IMDB’s Disclosure of Actress’s Age Will Go To Trial – Hoang v. Amazon

March 19, 2013 · by Venkat Balasubramani · in E-Commerce, Privacy/Security

[Post by Venkat Balasubramani with a comment by Eric]

Hoang v. IMDb.com, C11-1709MJP (W.D. Wash. Mar. 18, 2013)

We’ve blogged about this dispute—involving an actress’s attempt to hold IMDb liable for publishing her age against her wishes—before. The court recently denied the parties’ motions for summary judgment, setting the case up for a trial.

Background: The court discusses some of the factual background on how IMDb decided to “disclose” Hoang’s age information, and this is somewhat damning to Hoang. Apparently, she signed up without including her age, but later used her friend’s account to submit an incorrect birthdate (1978 instead of 1971). She then decided that she no longer wanted this date on her profile and followed up with IMDb in an attempt to get this error fixed. She even sent IMDb a scanned copy of a fake Texas identification, but none of this had the intended effect. Eventually, she emailed IMDb and asked it to:

Go back on your files and see if you have any documentation, verification, or identification that [her] birthdate [was] in 1978.

In response to her email, a customer service manager accessed information from IMDb’s database containing “pro” registration details. He found Hoang’s legal name. He then searched for her name in “PrivateEye,” a public records database, and ascertained that her birthdate was in 1971. He directed IMDb to update her profile to include the correct birthdate.

Hoang continued to lobby IMDb to change the birthdate:

press[ing] ahead with her false information campaign, sending IMDb links to her fake passport to ‘collect/delete [her birthdate]’ . . . .

She sought summary judgment on her then-remaining claims for breach of contract and violations of the consumer protection act. Amazon and IMDb both sought summary judgment as well.

Amazon is entitled to dismissal: The court dismisses Amazon because there is no evidence that it was involved in the decision-making of IMDb (a separate entity). Hoang asserted a variety of arguments, including that the customer service manager listed Amazon along with IMDb on his LinkedIn profile, but none were sufficient to overcome the general rule against holding a parent liable for the acts of its subsidiaries. The court notes there is no evidence that the two entitles shared databases.

Unclean hands: IMDb argued that Hoang should be barred by the doctrine of unclean hands. The court rejects this argument, noting that her unclean hands played no part in acquiring the rights at issue.

Breach of contract: The court rejects summary judgment on the key issue of whether IMDb breached the terms of the privacy policy by updating Hoang’s birthdate information. The privacy policy provided that IMDb would use “the information [end users] provide for such purposes as responding to [users’] requests.” The court says that a jury could conclude that IMDb was responding to her requests in searching its files and updating her information. The court cites to an (all caps) email from Hoang that exhorted IMDb to:

GO BACK ON YOUR FILES AND SEE IF YOU HAVE ANY DOCUMENTATION, VERIFICATION, OR IDENTIFICATION THAT MY BIRTHDATE IS IN 1978. IF YOU DO, PLEASE EMAIL IT TO ME BECAUSE I’M CURIOUS TO SEE WHAT YOU’RE GOING OFF OF. IF YOU DON’T FIND ANY PROOF ON RECORD, PLEASE DELETE IT BECAUSE I KNOW THAT 1978 ISN’T MY DATE OF BIRTH

Damages: The court addresses Hoang’s damages.

First, the court nukes the limitation of damages contained in IMDb’s term of service. [Ouch.] Its terms of service excluded consequential and exemplary damages, and capped liability to the amount of any fees paid to IMDb in the year prior to the claim. These provisions operated only in favor of IMDb, and the court says these provisions effectively result in a situation where no attorney would want to take a case alleging a violation of IMDb terms.

Second, the court says that Hoang can seek the following damages: (1) nominal damages; (2) direct losses; and (3) career damages. Emotional distress damages are not available in contract cases. The court also rejects her attempt to claim damages in the form of diminution to the value of her property (her personal information). On the other hand, the court does reject IMDb’s argument that no reasonable jury could conclude she has been damaged.

CPA claim: The consumer protection act claim turned on whether this was part of a pattern or likely to recur. If it’s an isolated one-time dispute between these two parties, then there’s no public interest. As part of her argument that this was part of a pattern, Hoang presented evidence that IMDb accessed the PrivateEye database over 20 times. However, IMDb came forward with evidence that each of these instances of access involved searches based on public record or publicly available IMDb information.

This is a super interesting dispute. We should be excited at the prospect of trial. Unlike the numerous class action cases we blog about, this presents the situation where a single plaintiff has an opportunity to present evidence to a jury that a company’s misuse of her information has resulted in damages.

Of course, the court’s “unclean hands” discussion is not particularly flattering to Hoang, and the fact that all of this was precipitated by her initial inclusion of incorrect information and subsequent attempts to “correct” this information doesn’t make her look good. That’s setting aside the fact that she’s complaining about IMDb’s publication of her information that only disclosed her accurate date of birth to prospective employers. [We’ve seen another instance or two of privacy plaintiffs being subject to the harsh light of scrutiny, so this is not surprising.]

Other items of interest in the ruling:

– databases are a treasure trove of information, as demonstrated by the fact that IMDb obtained her birthdate from a public database
– it’s sort of a reminder of how de-anonymization isn’t always effective (or can often be circumvented or reverse-engineered)
– the PII as valuable information argument doesn’t seem to resonate
– it’s always interesting to see a terms of use get axed by court–I would say a one-way limitation is fairly typical in these types of agreements, but the decision illustrates that they are by no means safe

I’m excited to see this case go to trial. I fear that the court’s ruling effectively steers the parties towards settlement, but if it goes to trial, I’ll make sure to attend and report back (since it’s in Seattle).

___

Eric’s Comment. The court has nicely teed this case up for settlement. Without the contract risk provisions, IMDB doesn’t want the damages exposure. And Hoang runs the real risk of a jury negatively reacting to her serial incidents of deception. A small check from IMDB to Hoang should be in both parties’ interest.

Other coverage:

Actress’ Lawsuit Against IMDb for Revealing Her Age to Proceed to Trial

Actress’s Suit Against IMDb for Publishing Her Actual Age Can Go to Trial

Previous post:

Actress Suing IMDB Can Assert Claim Based on Privacy Policy – Hoang v. Amazon.com, Inc.

Posts on data breach cases:

Court Dismisses Data Breach Lawsuit Against LinkedIn Based on Compromised Passwords – In re LinkedIn User Privacy Litigation

Class Action Against Path Over Cellphone Address Book Access Keeps Going

Judge Koh Whittles Down iPhone App Privacy Lawsuit

Data Breach Claim Survives Based on Allegation of Misuse of Personal Information — Burrows v. Purchasing Power

Sony Network Data Breach Class Action Suffers Setback — In re Sony Gaming Network

Starbucks Data Breach Plaintiffs Rebuffed by Ninth Circuit — Krottner v. Starbucks