Court Says Plaintiff Lacks Standing to Pursue Failure-to-Purge Claim Under the VPPA – Sterk v. Best Buy
[Post by Venkat Balasubramani]
Sterk v. Best Buy, 11 C 1894 (N.D. Ill. Oct. 17, 2012)
The VPPA has spawned a lot of litigation over the past couple of years. One hot button area has been the applicability of the statute to online streaming services. (Netflix; Hulu). 
This lawsuit is a putative class action alleging that plaintiff purchased DVDs from Best Buy, and that Best Buy: (1) retained the purchase history for over a year; and (2) disclosed this information to an affiliated entity (Best Buy Co., Inc.).
No private right of action for improper retention of personal information: Section 2710(e) is a poorly worded provision that requires covered entities to purge personally identifiable information “as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected.” The Seventh Circuit in Sterk v. Redbox (same plaintiff/counsel as in this case) held that section 2710(c) does not provide for a private right of action under 2710(e): “Seventh Circuit: No Private Cause of Action Under the Video Privacy Protection Act for Failure to Purge Information.” Given that this court is clearly bound by this ruling, plaintiff tried to get creative and argue that he could assert a claim under the Stored Communications Act which is part of the same chapter as the VPPA. Judge Kennelly considered and rejected plaintiff’s argument in Sterk v. Redbox (on remand), and the court follows suit here. Another court in the Northern District of California recently came to the same conclusion: Rodriguez v. Sony Computer Entertainment.
Plaintiffs lack standing to pursue injunctive relief: Plaintiffs also sought injunctive relief, which required the court to address the issue of standing. The court runs through the classic test for standing, but importantly says that Congress cannot create standing for injuries that do not satisfy Article III’s minimum standing requirement. The court also notes (citing to the Seventh Circuit’s opinion in Sterk, and to Van Alstyne v. Elec. Scriptorium, an email privacy case) that only plaintiffs that are “aggrieved” may seek relief under the VPPA. Here, any injury from retention is meager at best and shouldn’t support standing. Plaintiffs’ disclosure claim similarly did nothing to establish injury—the data was being disclosed to a 100% parent corporation. Plaintiffs also tried to rely on the diminution of value of their information and the fact that they allegedly overpaid for the services provided by Best Buy, but the court easily rejects these arguments.
Plaintiffs also brought a breach of contract claim. The court says that claims based on older purchases were time-barred. Claims based on later purchases were dismissed due to lack of alleged damages. Plaintiffs are permitted to replead these.
__
Claims alleging failure to purge under the VPPA represent the far extreme of privacy lawsuits. As the Seventh Circuit’s ruling from Sterk, as well as the rulings in Rodriguez and this case demonstrate, courts will not be very enthusiastic about these claims.
It’s interesting to see the court cite to the Supreme Court’s decision in First American Finance Corp. v. Edwards. Although this case dealt with standing to sue under the Real Estate Settlement Procedures Act, in advance of the ruling, many thought this case would alter the landscape for privacy lawsuits and standing. I thought it fizzled out in this regard, but maybe it has more vitality than originally thought.
Related posts:
Court Declines to Dismiss Video Privacy Protection Act Claims against Hulu
[cross-posted at IAPP’s Privacy Advisor]