I have a serious question about this entire thing.
Does this set a precedence for future "mistakes" by large companies to deactivate and identify accounts simply because they send compromising information?
Put another way, what if you wanted to "nuke" someones gmail account - do you simply need to send "confidential information" then ask for the court order?
It is certainly a far fetched and expensive plan, but the question is really about precedence this case has set.
I spoke to a lawyer friend about this entire thing:
"The judge should have conducted a "balancing test" in which he asked whose rights it was more important to protect: those of hundreds of people whose account information was in the hands of some schmuck, or those of the schmuck who won't be able to email that dirty joke to his Mom if his email is suspended. It seems that the rights of the hundreds of account holders are more important, but you can protect their rights without suspending the schmuck's email address (and that is where I agree with Mr. Morris). The court could have ordered him to turn over all of the data he inadvertently received and swear under oath that he did not retain any further copies and that he did not distribute the copies to anyone else. Once that is done, if it turns out that the sensitive information was compromised in any way, the account holders can hold the bank accountable AND the schmuck. If the schmuck is a decent guy -- and if an IT professional certifies that he purged all the data and that it was not otherwise disseminated to outsiders -- then the story should end there and there is no First Amendment violation."
I think this balance test makes way more sense than what happened in this case.