. The financial institution needs this information to determine the scope of a privacy-breach incident inadvertently generated by one of its own employees.
Montana-based Rocky Mountain Bank has filed a case against Google with the California Northern District Court and requested it be sealed in order to avoid creating panic amongst its customers regarding an unconfirmed privacy breach. United States District Judge Ronald M. Whyte denied the motion and his official order reveals significant details regarding the case.
It all started back in August, when one of the bank's customers requested that some loan statements be sent to his representative. A bank employee complied with the request, however, the second day, it was determined that he had inadvertently sent them to a wrong Gmail address.
But the employee's mistake did not stop here. Apparently, he also attached a confidential file to the e-mail message, which shouldn't have been sent to the requester anyway. The file was a document containing the names, addresses, tax identification number, as well as loan information of 1,325 individual and business customers.
The order specifies that the bank unsuccessfully tried to recall the e-mail, a feature supported only by Microsoft Exchange servers with a special configuration. Faced with a potentially serious breach of customer privacy, the bank sent a secondary e-mail to the Gmail address in question, which instructed its owner to delete the previous message without reading it.
Finally, the bank contacted Google and asked how the situation could be resolved. The Mountain View giant refused to provide any information about the account, not even if it was active or not, and made it clear that it would do so only if served with a subpoena. But, even if the bank obtains a court order, Google will not release the information immediately, without giving the account owner a chance to file a counterclaim.
The case records will remain under seal until September 21, because the bank's original filings with the court included the e-mail address, which is itself subject to privacy laws. The bank has until that date to file copies of all documents with the Gmail account redacted from them.
"An attempt by a bank to shield information about an unauthorized disclosure of confidential customer information until it can determine whether or not that information has been further disclosed and/or misused does not constitute a compelling reason that overrides the public’s common law right of access to court filings," the judge ruled, according to Wired.