Redbox Can be Liable Under the Video Privacy Protection Act for Failure to Purge Video Rental Records — Sterk v. Redbox

[Post by Venkat Balasubramani]

Sterk v. Redbox, 11 c 1729 (N.D. Ill. Aug 19, 2011)

Redbox is a company which rents DVDs to customers from automated, self-service kiosks, typically charging $1 per rental. The customer is required to return the DVD the following day and, if the customer fails to do so, the customer is charged a late fee. If the customer is twenty five days late, then the customer is charged the price of the DVD (at which point the customer owns the DVD).

Plaintiffs filed a putative class action, alleging that Redbox maintained customers’ credit card billing information, along with their “video programming viewing histories,” in violation of the provisions of the Video Privacy Protection Act. The VPPA has a section (“subsection 2710(e)”) which says that:

a person subject to this section shall destroy personally identifiable information as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected and there are no pending requests or orders for access to such information under subsection (b)(2) or (c)(2) or pursuant to a court order.

Plaintiffs alleged that Redbox violated subsection 2710(e).

Does the VPPA Create a Private Cause of Action for Wrongful Retention of Video Rental Records: Redbox argued that the statute only provides for a private action for wrongful disclosure, not for the “wrongful retention” of video rental records. The court rejects this argument, noting that the subsection authorizing a private right of action (subsection 2710(c)) says that any person aggrieved by a violation of “this section” may file a suit.

The court interpreted the language referring to “this section” as a reference to section 2710–i.e., the entire statute. The court looks to the “House Legislative Counsel’s Manual on Drafting Style,” which provides a hierachical breakdown of statutes (by sections, subsections, paragraphs, subparagraphs, and clauses) and the fact that Congress adhered to this hierarchy in other parts of the statute. Redbox pointed to another part of the statute dealing with court-ordered disclosures where Congress used the term “section” arguably somewhat imprecisely to argue that Congress did not consistently use the term “section” in the statute. The court rejects this argument on the basis that provisions dealing with court ordered disclosures are contained in several different subsections, so the use of the term “section” in section 2710(b)(3) is not a mistake, or alternatively does not support the argument that Congress used the term “section” ambiguously in subsection (e).

The court also distinguished a Sixth Circuit decision (Daniel v. Cantrell) which held that only subsection (b) can form the basis of liability under the VPPA. In that case, the court held that only subsection (b) “includes language relating to liability,” and if Congress intended a private right of action for violations of subsections (d) and (e), it would have included the private right of action language at the end of the statute, rather than preceding subsections (d) and (e).

Redbox also argued that the legislative history of the VPPA supported its theory that Congress did not provide for a private right of action for the wrongful retention of records, pointing to the Senate Report, which stated that the goal of the statute was to “reduce the chances that an individual’s privacy will be invaded, by requiring the destruction of information in an expeditious fashion.” The court says that the legislative history is inconclusive, and in any event, the court need not resort to it since the statute is not ambiguous.

Did Plaintiffs State a Claim for Wrongful Retention Under the Statute: Redbox also argued that it collected the information for the purpose of “recouping late fees,” and at worst, Redbox had one year from the date of collection to purge the information. The court disagrees with Redbox and says that the statute does not say that a provider always has at least 1 year to purge the information. According to the court, this interpretation of the statute reads the phrase “as soon as practicable” out of the statute. Redbox argued alternatively that it collected the information for marketing and advertising purposes, but this is only allowed if the provider gives the customer the opportunity to opt out “in a clear and conspicuous manner.” Sterk alleged that the opt-out was not conspicuous, and the court treats this as a factual dispute which cannot be resolved at the motion to dismiss stage. [Although the court does not rely on this allegation in resolving the motion to dismiss, plaintiffs alleged that Redbox changed its disclosure practices and included a more prominent link to Redbox’s terms of use and privacy policy after the lawsuit was filed.]

__

Oy. I’m guessing Congressional staffers who were involved in drafting the Video Privacy Protection Act are cringing as they read this decision.

It’s interesting that video rental records are carved out for such special protection under the law. (The VPPA was passed in 1988, in the wake of then-judge Robert Bork’s confirmation hearings.) Imagine if we had a similar law in place for book records or web-surfing records!

At any rate, Redbox is potentially on the hook for statutory damages under the VPPA, regardless of whether it used or misused its customers’ video rental records in any way. It’s unclear as to whether other online “video tape service providers” are going to be tagged with similar lawsuits. Netflix is in the firing line. (See “Close-Up: Netflix Hit With Privacy Suit.”) Are Amazon, Apple, and Hulu next?

The craziest part of the lawsuit is that video rental companies can avoid liability by taking the largely ministerial step of procuring their customers’ consent to the disclosure of rental records. (Given that Redbox is not some bootstrapped start-up, it’s surprising that it did not take this step in the first place.) Although the consent provisions don’t appear to expressly insulate records retention, consent needs to be “written” if the provider wants to disclose the information in question. Recently introduced legislation, supported by Netflix, would allow consumers to give blanket authorization to disclosure by video rental companies and to provide such disclosure online. (See Tech Daily Dose: “Calling Robert Bork” (reporting on H.R. 2471.) Interestingly, the proposed legislation does not clearly cover the retention of records and only covers their use and disclosure.

[Since this ruling, Redbox move to reconsider or, in the alternative, sought permission to take an interlocutory appeal, and this motion is pending. In the meantime, the court also denied Redbox’s motion to dismiss plaintiffs’ consolidated amended complaint. (Here is a copy of the court’s minute order denying Redbox’s motion.) Redbox in its answer also asserted the affirmative defense that the statute is unconstitutional.

Also, note that the ruling is from August of this year. This one languished in the queue.]

Additional coverage:

N.D. of Ill. Judge Allows VPPA Privacy Lawsuit to Go Forward (Sedgwick)