ANALISA TORRES, United States District Judge

Jonathan R. Donnellan, Kristina E. Findikyan, Hearst Corporation Office of the General Counsel, New York, NY, for Defendant.

MEMORANDUM AND ORDER

ANALISA TORRES, United States District Judge

Plaintiff, Josephine James Edwards, brings this class action lawsuit against Defendant, Hearst Communications, Inc., alleging violations of the Michigan Video Rental Privacy Act, H.B. 5331, 84th Leg., Reg. Sess., P.A. No. 378, § 2 (Mich. 1988) (amended 2016) ("VRPA"), and unjust enrichment. Defendant moves to dismiss the consolidated class action complaint for lack of subject matter jurisdiction and each party moves for summary judgment. For the reasons stated below, Defendant's motion to dismiss is DENIED, and each party's motion for summary judgment is GRANTED in part and DENIED in part.

BACKGROUND

I. The Michigan Video Rental Privacy Act

In 1988, Michigan enacted the VRPA "to preserve personal privacy with respect to the purchase, rental, or borrowing of" certain goods. Compl. ¶ 14. The law was enacted following the passage of the federal Video and Library Privacy Protection Act, 18 U.S.C. § 2710, and paralleled the enactment of similar consumer privacy laws in eleven other states. Compl. ¶¶ 13–17; see Boelter v. Hearst Commc'ns, Inc. , 192 F.Supp.3d 427, 447 n.13 (S.D.N.Y. 2016). As relevant to this action, the Michigan statute prohibits a person, and an "employee or agent of the person," "engaged in the business of selling at retail... books or other written materials" from "disclos[ing] to any person, other than the customer," "a record or information concerning the purchase ... of those materials by a customer that indicates the identity of the customer." VRPA § 2. The VRPA defines "customer" as "a person who purchases ... a book or other written material," defines "employee" as "a person who works for an employer in exchange for wages or other remuneration," and defines "employer" as "a person who has 1 or more employees." Id. § 1.

The law's prohibition is subject to five exceptions: disclosure is allowed "[w]ith the written permission of the customer"; "[p]ursuant to a court order"; to "collect payment" from the customer so long as the customer "has received written notice that the payment is due and has failed to pay ... within a reasonable time after notice"; if "the disclosure is for the exclusive purpose of marketing goods and services directly to the consumer," so long as the consumer receives "written notice that the customer may remove his or her name at any time by written notice to the person disclosing the information"; and pursuant to a search warrant or grand jury subpoena. Id. § 3.

Violation of the law constitutes a misdemeanor, id. § 4, and customers who are "identified in ... information that is disclosed in violation of [the] act" may bring a civil action to recover "actual damages, including damages for emotional distress, or $5,000.00, whichever is greater," as well as costs and reasonable attorneys' fees, id. § 5.

In May 2016, during the pendency of this action, the Michigan legislature amended the VRPA. See S.B. 490, 98th Leg., Reg. Sess., P.A. No. 92 (Mich. 2016) (to be codified at M.C.L. § 445.1711 et seq. ) ("Am. VRPA"). The amendment added an exemption for the disclosure of identifying information if the disclosure is "incident to the [discloser's] ordinary course of business." Am. VRPA § 3(d). This new exception, however, "only applies to a record or information that is created or obtained after" the amendment's effective date. Id. The amended VRPA no longer allows an individual to sue for statutory damages. See Am. VRPA § 5(2). In deciding Defendant's prior motion to dismiss, the Court concluded that the amendment does not apply retroactively and the pre-amendment version of the VRPA applies to this case. Boelter , 192 F.Supp.3d at 439–41 ; see also, e.g., Coulter–Owens v. Time Inc. , No. 16-1321, 695 Fed.Appx. 117, 120–21, 2017 WL 2731309, at *3 (6th Cir. June 26, 2017) ; Perlin v. Time Inc. , 237 F.Supp.3d 623, 628–33 (E.D. Mich. 2017) ; Moeller v. Am. Media, Inc. , 235 F.Supp.3d 868, 873–76 (E.D. Mich. 2017) ; Boelter v. Advance Magazine Publishers Inc. (Condé Nast ), 210 F.Supp.3d 579, 593–96 (S.D.N.Y. 2016).

II. Plaintiff

Plaintiff—who goes by Josephine James or Josephine James Edwards—is a Michigan resident. Def. 56.1 ¶¶ 14–20. Plaintiff has subscribed to a number of magazines published by Defendant, including Good Housekeeping, O, The Oprah Magazine , and Redbook. Id. ¶ 47. Plaintiff alleges that Defendant disclosed her personal information—including her name and address and the titles of magazines to which she subscribed—to third parties for Defendant's own gain, and that Plaintiff was not notified of and did not consent to these disclosures. See Compl. ¶¶ 7, 8, 58–60.

Among other subscriptions, Plaintiff maintained a subscription to Good Housekeeping from April 2009 to March 2010. Pl. 56.1 ¶ 48. Plaintiff testified that she "would not have subscribed" to Good Housekeeping if the protections of the VRPA did not exist: "The protections are more important to me than the value of the magazine.... [M]y privacy is more important than a magazine." Findikyan Decl. 1 Ex. H ("Pl. Dep."), at 193:22–25. Plaintiff explained that "what I read is really nobody's business," id. 66:18–19, and that she would not have purchased the subscription even it were free had she known that the publisher would share her personal information, id. 192:5–20.

III. Hearst's Privacy Practices

In each issue of Good Housekeeping sent to Plaintiff from April 2009 to March 2010, the following notice was included in the issue: "From time to time, we make our subscriber list available to companies who sell goods and services by mail that we believe would interest our readers." Def. 56.1 ¶ 49; Pl. 56.1 ¶ 204. The notice provided instructions on how to opt out of such mailings. Id. There is no evidence that Plaintiff ever requested to opt out. Def. 56.1 ¶ 78.

In addition, since at least April 2012, Hearst has maintained a privacy policy on its website. Id. ¶ 66; see Findikyan Decl. ¶ 31 & Ex. DD ("Def. Privacy Policy"), ECF No. 135. This policy is available by following a "Privacy Policy" link at the bottom of e-mails from Good Housekeeping. Def. 56.1 ¶ 63. Plaintiff received e-mails from Good Housekeeping from January 2012 to at least July 2016, id. ¶ 62, but testified that she never saw Hearst's privacy policy, Pl. Dep. 172:20-173:12.

The privacy policy indicates that "if you subscribe offline to one of the magazines published by Hearst..., from time to time we make your postal addresses available to companies for marketing purposes." Def. Privacy Policy § 1(d). The policy states that Hearst "may combine and use any and all information we collect on you either online or otherwise, including from third parties, for marketing purposes." Id. § 3(b). The policy also notes that "Hearst may (and you [the consumer] authorize us to) share or disclose Personally Identifiable Information" to "third party service providers to provide products, services or functions on our behalf (such as sending emails or processing credit cards or fulfilling subscriptions)," and third-party entities that "want[ ] to promote goods and services we think would be of interest to you." Id. § 4(a)(i), (vi). The privacy policy also states that a consumer's contact information may be disclosed "to third parties to allow them to market their products or services to you or for other marketing purposes," and that a consumer can opt-out by contacting Hearst or adjusting their online account preferences. Id. § 5(d).

IV. Defendant's Use of Plaintiff's Information

Defendant's Consumer Marketing department maintains a database of current and former subscribers of its magazines. Def. 56.1 ¶ 5. The database was established on or about June 1, 2008, and includes information relating to all magazine subscribers from June 2008 to the present, and information about some, but not all, subscribers who became inactive prior to June 2008. Id. ¶ 6. The records include names, mailing addresses, subscription information, promotional history, donor information for gift subscriptions, and demographic and other information provided to Defendant by third parties. Id. ¶¶ 7–9.

Defendant admits that it transmitted or authorized transmissions of Plaintiff's identifying information to six third-party entities. Each is described below.A. Acxiom Corporation

Since mid–2008, Defendant's marketing database has been hosted and maintained by Acxiom Corporation ("Acxiom"). Def. 56.11 ¶¶ 06–07. Defendant owns or licenses all the data residing in the database, id. ¶ 111, and pays Acxiom monthly service fees to host, maintain, and operate the database and perform related services, id. ¶ 115. At Defendant's direction, Acxiom has transmitted data from the database to some of Defendant's third-party service providers and partners. Id. ¶¶ 116–17. Acxiom has no authority to transmit Defendant's data without Defendant's permission and may not use the data for its own purposes. Id. ¶¶ 119, 121–22. Pursuant to the contract between Defendant and Acxiom, Acxiom would perform all services as an "independent contractor, and nothing contained herein shall be deemed to create any employment, associate, partnership, joint venture, or relationship of principal and agent or master and servant" between the two parties. Pl. 56.1 ¶ 10.

In May 2008, Acxiom received Plaintiff's identifying information from Defendant. Pl. 56.1 ¶ 18; see Marchese Decl. 1 Ex. 11. In the week prior to December 6, 2012, Acxiom received updated information about Plaintiff from Defendant. Pl. 56.1 ¶ 19; see Marchese Decl. 1 Ex. 5 ("Vanthournout Dep."), at 173:5–10. Acxiom's records include Plaintiff's name, address, and subscription history. Pl. 56.1 ¶ 20; Vanthournout Dep. 249:2–250:3.

B. Experian Marketing Solutions, Inc.

In February 2001, Defendant entered into a contract with Experian Marketing Solutions, Inc. ("Experian"). Pl. 56.1 ¶¶ 79. Defendant would send approximately 14 to 20 million records of current and former subscribers a year to Experian, and Experian would "overlay" additional data about these subscribers, such as political affiliation or demographic information. Id. ¶¶ 81, 86. The number of names Hearst submitted rose in 2012. Id. ¶ 87. At least once a year, Defendant directs Acxiom to provide data to Experian. Pl. 56.1 ¶¶ 88–92. Defendant's contract with Experian provides that they are "independent contractors" and states that "[n]othing in [the contract] shall be deemed to create any association, partnership, joint venture, or relationship of principal and agent or master and servant between the parties." Pl. 56.1 ¶ 80.

In 2011, 2012, 2013, and 2014, Defendant sent Experian data regarding Plaintiff. Id. ¶¶ 91–94. Defendant's database contains information acquired from Experian about Plaintiff. Id. ¶ 95. In March 2015, Defendant ceased sending subscription magazine titles as part of the data transmissions to Experian, and Defendant's June 2015 data transmission to Experian did not include the titles of the magazines Plaintiff subscribed to. Id. ¶¶ 96–97.

C. "Company 1"

In May 2007, Defendant entered into a contract to join the [Redacted] ("Company 1") data cooperative. Def. 56.11 ¶¶ 147–48; Pl. 56.11 ¶¶ 99–100. A data cooperative allows a company to receive personal information of potential new customers in exchange for submitting information about their current or past customers. Pl. 56.1 ¶ 101; Findikyan Decl. 1 Ex. I ("Murphy Dep."), at 346:5–12. Pursuant to its contract, Defendant was required to contribute its "customer file at the beginning of th[e] relationship and send[ ] complete previous-month customer history transaction information" on a monthly basis. Pl. 56.1 ¶ 102.

Once a month, Defendant directed Acxiom to transmit to Company 1 certain data, including name, address, and magazine title. Id. ¶¶ 107–08. It is not clear what years these transfers occurred. For instance, Defendant states that "[b]y 2011, Hearst was no longer participating in the [Company 1 data c]o-op" and that "Hearst renewed its participation ... in 2012 on a limited basis." Findikyan Decl. 2 Ex. WW ¶ 8. And Defendant "does not dispute that from November 2014 to March 2015 transmissions of certain subscriber data to [Company 1] included name, address and a three character code representing a magazine title." Pl. 56.1 ¶ 107. Plaintiff contends, however, that Defendant directed Acxiom to transmit Plaintiff's identifying information once a month from January 2011 through March 2015, id. ¶ 108, but does not provide any supporting evidence for this contention.

The evidence regarding Defendant's transmission of personal information about Plaintiff is similarly murky. A representative from Company 1 stated that it did not find any raw data files from Defendant containing information about Plaintiff. Marchese Decl. 1 Ex. 28. Company 1 did produce a "partial record for the James household," id ., which is dated June 7, 2014, and does include information identifying Plaintiff at her Michigan address and mentions the magazine Good Housekeeping , Marchese Decl. 1 Ex. 27.

D. "Company 2"

On February 28, 2007, Defendant entered into a contract with [Redacted] ("Company 2"), a data cooperative, under which Defendant would "contribute its subscriber file and related transaction data" in exchange for receiving leads on potential new customers. Id. ¶¶ 117–18, 120, 122. Only entities that provide customer data can receive new data from Company 2. Id. ¶ 121. Pursuant to the contract, Defendant was required to provide "(a) Active Subscriber Name and Address; (b) Active Subscriber historical transaction data including most recent subscription date and dollar amount, source of latest order, and such other data as may be agreed upon; [and] (c) Selected Expired Subscriber name, address, and transaction information similar to that provided for active subscribers." Id. ¶ 122.A representative from Company 2 testified that Defendant provided it with Plaintiff's name, address, and the fact that Plaintiff subscribed to Women's Day magazine. Marchese Decl. 1 Ex. 31 ("Company 2 Dep."), at 122:22–123:14. Company 2 also produced a spreadsheet with some of the information in its possession concerning Plaintiff. Pl. Mem. 16; Marchese Decl. 1 Ex. 33. The representative, reviewing that record, testified that the "Update Date" for Company 2's records regarding Plaintiff was April 7, 2011. Company 2 Dep. 124:7–17. However, Defendant did not own Women's Day magazine on April 7, 2011. Def. Suppl. 56.1 ¶¶ 21 –22. Plaintiff, in support of her claim, points to three addenda to the contract between Company 2 and Defendant, dated March 29, September 12, and October 24, 2013, which each added transmissions of personal information of expired subscribers of magazines to which Plaintiff subscribed. Pl. Reply 8 (citing Findikyan Decl. 2 Exs. CCC, DDD, EEE).

E. Dunn Data Co., Inc.

Pursuant to a December 2008 contract with Dunn Data Co., Inc. ("Dunn Data"), Defendant would provide Dunn Data with certain data about active and expired subscribers in exchange for money and reduced rates when using Dunn Data's services. Pl. 56.1 ¶ 53–54. Dunn Data is a "data aggregator," which means it "acquired data from companies like [Defendant] and companies like Equifax,... Time Inc., Condé Nast, Meredith and so on." Findikyan Decl. 1 Ex. K ("Dunn. Dep."), at 11:19–12:3. Dunn Data collects this data, matches it "to government records and other compiled information about consumers," and compiles it into "a large database." Id. From 2008 to 2013, Defendant provided certain customer data to Dunn Data on a quarterly basis, receiving $156,000 in total and access to Dunn Data's database products at a discount. Pl. 56.1 ¶¶ 72–74. Defendant cancelled its contract with Dunn Data in 2013. Id. ¶ 78.

Plaintiff's records, indicating her status as an expired Good Housekeeping magazine subscriber, were "eligible" to be included in three scheduled transmissions to Dunn Data by Defendant from June 2011 to March 2012. Pl. 56.11 ¶ 75; Murphy Dep. 366:19–367:18. Stephen Dunn, Dunn Data's owner, testified at a deposition that, at some unspecified time, Dunn Data received Plaintiff's name, address, and the titles of Defendant's magazines to which she subscribed. Pl. 56.1 ¶ 76; Dunn Dep. 130:7–17.

F. "Company 3"

Defendant entered into a contract with [Redacted] ("Company 3") in November 2009. Pl. 56.1 ¶ 35. Pursuant to the contract, Defendant agreed to provide "names and addresses of Hearst active subscribers, expires, and new moves" relating to thirteen different publications. Id. ¶ 36; Marchese Decl. 1 Ex. 16, at 1, 5. Defendant transmitted data to Company 3 monthly and committed to delivering millions of records each year. Pl. 56.1 ¶ 37; see also id. ¶¶ 42–43. In exchange, Defendant received an annual license fee. Id. ¶ 38. The contract provided that "[t]he parties are independent contractors under this Agreement and no other relationship is intended, including, but not limited to, customer, franchise, joint venture, agency, employer/employee, fiduciary, master/servant relationship, or other special relationship." Id. ¶ 41.

Under the contract, Plaintiff's identifying information was eligible to be transmitted by Acxiom to Company 3 each month from July 2011 to March 2015. Id. ¶ 47; Murphy Dep. 304:22–305:5. Defendant does not dispute that on December 1, 2014, January 5, 2015, February 2, 2015, and March 4, 2015, Acxiom transmitted Plaintiff's name, address, and status as an expired subscriber of Good Housekeeping, Oprah, Redbook , and Women's Day to Company 3. Pl. 56.1 ¶ 48. Defendant also transmitted data indicating whether Plaintiff's subscriptions were "Direct to Publisher" ("DTP")—that is, purchased directly from Defendant. Id. ¶¶ 50–52; Marchese Decl. 1 Ex. 18 ("Company 3 Decl.") ¶¶ 7–8; Pl. 56.1 50–52.

V. Procedural History

On May 21, 2015, former plaintiff Suzanne Boelter filed a class action against Defendant alleging violations of the VRPA and unjust enrichment. ECF No. 1. On November 24, 2015, Plaintiff filed a class action asserting similar claims. Edwards v. Hearst Commc'ns, Inc. , No. 15 Civ. 9279, ECF No. 1. The two cases were consolidated for all purposes on February 8, 2016, ECF No. 66, and on February 26, 2016, Boelter and Plaintiff filed an amended complaint, ECF No. 67. Defendant filed a motion to dismiss and, after extensive briefing including supplemental briefing on the Supreme Court's decision in Spokeo, Inc. v. Robins , the Court issued a memorandum and order (the "2016 Opinion") denying Defendant's motion. ECF No. 81. On October 17, 2016, the Court so-ordered Boelter's stipulation of dismissal. ECF No. 125.

DISCUSSION

I. Legal Standards

A. Rule 12(b)(1) Motion Following Discovery

In resolving a motion to dismiss for lack of subject matter jurisdiction, "the district court must take all uncontroverted facts in the complaint... as true, and draw all reasonable inferences in favor of the party asserting jurisdiction." Tandon v. Captain's Cove Marina of Bridgeport, Inc. , 752 F.3d 239, 243 (2d Cir. 2014). However, "[w]here jurisdictional facts are placed in dispute, the court has the power and obligation to decide issues of fact by reference to evidence outside the pleadings, such as affidavits." APWU v. Potter , 343 F.3d 619, 627 (2d Cir. 2003) (quoting LeBlanc v. Cleveland , 198 F.3d 353, 356 (2d Cir. 1999) ); see also Carter v. HealthPort Techs., LLC , 822 F.3d 47, 57 (2d Cir. 2016).

If a defendant's evidence " ‘reveal[s] the existence of factual problems,’ " a plaintiff "will need to come forward with evidence of [her] own to controvert that presented by the defendant." Carter , 822 F.3d at 57 (quoting Exch. Nat'l Bank v. Touche Ross & Co. , 544 F.2d 1126, 1131 (2d Cir. 1976) ). If, however, a defendant's evidence is "immaterial because it does not contradict plausible allegations that are themselves sufficient to show standing," a plaintiff may "rely on the allegations in the Pleading." Id. If a court is faced with material and controverted extrinsic evidence, the court may make findings of fact to determine standing. Id. ; see also All. For Envtl. Renewal, Inc. v. Pyramid Crossgates Co. , 436 F.3d 82, 88 (2d Cir. 2006).

B. Motion for Summary Judgment

On a motion for summary judgment, "[t]he court shall grant summary judgment if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed. R. Civ. P. 56(a). The moving party bears the initial burden of pointing to evidence in the record, "including depositions, documents[,] ... [and] affidavits or declarations," Fed. R. Civ. P. 56(c)(1)(A), "which it believes demonstrate[s] the absence of a genuine issue of material fact," Celotex Corp. v. Catrett , 477 U.S. 317, 323, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986). The moving party may support an assertion that there is no genuine dispute by "showing ... that [the] adverse party cannot produce admissible evidence to support the fact." Fed. R. Civ. P. 56(c)(1)(B). A genuine dispute of material fact exists when "the evidence is such that a reasonable jury could return a verdict for the nonmoving party." Anderson v. Liberty Lobby, Inc. , 477 U.S. 242, 248, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). On summary judgment, the Court construes the facts, resolves all ambiguities, and draws all permissible factual inferences in favor of the non-moving party. See Dallas Aerospace, Inc. v. CIS Air Corp ., 352 F.3d 775, 780 (2d Cir. 2003).

II. Defendant's Motion to Dismiss

Defendant argues that Plaintiff lacks standing to bring this action because Defendant's alleged violation of the VRPA does not constitute a concrete injury. Defendant is incorrect.

In denying Defendant's first motion to dismiss, the Court found that "[a]s alleged, Plaintiff[ ] suffered a particularized, concrete injury-in-fact—the violation of [her] rights under the VRPA, along with economic harm—that was caused by Defendant and that can be remedied by court action" and concluded that at that stage, "the pleadings are sufficient to establish Plaintiffs' standing to sue." Boelter , 192 F.Supp.3d at 438. Defendant now challenges the accuracy of the jurisdictional facts alleged.

"It is well ingrained in the law that subject-matter jurisdiction can be called into question either by challenging the sufficiency of the allegation or by challenging the accuracy of the jurisdictional facts alleged." Robinson v. Gov't of Malaysia , 269 F.3d 133, 140 (2d Cir. 2001) (quoting Gwaltney of Smithfield, Ltd. v. Chesapeake Bay Found., Inc. , 484 U.S. 49, 68, 108 S.Ct. 376, 98 L.Ed.2d 306 (1987) (Scalia, J., concurring in part and concurring in the judgment)). A defendant is "permitted to make a fact-based Rule 12(b)(1) motion, proffering evidence beyond the" pleadings, in which the defendant can controvert the allegations in the complaint and the plaintiff must come forward with evidence of her own. Carter , 822 F.3d at 57.

To establish standing, a plaintiff must allege "(1) an injury that is (2) ‘fairly traceable to the defendant's allegedly unlawful conduct’ and that is (3) ‘likely to be redressed by the requested relief.’ " Lujan v. Defs. of Wildlife , 504 U.S. 555, 590, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (quoting Allen v. Wright , 468 U.S. 737, 751, 104 S.Ct. 3315, 82 L.Ed.2d 556 (1984) ); see also Amidax Trading Grp. v. S.W.I.F.T. SCRL , 671 F.3d 140, 145 (2d Cir. 2011). The injury must be an "injury-in-fact," meaning it is "concrete and particularized" and "actual or imminent, not conjectural or hypothetical." Lujan , 504 U.S. at 560, 112 S.Ct. 2130 (internal quotation marks and citations omitted). An injury is particularized if it "affect[s] the plaintiff in a personal and individual way." Spokeo, Inc. v. Robins , –––U.S. ––––, 136 S.Ct. 1540, 1548, 194 L.Ed.2d 635 (2016) (quoting Lujan , 504 U.S. at 560 n.1, 112 S.Ct. 2130 ). A concrete injury must be " ‘de facto ’; that is, it must actually exist." Id. at 1549.

Although "tangible injuries are perhaps easier to recognize" as concrete, an "intangible" harm may also be concrete where, for example, an otherwise de facto injury that was inadequate at law has been "identif[ied] and elevat[ed]" by a legislature. Id. For that reason, "a bare procedural violation, divorced from any concrete harm, [does not] satisfy the injury-in-fact requirement of Article III." Id. However, "the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. In other words, a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified." Id.

Defendant contends that Plaintiff's alleged injury falls into the first category articulated in Spokeo —that is, a mere technical violation of the VRPA "divorced from any concrete harm"—and not the second category, which encompasses a violation of a statute that, in itself, constitutes an injury in fact. Spokeo , 136 S.Ct. at 1549 ; see generally Def. Opp. 5–13. The Court disagrees.

First, every court to consider the issue of standing under the VRPA has concluded that such a violation constitutes a concrete injury in and of itself. Earlier this year, the Sixth Circuit addressed the issue of standing under the VRPA, and concluded that "the disclosure of that information is a cognizable injury in fact for purposes of Article III standing." Coulter–Owens , 695 Fed.Appx. at 121, 2017 WL 2731309, at *3. That Court of Appeals rejected the argument posited by Defendant here: "[T]he violation at issue here is not a ‘bare procedural violation’; it is a violation of the [VRPA's] most basic substantive protection, the privacy in one's reading materials. Spokeo does not apply here." Id. at 121, at *4. Similarly, in a case parallel to this one against magazine publisher Conde Nast, the Honorable Naomi Reice Buchwald came to the same conclusion: "Boelter's allegations squarely implicate the right to privacy in her [personal information] protected by the [VRPA]. ... This is distinct from the procedural ‘notice’ violation discussed in Spokeo , which resulted in no additional harm." Condé Nast , 210 F.Supp.3d at 589. Federal district courts in Michigan have consistently come to the same conclusion. See Perlin , 237 F.Supp.3d at 640–41 (holding that VRPA violation is "not a ‘bare procedural violation,’ but rather a violation of the VRPA's substantive core" and "the right guaranteed by the VRPA is similar in kind to other privacy rights that were gradually recognized by American courts over the course of the last century"); Moeller , 235 F.Supp.3d at 873 ("Subscribers' right to privacy in their personal-reading information is grounded in an interest ‘traditionally regarded as providing a basis for a lawsuit in English or American courts.’ ... And because the alleged violation of the Michigan [VRPA] here implicates plaintiffs' ‘concrete interest’ in the nondisclosure of their personal information without their permission, they have adequately pled a concrete injury-in-fact.").

Plaintiff's alleged injury is not a "bare procedural violation," but a substantive violation that strikes at the long-recognized right to privacy. Both before and after Spokeo , courts have held that a plaintiff aggrieved under the federal Video and Library Privacy Protection Act has a concrete and actionable injury. See, e.g., Condé Nast , 210 F.Supp.3d at 589 (collecting cases). As Spokeo implies, a legislature may "elevate[ ] an otherwise non-actionable invasion of privacy into a concrete, legally cognizable injury." Id. (quoting Yershov v. Gannet Satellite Info. Network, Inc. , 204 F.Supp.3d 353, 361 (D. Mass. 2016) ). Although the parties debate the scope of the common law right to privacy and related Michigan torts, there is no question that an individual has an interest in the disclosure of her personal information sufficient to establish a de facto injury that can be identified and elevated by a legislature. Yershov , 204 F.Supp.3d at 362 ("[B]oth the common law and the literal understandings of privacy encompass the individual's control of information concerning his or her person." (quoting U.S. Dep't of Justice v. Reporters Comm. for Freedom of the Press , 489 U.S. 749, 763, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989) )); see also, e.g., In re Nickelodeon Consumer Privacy Litig. , 827 F.3d 262, 273–74 (3d Cir. 2016) (holding that a violation of the Video and Library Privacy Protection Act results in a concrete harm if "it involves a clear de facto injury, i.e. , the unlawful disclosure of legally protected information"). The harms the Michigan legislature intended to prevent—" one's choice in videos, records, and books is nobody's business but one's own, and [we] suggest the enactment of a statute to explicitly protect a consumer's privacy in buying and borrowing such items," House Legislative Analysis Section, Privacy: Sales, Rentals of Videos, Etc., H.B. 5331, (Jan. 20, 1989), Boelter Compl. Ex. A ("Mich. Leg. Analysis")—echo the fundamental right to privacy. A violation thereof represents a de facto injury elevated by the Michigan legislature into a legally cognizable claim. See, e.g., Condé Nast , 210 F.Supp.3d at 590 (discussing the common law tort of invasion of privacy); Perlin , 237 F.Supp.3d at 639–40.

Finally, although the substantive violation of the VRPA is sufficient to confer standing, Plaintiff has testified to additional economic injuries, explaining that she would not have purchased a subscription to any Hearst magazine had she known that her personal information would be disclosed. Pl. Dep. 192:9–193:25. The Second Circuit recently declined to find that plaintiffs had standing where they "fail[ed] to allege that they would not have purchased the life insurance and annuity riders ... had they known of [the defendant's] alleged shadow insurance practices," suggesting that a contention like Plaintiff's would be sufficient to establish standing. Ross v. AXA Equitable Life Ins. Co. , 680 Fed.Appx. 41, 45 (2d Cir. 2017). Although Defendant seeks to discredit Plaintiff's testimony as conclusory and self-serving, Defendant has also not provided any evidence to the contrary. Defendant merely suggests that Plaintiff should have known about Defendant's sharing of personal identifying information because prior lawsuits on this issue were "well known and well publicized," Def. Opp. 12, despite Plaintiff's denial of awareness, Pl. Dep. 83:9–11 ("Q. Did you learn about other lawsuits that had been filed? A. No, no."). As Defendant has not successfully challenged the accuracy of the jurisdictional facts alleged, the Court credits both the allegations in the complaint and Plaintiff's testimony. See Robinson , 269 F.3d at 140. These economic injuries also suffice to establish a particularized and concrete injury to confer standing. See Ross , 680 Fed.Appx. at 44–45.

Accordingly, Defendant's motion to dismiss is DENIED.

III. Defendant's Motion for Summary Judgment

Defendant moves for summary judgment on five legal theories that would narrow or eliminate its potential liability: (i) that some of Plaintiff's VRPA claims are time-barred by the three-year statute of limitations, which should not be tolled; (ii) that its transmissions of Plaintiff's identifying information are not actionable under the VRPA; (iii) that the VRPA is unconstitutionally vague, or (iv) in violation of the First Amendment; and (v) that Plaintiff's unjust enrichment claim fails as a matter of law. The Court addresses each issue below.

A. Tolling

First, Defendant argues that some of Plaintiff's VRPA claims are time-barred by Michigan's three-year statute of limitations. See M.C.L. § 600.5805(10). Plaintiff argues that her claims should be equitably tolled based on two cases in which Plaintiff was a putative class member: Grenke v. Hearst Communications, Inc. , No. 12 Civ. 14221, which was filed on September 24, 2012, in the Eastern District of Michigan and voluntarily dismissed on February 23, 2015; and Boelter , with which Plaintiff's case was consolidated before the Boelter plaintiff was dismissed. "[A] federal court evaluating the timeliness of state law claims must look to the law of the relevant state to determine whether, and to what extent, the statute of limitations should be tolled by the filing of a putative class action in another jurisdiction." Casey v. Merck & Co. , 653 F.3d 95, 100 (2d Cir. 2011). In a memorandum order in this case dated November 9, 2016, the Honorable James L. Cott, U.S. Magistrate Judge, wrote that "the tolling issue turns on unsettled questions of Michigan state law, which the Court declines to resolve at this juncture," but that "it appears that plaintiff's claims were at least potentially tolled until the motion for class certification was withdrawn in the Michigan action." Edwards , ECF No. 77 at 1–2.

Turning then to Michigan law, the parties do not dispute that Michigan has "essentially eliminated" equitable tolling, and instead requires that tolling be dictated by statute. Colen v. Corizon Med. Servs. , No. 14 Civ. 12948, 2017 WL 389960, at *8 (E.D. Mich. Jan. 25, 2017) ; see Chandler v. Wackenhut Corp ., 465 Fed.Appx. 425, 431 (6th Cir. 2012) ("The [Michigan Supreme Court] held that equitable tolling is only available if ‘no controlling statute negated the application of equity ...’ " (quoting Trentadue v. Buckler Lawn Sprinkler , 479 Mich. 378, 406, 738 N.W.2d 664 (2007) )). The parties identify Michigan Court Rule 3.501(F) as the relevant statute, which states in full:

(F) Statute of Limitations.

(1) The statute of limitations is tolled as to all persons within the class described in the complaint on the commencement of an action asserting a class action.

(2) The statute of limitations resumes running against class members other than representative parties and intervenors:

(a) on the filing of a notice of the plaintiff's failure to move for class certification under subrule (B)(2);

(b) 28 days after notice has been made under subrule (C)(1) of the entry, amendment, or revocation of an order of certification eliminating the person from the class;

(c) on entry of an order denying certification of the action as a class action;

(d) on submission of an election to be excluded;

(e) on final disposition of the action.

(3) If the circumstance that brought about the resumption of the running of the statute is superseded by a further order of the trial court, by reversal on appeal, or otherwise, the statute of limitations shall be deemed to have

been tolled continuously from the commencement of the action.

M.C.R. 3.501(F). As the Michigan Supreme Court has explained, this provision was "modeled after" the United States Supreme Court's decision in American Pipe and Constr. Co. v. Utah , 414 U.S. 538, 94 S.Ct. 756, 38 L.Ed.2d 713 (1974). Cowles v. Bank West , 476 Mich. 1, 719 N.W.2d 94, 103 (2006).

Defendant first argues that M.C.R. 3.501(F)"does not apply to the facts of this case [because] it only governs cases pending in Michigan state courts." Def. Opp. 45 (citing M.C.R. 1.103 ). This argument is unpersuasive: although M.C.R. 1.103 states that the Michigan Court Rules govern courts "established by the constitution and laws of the State of Michigan," M.C.R. 1.103, federal courts look to state law to determine tolling, Casey , 653 F.3d at 100. Federal district courts both within and outside Michigan have applied M.C.R. 3.501(F) to analyze tolling of Michigan claims. See, e.g., Compressor Eng'g Corp. v. Chicken Shack, Inc. , No. 10 Civ. 10059, 2013 WL 4413752, at *5 (E.D. Mich. Aug. 15, 2013) ; Emerson Elec. Co. v. Le Carbone Lorraine, S.A ., 500 F.Supp.2d 437, 451 (D.N.J. 2007). Accordingly, the Court will look to M.C.R. 3.501(F) to determine whether Plaintiff's claims were tolled by Grenke or Boelter.

Defendant contends that Grenke should not toll Plaintiff's claims because Grenke was voluntarily dismissed with prejudice after it was discovered that the plaintiff lacked standing. Def. Opp. 42 n.32 (citing Grenke , ECF No. 95). Defendant directs the Court to the tolling exception under American Pipe and its progeny where the statute of limitations is not tolled when a case has been voluntarily dismissed. See, e.g., In re IndyMac Mortg.–Backed Sec. Litig. , 718 F.Supp.2d 495, 504 (S.D.N.Y. 2010) ("The general rule ... is that a voluntarily dismissed complaint does not toll the statute of limitations. This is because the law treats a voluntarily dismissed complaint as if it never had been filed." (footnotes omitted) (citing Elgendy v. City of New York , No. 00 Civ. 5196, 2000 WL 1119080, at *5 (S.D.N.Y. Aug. 7, 2000) )).

However, the American Pipe exception does not apply here. As an initial matter, such an exception would be contrary to the purpose of M.C.R. 3.501(F) : "The manifest purpose of this provision is to avoid the situation in which each class member must initiate his or her own individual lawsuit to preserve a cause of action. Thus, class members must be allowed to rely upon the ‘assertion’ of a class action without having to independently determine that the person asserting it has a right to do so ." Cowles , 719 N.W.2d at 110 n.16 (emphasis added). It follows, therefore, that Plaintiff could rely on Grenke even though it turned out that the Grenke plaintiff did not have standing to represent the class. Moreover, this exception is generally limited to cases where the initial class action was voluntarily dismissed without prejudice, whereas Grenke was voluntarily dismissed with prejudice. See, e.g., Franklin v. Consol. Edison Co. of N.Y. , No. 98 Civ. 2286, 1999 WL 796170, at *4 (S.D.N.Y. Sept. 30, 1999) ("When an action is dismissed without prejudice, it is treated as if it had never been filed."); 9 Charles Alan Wright & Arthur R. Miller, Federal Practice and Procedure § 2367 (3d ed. 2017) ("[A] voluntary dismissal without prejudice under Rule 41(a) leaves the situation as if the action never had been filed."). Finally, M.C.R. 3.501(F) does not incorporate the American Pipe exception, nor has Defendant provided any indication that Michigan state courts apply this exception, and the Court is bound to apply Michigan state law. See Casey , 653 F.3d at 100 ; see also Compressor Eng'g Corp. , 2013 WL 4413752, at *5 (tolling, under both federal and Michigan law, a plaintiff's claim based on a prior class action that was voluntarily dismissed with prejudice). Accordingly, Plaintiff's claims may be tolled by Grenke.

Accepting that Grenke may toll Plaintiff's claims, the Court must calculate the precise number of days tolled. Grenke was filed on September 24, 2012, Grenke , ECF No. 1, and a motion to certify a class was filed the same day, id. at ECF No. 2. The Grenke plaintiff withdrew without prejudice his motion for class certification on August 20, 2013. Id. at ECF No. 39. This is the date that Judge Cott used to calculate tolling. Edwards , ECF No. 77 at 9. Grenke was voluntarily dismissed with prejudice on February 23, 2015. Grenke , ECF No. 95. The Court concludes that, under M.C.R. 3.501(F), Plaintiff is entitled to tolling for the entire length of Grenke litigation, not only until August 20, 2013. First, M.C.R. 3.501(F)(2) does not contemplate withdrawal without prejudice as one of the five conditions that recommences the running of the statute of limitations. The withdrawal without prejudice of the class certification motion in 2013 was not, therefore, a failure to move for class certification or a denial of certification that would otherwise terminate tolling under M.C.R. 3.501(F)(2)(a) or (c). Moreover, as Plaintiff explains:

Prior to the United States Supreme Court's decision in Campbell– [Ewald ] Emald Co. v. Gomez [––– U.S. ––––], 136 S.Ct. 663 (2016), plaintiffs would often file ‘placeholder’ motions for class certification with their complaints, to protect against any attempt by defendants to ‘pick-off’ the named plaintiff's individual claims by making a Fed. R. Civ. P. 68 offer of judgment above what the individual plaintiff could recover in the lawsuit. After discovery, [p]laintiffs would then file bona fide motions for class certification. That is exactly what happened in Grenke.

Pl. Opp. 47 (citation omitted). As is clear from the Grenke docket, the court set deadlines for class certification motions that extended well into 2015. See Grenke , ECF Nos. 47, 48, 52.

Plaintiff's claims, therefore, were tolled by Grenke from September 24, 2012, to February 23, 2015—for 883 days.

Boelter was filed on May 21, 2015. The Court rejects Defendant's argument that Boelter should be excluded under M.C.R. 3.501(F) for the reasons already explained and agrees, therefore, with Judge Cott that Plaintiff's claims were tolled from May 21, 2015, until November 24, 2015, when Plaintiff filed her action in this case. Accordingly, Plaintiff's claims were tolled for 883 days before the filing of Boelter , or December 20, 2012. Taking into account the three-year statute of limitations, any disclosure by Defendant that occurred after December 20, 2009 are actionable. Defendant's motion for summary judgment based on the three-year statute of limitations is, therefore, DENIED.

B. Scope of the VRPA

Defendant raises three statutory interpretation arguments as to why its transmissions of Plaintiff's identifying information are not actionable under the VRPA: first, Defendant did not transmit records "concerning the purchase" of Plaintiff's magazine subscriptions; second, Defendant's confidential transmissions were not "disclosures"; and third, Defendant's transmissions were to its employees or agents and therefore exempt. The Court addresses these arguments in turn and applies the Court's conclusions to the disclosures discussed in Plaintiff's motion for summary judgment in section IV, infra. i. "Concerning the Purchase"

The VRPA prohibits disclosure of "a record or information concerning the purchase ... [of written materials] by a customer that indicates the identity of the customer," VRPA § 2 (emphasis added), and defines "customer" as "a person who purchases ... written material," id. § 2(l)(a). The parties dispute whether the "record or information" disclosed has to directly relate to the purchase of Defendant's magazines, such as a receipt or billing record, as opposed to merely being related to a person's subscription.

Defendant argues that for the VRPA to prohibit disclosure of a record, that record or information must "identify Plaintiff as the purchaser of any of her magazine subscriptions." Def. Mem. 27. To justify its interpretation, Defendant draws a comparison between the Michigan law and its federal analogue, the Video and Library Privacy Protection Act, which defines "consumer" more broadly as "any renter, purchaser, or subscriber ." 18 U.S.C. § 2710(a)(1) (emphasis added). Defendant reasons that the Michigan legislature, by defining "customer" more narrowly as a person "who purchases," made a deliberate choice to exclude from the statute those records that merely disclose subscriber information. Def. Br. 29 & n.14. Also in contrast to the Michigan VRPA, the federal law prohibits a provider from "knowingly disclos[ing], to any person, personally identifiable information concerning any consumer of such provider." 18 U.S.C. § 2710(b)(1). Defendant posits, therefore, that because it did not disclose Plaintiff's identity as the purchaser of her subscriptions, those disclosures are not actionable.

Plaintiff, in response, argues that the use of the word "concerning" is intended to prohibit a broad range of disclosures "relating to; regarding; [or] about" Plaintiff's magazine purchase. Pl. Opp. 12–13 (quoting Bowman v. Greene , No. 308282, 2013 WL 5925995, at *10 (Mich. Ct. App. Nov. 5, 2013) (construing, in the context of disclosures of environmental issues, "concerning" as "relating to; regarding; about")). Plaintiff argues, therefore, that the VRPA prohibits " ‘disclosure of information about, relating to, or regarding’ Plaintiff's magazine subscription." Id. at 13.

The Court agrees with Defendant that "purchaser" is not synonymous with "subscriber," and agrees with Plaintiff that disclosures "concerning the purchase" should be construed broadly. Thus, a disclosure that includes information solely connected to a gift or free subscription would not be actionable, but a disclosure that concerns, in broad terms, the purchase of that subscription would be actionable.

In analyzing the VRPA, the Michigan Supreme Court relied on the dictionary definition of "rent" to determine that "the word ‘rent’ contemplates some form of payment," and that a plaintiff under the VRPA who received a sound recording for free could not have a cause of action under the VRPA. Deacon v. Pandora Media, Inc. , 499 Mich. 477, 885 N.W.2d 628, 632 (2016) ; see id. at 631–32 ("Because the [VRPA] was enacted in 1988, we consult dictionaries from that era to define those words."). Webster's dictionary from 1988 defines "sell" as "to give up, deliver, or exchange (property, goods, services, etc.) for money or its equivalent," and "purchase" as "to obtain for money or by paying a price." Webster's New World Dictionary : Third College Edition (1988). Webster's defines "concern" as "to have a relation to or bearing on." Id. The Court, therefore, gives "concern" this broad construction.

Thus, disclosure of a record that shows a customer's name, address, magazine title, and some additional information related to the purchase of that subscription is sufficient to be actionable. Cf. Bowman , 2013 WL 5925995, at *10.

ii. "Disclose"

Defendant argues that the transmissions of Plaintiff's data that occurred were not "disclosures" under the VRPA because they were not made public. Defendant cites dictionaries, treatises, and caselaw from within and outside Michigan to argue that " ‘disclosure’ is synonymous with ‘publicity.’ " Def. Mem. 31.

The Court disagrees. By Defendant's own dictionary definition, "disclose" has the meaning "to make known or public"—suggesting that something could be disclosed by being made known without being made public. Def. Mem. 30 (emphasis added) (quoting Webster's Ninth New Collegiate Dictionary (1986)). As the Michigan Court of Appeals has noted, albeit in a different context: "The Legislature's use of the broad term ‘disclose’ precludes a cleric from revealing the covered statements to anyone , not simply before a court of law." People v. Bragg , 296 Mich.App. 433, 824 N.W.2d 170, 181 (2012) (emphasis added). Further, although Defendant cites the Michigan invasion of privacy tort to argue that Michigan tort law requires public disclosure to be actionable, Def. Mem. 31, Defendant misses that only one of the four "types of invasion of privacy" requires "publicity" under Michigan law, see Lansing Ass'n of Sch. Adm'rs v. Lansing Sch. Dist. Bd. of Educ. , 216 Mich.App. 79, 549 N.W.2d 15, 20 (1996).

Even assuming that Defendant is correct that "disclose" generally requires publicity, Defendant's proposed interpretation of the VRPA is contrary to the clear text of the statute. "Courts must give effect to every word, phrase, and clause in a statute and avoid an interpretation that would render any part of the statute surplusage or nugatory." State Farm Fire & Cas. Co. v. Old Republic Ins. Co. , 466 Mich. 142, 644 N.W.2d 715, 717 (2002). The Michigan legislature prohibited disclosure "to any person , other than the customer." VRPA § 2 (emphasis added). Defendant's reading of the statute, to apply only to public disclosures, renders the words "to any person" superfluous. And as the VRPA's legislative history describes, the "apparent problem" the law addressed was that "[m]any in Michigan ... believe that one's choice in videos, records, and books is nobody's business but one's own " and that it is "a private matter ... not a fit subject for consideration by gossipy publications, employers, clubs, or anyone else, for that matter. " Mich. Leg. Analysis (emphasis added). To limit the scope of the statute to public disclosure would run contrary to the text and purpose of the statute.

Accordingly, the Court concludes that a disclosure need not be public to be actionable under the VRPA.

iii. "Employee or Agent" Exception

Finally, Defendant contends that the VRPA has an implicit exception for disclosures made to employees or agents. The Court agrees.

The statute prohibits "a person, or an employee or agent of the person" from disclosing a customer's personal information, VRPA § 2; the prohibition against disclosure by an employee or agent would be unnecessary if the disclosure to an employee or agent would itself be actionable. See State Farm Fire & Cas. Co. , 644 N.W.2d at 717. The Eastern District of Michigan implicitly recognized that such an exception exists, reasoning, on a motion to dismiss:

The nature and scope of an agency relationship is generally a question of fact. If a written agreement defines the scope of an agent-principal relationship, however, a Court must determine the nature of the relationship.... [T]his Court must take Plaintiffs' allegations regarding the relationship between Defendant and its "unrelated" vendors as true. Whether these third-party vendors are agents within the VRPA's statutory definition, therefore, is best left for discovery.

Cain v. Redbox Automated Retail, LLC , 981 F.Supp.2d 674, 684 (E.D. Mich. 2013) (citations omitted). Moreover, if a company was unable to disclose the name and purchase information of its customers to its employees, such as those who track billing or mail magazines, it would make operating a large business such as Defendant's nearly impossible—an absurd result that surely was not the intention of the Michigan legislature. See People v. Tennyson , 487 Mich. 730, 790 N.W.2d 354, 361 (2010) ("[S]tatutes must be construed to prevent absurd results ...." (alteration and omission in original) (quoting Rafferty v. Markovitz , 461 Mich. 265, 602 N.W.2d 367, 369 (1999) )). This construction allows an employer to share an individual's personal information with its employees and agents with the assurance that the employees and agents are prohibited by the VRPA from further disclosing such information. The Court concludes that the VRPA does not prohibit disclosures made to an employer's employees or agents.

The parties further dispute the scope of this exception. The VRPA defines "employee" as "a person who works for an employer in exchange for wages or other remuneration," and defines "employer" as "a person who has 1 or more employees." VRPA § 1(b), (c). Defendant suggests that this definition has a wide scope, permitting disclosure to any third party that received remuneration for services they performed for Defendant. See Def. Reply 38. Plaintiff urges the Court to apply the "economic reality test," which "looks to the totality of the circumstances surrounding the work performed." Chilingirian v. City of Fraser , 194 Mich.App. 65, 486 N.W.2d 347, 349 (1992) ( Chilingirian I ) (citing Derigiotis v. J.M. Feighery Co. , 185 Mich.App. 90,460 N.W.2d 235, 237 (1990) ).

As the Michigan Court of Appeals has stated, "when interpreting the terms ‘employ,’ ‘employer,’ or ‘employee’ in different statutory and factual contexts, the existence of an employment relationship is typically determined by examining a number of factors.... The economic reality test is the most common tool for discerning whether an employee-employer relationship exists." Buckley v. Prof'l Plaza Clinic Corp. , 281 Mich.App. 224, 761 N.W.2d 284, 290 (2008). Chilingirian I applied the economic reality test to Michigan's Whistleblowers' Protection Act ("WPA"), which defines "employee" and "employer" in similar terms to the VRPA: the WPA defines "employee," in relevant part, as "a person who performs a service for wages or other remuneration under a contract of hire, written or oral, expressed or implied," M.C.L. § 15.361 (a), and defines "employer," in relevant part, as "a person who has 1 or more employees," id. § 15.361(b). Furthermore, Michigan courts have applied the economic reality test in a variety of other contexts. Coblentz v. City of Novi , 475 Mich. 558, 719 N.W.2d 73, 85 (2006) (Freedom of Information Act); Derigiotis , 460 N.W.2d at 237 (Michigan's Workers' Disability Compensation Act); Farm Bureau Gen. Ins. Co. of Am. v. Westfield Ins. Co. , No. 330961, 2017 WL 2348747, at *3 (Mich. Ct. App. May 30, 2017) (No–Fault Automobile Insurance Act); Buckley , 761 N.W.2d at 290 (Payment of Wages and Fringe Benefits Act). The Court, therefore, adopts the economic reality test in determining the scope of the employee exception.

Michigan courts have articulated a number of factors to consider under the economic reality test. In Chilingirian I , the Michigan Court of Appeals considered: "(1) control of a worker's duties; (2) payment of wages; (3) right to hire, fire, and discipline; and (4) performance of the duties as an integral part of the employer's business toward the accomplishment of a common goal." 486 N.W.2d at 349. These factors will guide the Court's determination about whether the entities to which Defendant disclosed Plaintiff's personal information are "employees" under the VRPA.

Finally, although the VRPA also mentions "agent[s]," it does not define the term. Plaintiff asks the Court to adopt the "control test," which examines "whether the principal has a right to control the actions of the agent." Hart v. Comerica Bank , 957 F.Supp. 958, 978 (E.D. Mich. 1997) (quoting Meretta v. Peach , 195 Mich.App. 695, 491 N.W.2d 278, 280 (1992) ); see also Pl. Opp. 26–27 (quoting Hart , 957 F.Supp. at 978 ). However, "the common law developed the ‘control test’ as an aid to determining whether to apply the doctrine of respondeat superior " and applies "where an injured plaintiff seeks to hold a third party responsible for the tort of another." Pasieka v. Chaves , No. 304190, 2012 WL 5233619, at *4 (Mich. Ct. App. Oct. 23, 2012) (citing Nichol v. Billot , 406 Mich. 284, 279 N.W.2d 761, 764 (1979) ). As the employee and agent exception under the VRPA is not an issue of respondeat superior , the Court does not find the "control test" to be appropriate. See id.

In order to determine what the Michigan legislature meant by "agent," the Court first looks to dictionaries of the same vintage as the VRPA. See Deacon , 885 N.W.2d at 631–32. Turning again to Webster's New World Dictionary from 1988, "agent" is defined as, inter alia , "a person, firm, etc. empowered to act for another." The Michigan Court of Appeals has adopted a similar definition in interpreting a statute that does not provide a definition for "agent":

The [Michigan Civil Rights Act] does not define the term "agent," so we may turn to a dictionary for guidance on its plain and ordinary meaning. An agent is "a person or business authorized to act on another's behalf" and "a person or thing that acts or has the power to act." Random House Webster's College Dictionary (1997). And, if "agent" is considered a legal term, its meaning is the same: "[o]ne who is authorized to act for or in place of another." Black's Law Dictionary (7th ed). These definitions are consistent with general agency principles, Stephenson v. Golden (On Rehearing) , 279 Mich. 710, 734–735, 276 N.W. 849 (1937), and the fact that "most employers are corporate entities that cannot function without delegating supervisory power." Champion [v. Nationwide Security, Inc. , 450 Mich. 702,545 N.W.2d 596 (Mich. 1996) ].

Elezovic v. Bennett , 274 Mich.App. 1, 731 N.W.2d 452, 458 (2007).

In determining whether a third party is an agent, a court considers the contract between the parties as one factor. See Fed. Ins. Co. v. Detroit Med. Ctr. , No. 08-13322, 2009 WL 136866, at *9 (E.D. Mich. Jan. 16, 2009) ("Agency is a question of law when based on an unambiguous contract."); see also Potomac Leasing Co. v. The French Connection Shops, Inc. , 172 Mich.App. 108, 431 N.W.2d 214, 216 (1988) (considering, among other evidence, the contract between the relevant parties and deposition evidence to determine whether agency relationship existed). However, the actions of the parties also are relevant. As the Michigan Supreme Court has long recognized: "An agent is a person having express or implied authority to represent or act on behalf of another person, who is called his principal. ... Whether an agency has been created is to be determined by the relations of the parties as they in fact exist under their agreements or acts ." Stephenson , 276 N.W. at 857 (emphasis added); see also, e.g., Potomac Leasing Co. , 431 N.W.2d at 216. Thus, "one may be both an independent contractor and an agent." Douglas v. Pontiac Gen. Hosp. , 182 Mich.App. 446, 452 N.W.2d 845, 846 (1990) (citing 41 Am. Jur. 2d, Independent Contractors, § 2 ; 1 Restatement Agency, 2d, § 2(3) ) (Batzer, J., dissenting), rev 'd for reasons stated in dissent , 438 Mich. 851, 473 N.W.2d 68 (1991).

Defendant argues that each of the disclosures it made were to third parties that "would be Hearst's agents, not for all purposes ... but only regarding the receipt and handling of Plaintiff's" personal information. Def. Opp. 40 (citing Midwest Healthplan, Inc. v. Nat'l Med. Health Card Sys., Inc. , 413 F.Supp.2d 823, 833 (E.D. Mich. 2005) ; People v. Belz , 257 Mich. 302, 241 N.W. 219, 220 (1932) ). Defendant's argument is not supported by law. In Midwest Healthplan, Inc. , the agreement at issue "require[d] that Defendant pay the participating pharmacies' claims on Plaintiff's behalf as the manager of the prescription benefits program." 413 F.Supp.2d at 833. This was sufficient to create a fiduciary relationship because "one person or entity ha [d] a duty to act for another on matters falling within the scope of the relationship." Id. Similarly, in Belz , "the defendant's authority to withdraw corporate funds ... was expressly conferred on him by resolution of the board of directors. He was made the agent of the company to handle its funds." 241 N.W. at 220. In both cases, the principal explicitly empowered the agent to act on its behalf. Moreover, in neither case cited by Defendant did the parties enter a contract that expressly disclaimed an agency relationship, as is the case here. Cf. Bergin Fin., Inc. v. First Am. Title Co. , 397 Fed.Appx. 119, 126 (6th Cir. 2010). Defendant's proposition would turn every contract with a confidentiality clause into a principal-agent relationship, and that cannot be.

Accordingly, the Court concludes that the VRPA contains an exception for disclosures made to bona fide agents or employees, and construes those terms as described above.

C. Unconstitutionally Vague

Defendant next argues that the VRPA, if construed as Plaintiff proposes, is unconstitutionally vague under the due process of clause of the Fourteenth Amendment. Because the Court agrees with Defendant on its interpretation of "purchase" information and the employee/agent exception, see supra , the Court need only address Defendant's argument that construing the VRPA to prohibit disclosures "to any person," and not merely public disclosures, is unconstitutionally vague.

"A law is void for vagueness if it either (1) ‘fails to provide people of ordinary intelligence a reasonable opportunity to understand what conduct it prohibits' or (2) lacks ‘explicit standards for those who apply [it].’ " Expressions Hair Design v. Schneiderman , 808 F.3d 118, 142 (2d Cir. 2015) (alteration in original) (quoting VIP of Berlin, LLC v. Town of Berlin , 593 F.3d 179, 186–87, 191 (2d Cir. 2010) ), vacated and remanded on other grounds , ––– U.S. ––––, 137 S.Ct. 1144, 197 L.Ed.2d 442 (2017). Although Defendant does not specify whether its challenge to the statute is facial or as-applied, the Court construes it as facial. See Def. Mem. 39 ("Because the VRPA, as Plaintiff urges it to be read, would leave one to guess at the meaning of ‘disclosure’ ... (because it would vary from the accepted meaning of [that] term[ ] ) ..., it would lack the requisite clarity to impose civil or criminal liability consistent with due process."). "A facial challenge is an attack on a statute itself as opposed to a particular application." Copeland v. Vance , 230 F.Supp.3d 232, 247–48 (S.D.N.Y. 2017) (quoting City of Los Angeles v. Patel , ––– U.S. ––––, 135 S.Ct. 2443, 2449, 192 L.Ed.2d 435 (2015) ). Facial challenges "are generally disfavored," and are "the most difficult... to mount successfully." Id. at 248 (first quoting Dickerson v. Napolitano , 604 F.3d 732, 741 (2d Cir. 2010), and then quoting United States v. Salerno , 481 U.S. 739, 745, 107 S.Ct. 2095, 95 L.Ed.2d 697 (1987) ).

The VRPA, construed to prohibit non-public disclosures, does not fail to communicate the conduct it prohibits, nor does it lack explicit standards for those who apply it. As described above, the Court rejects Defendant's argument that "disclose" has the common and ordinary meaning of "public disclosure." See, e.g., Bragg , 824 N.W.2d at 181. Moreover, the VRPA is clear that disclosure "to any person" is prohibited: a person of ordinary intelligence would reasonably understand that even a confidential transmission to a third party is prohibited by the statute. The Court, therefore, concludes that "the language conveys sufficiently definite warning as to the proscribed conduct when measured by common understanding and practices" sufficient to satisfy the first prong. Copeland , 230 F.Supp.3d at 249 (quoting VIP of Berlin , 593 F.3d at 187 ); see also id. ("Only an ‘unexpected and indefensible’ interpretation of a statute that gives a defendant ‘no reason to even suspect that his [or her] conduct might be within its scope’ will violate the notice element." (alteration in original) (quoting United States v. Smith , 985 F.Supp.2d 547, 588 (S.D.N.Y. 2014) ). For similar reasons, the Court concludes that the VRPA gives explicit standards as to what disclosures are prohibited under the law as the prohibition "provides sufficiently clear standards to eliminate the risk of arbitrary enforcement." Id. (quoting VIP of Berlin , 593 F.3d at 191 ).

Accordingly, Defendant's motion for summary judgment based on the theory that the VRPA is unconstitutionally vague is DENIED.

D. First Amendment

Defendant moves for summary judgment on the ground that the VRPA is unconstitutional because it suppresses protected First Amendment speech. The Court rejected the same argument in the 2016 Opinion. See Boelter , 192 F.Supp.3d at 444–52. In that opinion, the Court found that the VRPA was a regulation on commercial speech, applied intermediate scrutiny under Central Hudson Gas & Electric Corp. v. Public Serv. Comm'n of New York , 447 U.S. 557, 562–63, 100 S.Ct. 2343, 65 L.Ed.2d 341 (1980), and carefully considered and rejected both Defendant's facial and as-applied challenges. Id. The Court finds no reason to abandon that analysis.

First, in renewing its First Amendment argument on summary judgment, Defendant stresses "Plaintiff's extraordinary evidentiary burden" in defending the constitutionality of the VRPA. Def. Reply 17; see also Def. Mem. 46 ("Plaintiff bears the heavy burden of affirmatively demonstrating that application of the Michigan VRPA to this case will in fact advance the government's stated interest...."). Defendant misstates the law. On the contrary, "[u]nder a commercial speech inquiry, it is the State's burden to justify its content-based law as consistent with the First Amendment." Sorrell , 564 U.S. at 571–72, 131 S.Ct. 2653 (emphasis added) (citing Thompson v. Western States Medical Center , 535 U.S. 357, 373, 122 S.Ct. 1497, 152 L.Ed.2d 563 (2002) ); see Florida Bar v. Went For It, Inc. , 515 U.S. 618, 640, 115 S.Ct. 2371, 132 L.Ed.2d 541 (1995) (under the second prong of the Central Hudson test, analyzing "[w]hat the State has offered" to justify the law in question); see generally Pl. Reply n.16 (collecting cases). Defendant has cited no law that suggests that a private citizen bears the state's burden to defend a state law.

Nevertheless, Defendant's renewed attempt to invalidate the VRPA on First Amendment grounds also fails. Neither discovery nor Defendant's additional briefing has changed the conclusions the Court reached in the 2016 Opinion. Under Central Hudson , a court evaluating an as-applied challenge to a statute restricting commercial speech applies a four-part test: (1) "the speech in question must not be misleading and must concern lawful activity"; (2) "the asserted government interest [justifying the restriction] must be substantial"; (3) "the regulation must directly advance the governmental interest asserted ... to a material degree"; and (4) "the regulation must be ‘narrowly drawn,’ and may not be more extensive than necessary to serve the interest." United States v. Caronia , 703 F.3d 149, 164 (2d Cir. 2012) (citing, inter alia, Cent. Hudson , 447 U.S. at 566, 100 S.Ct. 2343 ). Defendant again challenges the latter three prongs.

As to Michigan's asserted government interest, Defendant argues—yet again—that the VRPA must be limited only to public disclosure and not to "transmissions between publishers and trusted business associates to whom they outsource operations and share information about subscribers on a strictly confidential basis." Def. Mem. 42. As discussed above, the VRPA makes clear that disclosures to employees or agents is not prohibited, but that even a "confidential" disclosure to an unrelated third party may be actionable. See secs. III.B.ii-iii, supra. Defendant argues that this broader reading of the VRPA is not supported by a substantial government interest. Def. Mem. 42–45. However, as the Court held in the 2016 Opinion, the Michigan legislature's stated interest in protecting consumer privacy from nonconsensual disclosure to third parties—and particularly in this case, where Defendant traded and sold Plaintiff's personal information for its own gain—is a substantial government interest. See Boelter , 192 F.Supp.3d at 448 ; see also , e.g., Stanley v. Georgia , 394 U.S. 557, 564–565, 89 S.Ct. 1243, 22 L.Ed.2d 542 (1969) (recognizing the "the right to read or observe what [one] pleases—the right to satisfy [one's] intellectual and emotional needs in the privacy of [one's] own home); Trans Union Corp. v. F.T.C. , 245 F.3d 809, 818 (D.C. Cir. 2001) (expressing "no doubt-" that the state's interest in protecting "the consumer's right to privacy ... is substantial"). The VRPA, even construed to encompass non-public disclosures to third parties, serves a substantial state interest.

Defendant next argues that the application of the VRPA to it under the facts of this case does not "directly advance" the substantial state interest "to a material degree." Under this prong, the statute "may not be sustained if it provides only ineffective or remote support for the government's purpose." 44 Liquormart, Inc. v. Rhode Island , 517 U.S. 484, 505, 116 S.Ct. 1495, 134 L.Ed.2d 711 (1996). Defendant posits that three key facts highlight that applying the VRPA to this case would not further Michigan's stated interest: first, that Plaintiff lacks a genuine privacy interest in the purchase history of her reading material because her name and address are matters of public record and Plaintiff did not consider her subscription to Good Housekeeping a "secret"; second, that Defendant never made Plaintiff's personal information public; and third, that the transmissions Defendant did make were to "business associates" who abided by strict confidentiality agreements. Def. Mem. 47–48 (citing Def. 56.1 ¶¶ 77, 78, 106–91).

These facts do not suggest that the VRPA, as applied to Defendant in this case, does not directly and materially advance the privacy interest enshrined in the statute. As to Defendant's first point, Plaintiff testified at her deposition that "what I read is really nobody's business" and that "nobody needs to know what I read." Pl. Dep. 66:18–19, 67:9–10. Even though Plaintiff's name and address are public information, connecting those facts to purchase information of reading material is exactly the harm the Michigan legislature intended to prevent. See Condé Nast , 210 F.Supp.3d at 600 ("Far from providing remote support for the stated privacy interest, th[is application of the VRPA] is aimed directly at the ‘speech ... [that] causes the very harm the government seeks to prevent.’ " (omission and second alteration in original) (quoting Trans Union Corp. v. FTC , 267 F.3d 1138, 1142 (D.C. Cir. 2001) )). Moreover, the fact that the recipients of Defendant's disclosures promised not to further distribute Plaintiff's information does not suggest that Michigan's substantial interest in preventing the initial disclosures is not advanced; the harm was committed when Defendant disclosed Plaintiff's personal information.

Defendant's argument that the VRPA is underinclusive because it fails to "prohibit numerous means of publicly communicating that same information," such as third-party sellers, is unpersuasive. Def. Reply 21. Judge Buchwald rejected this argument in Condé Nast : "Whatever nonretail sellers are, it is possible that the [VRPA] could have further advanced Michigan's aims by reaching them, but ‘[a] State need not address all aspects of a problem in one fell swoop; policymakers may focus on their most pressing concerns.’ As it stands, the law restricts those most likely to have protected information." 210 F.Supp.3d at 600–01 (citation omitted) (quoting Williams–Yulee v. Florida Bar , ––– U.S. ––––, 135 S.Ct. 1656, 1668, 191 L.Ed.2d 570 (2015) ).

Nothing uncovered during discovery moves the Court from its prior position that the application of the VRPA to Defendant in this case directly advances Michigan's interest in protecting the private reading material of its citizens in a material way. See Boelter , 192 F.Supp.3d at 448–49.

Finally, Defendant argues that the VRPA is not, as applied, narrowly drawn. Defendant posits that "as urged by Plaintiff, the VRPA would sweep so broadly that it would effectively ban—and criminalize—all outsourcing by publishers of any functions that involve access to basic subscriber information. This would include database hosting, analytics, the printing of magazine labels, and the delivery of addressed magazines." Def. Mem. 49. As discussed above, the Court construes the VRPA more narrowly: disclosures, such as to printing and delivery providers, that do not concern the purchase of a subscription are not actionable under the VRPA, nor are disclosures to a person's employees or agents. See secs. III.B.i, iii, supra ; cf. Def. Mem. 50 (comparing the VRPA to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") in that HIPPA's "Privacy Rule" allows personal medical information to be shared to certain relevant outside entities subject to confidentiality safeguards). The Court adheres to its prior holding that the VRPA is sufficiently tailored to advance Michigan's substantial interest. See Boelter , 192 F.Supp.3d at 449–51 ; see also Condé Nast , 210 F.Supp.3d at 601–02 (holding that the VRPA is narrowly drawn).

Accordingly, Defendant's motion for summary judgment that the VRPA, as applied, violates the First Amendment is DENIED.

E. Unjust Enrichment

Finally, Defendant renews its objections to Plaintiff's unjust enrichment claim, arguing that the VRPA provides the exclusive remedy for Plaintiff's claim and that Plaintiff has failed to come forward with evidence that Defendant was unjustly enriched. In the 2016 Opinion, the Court held that the VRPA does not preclude Plaintiff's unjust enrichment claim and that Plaintiff's complaint alleged a cause of action for unjust enrichment. Boelter , 192 F.Supp.3d at 454–55. The Court does not change those determinations here.

First, Defendant repeats its argument that the VRPA provides the sole remedy for Plaintiff's claims. This is directly contrary to Michigan law, as described in the 2016 Opinion. See id. at 454 ("Under Michigan law, ‘[w]hether or not a statutory scheme preempts the common law on a subject is a matter of legislative intent.’ A statutory remedy will only exclude common law claims if it is granted pursuant to ‘comprehensive legislation [that] prescribes in detail a course of conduct to pursue and the parties and things affected, and designates specific limitations and exceptions.’ Therefore, statutes only operate to exclude common law claims when they feature express language to that effect, or when they are part of a ‘comprehensive’ legislative scheme. The VRPA does not include express language limiting a plaintiff's other potential remedies and is not part of a comprehensive legislative scheme. Therefore, it does not preclude Plaintiffs' unjust enrichment claim." (internal citations omitted) (quoting Kraft v. Detroit Entm't, L.L.C. , 261 Mich.App. 534, 683 N.W.2d 200, 206–09 (2004) )). Courts in this district and in Michigan have concurred with this Court's analysis. See, e.g., Condé Nast , 210 F.Supp.3d at 604 ; Perlin , 237 F.Supp.3d at 643–44 ; Moeller , 235 F.Supp.3d at 876. Plaintiff's unjust enrichment claim does not fail as a matter of law.

Defendant contends that Plaintiff has failed to offer any evidence that she suffered an injury sufficient to state a cognizable unjust enrichment claim. "To state a claim for unjust enrichment under Michigan law, the plaintiff must establish "(1) the receipt of a benefit by the other party from the complaining party and (2) an inequity resulting to the complaining party because of the retention of the benefit by the other party." Boelter , 192 F.Supp.3d at 455 (quoting Karaus v. Bank of N.Y. Mellon , 300 Mich.App. 9, 831 N.W.2d 897, 905 (2012) ). Defendant received a benefit from Plaintiff in the form of subscription fees and personal information. As described below, some of Defendant's disclosures of Plaintiff's personal information—including one in which Defendant received compensation to disclose—were unlawful under the VRPA. See secs. IV.B, IV.F, infra. Defendant, therefore, used Plaintiff's personal information for its own pecuniary benefit in a way prohibit by law. See Halaburda v. Bauer Pub. Co., LP , No. 12 Civ. 12831, 2013 WL 4012827, at *8 (E.D. Mich. Aug. 6, 2013) (finding that defendant who was alleged to have received "monetary and other benefits associated with such [unlawful] disclosure represents unjust enrichment of defendants"); cf. Coulter–Owens v. Time, Inc. , No. 12 Civ. 14390, 2016 WL 612690, at *5 (E.D. Mich. Feb. 16, 2016) (dismissing unjust enrichment claim because the plaintiff did not have a viable VRPA claim), aff'd , No. 16-1321, 695 Fed.Appx. 117, 2017 WL 2731309 (6th Cir. June 26, 2017).

Therefore, Defendant's motion for summary judgment on Plaintiff's unjust enrichment claim is DENIED.

IV. The Parties' Cross–Motions for Summary Judgment on Actionable Disclosures

Having settled on what it means to "disclose" records "concerning the purchase" of a magazine subscription under the VRPA and what factors are considered in determining whether disclosures to a third-party entity are actionable, see sec. III.B, supra , the Court now applies this law to Defendant's disclosures to the six third-party entities at issue in the parties' motions.

Although Defendant does not contest that it transmitted certain information about Plaintiff to each entity, it argues that such transmissions do not create liability under the VRPA. As discussed below, the Court GRANTS Plaintiff's motion as to disclosures made to Experian and Company 3; GRANTS Defendant's motion as to disclosures made to Acxiom, Company 1, and Company 2; and DENIES each parties' motion as to Dunn Data.

For a transmission to be actionable, Plaintiff must prove: (1) Defendant engaged in the business of selling magazines at retail; (2) Plaintiff purchased the magazine from Defendant; (3) Defendant disclosed a record or information concerning Plaintiff's purchase of the magazine; and (4) the disclosed record or information indicated Plaintiff's identity. See Hon. William Murphy & John VandenHombergh, Mich. Non–Standard Jury Instr. Civil § 32:10 (Aug. 2016) (listing the elements of a VRPA violation). The parties do not dispute that Defendant engaged in the business of selling magazines at retail, Pl. 56.1 ¶ 2, or that Plaintiff purchased at least some of her magazine subscriptions from Defendant, id. ¶¶ 169, 171, 173, 176, 178, 182, 183, 187, 191, 192. Even where a transmission is actionable, Defendant may nonetheless show that it is permissible under the employee or agent exception of the VRPA. See sec. III.B.iii, supra.

A. Acxiom

Acxiom has, since 2008, hosted, maintained, and operated Defendant's marketing database in exchange for monthly service fees. Def. 56.1 ¶¶ 106–07, 115. The Court concludes that Acxiom is an agent of Defendant and, therefore, transmissions of Plaintiff's personal information to Acxiom is not actionable under the VRPA's agent exception.

Defendant hired Acxiom to act on its behalf in performing essential information technology ("IT") functions that would otherwise be handled by an in-house IT department. It is undisputed that Acxiom built and hosted the database for Defendant, id. ¶ 107, which was previously hosted by a Hearst-affiliated company, id. ¶ 108. Defendant owns or licenses all of the data hosted in Acxiom's database. Id. ¶ 111. Acxiom receives and inputs information from Defendant, processes and organizes that data, provides analytical tools to access and use the information, and executes Defendant's instructions with respect to certain external transmissions. Id. ¶¶ 114, 117. Acxiom has no authority to transmit Defendant's data without Defendant's permission, id. ¶ 119, nor can Acxiom use Defendant's data for its own purposes, id. ¶ 121. Acxiom never shared Defendant's subscriber data with any third party except as directed or permitted by Defendant. Id. ¶ 127. Acxiom is "the functional equivalent of [Defendant's] IT department," but is outsourced rather than in-house. Vanthournout Dep. 257:2–12.

Given the scope of this relationship, it is clear that Acxiom was Defendant's agent. See Elezovic , 731 N.W.2d at 458. Although the Court does not opine on whether Acxiom could be considered an "employee" under the economic reality test—although Defendant controls much of Acxiom's duties, which in turn play an integral part in Defendant's business, Acxiom provides its own equipment and does not work exclusively for Defendant, see, e.g. , Vantournout Dep. 98:7–24—the presence of at least some of these factors further indicates a relationship that falls under the broader category of agent. Finally, given that the VRPA contains an exception for "agents," it would be an absurd result if the statute prohibited a company from utilizing outside vendors to perform key tasks—such as IT, subscription management, shipping and fulfillment, legal, and so on—who might need to know a customer's subscription purchase information. See Tennyson , 790 N.W.2d at 361.

It is true, as Plaintiff argues, that Defendant's contract with Acxiom disclaims an employee or agency relationship: "Acxiom shall perform all Services hereunder as an independent contractor, and nothing contained herein shall be deemed to create any employment, association, partnership, joint venture, or relationship of principal and agent or master and servant between the parties hereto ...." Marchese Decl. 1 Ex. 10, ¶ 13. This, as discussed above, is not dispositive. See Stephenson , 276 N.W. at 857 ; Douglas , 452 N.W.2d at 846. Given the scope and circumstances of the relationship, the Court concludes that Acxiom was Defendant's agent, as contemplated by the VRPA.

Defendant's motion for summary judgment regarding Acxiom is, therefore, GRANTED and Plaintiff's motion is DENIED.

B. Experian

Defendant hired Experian to append demographic and other data onto records in its customer marketing database. See Pl. 56.1 ¶¶ 82, 87; Def. 56.1 ¶ 135. In 2011, 2012, 2013, and 2014, Defendant directed Acxiom to provide customer data, including Plaintiff's data, to Experian. Pl. 56.1 ¶¶ 91–94; see Murphy Dep. 245:11–25 (Defendant's representative testifying that Defendant transmitted Plaintiff's personal information to Experian). On an annual basis, for both active and expired subscribers, Defendant transmitted the name, address, account number, code indicating the title of a magazine, and order date. Def. Suppl. 56.1 ¶ 49; see Marchese Decl. 1 Ex. 15 ("Experian Refresh—Yearly" tab). The Court concludes that these disclosures are actionable under the VRPA.

Defendant argues that these disclosures did not "concern[ ] the purchase" of Plaintiff's magazine subscription and that Experian was Defendant's agent or employee. The Court disagrees. As discussed above, see sec. III.B.i, supra , a record "concerning the purchase" need only relate to or have some bearing on that customer's purchase. See Bowman , 2013 WL 5925995, at *10. A disclosure that links a customer of a magazine subscription to the magazine title and includes an order date is sufficient to "concern" the purchase of that subscription. See Company 2 Dep. 97:23–98:8 (explaining that "order date" means "[l]atest purchase date for consumer").

Defendant also argues that Experian is its employee or agent. The Court is not persuaded. Although it is undisputed that Defendant paid Experian to provide data append services, Def. 56.1 ¶¶ 133–136, 146, this does not make Experian Defendant's employee under the economic reality test: Defendant hired Experian to provide a service, in which Experian was afforded "the right to employ such methods and procedures in the performance of [the agreement] as Experian shall deem appropriate," Marchese Decl. 1 Ex. 24 ¶ 3.1; Experian dictated the format of the data Defendant delivered to it, id. ¶ 3.2; and Experian was paid for its services on a monthly basis, id. ¶ 4.1. Experian holds itself out to the public as ready and able to perform data append services to any business. See "Data Append Services," Experian , http://www.experian.com/marketing-services/data-append-on-demand.html. Further, Defendant's contract with Experian provides that Experian is an "independent contractor[ ]" and that "[n]othing contained in this [agreement] shall be deemed to create any association, partnership, joint venture, or relationship of principal and agent or master and servant between the parties." Def. 56.1 ¶ 80; cf. Stephenson , 276 N.W. at 857. Although not dispositive, the Court finds that the contract properly reflects the relationship between the parties. The Court, therefore, concludes that Experian is neither Defendant's agent nor employee. See Chilingirian I , 486 N.W.2d at 349 (finding that a law firm was not an employee where the law firm had many clients, maintained its own office, was not paid a salary but instead billed monthly, and was not subject to control with respect to the method of work, but only the result achieved).

Because Defendant disclosed a record concerning the purchase of a magazine subscription that indicates that customer's—Plaintiff's—identity, Defendant has violated the VRPA. Plaintiff's motion for summary judgment as to these disclosures to Experian is GRANTED and Defendant's motion is DENIED.

C. Company 1

Defendant does not dispute that it transmitted certain subscriber data—including name, address, and a three-character code identifying the magazine title—to Company 1 in 2014 and 2015 and that Plaintiff's status as an expired subscriber to Good Housekeeping was eligible to be included. Pl. 56.1 ¶¶ 106–09. Defendant also was required to contribute its "customer file at the beginning of" its relationship with Company 1, which began in 2007, and then send "complete previous-month customer history transaction information" on a monthly basis. Id. ¶ 102. Because, even viewing the facts in the light most favorable to her, Plaintiff has not proven that a disclosure of Plaintiff's personal information actually occurred within the statute of limitations, Plaintiff's motion is denied and Defendant's motion is granted.

The only evidence of an actual disclosure of Plaintiff's information is a "partial record for the James household," Marchese Decl. 1 Ex. 28, that Company 1 produced, which includes, inter alia , Plaintiff's name, address, the title of Good Housekeeping , the code "DTP," the text "Upd:06/2014," the date "06/07/2014" in the title of the page, and dates including March 10, 2009 and March 10, 2010, Marchese Decl. 1 Ex. 27.

Defendant objects to Exhibit 27 as not being properly authenticated and including inadmissible hearsay. See, e.g. , Pl. 56.1 ¶ 109; Def. Opp. 58 n.44. Defendant's argument about improper authentication is not compelling, as Defendant does not challenge the authenticity of the document, but only its admissibility. See Long v. New York City , No. 14 Civ. 9908, 2016 WL 4203545, at *2 n.4 (S.D.N.Y. Aug. 8, 2016) (" ‘[A] party is not required to authenticate documents on a summary judgment motion where ... authenticity is not challenged by the other party,’ and, in this case, Defendants challenge only the lack of proper authentication, not the authenticity per se ." (alteration and omission in original) (citation omitted) (quoting Daniel v. UnumProvident Corp ., 261 Fed.Appx. 316, 319 (2d Cir. 2008) )). The Court is more persuaded by Defendant's hearsay argument, however, as Exhibit 27 is supported only by an unsworn letter from a representative at Company 1 that does not, on its face, establish that Exhibit 27 is a business record or otherwise fits within an exception to the hearsay bar. Cf. Capobianco v. City of New York , 422 F.3d 47, 55 (2d Cir. 2005) ("[T]he submission of [an] unsworn letter was an inappropriate response to the ... motion for summary judgment, and the factual assertions made in that letter were properly disregarded by the court." (alterations and omission in original) (quoting United States v. All Right, Title & Interest in Real Prop. & Appurtenances , 77 F.3d 648, 657–58 (2d Cir. 1996) )).

Even assuming that Exhibit 27 were admissible, summary judgment could not be granted to Plaintiff. First, Plaintiff's account of Defendant's disclosures to Company 1 are contrary to the evidence. Plaintiff consistently argues that "Plaintiff's [personal information] was transmitted to [Company 1] 50 times, once per month, from January 2011 through March 2015." Pl. Br. 12; see also Pl. Reply 7 ("[Company 1:] 3^rd Monday of each month from Jan. 2011 through Mar. 2015"). This date range is not supported by any of the evidence cited by Plaintiff. See Pl. 56.1 ¶ 108 (citing Marchese Decl. 1 Ex. 15; Marchese Decl. 1 Ex. 25 (e-mail dated March 31, 2015, stating "Jim to submit change to requests to Acxiom to remove Michigan names from coop feeds for ... [Company 1]"); Murphy Dep. 360:6–16 (describing data transfers to Company 1 in the abstract)). On the other hand, Defendant provides testimony that by 2011, it was "no longer participating in the [Company 1 data c]o-op." Def. Suppl. 56.1 ¶ 37 (citing Findikyan Decl. 2 Ex. WW ¶ 8). Although Plaintiff denies Defendant's statement, she does not, as required by Local Rule 56.1, "specifically controvert[ ]" Defendant's statement with a "citation to evidence." See id. (Plaintiff responding only that the contract between Hearst and Company 1 contained a renewal clause and that there "is no evidence that Hearst or [Company 1] terminated the contract"). Although it also appears that Defendant resumed limited participation in the data cooperative in 2012, see Findikyan Decl. 1 Ex. QQ; Findikyan Decl. 2 Ex. WW ¶ 8, Plaintiff did not subscribe to any of the magazine titles involved in the renewed relationship, Def. Suppl. 56.1 ¶ 39. There is no other evidence of any agreement after 2012 that may have authorized transmission of Plaintiff's personal information.

The Court recognizes that there are inconsistencies in the record. For example, Defendant admits that "Plaintiff's status as an expired subscriber to Good Housekeeping was eligible to be included in scheduled transmissions to [Company 1] from June 2014 to March 2015." Pl. 56.1 ¶ 108. Having reviewed the voluminous record, however, the Court finds no evidence that a transmission of Plaintiff's personal information did, indeed, occur. In addition, under its 2007 agreement with Company 1, Defendant was obligated to "contribut[e] [its] customer file at the beginning of this relationship and send[ ] complete previous-month customer history transaction information ... on a monthly basis." Pl. 56.1 ¶ 102; see Findikyan Decl. 1 Ex. PP ¶ B(1). Presumably, when Plaintiff subscribed to Good Housekeeping in March 2009, Def. 56.1 ¶ 48 (undisputed fact that Plaintiff was an active subscriber from April 2009 to March 2010), Defendant transmitted that information to Company 1 in its monthly update. This would explain the dates "2010/03/10" and "2009/03/10" contained in Exhibit 27. These dates suggest that any transmission of Plaintiff's personal information occurred as early as March or April 2009, which would be barred by the statute of limitations. See sec. III.A, supra. Plaintiff provides no evidence that suggests that any actionable transmission occurred.

The Court is frustrated by the parties' failure to provide a clearer record on summary judgment. Because the evidence does not show that Defendant disclosed Plaintiff's personal information to Company 1 within the statute of limitations, Defendant's motion is GRANTED and Plaintiff's motion is DENIED. However, if Plaintiff believes that evidence of an actionable disclosure to Company 1 is contained in the record and the Court has overlooked it, Plaintiff is invited to file a motion for reconsideration on that ground.

D. Company 2

Company 2 produced a spreadsheet that contained some of the information it possessed about Plaintiff, which Plaintiff relies upon in asserting that Defendant disclosed Plaintiff's personal information to Company 2. See Marchese Decl. 1 Ex. 33; Pl. Mem. 16. These records show that Plaintiff purchased a subscription to Women's Day for $9.99 on January 2, 2007, and that Company 2's records were updated on April 7, 2011. Marchese Decl. 1 Ex. 33 (indicating "latest_purchase_gross_amf" is "9.99"; the "latest_purchase_date" is "1/2/2007"; the "update_date" is 4/7/2011 5:33"; and the "user_data l" is "15," which the spreadsheet indicates corresponds to Women's Day ).

It is undisputed that Women's Day magazine was, until June 2011, published by Hachette Filipacchi Media U.S., Inc. ("Hachette"). Def. 56.1 ¶¶ 2–4. Defendant acquired all outstanding stock of Hachette in May 31, 2011. Id. The "update date" is April 7, 2011—over a month before Defendant acquired Women's Day. Moreover, the content and codes contained in Company 2's spreadsheet do not match Defendant's customer database. Findikyan Decl. 3 Ex. GGG ¶¶ 8–12. Thus, the undisputed evidence indicates that Defendant did not provide this information about Plaintiff to Company 2.

Plaintiff makes two arguments to the contrary. First, she relies on the deposition testimony from the representative of Company 2, who testified that Hearst provided this subscription information. See Company 2 Dep. 122:16–123:14. However, the Court need not "credit testimony on summary judgment when it is so clearly contradicted by other evidence that no reasonable jury could believe it." Fendi Adele, S.R.L. v. Ashley Reed Trading, Inc. , 507 Fed.Appx. 26, 31 (2d Cir. 2013) (citing Scott v. Harris , 550 U.S. 372, 378–80, 127 S.Ct. 1769, 167 L.Ed.2d 686 (2007) ). Here, the deposition testimony is clearly contradicted by undisputed and indisputable facts about the ownership of Women's Day magazine.

Second, Plaintiff argues that the three addenda to the contract between Defendant and Company 2, each entered into in 2013, provided for quarterly transmissions of Women's Day, Good Housekeeping, Oprah , and Redbook subscribers, including expired subscribers such as Plaintiff. Pl. Reply 8 (citing Findikyan Decl. 2 Exs. CCC, DDD, EEE). However, the fact that Defendant agreed to transmit some subscriber information is not evidence that it did, in fact, transmit Plaintiff's subscriber information. "[W]here the non-moving party has the ultimate burden of proof, ‘the movant's burden will be satisfied if he can point to an absence of evidence to support an essential element of the non-moving party's claim.’ " Commodity Futures Trading Comm'n v. Walsh , 3 F.Supp.3d 70, 74 (S.D.N.Y. 2014) (quoting Kwon v. Yun , 606 F.Supp.2d 344, 355 (S.D.N.Y. 2009) ). The record contains no evidence that Defendant actually disclosed Plaintiff's personal information to Company 2 at any time. See Company 2 Dep. 124:1–17 ("Q. Is it your understanding that the information on [the Company 2 spreadsheet] represents all of the information that [Company 2] has regarding Josephine Edwards that it believes it received from Hearst? ... A: That is my understanding. Q: ... [I]s it your understanding that the date listed under Josephine Edwards for ‘Update Date’ indicates that the last time that record was updated in records was on ... April 7, 2011? A: Yes.").

Defendant's motion for summary judgment as to Company 2 is GRANTED and Plaintiff's motion is DENIED.

E. Dunn Data

From 2008 to 2013, Defendant sent active and former subscriber information to Dunn Data in exchange for money and a discount to use Dunn Data's database to identify new subscribers. Pl. 56.1 ¶¶ 72, 73. Defendant does not dispute that Plaintiff, as an expired Good Housekeeping magazine subscriber, was "eligible" to have her records transmitted to Dunn Data in three transmissions scheduled between June 2011 and March 2012. Id. ¶ 75; Murphy Dep. 366:19–367:18. Because there is a dispute about when Plaintiff's information was disclosed to Dunn Data, the Court denies each party's motion.

Dunn Data's representative testified that it received, among other things, Plaintiff's name, address, and magazine titles from Defendant, Dunn Dep. 130:7–17, and that Defendant provided data pursuant to the contract nearly every quarter, id. 55:24–56:2; see also id. 56:5–10 ("We might have skipped a couple. Sometimes it's not worth doing that frequently. So they might have. They certainly, you know, didn't violate my contract. But we may not have requested it at certain times."). Although Plaintiff has established that her data was eligible to be transmitted, Plaintiff has not provided evidence that these scheduled transmissions occurred or that Plaintiff's personal information was in fact ever transferred. Nor has Plaintiff proven that Dunn Data had information about Plaintiff's subscription purchases that were the result of transmissions that took place after December 20, 2009 and, therefore, within the statute of limitations. See sec. III.A, supra. Therefore, drawing reasonable inferences in Defendant's favor, the Court cannot grant Plaintiff's motion for summary judgment.

However, the Court is skeptical of Defendant's position that these transmissions did not occur. Drawing reasonable factual inferences in Plaintiff's favor, Defendant's motion also must be denied: a reasonable jury could draw the inference that these transmissions occurred, despite the lack of direct evidence. And assuming that any of the three scheduled transmissions occurred between June 2011 and March 2012, Plaintiff could make out a cause of action. These transmissions contained a wealth of information concerning Plaintiff's purchase of Defendant's magazines: in addition to Plaintiff's name, address, and a name of a magazine subscribed to, Defendant also transmitted, inter alia , whether the order was a gift, the paid status, the order date, and amount paid, Marchese Decl. 1 Ex. 15 ("Dunn Data" tab, rows 33 to 40); Marchese Decl. 1 Ex. 41—in other words, the type of data "concerning" a "purchase" that is necessary to make out a VRPA claim. In addition, there is no indication that Dunn Data was Defendant's agent or employee; indeed, Dunn Data paid Defendant for its customer data, Pl. 56.1 ¶ 72, and unlike Acxiom, Dunn Data was not empowered or authorized to act on Defendant's behalf in any manner, see Elezovic , 731 N.W.2d at 458.

Because the evidence does not conclusively prove an actionable transmission and because a reasonable jury could draw a conclusion in favor of either party, Plaintiff's motion for summary judgment as to Dunn Data is DENIED and Defendant's motion is DENIED.

F. Company 3

Defendant does not dispute that on December 1, 2014, January 5, 2015, February 2, 2015, and March 4, 2015, it directed Acxiom to transmit Plaintiff's name, address, and status as an expired subscriber of Good Housekeeping, Oprah, Redbook , and Women's Day to Company 3. Pl. 56.1 ¶ 48. Exhibit 19 is a spreadsheet created by Company 3 from the raw data provided by Acxiom on those dates. Company 3 Decl. ¶ 7. Each of the four transmissions included Plaintiffs name and address and an "expired" status for four magazines: a Good Housekeeping subscription that expired in the year "11"; an Oprah subscription that expired in "05"; a Redbook subscription that expired in "07"; and a Women's Day subscription that expired in "07." Marchese Decl. 1 Ex. 19. Each subscription also includes a "DTP–FLAG" as "Y." Id. The field "DTP–FLAG" stands for "Direct to Publisher." Pl. 56.1 ¶ 52; Company 3 Decl. 7–8. The DTP flag describes the primary source code for the subscription purchase. See Murphy Dep. 309:8–311:15.

The Court concludes that the disclosures of the Good Housekeeping and Women's Day subscriptions are not actionable, but that the Oprah and Redbook subscriptions are. First, it is undisputed that Defendant did not own Women's Day in 2007, Def. 56.1 ¶¶ 2–4; Def. Suppl. 56.1 ¶¶ –22, so Plaintiff was not Defendant's "customer" under the VRPA as to her Women's Day subscription. Cf. Coulter–Owens , 695 Fed.Appx. at 123, 2017 WL 2731309, at *6 (holding that a disclosure by Time Inc. of a subscription that plaintiff purchased from a third party subscription agent was not actionable against Time Inc.). In addition, Plaintiff did not purchase a subscription to Good Housekeeping subscription that expired in 2011; rather, that subscription was "tentatively automatically renewed by Hearst, but cancelled before servicing. There was never any payment received or processed for that cancelled subscription order and no magazine issues were ever mailed to Plaintiff." Def. Suppl. 56.1 ¶ 41. Because Plaintiff did not pay for this cancelled subscription, she cannot be a customer who "purchases ... written material" under the VRPA. See sec. III.B.i, supra; Deacon , 885 N.W.2d at 632 (plaintiff who did not provide payment could not have "rented" sound recording).

However, it is undisputed that Plaintiff purchased a subscription to Oprah in May 2004 (presumably expiring in 2005) directly from Defendant, Pl. 56.1 ¶ 82, and purchased a subscription to Redbook in October 2006 (presumably expiring in 2007) directly from Defendant, id. ¶ 187. These two purchases correspond precisely to the data transmissions made by Defendant in 2014 and 2015 described above. Because these records include Plaintiff's name and address, there is no dispute that they "indicate the identity of the customer."

Having concluded that Defendant engaged in the business of selling magazines at retail, that Plaintiff purchased magazines from Defendant, and that Defendant transmitted Plaintiff's identity to a third party, only two questions remain: whether the records were "concerning the purchase" of the magazines and whether Company 3 was an agent or employee of Defendant.

First, for the reasons more thoroughly explained above, see sec. III.B.i, supra , the Court concludes that these disclosures "concern" Plaintiff's subscriptions. Not only did Defendant disclose the title of a magazine subscription that Plaintiff purchased, it also noted that the order was "Direct to Publisher" and included information about whether Plaintiff was a "Multiple Buyer." See Marchese Decl. 1 Ex. 19; Marchese Decl. 1 Ex. 16 at Ex. A. These identifiers are sufficient to relate to or regard Plaintiff's purchase of a subscription. See Bowman , 2013 WL 5925995, at *10.

Further, Company 3 is neither an employee nor an agent of Defendant. Defendant concedes that Company 3 is not Plaintiff's employee. See Def. Mem. 33–34 (arguing only that Acxiom, Experian, and Company 1 were "employees"). In exchange for providing subscribers' information, Defendant was paid a licensing fee. Pl. 56.1 ¶¶ 38, 44, 45. Although just a factor, the contract between Defendant and Company 3 explicitly disclaimed that an agency relationship was formed. Id. ¶ 41. And unlike Acxiom, Company 3 was not empowered or authorized to act on Defendant's behalf in any manner. See Elezovic , 731 N.W.2d at 458. This relationship is far afield from what the Michigan legislature intended in carving out an exception for agents or employees. The Court finds that Company 3 is not an agent or employee of Defendant for purposes of these disclosures.

Accordingly, Plaintiff's motion for summary judgment as to the disclosures to Company 3 of Plaintiff's subscriptions to Oprah and Redbook on December 1, 2014, January 5, 2015, February 2, 2015, and March 4, 2015 is GRANTED and Defendant's motion is DENIED.

CONCLUSION

For the reasons stated above, Defendant's motion to dismiss is DENIED; Defendant's motion for summary judgment is GRANTED as to the disclosures it made to Acxiom, Company 1, and Company 2; Plaintiff's motion for summary judgment is GRANTED as to Defendant's disclosures to Experian and Company 3; and the balance of each party's summary judgment motion is DENIED, which leaves for trial Plaintiff's VRPA claim as to Defendant's disclosure to Dunn Data and Plaintiff's unjust enrichment claim.

By September 22, 2017 , the parties shall submit a joint letter to the Court and Judge Cott that addresses whether the parties believe a settlement conference might be productive at this time and that includes a proposed schedule for going forward, including for Phase II discovery.

The Clerk of Court is directed to terminate the motions at ECF Nos. 150, 151, and 157 in 15 Civ. 3934 and ECF Nos. 132, 136, and 140 in 15 Civ. 9279.

SO ORDERED.