Summary
dismissing § 2701-based claim because "[p]laintiffs' complaint is not with how Northwest obtained the information, but with how Northwest subsequently used the information."
Summary of this case from In re American Airlines, Inc., Privacy LitigationOpinion
Civ. File No. 04-126 (PAM/JSM)
June 6, 2004
MEMORANDUM AND ORDER
This matter is before the Court on a Motion to Dismiss filed by Defendants Northwest Airlines Corporation and Northwest Airlines, Inc. (collectively, "Northwest"). Seven putative class actions have been consolidated into a master case, and the Motion to Dismiss applies to the Amended Consolidated Class Action Complaint filed in the consolidated matter. After the Motion to Dismiss was filed, Plaintiffs sought a stay because the Judicial Panel on Multidistrict Litigation is considering a motion in a related case to consolidate all similar cases nationwide. As stated at the hearing, however, the Court will not stay this matter. For the reasons that follow, the Court finds that Plaintiffs have failed to state any claims on which relief can be granted, and the Court therefore dismisses all of the individual Complaints.
BACKGROUND
Plaintiffs are customers of Defendant Northwest Airlines, Inc. ("Northwest"). After September 11, 2001, the National Aeronautical and Space Administration ("NASA") requested that Northwest provide NASA with certain passenger information in order to assist NASA in studying ways to increase airline security. Northwest supplied NASA with passenger name records ("PNRs"), which are electronic records of passenger information. PNRs contain information such as a passenger's name, flight number, credit card data, hotel reservation, car rental, and any traveling companions.
Plaintiffs contend that Northwest's actions constitute violations of the Electronic Communications Privacy Act ("ECPA"), 18 U.S.C. § 2701 et seq., the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681, and Minnesota's Deceptive Trade Practices Act ("DTPA"), Minn. Stat. § 325D.44, and also constitute invasion of privacy, trespass to property, negligent misrepresentation, breach of contract, and breach of express warranties. The basis for most of Plaintiffs' claims is that Northwest's website contained a privacy policy that stated that Northwest would not share customers' information except as necessary to make customers' travel arrangements. Plaintiffs contend that Northwest's provision of PNRs to NASA violated Northwest's privacy policy, giving rise to the legal claims noted above.
Northwest has now moved to dismiss the Amended Consolidated Class Action Complaint (hereinafter "Amended Complaint"). Northwest contends that Plaintiffs cannot make out a claim under either the ECPA or the FCRA, that some of Plaintiffs' claims are preempted by the Airline Deregulation Act, 49 U.S.C. § 41713(b)(1), and that the remainder of Plaintiffs' claims fail as a matter of law.
DISCUSSION
A. Standard of Review
When analyzing a motion to dismiss under Rule 12(b)(6) of the Federal Rules of Civil Procedure, the Court must construe the allegations in the pleadings and make all reasonable inferences arising from the pleadings in favor of the non-moving party. Morton v. Becker, 793 F.2d 185, 187 (8th Cir. 1986). The Court should not, however, "blindly accept the legal conclusions drawn by the pleader from the facts." Id. A motion to dismiss will be granted only if "it appears beyond doubt that the [non-movants] can prove no set of facts which would entitle [them] to relief." Id.; see also Conley v. Gibson, 355 U.S. 41, 45-46 (1957).
B. The Electronic Communications Privacy Act
The ECPA prohibits a person or entity from
(1) intentionally access [ing] without authorization a facility through which an electronic communication service is provided; or
(2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished. . . .18 U.S.C. § 2701(a). Plaintiffs argue that Northwest's access to its own electronic communications service is limited by its privacy policy, and that Northwest's provision of PNRs to NASA violated that policy and thus constituted unauthorized access to the "facility through which an electronic communication service is provided" within the meaning of this section. Plaintiffs also allege that Northwest violated § 2702 of the ECPA, which states that "a person or entity providing an electronic communications service to the public shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service." 18 U.S.C. § 2702(a)(1).
Northwest argues first that it cannot violate § 2702 because it is not a "person or entity providing an electronic communications service to the public." Plaintiffs contend that, because the Amended Complaint alleges that Northwest is a provider of electronic communications service, and because the Court must accept the facts in the Amended Complaint as true, Northwest's Motion to Dismiss must fail.
Plaintiffs misapprehend the nature of the inquiry on a Motion to Dismiss. Although the Court must accept as true the well-pleaded facts in the Amended Complaint, the Court need not, and indeed should not, accept as true the legal conclusions the Amended Complaint draws from the facts. See Morton, 793 F.2d at 187. Whether Northwest is a provider of electronic communications service is a legal question, not a factual issue.
Defining electronic communications service to include online merchants or service providers like Northwest stretches the ECPA too far. Northwest is not an internet service provider. In fact, Northwest purchases its electronic communications service from a third party, Worldspan. Under these circumstances, Northwest is simply not an electronic communications service provider, and therefore cannot violate § 2702. See, e.g., Crowley v. CyberSource Corp., 166 F. Supp.2d 1263 (N.D. Cal. 2001) (finding online retailer not electronic communications service provider because retailer purchased electronic communications service from provider and did not independently provide such service to public).
Similarly, Northwest's conduct as outlined in the Amended Complaint does not constitute a violation of § 2701. Plaintiffs' claim is that Northwest improperly disclosed the information in PNRs to NASA. Section 2701 does not prohibit improper disclosure of information. Rather, this section prohibits improper access to an electronic communications service provider or the information contained on that service provider. There is no dispute that Northwest obtained Plaintiffs' personal information properly, in the ordinary course of business. Plaintiffs' complaint is not with how Northwest obtained the information, but with how Northwest subsequently used the information. Because § 2701 does not speak to the use of the information, it does not apply and Plaintiffs' claims under § 2701 fail as a matter of law.
C. The Fair Credit Reporting Act
The FCRA was enacted "to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy." 15 U.S.C. § 1681(a). Plaintiffs encourage the Court to apply the FCRA liberally, to further the remedial purposes of the statute. As with Plaintiffs' claims under the ECPA, however, Plaintiffs' FCRA claims require not liberal application of the statute, but wholesale disregard of the statute's purposes and definitions.
Plaintiffs contend that Northwest violated the FCRA by furnishing PNRs to NASA without first obtaining Plaintiffs' written consent to do so. (Am. Compl. ¶ 88; 15 U.S.C. § 1681b(a)(2).) This allegation presupposes that Northwest or Worldspan is a "consumer reporting agency" and that PNRs are "consumer reports" within the meaning of the statute.
The FCRA defines "consumer reporting agency" as
any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties. . . .15 U.S.C. § 1681a(f). Under no possible interpretation of this definition is Northwest a "consumer reporting agency." Worldspan may be a "consumer reporting agency," but only if the PNRs Worldspan maintains for Northwest constitute "consumer reports."
The term "consumer report" means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purposes of serving as a factor in establishing the consumer's eligibility for —
(A) credit or insurance to be used primarily for personal, family, or household purposes;
(B) employment purposes; or
(C) any other purpose authorized under section 168 lb of this title.Id. § 1681a(d).
Even accepting as true Plaintiffs' allegations regarding what information is contained in PNRs, PNRs do not constitute "consumer reports" within the definition of the FCRA. At most, a PNR contains information about a consumer's credit card, including perhaps the consumer's balance on that credit card. This limited information cannot fairly be said to be information "bearing on a consumer's credit worthiness, credit standing, [or] credit capacity." Similarly, information such as dietary restrictions and traveling partners is not information on the consumer's "personal characteristics or mode of living." The FCRA does not apply to the information contained in PNRs. Plaintiffs' claims under the FCRA fail as a matter of law.
D. State- and Common-Law Claims
1. Preemption
Northwest argues that Plaintiffs' claims under the DTPA and for negligent misrepresentation are preempted by the Airline Deregulation Act ("ADA"), 49 U.S.C. § 41713(b). This section provides that "a State . . . may not enact or enforce a law . . . related to a price, route, or service of an air carrier." 49 U.S.C. § 41713(b)(1). The scope of this preemption provision is undisputedly broad, and applies to preempt Plaintiffs' claims if those claims relate to a "price, route, or service" of Northwest.
The Supreme Court has determined that a law or claim "relates to" a price, route, or service if that claim has a "connection with or reference to" an airline's rates, routes, or services. Morales v. Trans World Airlines, Inc., 504 U.S. 374, 384 (1992). The Court has further elucidated that the preemption provision "bars state-imposed regulation of air carriers." Am. Airlines, Inc. v. Wohlens, 513 U.S. 219, 222 (1995). In the Wohlens case, the Court determined that the ADA preempted the plaintiffs' claims under the Illinois Consumer Fraud and Deceptive Business Practices Act. Northwest argues that Plaintiffs' claims under the Minnesota DTPA and for negligent misrepresentation are almost indistinguishable from the claims found to be preempted in Wohlens.
The Wohlens Court noted that "the potential for intrusive regulation of airline business practices [is] inherent in state consumer protection legislation," such as the Minnesota Deceptive Trade Practices Act. Id. at 227-28. Plaintiffs contend that theWohlens matter involved an airline's marketing practices, while their claims here involve an airline's privacy policy. This distinction is not persuasive, however. Plaintiffs' claim that Northwest's failure to abide by its privacy policy when providing services to customers on its website violates the DTP A is strikingly similar to the plaintiffs' claims inWohlens that the airline violated its own policies by changing its frequent flyer program. Plaintiffs' claims under the DTPA at the least relate to Northwest's services and are preempted by the ADA. Similarly, Plaintiffs' negligent misrepresentation claim, which raises the same contentions raised in their DTPA claim, is preempted by the ADA.
2. Remaining Claims
Finally, Northwest argues that Plaintiffs' remaining claims fail to state a claim on which relief can be granted. These claims are: trespass to property, intrusion upon seclusion, breach of contract, and breach of express warranties,
a. Trespass
To state a claim for trespass to property, Plaintiffs must demonstrate that they owned or possessed property, that Northwest wrongfully took that property, and that Plaintiffs were damaged by the wrongful taking.H. Christiansen Sons. Inc. v. City of Duluth, 31 N.W.2d 270, 274 (Minn. 1948). Plaintiffs contend that the information contained in the PNRs was Plaintiffs' property and that, by providing that information to NASA, Northwest wrongfully took that property.
As a matter of law, the PNRs were not Plaintiffs' property. Plaintiffs voluntarily provided some information that was included in the PNRs. It may be that the information Plaintiffs provided to Northwest was Plaintiffs' property. However, when that information was compiled and combined with other information to form a PNR, the PNR itself became Northwest's property. Northwest cannot wrongfully take its own property. Thus, Plaintiffs' claim for trespass fails.
b. Intrusion Upon Seclusion
Intrusion upon seclusion exists when someone "intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns . . . if the intrusion would be highly offensive to a reasonable person." Lake v. Wal-Mart Stores, Inc., 582 N.W.2d 231, 233 (Minn. 1998) (quoting Restatement (Second) of Torts § 625B). Thus, to make out a claim for intrusion upon seclusion, Plaintiffs must show that the alleged intrusion would be highly offensive to a reasonable person. The Court may properly preliminarily determine whether the alleged intrusion is sufficiently offensive to state a claim for intrusion upon seclusion. Bauer v. Ford Motor Credit Co., 149 F. Supp.2d 1106, 1109 (D. Minn. 2001) (Doty, J.). When making this determination, the Court should consider the "degree of intrusion, the context, conduct and circumstances surrounding the intrusion as well as the intruder's motives and objectives, the setting into which he intrudes, and the expectations of those whose privacy is invaded." Id. (citation omitted).
In this instance, Plaintiffs voluntarily provided their personal information to Northwest. Moreover, although Northwest had a privacy policy for information included on the website, Plaintiffs do not contend that they actually read the privacy policy prior to providing Northwest with their personal information. Thus, Plaintiffs' expectation of privacy was low. Further, the disclosure here was not to the public at large, but rather was to a government agency in the wake of a terrorist attack that called into question the security of the nation's transportation system. Northwest's motives in disclosing the information cannot be questioned. Taking into account all of the factors listed above, the Court finds as a matter of law that the disclosure of Plaintiffs' personal information would not be highly offensive to a reasonable person and that Plaintiffs have failed to state a claim for intrusion upon seclusion.
c. Breach of Contract and Express Warranty
Northwest contends that the privacy policy on Northwest's website does not, as a matter of law, constitute a unilateral contract, the breach of which entitles Plaintiffs to damages. Northwest also argues that, even if the privacy policy constituted a contract or express warranty, Plaintiffs' contract and warranty claims fail because Plaintiffs have failed to plead any contract damages.
Whether a person's statements constitute a unilateral contract is a question of law for the Court to determine. Martens v. Minn. Mining Mfg. Co., 616 N.W.2d 732, 740 (Minn. 2000). Plaintiffs' rely on the following statement from Northwest's website as the basis for their contract and warranty claims:
When you reserve or purchase travel services through Northwest Airlines nwa.com Reservations, we provide only the relevant information required by the car rental agency, hotel, or other involved third party to ensure the successful fulfillment of your travel arrangements.
(Compl. ¶ 49.) As noted above, Plaintiffs do not allege that they actually read this privacy statement prior to providing Northwest with their personal information, although they do generally allege that they "relied to their detriment" on this policy. (Id. ¶ 136.)
The usual rule in contract cases is that "general statements of policy are not contractual." Martens. 616 N.W.2d at 741 (quotations omitted). In the employment context, the Minnesota Supreme Court has found that statements in an employee handbook as specific as "[a] person is not dismissed without cause, and it is customary to give a warning and an opportunity to `make good' before final dismissal" did not create an employment contract that altered the presumed at-will employment relationship. Cederstrand v. Lutheran Bhd., 117 N.W.2d 213, 215-16 (Minn. 1962). The court characterized the statement as a "general polic[y], not an offer of contractual character." Id. at 222.
The privacy statement on Northwest's website did not constitute a unilateral contract. The language used vests discretion in Northwest to determine when the information is "relevant" and which "third parties" might need that information. See Grenier v. Air Express Int'l Corp., 132 F. Supp.2d 1198, 1201 (D. Minn. 2001) (Doty, J.). Moreover, absent an allegation that Plaintiffs actually read the privacy policy, not merely the general allegation that Plaintiffs "relied on" the policy, Plaintiffs have failed to allege an essential element of a contract claim: that the alleged "offer" was accepted by Plaintiffs. Id. at 1200. Plaintiffs' contract and warranty claims fail as a matter of law.
Even if the privacy policy was sufficiently definite and Plaintiffs had alleged that they read the policy before giving their information to Northwest, it is likely that Plaintiffs' contract and warranty claims would fail as a matter of law. Defendants point out that Plaintiffs have failed to allege any contractual damages arising out of the alleged breach. As Defendants note, the damages Plaintiffs claim are damages arising out of the torts alleged in the Amended Complaint, not damages arising out of the alleged contract. Damages are an essential element of a breach of contract claim, and the failure to allege damages would be fatal to Plaintiffs' contract claims. Sloggy v. Crescent Creamery Co., 75 N.W. 225, 226 (Minn. 1898).
CONCLUSION
Plaintiffs' claims under the ECPA and FCRA fail as a matter of law. Plaintiffs' claims under the Minnesota DTPA and for negligent misrepresentation are preempted, and Plaintiffs' remaining common-law claims fail to state claims on which relief can be granted. Accordingly, IT IS HEREBY ORDERED that:
1. Plaintiffs' Motion to Stay (Clerk Doc. No. 19) is DENIED; and
2. Defendants' Motion to Dismiss (Clerk Doc. No. 13) is GRANTED.LET JUDGMENT BE ENTERED ACCORDINGLY.