BOSTON (Legal Newsline) -- Gannett Satellite Information Network has suffered a second denial of a motion to dismiss a case filed against it alleging violations of the Video Protection Privacy Act (VPPA).
First Denial: First Circuit denies Gannett’s motion to dismiss
The first dismissal came in April from the U.S. Court of Appeals for the First Circuit, which clarified the definitions of “consumer” and Personally Identifiable Information (PII) under the VPPA.
Alexander Yershov filed the class action lawsuit in Massachusetts federal court in 2014. The complaint states Yershov downloaded a free USA Today app, provided by Gannett, to his mobile phone.
He said each time he viewed a video through the app, Gannett recorded the titles of the videos, his device ID and the GPS coordinates of his phone and sent that information to Adobe, Gannett’s analytics vendor, without his permission, which is in violation of the VPPA.
Yershov is seeking class certification and, among other requests, statutory damages of $2,500 for each violation.
Gannett argued he was not a "consumer" as defined by the VPPA. U.S. District Judge F. Dennis Saylor initially dismissed the lawsuit, ruling that while Yershov’s device ID was “personally identifiable information” under the VPPA, his use of the app did not make him a subscriber as defined by the VPPA, because he didn’t pay any fees to access the app.
Yershov appealed the decision to the First Circuit. In its ruling, a three-judge panel reversed the dismissal on grounds that, under Yershov’s complaint, he was a “consumer” as intended by VPPA and monetary payment was not necessary to be considered a consumer.
In its ruling to determine whether Yershov was a subscriber, the court admitted the VPPA’s definition was broad and to assist in its interpretation referred to Merriam-Webster’s Dictionary citing it as, “to enter one's name for a publication or service."
It corroborated its interpretation by also relying on the American Heritage Dictionary’s definition of "subscribe" as, “[t]o receive or be allowed to access electronic texts or services by subscription" and included the definition of “subscription" defined as "[a]n agreement to receive or be given access to electronic texts or services."
Second denial: Massachusetts federal court denies Gannett’s next motion to dismiss
On remand, Gannett again filed for dismissal, contending Yershov’s complaint alleges a “bare procedural violation” of the VPPA, which is insufficient to establish Article III standing.
Gannett argued the plaintiff didn't prove a concrete injury. In fact, a requirement set by the U.S. Supreme Court this year in Spokeo v. Robins is that an injury must be both “concrete and particularized.”
The Massachusetts federal court denied Gannett’s motion to dismiss on Sept. 2, stating, “Gannett raises two principal arguments in its motion to dismiss. First, it contends that the complaint fails to allege a ‘concrete’ injury, in fact, because it relies on a bare procedural violation of the VPPA. Furthermore, it contends that even if the complaint alleges an injury that is concrete, Yershov’s standing depends on the implausible assumption that Adobe has a ‘profile’ on him.”
The court ruled the VPPA “plainly” provides plaintiffs like Yershov, who allege wrongful disclosure of their PII, with standing and a right to relief. The intangible harm allegedly suffered by Yershov from Gannett’s alleged disclosure of his PII is a concrete injury in fact.
Regarding its claim Yershov had no standing to file suit, the court ruled, “To state a claim under the VPPA, a consumer needs to allege only that a videotape service provider disclosed his personally identifiable information to a third party without his consent.”
"Data breach case law would support that a disclosure, by itself, is not a harm sufficient to warrant standing," said Scot Ganow, a privacy and security attorney with Faruki Ireland & Cox in Dayton, Ohio.
"However, the VPPA's language does not require the same level of harm to be shown. Rather, under the VPPA, a statutorial right to privacy is established and a knowing disclosure violates that right.”
Both rulings have significant impact on video service providers in how they operate and how they may potentially litigate future claims.
Gregory Stein, an associate attorney and vice chair of data privacy and information security with Ulmer and Berne in Cleveland, told Legal Newsline that the First Circuit's decision was very important to the industry.
"It’s essential that video service providers are aware of it," Stein said. "It seems it would be easy to violate the VPPA, because of the parameters set up by the decision.
"It’s not about a person’s Social Security number or spreadsheets of personal data, The PII identified are a user’s device ID and location coordinates. It’s a step away from what most people think PII is.”
Stein explained that the First Circuit's ruling says the downloader of a mobile app is considered a subscriber, without even creating a username or password.
“It creates more risk for companies who create apps for subscribers," he said. "They should look at the ruling and determine how it affects the manner in which their business operates. They should use it to determine what a business can and cannot do under the VPPA to reduce risk."
But risk may still exist for those outside the First Circuit jurisdiction, he said.
“It’s a case that provides clarity in the ruling that is not consistent with other decisions. If you’re in the First Circuit, you now know what a court would consider PII or subscriber definitions. For other areas, the ruling could be adopted, or it may not. It creates risk,“ he said.
The recent ruling denying the Spokeo defense affects how businesses will litigate in the future and what defenses they may raise, Stein said.
“The question raised by the decision was whether [VPPA] statutory damages would suffice to give a plaintiff standing," he said. "It was not a 100 percent clear answer in Spokeo. What makes Spokeo interesting is that it is hard to find a clear winner because of the broadness of the ruling as it applied to the Fair Credit Reporting Act. In this case, the ruling made [standing] very clear, as it relates to the VPPA.”
Ganow said that courts are wary of recognizing subjective harms that are difficult to quantify or define, like infliction of emotional distress claims.
"However, I think momentum is moving in favor of plaintiffs as judges and juries, as people, are more aware and sensitive to these harms that result from disclosure," he said.
"Companies could still find some refuge in the Spokeo holding, as it supports previous case law on standing. But that sanctuary will be short-lived. I think plaintiffs will continue to remove bricks from the wall of standing established in Clapper and other cases.
"This is why I encourage clients to continue to invest in implementing better data governance practices to reduce the risk associated with such disclosures, whether intentional or not."