On remand from the U.S. Supreme Court, the U.S. Court of Appeals for the Ninth Circuit reaffirmed its own 2019 opinion that previously prohibited a professional networking platform from denying an analytics firm given access to publicly available profiles. HiQ Labs, Inc. v LinkedIn CorporationCase No. 17-16783, (9th Cir., April 18, 2022) (Wallace, BerzonBerg (sitting by designation) JJ.).
Previously, the Supreme Court had granted certiorari in that case, but later reversed the judgment and sent it back to the Ninth Circuit for further consideration given its 2021 ruling in Van Buren v. United States. In Van Buren, the Supreme Court attempted to clarify the scope of the Computer Fraud and Abuse Act of 1986 (CFAA), finding that authorized access to a computer for arguably inappropriate purposes is unlikely to constitute a violation of the CFAA . On remand, the Ninth Circuit found that Van Buren reinforced its determination that hiQ had raised “serious questions” about whether LinkedIn could invoke the CFAA to pre-empt hiQ’s tortious interference allegation.
HiQ is a data company that sells “people analytics” focused on predictive employee data. HiQ’s data is largely obtained by scraping public LinkedIn profiles with automated bots. In 2017, LinkedIn sent a letter of formal notice to hiQ claiming that hiQ’s scraping activity violated the CFAA, the Digital Millennium Copyright Act (DMCA), the California Penal Code and common law. HiQ immediately sued for an injunction and declaratory relief that LinkedIn could not legally assert the asserted claims. Granting hiQ’s motion for the preliminary injunction, the district court ordered LinkedIn to remove and refrain from implementing any technical barriers to hiQ’s access to LinkedIn’s public profiles.
The Ninth Circuit said a plaintiff seeking a preliminary injunction must establish the following:
- He is likely to succeed on the merits.
- He is likely to suffer irreparable harm in the absence of an injunction.
- The balance of stocks is tilting in his favour.
- The injunction is in the public interest.
This analysis forced the Ninth Circuit to focus solely on whether hiQ had raised serious issues on the merits of the factual and legal issues presented. The Ninth Circuit’s review of these factors was nearly identical to that of 2019.
Beginning with irreparable harm, the Ninth Circuit found that the survival of hiQ’s business was threatened because it depends on the ability to access LinkedIn members’ public profiles. The Court also accepted, once again, the district court’s decision that the balance of actions tipped in favor of hiQ. The Court found that the privacy interests of individuals who chose to maintain a public LinkedIn profile did not outweigh hiQ’s interests in continuing to operate. On this factor, the Court noted that “little evidence” suggested that LinkedIn users who choose to make their profiles public in fact maintain an expectation of confidentiality with respect to publicly posted information. The Court also noted that LinkedIn does not own its users’ data, since users retain ownership of the data comprising their LinkedIn profiles.
Returning to the probability of success factor, the Ninth Circuit recalled that its investigation was limited to whether hiQ raised serious questions about the merits of LinkedIn’s “sole defense” to hiQ’s request for a preliminary injunction in under the CFAA. Other potential claims, such as those arising from the Digital Millennium Copyright Act or trespass and misappropriation, were not at issue in this specific appeal.
The Ninth Circuit determined that hiQ raised serious questions about the merits of its claim for tortious interference with the contract by showing the existence of valid contracts, LinkedIn’s knowledge of those contracts, LinkedIn’s “intentional acts” aimed at disrupting these contracts and the resulting harm to salutQ. HiQ also raised serious questions about the propriety of defending LinkedIn’s legitimate business purposes, which LinkedIn said would justify intentionally inducing breach of contract.
The majority of the Ninth Circuit’s opinion considered whether hiQ had raised a serious question as to the scope of legal coverage of the CFAA (which prohibits intentional access to a computer without authorization and is limited to computer information for which authorization or access authorization, such as as a password, is required) and whether access to a public LinkedIn profile would not be within the scope of the CFAA. The “pivotal” question was whether the continued scraping of hiQ’s data from public LinkedIn profiles after receipt of LinkedIn’s formal notice in 2017 was “unauthorized” within the meaning of the CFAA.
The Ninth Circuit found that the hiQ had increased”[a]t the least. . . a serious question” about whether the CFAA “permission-free” language is even applicable if the data being accessed is open to the public. This included a detailed breakdown of legislative language and that the affirmative notion of “authorization” implies express permission and therefore does not relate to freely available information. Legislative history also supported the Court’s findings, as the LCFA has been best understood as an anti-trespass law (not a hijacking law) requiring conduct analogous to breaking and entering. The Court found reinforcement in Van Burenalthough Van Buren addressed a different CFAA clause (the “exceeds authorized access” clause, rather than the “unauthorized” clause). Van Buren examined the interplay between these two language provisions and gave an “up or down” interpretation of the CFAA. Therefore, the Court concluded that Van Buren reinforced the conclusion that when “doors” are “opened” to publicly accessible web pages without requiring permission or access, the CFAA may not apply. This finding was contrasted with two previous cases cited by LinkedIn, where doors were “closed” due to required passwords or other required access controls.
Finally, the Ninth Circuit agreed that there were significant public interests on both sides of the dispute, but again ruled in favor of hiQ’s position, which asserted that giving a company such as LinkedIn a complete monopoly on the collection and use of data it does that are not its own (but only user licenses) would not serve the public interest. Finding that hiQ had established all the elements required for a preliminary injunction, the Court reaffirmed the injunction and remanded for further proceedings.