Opinion
CASE NO. 5:11-CV-01629-EJD
08-17-2012
MEGHAN MOLLETT and TRACY HELLWIG, individually, on behalf of themselves and all others similarly situated, Plaintiffs, v. NETFLIX, INC., Defendant.
ORDER GRANTING NETFLIX'S
MOTION TO DISMISS
[Re: Docket Item No. 19]
Presently before the court is Defendant Netflix, Inc.'s motion to dismiss the complaint for failure to state a claim on which relief can be granted. For the reasons set forth below, the motion is granted.
I. BACKGROUND
Netflix operates an Internet video streaming service to which all its subscribers have access. Compl. ¶¶ 26-31. Some subscribers—including both of the named Plaintiffs—access the streaming service through a "Netflix Ready Device," which can be a video game console, a DVD or Blu-ray player, an Internet-ready television, or a set-top box. Id. ¶¶ 9-10, 32. Netflix Ready Devices which do not incorporate a display typically output to a TV. Id. ¶ 32. Registering a Netflix Ready Device to access a subscriber's account requires a password only during the initial set-up process. Id. ¶¶ 18, 25, 33. Both named Plaintiffs necessarily went through this process. Id. ¶ 33.
Once configured, anyone who accesses the Netflix Ready Device—and anyone watching the same screen—can see a list of the subscriber's recently watched video titles (the "Recently Watched" list), a list of video titles the subscriber has tagged for later viewing (the "Instant Queue"), and other custom-generated lists of suggested content (for example, the "Top Picks" list). Id. ¶¶ 36-46, 62-64. Both of the Plaintiffs' Netflix Ready Devices have "automatically display[ed]" these lists to "others." Id. ¶¶ 8-9.
Plaintiffs bring this action on behalf of the putative nationwide class of all Netflix subscribers who used Netflix Ready Devices to stream Netflix video to their TVs over the two-year period leading up to the filing of the complaint. Id. ¶ 48. Plaintiffs claim that the unrestricted display of each of these lists on a subscriber's television violates the Video Privacy Protection Act of 1988 (VPPA) and California Civil Code § 1799.3. Id. ¶¶ 57-79.
II. LEGAL STANDARD
A complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a). A motion to dismiss pursuant to Rule 12(b)(6) tests the legal sufficiency of the claims asserted in the complaint. Navarro v. Block, 250 F.3d 729, 731 (9th Cir. 2001). The court must accept all factual allegations pleaded in the complaint as true, and must construe them and draw all reasonable inferences from them in favor of the nonmoving party. Cahill v. Liberty Mutual Ins. Co., 80 F.3d 336, 337-38 (9th Cir. 1996).
To avoid a Rule 12(b)(6) dismissal, a complaint need not contain detailed factual allegations; rather, it must plead "enough facts to state a claim to relief that is plausible on its face." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).
III. DISCUSSION
The VPPA prohibits video tape service providers from knowingly disclosing personally identifiable information concerning any consumer to any person. 18 U.S.C. § 2710(b)(1). The statute enumerates several exceptions; most notably, a provider may disclose a consumer's personally identifiable information ("PII") to the consumer herself. 18 U.S.C. § 2710(b)(2)(A). The terms consumer, personally identifiable information, and video tape service provider are defined as follows:
(1) the term "consumer" means any renter, purchaser, or subscriber of goods or services from a video tape service provider;18 U.S.C. § 2710(a). The VPPA creates a private right of action for any person aggrieved by a violation of the Act. 18 U.S.C. § 2710(c).
. . .
(3) the term "personally identifiable information" includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider; and
(4) the term "video tape service provider" means any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials . . . .
Similarly, California Civil Code § 1799.3(a) provides,In the event of a willful violation of § 1799.3(a), the person who is the subject of the unlawfully disclosed record may recover a penalty by bringing a civil action against the violator. Cal. Civ. Code § 1799.3(c). This remedy is cumulative to any recovery available under the federal law. See 18 U.S.C. § 2710(f); Cal. Civ. Code § 1799.3(e).
No person providing video recording sales or rental services shall disclose any personal information or the contents of any record, including sales or rental information, which is prepared or maintained by that person, to any person, other than the individual who is the subject of the record, without the written consent of that individual.
It is safe to say that the 100th Congress did not contemplate the existence of a service like Netflix when it passed the VPPA in 1988. This month, the first court to squarely address the issue of whether the VPPA applies to streaming video providers decided—after a careful statutory analysis—that it does. In re Hulu Privacy Litig., Case No. C 11-03764 LB, ECF No. 68, 2012 WL 3282960 at *4-*6 (N.D. Cal. Aug. 10, 2012). In any event, Netflix does not challenge the allegations that it is a "video tape service provider" and a "person providing video recording . . . rental services," and therefore subject to both the VPPA and § 1799.3. Mot. Dismiss at 4:24-28. Nor does it dispute that Plaintiffs are "consumers" or that the data it disclosed was "personally identifiable information" as those terms are defined by the VPPA.
A. Netflix's Disclosures Were Made to the Consumer
Rather, Netflix primarily contends that its disclosures were made to devices registered to the Plaintiffs themselves, and therefore permissible under the provisions of both statutes allowing disclosure to the person who is the subject of the PII. The Plaintiffs respond that their Netflix Ready Devices, once configured, automatically display PII on their TVs where it is "freely available for anyone in their households to view, whenever they use their Netflix streaming video service." Opp'n at 8:10-12; Compl. ¶¶ 44, 63-64. Plaintiffs maintain that this automatic display can be a disclosure to the other members of their household. This court disagrees.
During the initial set-up of her Netflix Ready Device, each Plaintiff logged in to her Netflix account using a computer and affirmatively coupled the device with the account. Id. ¶ 33. By so doing, the Plaintiffs themselves authorized their devices to access their accounts. Plaintiffs apparently leave their devices coupled to their accounts and allow the other members of their homes access to the devices. Compl. ¶¶ 8-9, 44-47.
Netflix's privacy policy informs its subscribers,
You are responsible for maintaining the confidentiality of your account information and for restricting access to your computer or device through which you access your Netflix account. If you disclose your password to anyone or share your account and/or devices with other people, you take full responsibility for their actions.Snorgrass Decl. Ex. 1 at 4, ECF No. 20. Obviously, posting a privacy policy cannot relieve Netflix of its duty to comply with the VPPA. It does confirm, however, that the Plaintiffs knew that by allowing access to their device they were making the choice to also allow others access to their PII.
The privacy policy is properly considered on this motion to dismiss because it is incorporated by reference into the complaint. See Compl. ¶ 71; Branch v. Tunnell, 14 F.3d 449, 454 (9th Cir. 1994).
Plaintiffs point out that the legislative history of the VPPA indicates that Congress was concerned with unlawful disclosures even among members of the same household. For example, testimony before the Senate revealed at least one instance in which a man's video store rental records were requested by his soon-to-be-ex-wife in order to show in child custody proceedings that he was an unfit parent. See Senate Committee on the Judiciary, Video Privacy Protection Act of 1988, S. Rep. No. 100-599, at 5 (1988), reprinted in 1988 U.S.C.C.A.N. 4342-1, -7. Since Congress was motivated in part based on these findings, the Plaintiffs reason, the to-the-consumer exception should be read narrowly so as to preserve privacy protection vis-a-vis members of a consumer's household.
There is a real difference between the kind of disclosures identified by Congress and those at issue here. The consumer whose video store records are requested by a reporter or an ex-spouse needs the protection of the VPPA to ensure her records are kept private because she has no part in that communication. Without the VPPA, her privacy is subject to the whim of the clerk or the policy of the store. A consumer with a Netflix Ready Device faces no such quandary: she may control access to the device or the device's access to her account.
The following hypothetical may be instructive: A couple goes to the video store. They select a romantic movie and approach the counter together to check out. While the clerk scans the movie, one of them asks if she has any movies checked out that are overdue. The clerk informs her that she has kept a DVD of the Broadway-slasher film Phantom of the Opera Knife Person two days too many. She sues under the VPPA on the theory that the clerk disclosed her rental history to her partner. A court would surely hold that this disclosure was "to the consumer" even though the disclosure also reached her partner. If she had been concerned about the possibility of others receiving the disclosure, the responsibility to prevent the disclosure from being overheard was hers, not the clerk's. Likewise, any disclosure by Netflix here was to devices that the Plaintiffs themselves authorized to access their accounts. If the Plaintiffs do not want those disclosures to be "overheard" by other members of their household, they may restrict access to their devices.
The observation that Netflix could have implemented a more secure or private system is irrelevant. See Compl.¶ 46; Opp'n at 10 (asserting that "[l]iability . . . [turns] on whether Netflix uses a secure method to transmit PII to its subscribers."). In deciding a different question about the scope of the VPPA, the Sixth Circuit observed,
Just because Congress' goal was to prevent the disclosure of private information, does not mean that Congress intended the implementation of every conceivable method of preventing disclosures. Printing all personal information in hieroglyphics instead of English would also help prevent the disclosure of such information. However, nothing in the legislative history suggests that Congress was encouraging hieroglyphics . . . ."Daniel v. Cantrell, 375 F.3d 377, 384 (6th Cir. 2004). The same point can be made here. The fact that Congress outlawed disclosure to persons other than the consumer does not mean that Congress intended to prevent every conceivable manner in which a third party might gain access to a consumer's PII.
B. Any Third-Party Disclosure Was Not Made Knowingly or Willfully
Finally, Netflix argues in the alternative that any third-party disclosures were not made knowingly (as required by the VPPA) or willfully (as required by § 1799.3).
Neither the VPPA nor § 1799.3 is a strict liability statute. Even if this court has construed the to-the-consumer exceptions too broadly, Plaintiffs must still allege facts giving rise to a reasonable inference that Netflix knowingly or willfully disclosed PII to someone other than the consumer. Plaintiffs have alleged that Netflix knew that some of its subscribers accessed their devices in the presence of other people some of the time. Compl. ¶¶ 65-66. But the court would be unable to draw a reasonable inference from the allegations of the complaint that Netflix knew that people other than the Plaintiffs were present when it displayed PII on any individual occasion. Those circumstances are necessarily outside of Netflix's control or potential knowledge when it serves the information to the device.
Citing Safeco Ins. Co. of Am. v. Burr, 551 U.S. 47 (2007), Plaintiffs contend that willfulness (under § 1799.3) encompasses not only actual knowledge but also recklessness. 551 U.S. at 57-58 ("[W]here willfulness is a statutory condition of civil liability, we have generally taken it to cover not only knowing violations of a standard, but reckless ones as well . . . ."). But like in Safeco, even if Netflix's disclosures otherwise violated the statute, the violations were not reckless because—for all the reasons discussed above—Netflix's reading of the statute was not objectively unreasonable. Id. at 69-70; see also Shlahtichman v. 1-800 Contacts, Inc., 615 F.3d 794, 803-04 (7th Cir. 2010).
IV. CONCLUSION AND ORDER
Because all disclosures alleged in the complaint were essentially made "to the consumer" and "to the individual who is the subject of the record," the facts alleged do not give rise to any liability on the part of Netflix; indeed, the facts alleged are inconsistent with liability under the VPPA because any disclosure to a subscriber's Netflix Ready Device would fall under those statutory exceptions, because Netflix cannot possibly know who is viewing the screen when PII is displayed, and because its interpretation of both the VPPA and § 1799.3 were objectively reasonable. Accordingly, Netflix's motion to dismiss the complaint is hereby GRANTED, and the complaint is DISMISSED WITH PREJUDICE. The clerk shall close the file.
IT IS SO ORDERED.
_________________
EDWARD J. DAVILA
United States District Judge