Actress Suing IMDB Can Assert Claim Based on Privacy Policy – Hoang v. Amazon.com, Inc.

[Post by Venkat Balasubramani]

Hoang v. Amazon.com, Inc. & IMDB.com, Inc., C11-1709MJP (W.D. Wash.; Mar. 30, 2012)

Hoang sued IMDB, alleging that IMDB took information she provided when she paid for her subscription and used this information to derive her birthdate. She alleges IMDB then added her birthdate to her public profile and declined to remove it despite her request. She asserts claims for breach of contract, fraud, along with claims under the Washington Privacy Act and the Washington Consumer Protection Act. (She initially filed a Doe lawsuit and argued that she should be able to proceed pseudonymously, but the court rejected this request. See coverage from Matthew Belloni here: “Actress Suing IMDB Reveals Her Real Name.”)

Breach of contract: The court declines to dismiss Hoang’s breach of contract claim, finding that statements in IMDB’s privacy policy could support a claim for breach of contract. What tripped up IMDB? Flowery language in its privacy policy saying that it would use customer information “carefully and sensibly.” While there was a section of the policy which informed users what the information would be used for, it did not encompass the use of information for targeting or using the information provided by customers to obtain other information about them:

You can choose not to provide certain information, but then you might not be able to take advantage of many of our features . . . . IMDB uses the information that you provide for such purposes as responding to your requests, customizing future browsing for you, improving our site, and communicating with you.

Remaining claims: The remaining claims are largely nuked, with one big exception. The court says that Hoang fails to identify any fraudulent statements, and her broad claims about IMDB’s misuse of her information is not sufficient to state a fraud claim. Her claim under the Washington Privacy Act fails as well because this statute covers the interception or recordation of private communications, and Hoang failed to identify any communications intercepted or recorded by IMDB. The one claim which the court did not dismiss which could turn into a problem for IMDB is the Consumer Protection Act claim under Washington law. This allows Hoang to ask for treble damages plus injunctive relief (which may be something IMDB is more worried about).

Quick thoughts:

* Re-identification is risky behavior for companies.

* Finally, a privacy plaintiff who does not have an Article III standing problem! Her damages may not seem like they are the easiest to prove and they may not be astronomical. However, she clearly gets past the Article III hurdle, and if she can get in front of a jury and argue that big bad IMDB (Amazon) played fast and loose with her information, and failed to remove it upon her request, she may find a sympathetic audience.

* Flowery privacy policy language that comes back to haunt a company. This has happened time and time again and is yet another example of a court or agency latching on to flowery language to find an obligation with respect to the use of information. Twitter’s language about its security practices came back to haunt it when it was investigated by the FTC: “The FTC Dings Twitter’s Security Practices — What Does This Mean for Everyone Else?” Language in RockYou’s policy supported both a breach of contract claim and was cited by the FTC in an enforcement action (which recently settled).

* Here’s the million dollar question: does Hoang’s breach of contract claim require her to show that IMDB obtained information and caused her harm by publicly attaching this information to her profile, or would she have a claim merely based on IMDB’s use of her information in a way that is not described in IMDB’s privacy policy? The court does not address this issue since Hoang made the allegation that IMDB’s public use of her information harmed her. I’m guessing Hoang can’t make an argument that IMDB’s contractual promises restricted IMDB from using the information she provided as part of the subscription process for any purpose other than to process payment (say for direct marketing or targeting)? This could be a somewhat far-reaching argument, but would run squarely into the Article III problem.

[It’s also worth noting that IMDB did not try to force Hoang to arbitrate her claims. IMDB’s terms do not contain an arbitration provision. I’m guessing they will consider adding one soon.]

Other coverage:

Eriq Gardner: “Judge Allows Actress Suing IMDb Over Age Revelation to Go Forward on Lawsuit”