ST. LOUIS (Legal Newsline) - A federal appeals court last month agreed to put the brakes on a putative class action brought against popular video game retailer GameStop over an alleged breach of its privacy policy.
A three-judge panel of the U.S. Court of Appeals for the Eighth Circuit in Carlsen v. GameStop Inc. said the plaintiff failed to clear a necessary hurdle in the class action.
Matthew Carlsen filed the action against GameStop and Sunrise Publications Inc. for breach of contract, unjust enrichment, money had and received, and violation of Minnesota’s Consumer Fraud Act, or CFA.
Carlsen, who subscribed to GameStop’s Game Informer Magazine -- which offers news, reviews and commentary about the video-game industry -- accused the company of disclosing his Facebook ID and browsing information for GameStop’s online content to the social network.
GameStop filed a motion to dismiss Carlsen’s complaint. The U.S. District Court for the District of Minnesota in Minneapolis granted the motion, finding Carlsen lacked standing.
Eighth Circuit judges Raymond Gruender and Diane Murphy, along with senior judge C. Arlen Beam, affirmed the district court’s ruling on the basis that Carlsen’s complaint failed to state a claim upon which relief can be granted.
“Here, Carlsen argues that GameStop promised not to disclose PII (personally identifiable information) and that this PII included his Facebook ID and browser history. We conclude, however, that the privacy policy unambiguously does not include those pieces of information among the protected PII,” the judges wrote in the 12-page ruling.
Carlsen alleged GameStop shared his personal information through the Game Informer website, which includes features that allow Game Informer users to log in to the website using their Facebook accounts and to use Facebook’s “like,” “share” and “comment” functions through the Game Informer website.
Game Informer provides these features by adding a Facebook Software Development Kit, or SDK, to the source code on the Game Informer website.
Carlsen alleged this SDK transmitted a user’s unique Facebook ID and Game Informer browsing history to Facebook if the user previously had opted to stay logged in to Facebook.
He further alleged GameStop breached a term of the privacy policy by disclosing his Facebook ID and browsing information. He also claimed this disclosure constituted a material misrepresentation about Game Informer subscriptions because he believed his personal information would not be disclosed and because part of his subscription fee paid for the protection of that information.
Carlsen said had he known about the disclosures, he either would not have paid for the subscription or would have refrained from accessing the online content for which he paid.
The district court, in its ruling, said the case was comparable to identity theft and data breach class actions and found that that Carlsen lacked standing for failure to allege an injury in fact with respect to his overpayment and would-not-have-shopped theories.
His allegations, the lower court said, were based on the Game Informer privacy policy, which applied equally to both paid and non-paid Game Informer subscriptions.
The Eighth Circuit, in its Aug. 16 opinion, concluded Carlsen did, in fact, have standing to bring his breach-of-contract and other claims.
“Here, Carlsen has provided sufficient facts alleging that he is party to a binding contract -- the terms of service, which include the Game Informer privacy policy -- with GameStop, and GameStop does not dispute this contractual relationship,” Gruender wrote for the court. “Carlsen also has alleged that GameStop has violated that policy by ‘systematically disclos[ing] Game Informer’s users’ PII... to third party Facebook and/or allow[ing] Facebook to directly collect that information itself.’ This allegation of breach is both concrete and particularized, as the breach allegedly already has occurred, and any consequences of the breach have occurred specifically to Carlsen as a result of the actions of GameStop’s alleged systematic disclosure via the Facebook SDK.
“Additionally, Carlsen alleged that he has suffered damages as a result of GameStop’s breach in the form of devaluation of his Game Informer subscription in an amount equal to the difference between the value of the subscription that he paid for and the value of the subscription that he received, i.e., a subscription with compromised privacy protection. Accordingly, Carlsen has alleged an ‘actual’ injury.”
However, the facts as alleged fail as a matter of law to establish GameStop’s breach, the appeals court ruled.
As the court explains, the privacy policy refers to PII and notes that it may include: name, home address and zip code, telephone number, e-mail address and (for those purchasing products online) credit card or checking account information, including billing and shipping addresses and zip codes.
And while “may include” appears to create a non-exclusive list, the court points out that the definition of personal information is included and better explained in a section entitled, “What Information Does Game Informer Collect.”
“The PII set forth in the privacy policy does not encompass a user’s Facebook ID and browsing history,” the Eighth Circuit concluded.
“The protection Carlsen argues GameStop failed to provide was not among the protections for which he bargained by agreeing to the terms of service, and GameStop thus could not have breached its contract with Carlsen.”
His Minnesota CFA claim fails for similar reasons, the appeals court ruled.
Beam concurred with affirming the district court’s dismissal of Carlsen’s claims, but disagreed with his fellow Eighth Circuit judges on their reasoning.
He argues Carlsen has failed to assert the “necessary justiciable controversy” required, citing the U.S. Supreme Court’s recent ruling in Spokeo v. Robins.
The nation’s high court explained in its May decision that for an injury to be particularized, it must affect the plaintiff in a “personal and individual way.” The injury-in-fact also must be “concrete,” which means “real” and “not abstract.” But “concrete” is not necessarily synonymous with “tangible.”
“At best, Carlsen’s pleadings consist of a panoply of imprecise contractual emanations purporting to illustrate possible economic harm,” Beam wrote. “This is not enough.”
From Legal Newsline: Reach Jessica Karmasek by email at jessica@legalnewsline.com.