Ninth Circuit Rejects Video Privacy Protection Act Claims Against Sony

September 9, 2015 · by Venkat Balasubramani · in E-Commerce, Privacy/Security

Shutterstock / SoulCurry – I love My Privacy

This lawsuit asserts Sony failed to purge Video Privacy Protection Act-covered information and made impermissible transfers to an affiliated entity. The district court dismissed, among other reasons, because it found the VPPA did not create a cause of action for failure-to-purge, only for wrongful disclosures or transfers. On appeal, the Ninth Circuit affirms.

No failure-to-purge claim: The question here is whether the statute provides a cause of action for failure to purge, and the language of the statute creating a cause of action unhelpfully says that anyone aggrieved by any violation of “this section” can bring a cause of action. It could be interpreted to mean that a person has a private cause of action for any action inconsistent with the VPPA, including the prohibitions on use of information in certain evidentiary settings. Or it could be interpreted in a more limited way to just refer to the subsections immediately preceding the section creating a cause of action (this would preclude improper retention claims). The Ninth Circuit adopts the Seventh Circuit’s reasoning in Sterk v. Redbox. (See “Seventh Circuit: No Private Cause of Action Under the Video Privacy Protection Act for Failure to Purge Information–Sterk v. Redbox”.) As did the Seventh Circuit, the Ninth Circuit finds that the VPPA does not create a private cause of action for mere improper retention of covered information. (See also Daniel v. Cantrell from the Sixth Circuit.)

Plaintiff also argued that even if he were not entitled to damages, he could sue for equitable relief, but the court says that the VPPA does not independently authorize equitable relief. To the extent someone already has a cause of action, they may be entitled to equitable relief (and the statute makes passing reference to this), but plaintiff can’t construct an independent cause of action out of a request for equitable relief.

Claim based on intra-corporate transfer: Sony had multiple (presumably, affiliated entities) involved in operation of the Playstation Network, and this changed over time. Plaintiff argued that this resulted in transfers between entities that were not covered by the exemption in the statute, which covers “the ordinary course of business,” defined to include “debt collection activities, order fulfillment, request processing, and the transfer of ownership.”

Plaintiff had a few different allegations around why Sony ran afoul of the statute, but the court buys none of them. As to the allegation that Sony transferred his information “after Sony Network took over the [Playstation Network]” the court says this falls under the “transfer of ownership” exception. The court also adds that intra-corporate disclosures are not unauthorized. Citing to a later Sterk opinion, the court says that businesses often use third parties to provide support services, and the functions performed by the third parties fall within the definition of “order fulfillment” or “request processing”. The court says plaintiff’s alternate allegations would in any event fall within these exceptions.

The Ninth Circuit has not dealt with many VPPA cases, but this is the second recent loss for plaintiffs. It previously ruled for Netflix against plaintiffs’ claims that intra-household disclosures were improper. (Coincidentally, same panel.) In general, it’s fair to say that plaintiffs bringing claims under the VPPA have fared poorly.

The court’s treatment of the second cause of action (alleging that Sony improperly transferred covered information when an affiliated entity took over operations of the Playstation Network) was not very strict, for lack of a better word. It says unhelpfully that there’s no cause of action when another entity is assigned the information because this could be a “transfer of ownership” of the information itself. Alternatively, if considered something less than a transfer of ownership, it would surely fall within the “request process” and “order fulfillment” exceptions that companies typically use outside entities to assist with. The court does not appear to set any limitations on this exception, nor does it require Sony to articulate how the transfers were intended to facilitate support services, rather than, say, due to Sony’s own internal corporate ownership structure and re-shuffling. Chalk up the court’s latitude towards the well-acknowledged flawed drafting of the statute, or to courts seeing numerous VPPA claims they don’t see as meritorious (thus wanting to give companies latitude). In any event, I thought it was worth noting.

Case citation: Rodriguez v. Sony Computer Entertainment America, LLC, et al., No. 12-17391 (9th Cir. Sept. 4, 2015) [pdf]

9th Circuit Rejects VPPA Claims Against Netflix For Intra-Household Disclosures

Lawsuit Fails Over Ridesharing Service’s Disclosures To Its Analytics Service–Garcia v. Zimride

Court Rejects VPPA Claim Against Viacom and Google Based on Failure to Disclose Identity

Android ID Isn’t Personally Identifiable Information Under the Video Privacy Protection Act

Minors’ Privacy Claims Against Viacom and Google Over Disclosure of Video Viewing Habits Dismissed

Hulu Unable to Shake Video Privacy Protection Act Claims

Video Privacy Protection Act Plaintiffs Can Proceed Against Hulu Absent Showing of Actual Injury

Judge Boots Privacy Lawsuit Against Pandora but Plaintiffs Can Replead – Yunker v. Pandora

Court Says Plaintiff Lacks Standing to Pursue Failure-to-Purge Claim Under the VPPA – Sterk v. Best Buy

Judge Dismisses Claims Against Pandora for Violating Michigan’s Version of the VPPA – Deacon v. Pandora Media

Split 9th Circuit Panel Approves Facebook Beacon Settlement – Lane v. Facebook