Summary
holding that “the VPPA requires only injury in the form of a wrongful disclosure” because “[t]he consumer ... is ‘aggrieved’ based solely on the disclosure of personally identifiable information to third parties,” “which demonstrates an injury in-fact for Article III standing purposes”
Summary of this case from Austin-Spearman v. AMC Network Entertainment LLCOpinion
No. C 11-03764 LB
12-20-2013
IN RE: HULU PRIVACY LITIGATION
ORDER DENYING HULU, LLC'S
MOTION FOR SUMMARY
JUDGMENT BASED ON LACK OF INJURY
[ECF No. 124]
INTRODUCTION
In this putative class action, viewers of Hulu's on-line video content allege that Hulu wrongfully disclosed their video viewing selections and personal identification information to third parties such as metrics companies (meaning, companies that track data) and social networks, in violation of the Video Privacy Protection Act ("VPPA"), 18 U.S.C. § 2710. Second Amended Consolidated Class Action Complaint ("SAC"), ECF No. 83 at 7-8. In their class certification motion, Plaintiffs limit the third parties to comScore, a metrics company that analyzes Hulu's viewing audience and provides reports, and the social network Facebook. See Motion For Class Certification, ECF No. 111.
Citations are to the Electronic Case File ("ECF") with pin cites to the electronic page number at the top of the document.
The Act prohibits a "video tape service provider" from knowingly disclosing "personally identifiable information of a consumer of the provider" to third parties except for certain exceptions that are not applicable here. 18 U.S.C. § 2710. "'Personally identifiable information' includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider." Id. § 2710(a)(3). A provider is liable to an "aggrieved person" for the relief in 2710(c). Id. § 2710(b). Section 2710(c)(1) provides a private right of action in district court to an "aggrieved person," and subsection (c)(2) provides that the court "may award - (A) actual damages but not less than liquidated damages in an amount of $2,500."
Hulu moves for summary judgment on the ground that this provision means that Plaintiffs must show actual injury that is separate from a statutory violation to recover actual or liquidated damages under the VPPA. See Hulu's Motion for Summary Judgment Based on Lack of Injury ("Motion"), ECF No. 124. Under the plain language of the statute, Plaintiffs must show only a wrongful disclosure, and not an additional injury, to recover damages. The court thus denies Hulu's motion.
STATEMENT
The parties did not submit a joint statement of undisputed facts, as required by the court's orders. See Standing Order, ECF No. 2-2; Order, ECF No. 98. There are relevant facts from the SAC that the parties cite and do not dispute. The parties also cite interrogatory responses and deposition testimony without objection. The court cites the facts that the parties relied on and identifies any disputed facts.
I. THE PARTIES AND THE VPPA CLAIM
Hulu provides on-demand, online access to television shows, movies, and other pre-recorded video content from networks and studios through its website, www.hulu.com. SAC ¶¶ 1, 17. Plaintiffs Joseph Garvey, Sandra Catalina Vega Peralta, Paul Torre, Joshua Wymyczak, and Evan Zampella are five registered Hulu users. See id. ¶¶ 1-6. Three of the Plaintiffs also became Hulu Plus subscribers, meaning they paid money for Hulu's services. See SAC ¶¶ 3-4, 6, 34; Opp'n at 18. Sandra Peralta, Evan Zampella, and Paul Torre became Hulu Plus subscribers in July 2010, June 2011, and July 2012, respectively. SAC ¶¶ 3-4, 6. Plaintiffs allege that Hulu wrongfully disclosed their video viewing selections and personal identification information to third parties, which Plaintiffs narrowed in their class certification motion to the metrics company comScore and the social network Facebook, all in violation of the VPPA. See SAC ¶¶ 51-63; Motion for Class Certification, ECF No. 111.
Plaintiffs ask the court to certify two classes. See Class Cert. Motion, ECF No. 111 at 2. The first class, the "comScore Disclosure Class," is defined as follows:
All persons residing in the United States and its territories who, from March 4, 2011 through November 8, 2012, were registered users of hulu.com (including, but not limited to, paying subscribers, also known as Hulu Plus subscribers) and requested and/or obtained video materials and/or services on hulu.com during the Class Period.Id. The definition for the "Facebook Disclosure Class" is similar:
All persons residing in the United States and its territories who, from April 21, 2010 through June 7, 2012, were registered users of hulu.com (including, but not limited to, paying subscribers, also known as Hulu Plus subscribers) and requested and/or obtained video materials and/or services on hulu.com during the Class Period.
Id.
II. EVIDENCE REGARDING PLAINTIFFS' INJURIES
Hulu served the following interrogatory on each Plaintiff:
Please describe the nature and amount of any actual economic injury or damage that YOU contend that YOU suffered as a result of HULU's alleged violations of the Video Privacy Protection Act with respect to YOU, excluding any claim for liquidated damages under 18 U.S.C. § 2710(c)(2)(A).See Robison Decl. Exs. A-E. Subject to several objections, each Plaintiff responded: "Plaintiff seeks statutory damages under VPPA. Plaintiff suffered harm in that [his/her] privacy rights were violated." Four Plaintiffs added "and because he paid for Hulu's premium services . . . ." See Robison Decl. Ex. A, ECF No. 124-2 at 7-8 (Garvey); Ex. B, ECF No. 124-3 at 7-8 (Peralta); Ex. C, ECF No. 124-4 at 7-8 (Torre); Ex. D, ECF No. 124-5 at 7-8 (Wymyczak); Ex. D, ECF No. 124-6 at 8 (Zampella).
The Plaintiffs also gave deposition testimony regarding their alleged injuries. On September 28, 2013, Torre gave the following deposition testimony:
Q: Is there anything else, besides what you've already told me, that you can articulate as far as how you've been harmed by any disclosures that occurred in this case as alleged in this case? . . .Torre Dep. Tr. 135:23 - 136:8, Parisi Decl. Ex. 1, ECF No. 131-2 at 4-5. During Garvey's October 16, 2013 deposition, Hulu asked, "Do you think you have been injured in any way as a result of the conduct by Hulu that you have raised in your lawsuit?" Garvey said "Yes" and when asked "How so," added "As I said, my privacy has been violated." Garvey Dep. 56:6-11, Parisi Decl. Ex. 2, ECF No. 131-3 at 3. Similarly, when Hulu asked Wymyczak how he thought that he had been injured by Hulu's alleged conduct, he responded, "I feel like my privacy has been violated." Wymyczak Dep. 49:21-24, Parisi Decl. Ex. 3, ECF No. 131-4 at 3.
A: Right. Well, I mean, I - I'm paying for a service, and I thought that I understood
what was involved in that transaction. But now I understand more, and it's disturbing.
III. RELEVANT PROCEDURAL HISTORY
Hulu moved to dismiss the SAC under Rule 12(b)(1) for lack of standing, but the court found that Plaintiffs alleged injury (and standing) by alleging a violation of the VPPA. 6/11/12 Order, ECF No. 64 at 10. The court allowed further briefing in case the Supreme Court's decision in First American Fin'l Corp. v. Edwards altered the standing analysis, but the Court dismissed the writ of certiorari as improvidently granted. See 132 S. Ct. 2536 (June 28, 2012); 8/10/12 Order, ECF No. 68 at 2. The court then denied the motion to dismiss for lack of standing and also denied Hulu's 12(b)(6) motion to dismiss the SAC. 8/10/12 Order, ECF No. 68.
Plaintiff filed a motion for class certification, and Hulu filed a second motion for summary judgment on the ground that it did not knowingly transmit protected information to comScore and Facebook in violation of the VPPA. See ECF Nos. 111, 130. Those motions are not fully briefed yet and are set for a hearing on February 6, 2014. The parties agreed that Hulu could bring this early summary judgment motion about actual injury. See ECF No. 119. On December 19, 2013, the court held a hearing on Hulu's "no injury" summary judgment motion.
IV. HULU'S OTHER "UNDISPUTED" (BUT ACTUALLY DISPUTED) FACTS
Hulu cites "undisputed facts" (including incorporating by reference the evidence raised in its second summary judgment motion) that Hulu transmits only anonymized information to comScore and Facebook. See Motion at 7-9; Motion for Summary Judgment Re comScore and Facebook, ECF No. 130. Other "undisputed facts" include the facts about the potential for comScore and Facebook to reverse engineer the anonymized data to link a person's name to the video content. Motion at 7-9 (arguing that these undisputed facts means that Hulu could not have knowingly disclosed information that linked a person's name with what they watched).
Plaintiffs respond that the facts are disputed (including the relationships between Hulu and comScore and Facebook), discovery was ongoing at the time of the motion into these issues, and these "facts" are irrelevant to the legal inquiry about what injury the Plaintiffs must establish under the VPPA. See Opp'n, ECF No. 131 at 8-9.
The point of an early damages motion was to assume a statutory violation and address only the legal issue of whether Plaintiffs need an injury beyond a statutory violation. At the December 19, 2013 hearing, Hulu agreed that the court should disregard its additional "undisputed facts" and consider only those set forth above. Presumably Hulu cited the "facts" to preview its summary judgment motion that will be heard in February.
ANALYSIS
I. SUMMARY JUDGMENT
A motion for summary judgment should be granted if there is no genuine issue of material fact and the moving party is entitled to judgment as a matter of law. Fed. R. Civ. P. 56(a); Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 247-48 (1986). Material facts are those that may affect the outcome of the case. Anderson, 477 U.S. at 248. A dispute about a material fact is genuine if there is sufficient evidence for a reasonable jury to return a verdict for the non-moving party. Id. at 248-49.
The party moving for summary judgment has the initial burden of informing the court of the basis for the motion and identifying those portions of the pleadings, depositions, answers to interrogatories, admissions, or affidavits that demonstrate the absence of a triable issue of material fact. Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986). To meet its burden, "the moving party must either produce evidence negating an essential element of the nonmoving party's claim or defense or show that the nonmoving party does not have enough evidence of an essential element to carry its ultimate burden of persuasion at trial." Nissan Fire & Marine Ins. Co., Ltd. v. Fritz Companies, Inc., 210 F.3d 1099, 1102 (9th Cir. 2000); see Devereaux v. Abbey, 263 F.3d 1070, 1076 (9th Cir. 2001) ("When the nonmoving party has the burden of proof at trial, the moving party need only point out 'that there is an absence of evidence to support the nonmoving party's case.'") (quoting Celotex, 477 U.S. at 325).
If the moving party meets its initial burden, the burden shifts to the non-moving party, which must go beyond the pleadings and submit admissible evidence supporting its claims or defenses and showing a genuine issue for trial. See Fed. R. Civ. P. 56(e); Celotex, 477 U.S. at 324; Nissan Fire, 210 F.3d at 1103; Devereaux, 263 F.3d at 1076. If the non-moving party does not produce evidence to show a genuine issue of material fact, the moving party is entitled to summary judgment. See Celotex, 477 U.S. at 323.
In ruling on a motion for summary judgment, inferences drawn from the underlying facts are viewed in the light most favorable to the non-moving party. Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587 (1986).
II. THE VIDEO PRIVACY PROTECTION ACT
The Video Privacy Protection Act "'protect[s] certain personal information of an individual who rents video materials from disclosure.'" See Dikes v. Borough of Runnemede, 936 F. Supp. 235, 238 (D.N.J. 1996) (quoting S. Rep. 100-599, 2d Sess. at 16 (1988)). The impetus for the Act was a newspaper's obtaining a list of video tapes that Supreme Court nominee Judge Robert H. Bork rented from his local video store and publishing an article about his viewing preferences. Id. (citing S. Rep. 100-599, 2d Sess. at 5).
The Act prohibits a "video tape service provider" from (1) knowingly disclosing to any person (2) personally identifiable information concerning any consumer of such provider (3) except for certain disclosures that are not applicable here (such as disclosures to the consumer or law enforcement or in the ordinary course of business). See 18 U.S.C. § 2710(b). "'Personally identifiable information' includes information which identifies a person as having requested or obtained specific video materials or services." Id. § 2710(a)(3). A video tape service provider who knowingly discloses information in violation of section 2710(b) "shall be liable to the aggrieved person for the relief provided in subsection [(c)]." Id. § 2710(b)(1). Section 2710(c) provides a private right of action to "aggrieved persons" and allows damages:
Congress amended the VPPA, effective January 20, 2013. The amended statute, which does not apply here, broadens the consumer consent provisions. See 18 U.S.C. § 2710(b)(2) (2013).
(c) Civil Action.-(1) Any person aggrieved by any act of a person in violation of this section may bring a civil action in a United States district court.18 U.S.C. § 2710(c)(1)-(2).
(2) The court may award-
(A) actual damages but not less than liquidated damages in an amount of $2,500;
(B) punitive damages;
(C) reasonable attorneys' fees and other litigation costs reasonably incurred; and
(D) such other preliminary and equitable relief as the court determines to be appropriate.
III. PLAINTIFFS NEED SHOW ONLY A STATUTORY VIOLATION OF THE VPPA
The legal issue is whether the VPPA requires Plaintiffs to show actual injury that is separate from a statutory violation to recover actual or liquidated damages. The court concludes that they do not because the VPPA requires only injury in the form of a wrongful disclosure. Hulu's main argument - that the word "aggrieved" in the statute requires an additional injury - does not change the outcome.
A. The Statute Requires Only Injury in the Form of a Wrongful Disclosure
The analysis begins with the plain language of the statute, and it ends there if the text is unambiguous. See Edwards v. First Am. Corp., 610 F.3d 514, 517 (9th Cir. 2010). If the statutory language is unclear, courts consider legislative history and also follow the "common practice of consulting dictionary definitions to clarify their ordinary meaning [] and look to how the terms were defined at the time [the statute] was adopted.]" United States v. TRW Rifle 7.62X51mm Caliber, One Model 14 Serial 593006, 447 F.3d 686, 690 (9th Cir. 2006) (citing MCI Telecomms. Corp. v. AT & T Co., 512 U.S. 218, 228 (1994)) (other quotation omitted); see United States v. Williams, 659 F.3d 1223, 1225 (9th Cir. 2011).
18 U.S.C. § 2710(b)(1) establishes the scope of VPPA liability. It states that "a video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person for the relief provided in subsection" (c).
18 U.S.C. § 2710(b)(1) (refers to subsection (d) instead of (c), but that is a typographical error); see Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535, 539 (7th Cir. 2012) (making this observation).
Subsection (c) provides the "relief" referenced in subsection (b)(1). Id. § 2710(b)(1). First, subsection (c)(1) provides a private right of action by allowing "[a]ny person aggrieved by any act of a person in violation of this section [to] bring a civil action in a United States district court." Second, subsection (c)(2) provides remedies: "The court may award- (A) actual damages but not less than liquidated damages in an amount of $2,500; (B) punitive damages; (C) reasonable attorneys' fees and other litigation costs reasonably incurred; and (D) such other preliminary and equitable relief as the court determines to be appropriate."
The plain language of the statute shows that Congress considered a consumer to be an "aggrieved person" under the VPPA if a video tape service provider wrongfully discloses that consumer's personally identifiable information. Id. § 2710(b). Subsection (b) refers to the "aggrieved person" in the singular and precedes it with a definite article. Thus, "the aggrieved person" is the consumer whose information was disclosed. Subsection (b) does not refer to "an aggrieved person" or "any person aggrieved." The consumer, therefore, is "aggrieved" based solely on the disclosure of personally identifiable information to third parties and the video tape service provider is liable to that "aggrieved person" for the relief in subsection (c). Id.
The "any aggrieved person" language in subsection (c) establishes that any person who meets the definition of "the aggrieved person" in subsection (b)(2) (which demonstrates an injury in-fact for Article III standing purposes) "may bring" a federal lawsuit. Id. § 2710(c)(1). The court then "may award actual damages but not less than liquidated damages of $2,500." Id. § 2710(c)(2). Nothing in subsection (c) (or any other part of the statute) requires an injury beyond a violation of subsection (b). Moreover, the practical import of the statute is that the words "aggrieved person" in subsection (c) mean the same thing they do in subsection (b)(1): a consumer whose personally identifiable is disclosed by the video provider in violation of the statute. Hulu provides no alternative reading of the plain language of the statute.
B. The Words "Aggrieved Person" Do Not Change The Analysis
Hulu nonetheless argues that case law establishes that a statutory requirement that a person must be "aggrieved" means that a plaintiff must suffer an actual injury beyond the statutory injury. Motion at 10. To support that proposition, Hulu cites Dep't of Labor v. Newport News Shipbuilding & Dry Dock Co., 514 U.S. 122, 126-27 (1995). See Motion at 10; Reply at 3. In that case, the Newport News Shipping Company paid benefits under the Longshore and Harbor Workers' Compensation Act ("LHWCA") to an employee who was injured on the job. Id. at 124. After he returned to work under medical restrictions, he could not perform essential tasks, and the company terminated him. Id. The employee filed for further benefits, and an ALJ determined he was eligible for only partial-disability (not total-disability) benefits. Id. That decision was affirmed by the Benefits Review Board, which held that the company also was entitled to cease payments to the employee after 104 weeks, after which the LHWCA special fund would be liable for disbursements under section 944 of the Act. Id. at 125. The Board's decision was appealable to a United States court of appeals "at the instance of '[a]ny person adversely affected or aggrieved by" the Board's order. Id. at 125-26 (citing 33 U.S.C. § 921(c)). The employee did not seek review, but the Director of the Office of Workers' Compensation Programs ("OWCP") for the Department of Labor sought review first in the 4th Circuit and then in the Supreme Court. Id. at 125.
The Director argued that she had standing to challenge the decision because "it impairs her ability to achieve the Act's purposes and to perform the administrative duties the Act prescribes." Id. at 126. The Court disagreed, explaining that "[t]he phrase 'person adversely affected or aggrieved' is a term of art used in many statutes to designate those who have standing to challenge or appeal an agency decision, within the agency or before the courts." Id. at 126 (collecting statutes). Furthermore, "what constitutes adverse effect or aggrievement varies from statute to statute." Id. The Court concluded that the phrase "person adversely affected or aggrieved" did not include "an agency acting in its governmental capacity." Id. at 130.
Newport News is about whether an agency, in its regulatory or policy-making capacity, has standing to sue under a worker's compensation statute when it disagrees with its decisions issued by its administrative, quasi-judicial decision makers. Id. at 127-128. The answer there was no because only the worker was "aggrieved" within the meaning of the statute. The holding is relevant here only for the uncontroversial proposition that Plaintiffs must have standing to sue in order to recover damages. It does not say anything about whether the words "aggrieved person" in the VPPA mean that Plaintiffs here must have an injury that is more than the statutory injury in order to prove the elements of their claim.
Hulu cites two other cases to support its argument, but neither changes the outcome. See Motion at 10 (citing Hydro Invs., Inc. v. FERC, 351 F.3d 1192, 1195 (D.C. Cir. 2003) and Straus Commc'ns, Inc. v. FCC, 530 F.2d 1001, 1006 n.7 (D.C. Cir. 1976)).
In Hydro Investors, the D.C. Circuit held that Petitioner Hydro Investors lacked standing to challenge a Federal Energy Regulatory Commission decision under the Federal Power Act. Hydro had petitioned the FERC (which Hydro claimed had regulatory authority) to prevent Hydro's joint venture partner from transferring certain licenses to a third party. 351 F.3d at 1195. Hydro claimed that permitting this transfer would diminish its interest in the joint venture. As the court of appeals explained, however, Hydro could not show that "FERC's action has caused it some concrete injury that the relief it seeks . . . will redress" because Hydro's "joint venture interest appears to be worthless." Id.
In Straus Communications, the D.C. Circuit held that the court had jurisdiction when a radio station sought judicial review of an FCC ruling that the radio station was not liable for violating FCC's fairness doctrine. 530 F.2d 1001 (D.C. Cir. 1976). The court required the station to show "some modicum of injury, some concrete effect upon the station sufficient to support a court's jurisdiction." Id. at 1006. The station demonstrated a sufficiently concrete injury in the "likelihood . . . that future violations by this station would stand to suffer harsher treatment than similar violations by other stations." Id.
These cases suggest only that Plaintiffs must have been injured in order to have standing to recover and do not suggest Plaintiffs must show an additional injury as an element of their claim.
In its reply, Hulu also argues that the legislative history shows Congress's intent to limit recovery under VPPA to "'individuals who suffer as the result of unauthorized disclosures.'" Reply at 4 (quoting S.Rep. 100-599 (1988) at 7). Hulu cites this to counter "Plaintiffs' conten[tion] that they are not required to show actual injury because the VPPA authorizes liquidated damages." Id. (citing Opp'n at 10). But that is not Plaintiffs' argument. They argued that they did not have to show actual damages (as opposed to actual injury) as a prerequisite to statutory damages. Regardless, the legislative history is not as clear as Hulu suggests. See Order Denying Hulu's Motion to Dismiss, ECF No. 68 at 9 (quoting legislative denouncements of privacy violations similar to those alleged here). Even if the legislative history clearly supported Hulu's statutory interpretation (which it does not), the court relies (as it must) on the unambiguous plain language of the statute.
C. Hulu's Other Arguments
Hulu also argues the following: (1) Congress could have provided relief on the mere showing of disclosure as it did with the Drivers Privacy Protection Act ("DPPA"), and it did not; and (2) other cases support the conclusion that actual injury is a necessary prerequisite for Plaintiffs' recovering any damages (actual or statutory). These arguments do not change the outcome either.
1. The DPPA Supports The Statutory Analysis Here
Hulu argues that Congress could have provided monetary relief on the mere showing of an improper disclosure, as it did with the Drivers Privacy Protection Act ("DPPA"), which allows liquidated damages without the condition precedent of actual damages. See, e.g., Pichler v. UNITE, 542 F.3d 380, 398 (3rd Cir. 2008). The DPPA provides the following:
(a) Cause of action.-A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.18 U.S.C. § 2724.
(b) Remedies.- The court may award-
(1) actual damages, but not less than liquidated damages in the amount of $2,500;
(2) punitive damages upon a showing of willful or reckless disregard of the law;
(3) reasonable attorneys' fees and other litigation costs reasonably incurred; and
(4) such other preliminary and equitable relief as the court determines to be appropriate.
The DPPA and VPPA sections prohibiting disclosure of personal information are similar. They differ in their description of the protected personal information. The VPPA addresses "personally identifiable information concerning any consumer of such [video tape service] provider" and thereafter uses "the aggrieved person" as short hand for the consumer. 18 U.S.C. §§ 2710(b) & (c). The DPPA uses the terms "personal information" and "the individual" in the same way. 18 U.S.C. § 2724(a). The differences in wording are because of the nature of the information disclosed and the relationship of the wronged person to the discloser. Under the VPPA, the relationship between the consumer and the disclosed information (identity of the person and specific video materials requested or obtained) is more complicated than the DPPA's simpler disclosure of "personal information" of an individual). A plain reading of the statute leads to the conclusion that the VPPA's "the aggrieved person" is the equivalent of the DPPA's "the individual."
The DPPA also differs from the VPPA in that it includes the clause "may bring a civil action" as a dependent clause in the "defining the wrong" section of the statute, and it sets forth the relief itself in the next subsection. See id. §§ 2724(a) & (b). By contrast, the VPPA puts both the "may bring a civil action" clause and remedies similar to the DPPA's remedies one subsection down. See 18 U.S.C. § 2710(c). It has to do that because - unlike the DPPA - the VPPA has permissible disclosures that do not create a right to sue by the consumer. Id. § 2710(b)(2). Again, the DPPA's plain language is so similar to the VPPA as to be practically indistinguishable.
Courts hold that the DPPA requires only an improper disclosure under the statute. See Pichler v. UNITE, 542 F.3d 380, 398 (3rd Cir. 2008); Kehoe v. Fidelity Fed. Bank & Trust, 421 F.3d 1209, 1216 (11th Cir. 2004). Kehoe involved a savings bank's purchase of Florida DMV names and addresses for people who registered new cars or newer used motor vehicles. 421 F.3d at 1210. In rejecting the argument that proving actual damages is a condition precedent to receiving liquidated damages, the court observed that "[d]amages for a violation of an individual's privacy are a quintessential element of damages that are uncertain and possibly unmeasurable," which means that liquidated damages are "an appropriate substitute for the potentially uncertain and unmeasurable actual damages of a privacy violation." Id. at 1213. Given the similarity of the DPPA and the VPPA, the DPPA cases militate in favor of a conclusion that Plaintiffs need show only a violation of the VPPA. The difference between the words "aggrieved person" and "individual" do not suggest a different result. The court notes that under the DPPA, there is a comma between "actual damages" and "but not less than 2,500," but the use or lack of use of a restrictive comma does not change the result under a plain reading of the VPPA.
2. Actual Injury Is Not a Prerequisite to Recovering Any Damages
Hulu cites Sterk v. Best Buy Stores, L.P., No. 11 C 1894, 2012 WL 5197901 (N.D. Ill. Oct. 17, 2012), for the proposition that actual injury is a prerequisite to recovering any damages under the VPPA. Sterk sued Best Buy Stores, L.P. and BestBuy.com L.L.C. under the VPPA and another privacy statute for allegedly disclosing his DVD purchase history and other information to their parent company, Best Buy Co., Inc. Id. at *1-3. The Sterk court held that under the VPPA, a plaintiff "must plead an injury beyond a statutory violation to meet the standing requirement of Article III," meaning, to establish an Article III injury-in-fact, and it rejected Sterk's argument that a statutory violation alone was enough. Id. at *5. It reached this conclusion in part by relying on Doe v. Chao, 540 U.S. 614 (2004), where the Supreme Court interpreted the Privacy Act's provision of "'actual damages sustained by the individual as a result of the refusal or failure [of a federal agency to comply with the Privacy Act], but in no case shall a person entitled to recovery receive less than a sum of $1,000.'" Id. (quoting Chao, 540 U.S. at 621).
Sterk does not alter the analysis for several reasons.
First, Sterk is a standing case that addresses whether a statutory violation is an injury-in-fact. As the court held previously, the Ninth Circuit recognizes that a plaintiff satisfies Article III's injury-in-fact requirement by alleging a violation of a statutorily-created right. 6/11/12 Order, ECF No. 64 at 9-11 (citing Edwards v. First Am. Corp., 610 F.3d 514, 515-16 (9th Cir. 2010)). Hulu does not raise the issue of standing explicitly and instead makes the argument that the VPPA requires actual injury even for liquidated damages only. See, e.g., Motion at 6, 12. Still, it is close to a standing argument, and Sterk is an out-of-circuit case that applies a different injury-in-fact standard than the Ninth Circuit.
In its notice of motion, Hulu "moves for summary judgment on the grounds that no named plaintiff sustained any actual injury and that, as a result, whether that is considered an issue of standing or a prima facie element of the claim for relief, Hulu is entitled to prevail." Notice, ECF No. 124 at 2. In its motion, it refers to standing in discussing Sterk: "Sterk addressed the issue of injury in the context of standing. But the court made clear that the actual injury was a requirement for any recovery under the VPPA." Motion, ECF No. 124 at 12. Hulu's main argument in the motion was that "actual injury" was an element of the claim for relief. If Hulu wanted to reargue its standing argument, it should have done so explicitly and not obliquely. In any event, as this order holds, Hulu's arguments in its motion here do not alter the court's prior conclusion that Plaintiffs have standing. See 6/11/12 Order, ECF No. 64 at 10; 8/10/12 Order, ECF No. 68 at 2.
Second, Sterk needs to be considered in context. Best Buy submitted its corporate disclosure statement showing that Best Buy Co., Inc. owns 100% of the defendants Best Buy Stores, L.P. and BestBuy.com. See 2012 WL 5197901, at *3, *6. The court did not consider whether this could constitute a disclosure in evaluating whether Sterk stated a claim because it was a matter outside the pleadings that could not be considered on a motion to dismiss. Id. at *3 (finding that Sterk stated a claim). But the court did consider the disclosure in the context of Best Buy's factual challenge to whether Sterk showed an injury-in-fact: "Therefore, here, the court may consider Defendants' corporate disclosure statement." Id. at *6. "'Defendants have produced evidence calling Plaintiff's statutory standing into question,'" which means that the "presumption of correctness that we accord to a complaint's allegations falls away, and the plaintiff bears the burden of coming forward with competent proof that standing exists.'" Id. (quoting Apex Digital, Inc., v. Sears, Roebuck & Co., 72 F.3d 740, 444-45 (7th Cir. 2009). The court then held that "Plaintiff has not submitted any competent proof that he has statutory standing under the VPPA. Nor has Plaintiff demonstrated how Best Buy Co., Inc.'s acquisition of the PII [the information protected by the VPPA] could be found to be the result of a 'disclosure' by Defendants." Id.
It is at this point that the court held that "[m]oreover, Plaintiff has failed to allege an actual injury." Id. It is instructive to see how the court analyzed that economic injury. It was a dismissal without prejudice at the pleadings stage where Sterk alleged only that Best Buy retailers retained his information and shared it with the parent. Id. The court found that Sterk had not alleged a disclosure and, therefore, must allege some other economic harm. Id. at *6. To the extent that Sterk made some other allegations about economic harm, the court rejected them as not grounded in the actual facts. See id. at *6-7 (Sterk alleged that they "sold" his information but did not allege that he had been able to sell his own information for as much value; Sterk said that he overpaid Best Buy in reliance on its compliance with laws but the value of the information cannot be plausibly factored into the sales price). The court also noted Best Buy's argument that Plaintiff had not alleged that the value of his own information had been diminished but instead alleged only that Best Buy deprived "customers" of benefits. Id.
In sum, the Sterk Defendants challenged standing (and injury-in-fact) based on evidence that showed only a transmission of PII by wholly-owned subsidiaries to a parent company, and Plaintiffs did not show any disclosure within the meaning of the VPPA and had no injury and no standing. See id. (dismissed for lack of standing). Sterk does not support a conclusion that injury beyond disclosure is a prima facie element of a VPPA claim.
Hulu also argues that Doe v. Chao, 540 U.S. at 627, compels summary judgment in its favor, but this analysis is not persuasive either. According to Hulu, in Chao, "the Supreme Court concluded that a plaintiff must have sustained an actual injury to recover the liquidated amount." Motion at 13 (emphasis added). The Chao Court actually held that under the Privacy Act, a plaintiff must prove some measure of actual damages (not actual injury) before receiving the minimum statutory award of $1,000. 540 U.S. at 616 ("The question before us is whether Plaintiffs must prove some actual damages to qualify for a minimum statutory award of $1,000."), 627 ("The statute guarantees $1,000 only to plaintiffs who have suffered some actual damages"). Hulu does not argue that Plaintiffs need to prove actual damages to recover liquidated damages and instead casts its argument as a requirement that Plaintiffs prove actual injury. See, e.g., Motion at 12; Reply, ECF No. 140 at 2 ("Hulu has not argued that the injury must also be "measurable" or "pecuniary;" just that it must exist. . . . If that injury is difficult to quantify (such as damage to reputation), a court may award liquidated damages."). But its argument here - that Plaintiffs must show actual injury - hinges on a case (Chao) that is about proving actual damages.
In Chao, the Supreme Court interpreted the Privacy Act, which (1) protects the privacy of individuals identified in federal agencies' information systems and regulates the collection, maintenance, use, and dissemination of information by such agencies and (2) allows a civil action for certain agency misconduct. 540 U.S. at 618-19. The misconduct at issue was the government's disclosure of petitioner Buck Doe's Social Security number in processing his claim for benefits. Id. at 616-17. The applicable provision of the Privacy Act allows a civil action against an agency when the agency "fails to comply with [provisions of the Act] . . . in such a way as to have an adverse effect on an individual." 5 U.S.C. § 552a(g)(1)(D). The Act provides a remedy for intentional or willful violations of "actual damages sustained by the individual as a result of the refusal or failure, but in no case shall a person entitled to recovery receive less than the sum of $1,000." 5 U.S.C. § 552a(g)(4). The district court awarded Doe $1,000 in statutory damages. Chao, 540 U.S. at 617. The Fourth Circuit reversed that award, noting Doe's failure to raise a triable issue of fact about damages in that he had not submitted any corroboration of his claim of emotional distress (such as evidence of physical symptoms, medical treatment, loss of income, or impact on his behavior). Id.
The government did not challenge liability and instead argued that Doe had to prove some actual damages in order to recover under the statute. Id. at 620. The Court agreed. Id. at 620-23. It noted that the statute confined eligibility to "victims of adverse effects caused by intentional or willful actions," and provided expressly for liability to victims for "actual damages sustained." It held that the "entitled to recovery" phrase was a critical limiting phrase that conditioned recovery of $1,000 on proof of "actual damages sustained." 540 U.S. at 620-23.
Given that Hulu does not argue that Plaintiffs must prove actual damages, it is hard to say how Chao applies. If it were making an argument that actual damages are a necessary predicate to statutory damages, which it says it is not, Chao does not compel that conclusion. Indeed, in rejecting Doe's argument, the Court noted that Congress cut out "the very language in the bill that would have authorized any presumed damages. The Senate bill would have authorized an award of "actual and general damages sustained by any person,' with that language followed by the guarantee that "in no case shall a person be entitled to recovery receive less than the sum of $1,000." Id. at 622-23 (footnote omitted) (quoting legislative history). The Kehoe court found that this language was similar to the DPPA and supported the conclusion that the DPPA permits an award of liquidated damages without proof of actual damages. See 421 F.3d 1214-15. The similarities between the DPPA and the VPPA support the same conclusion in this case.
While Hulu couches its arguments in terms of "actual injury" as a necessary predicate to any damages, it relies only on cases that make different arguments (such as standing or "actual damages" as a necessary predicate to statutory damages). Given Hulu's arguments, the court addresses - as Plaintiffs did - Hulu's arguments in the context of the issues actually raised in Hulu's cited authorities.
--------
Hulu also cites Halaburda v. Bauer Publishing Co., Nos. 12-CV-12831, 12-CV-14221, 12-CV-14390, 2013 WL 4012827 (E.D. Mich. Aug. 6, 2013), for the proposition that actual injury is prerequisite to recovering any damages (actual or statutory). See Motion at 12. Halaburda is another Article III standing case where Plaintiff sued under Michigan's Video Rental Privacy Act, which is similar to the VPPA except that it provides for the recovery of "actual damages, including damages for emotional distress, or $5,000, whichever is greater." 2013 WL 4012827, * 2. In holding that an improper disclosure was sufficient for Article III standing, the court distinguished Sterk and held only that the Michigan statute's language differed from the VPPA's in that it provided for actual damages as an alternative to statutory damages. Id. at *4-*5 (noting that the VPPA's "any person aggrieved" language was central to the reasoning in Sterk v. Best Buy, and distinguished Sterk because the Michigan statute lacked similar statutory language). Id. at *4. Halaburda contains no substantive analysis of the VPPA's "any person aggrieved" language. It does not change the outcome here.
Finally, the court's conclusion that the unlawful disclosure of personal information is an "actual injury" is bolstered by another case involving Mr. Sterk (as opposed to Sterk v. Best Buy, where the court concluded that there was no disclosure and no injury). In Sterk v. Redbox Automated Retail, LLC, the Seventh Circuit found that Sterk could not obtain damages under the VPPA from Redbox (which provides DVDs via automated retail kiosks in stores) for failure to destroy records within one year as required by VPPA subsection (e) because the VPPA authorizes a civil action only for unlawful disclosure. 672 F.3d 535, 539 (7th Cir. 2012). In reaching the court's holding, Judge Posner distinguished between an unlawful retention claim (which does not establish injury) and an unlawful disclosure claim (which may). He observed, "How could there be injury, unless the information, not having been timely destroyed, were disclosed? If, though not timely destroyed, it remained secreted in the video service provider's files until it was destroyed, there would be no injury." Id. at 538. He then analyzed the DPPA cases (Kehoe and Pichler) and observed that "[w]e need not decide whether" their effort to distinguish Doe v. Chao was successful because in both cases, "there was an unlawful appropriation of private personal information, and as the courts pointed out this is a perceived although not a quantifiable injury. It corresponds to disclosure of personal information in violation of subsection (b) of the [VPPA]." Id. at 539 (internal citations omitted). This discussion supports the conclusion that disclosure is an injury. See also Edwards, 610 F.3d at 515-16 (violation of a statutory right is Article III injury-in-fact).
In sum, Hulu provides no authority for reading the VPPA's "person aggrieved" language as establishing an additional element of a prima facie claim for unlawful disclosure under the VPPA. The court denies Hulu's motion for summary judgment.
CONCLUSION
The issue in this motion is whether - assuming an unauthorized disclosure in violation of the VPPA - Plaintiffs must show "actual injury" evidence beyond the unauthorized disclosure as a prerequisite to obtaining any damages (actual or statutory). The court holds that they do not. The parties do not dispute that actual damages are not a prerequisite for statutory damages.
The court thus DENIES Hulu's Motion for Summary Judgment.
This disposes of ECF No. 124.
IT IS SO ORDERED.
_______________________
LAUREL BEELER
United States Magistrate Judge