• by Wendy Davis  @wendyndavis, July 5, 2011

The Gmail user who was mistakenly sent confidential records by Rocky Mountain Bank marked the message as spam four days after it was sent without ever opening it, newly unsealed court records show.

Nonetheless, more than one month after the user flagged the unopened message as spam, U.S. District Court Judge James Ware in the Northern District of California ordered the Gmail account "deactivated" in response to court papers filed by Rocky Mountain Bank. The account remained shuttered for around one week.

A report stating that the user never opened the message was made public at the request of MediaPost, which successfully sought to intervene in the matter for purposes unsealing the records.

Ware issued the deactivation order in September of 2009, after the Wilson, Wyoming-based Rocky Mountain Bank said in court papers that it had mistakenly sent names, addresses, Social Security numbers and loan information of more than 1,000 customers to the wrong Gmail address.

The bank said that after it realized the problem, it sent a message to that same address asking the recipient to contact the bank and destroy the file without opening it. No one responded, so the bank contacted Google to ask for information about the account holder.

Google refused to provide the information without a court order. The bank responded by seeking an injunction requiring Google to disclose the information.

Ware not only ordered Google to reveal identifying information but also to "deactivate" the user's account. Several days later, Google presented a report to Ware outlining how it had complied with the order. Soon afterward, Ware vacated the order without ever making public the document Google submitted, even with the user's name deleted.

Represented by Public Citizen, MediaPost sought to intervene for purposes of obtaining the report. Ware denied the request, but the 9th Circuit Court of Appeals ruled in April that the report was public.

The report states that the user's account was active and the email was received on Aug. 12, 2009. The user marked the message as spam on Aug. 16 and it was permanently removed by Google's system on Sept. 19 of that year.

Google also said in the report that on Sept. 21 it sent the user a copy of the bank's request for an injunction. But Google said that Ware's deactivation order, dated Sept. 23, meant that the user wouldn't be able to retrieve the message. The report doesn't indicate whether Google had an alternative email address for the user.