The Latest Trend of the Plaintiff-Class Action Bar:

Video Privacy Protection Act Class Action Litigation

 

The Video Privacy Protection Act Has Become the Latest Favorite Cause of Action of the Plantiff Class Action Bar.

 Be Aware of the Prohibitions of the VPPA or You Could be Facing a Class Action Lawsuit With Millions of Dollars of Potential Exposure.

 

            There has been a recent spate of class action litigation filed under the Video Privacy Protection Act of 1988 (18 U.S.C. §2710) (VPPA) against retailers of video products.  VPPA class action cases have been recently filed in the U.S. District Court for the Northern District of Illinois against Redbox and Best Buy and against Netflix in the U.S. District Court for the Northern District of California.  These cases allege that the defendants violated the VPPA by failing to destroy protected information under the Act and seek potentially millions of dollars in statutory damages on behalf of putative classes. 

 

The VPPA passed in 1988 in reaction to the disclosure of Supreme Court nominee Robert Bork's video rental records in a newspaper during his confirmation hearings.  Generally it prohibits the disclosure of "personally identifiable information" regarding consumers' rental or purchase of video materials.  It also creates an affirmative obligation on the part of the entities or persons covered by the Act to destroy "personally identifiable information" as soon as practicable. 

 

The Plaintiff Class Action Bar is Drawn to the VPPA as it Provides for the Recovery of Statutory Damages of $2,500 Per Violation, Regardless of Whether the Plaintiff Sustained Any Actual Damages.

 

The VPPA provides for a private right of action and more importantly it provides for the recovery of statutory damages of a minimum of $2,500 per violation regardless of whether the plaintiff sustained any actual injury.  It is the statutory damages provision which has attracted the attention of the plaintiff class action bar.  The Act provides that a Court may award a successful plaintiff actual damages but not less than the liquidated amount of $2,500; punitive damages; attorney's fees and costs and injunctive relief. 18 U.S.C. §2710(c)(2). 

 

In the context of a class action, the damages provision of the VPPA creates the prospect of ruinous exposure.  Every 1,000 violations represents a minimum of $2.5 million in potential exposure.  At least one case which included allegations of violations of the VPPA has settled for $9.5 million with the plaintiff class action attorneys receiving $2.3 million in fees and costs. 

 

Beginning in January 2011, the plaintiff class action bar began filing class actions under the VPPA under the theory that defendants failed to meet their obligation under Subsection (e) of the Act which requires a covered entity to destroy personally identifiable information regarding customers as "soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected . . ."  18 U.S.C. §2710(e).     

 

            Plaintiffs have filed class action lawsuits alleging this theory of liability in the U.S. District Court for the Northern District of California and the U.S. District Court for the Northern District of Illinois.  Netflix, Redbox and Best Buy have been the targeted defendants.  We anticipate that others will be targeted in the months ahead.  You should ensure your company is not in violation of the Act to avoid becoming a target.

 

Who Does The Act Apply To?

 

The Act applies to "video tape service providers."  It defines video tape service providers as follows:

 

[A]ny person, engaged in the business, in or affecting interstate or foreign  commerce, of rental, sale, or delivery of prerecorded video
cassette tapes or similar audio visual materials, or any person or other entity to whom a disclosure is made under subparagraph (D) or (E) of subsection (b)(2), but only with respect to the information contained in the disclosure.

 

18 U.S.C. §2710(a)(4).  The definition is obviously broad and includes retailers and potentially others, selling or renting DVDs, videos and potentially other materials such as video games.      

 

What Does The Act Require a Company To Do or Not Do?         

 

            In general, the VPPA requires a company subject to its provisions to do two things.  First, the company may not disclose "personally identifiable information" regarding a consumer to anyone other than certain enumerated persons; and second, it requires a company to destroy "personally identifiable information regarding consumers which it has collected as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected.

 

What is "Personally Identifiable Information?"

 

            The Act defines "personally identifiable information" broadly and provides that it includes: "information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider."  18 U.S.C. §2710(a)(3).  Any information which identifies a consumer (defined as: a renter, purchaser, or subscriber of goods or services from a video tape service provider) as having ordered, purchased or inquired about specific video materials (which is not defined) should be presumed to be personally identifiable information which is protected under the Act.  You should consult counsel as to whether information is protected under the Act or not. 

 

Examples of "Personally Identifiable Information" include:

 

 

 

 

 

 

 

The Act Prohibits Disclosure of Personally Identifiable Information With Certain Exceptions.

 

            The VPPA generally prohibits an entity selling or renting video materials from disclosing information regarding the video materials a consumer purchased, requested or inquired about.  There are certain exceptions to the prohibition against disclosure.  A seller or renter of video materials may disclose personally identifiable information to:

 

            a)         the consumer;

 

b)         to any person if the consumer gives informed written consent to the disclosure given at the time the disclosure is sought;

 

c)         to a law enforcement agency pursuant to a court order or subpoena;

 

d)         to any person if the only information disclosed is the name and address of the consumer provided that: i) the consumer is informed in a clear and conspicuous manner of his right to opt out of any such disclosures; and ii) the disclosure does not identify the title or subject matter of any video materials with the further exception that the title or subject matter may be disclosed if the purpose of the disclosure is for the exclusive use of marketing goods or services to the consumer;

 

e)         to any person if the disclosure is incident to the ordinary course of business (debt collection, order fulfillment, request process and transfer of ownership); and

 

f)          pursuant to a court order with certain restrictions.

 

If a disclosure is made which does not fit under one of the six exceptions above, the consumer can bring an action for violating the Act.

 

The VPPA Also Requires a Seller or Renter of Video Material to Destroy Personally Identifiable Information as Soon As Practicable, But No Later Than One Year, After The Information Is No Longer Necessary for the Purpose For Which It Was Collected.

 

            In addition to limiting who personally identifiable information may be disclosed to, the VPPA also requires that sellers and renters of video material destroy any personally identifiable information as soon as practicable after the information is no longer needed.  The Act provides that the information must be no later than one year after the information is no longer necessary for the purpose for which it was collected.  Subsection (e) of the Act provides:

 

A person subject to this section shall destroy personally identifiable information as soon as practicable but no later than one year from the date the information is no longer necessary for the purpose for which it was collected and there are no pending requests or orders for access to such information under subsection (b).

 

18 U.S.C. §2710(e).  The Act does not define what time period constitutes "as soon as practicable" to satisfy the requirements of the Act.  The determination of whether information was timely destroyed under the Act will be a case-by-case determination.  The Act does provide the objective criteria that the personally identifiable information is to be destroyed no later than one year after it is no longer necessary for the purpose for which it was collected, but this standard creates further factual questions as to when the information is no longer necessary.  Those subject to the Act should be prepared to articulate a basis for why personally identifiable information is retained for the amount of time it is retained. 

           

In The VPPA Class Actions Which Have Been Filed Recently, Plaintiffs Allege That Defendants Have Failed to Timely Destroy Personally Identifiable Information in Violation of the Act.

 

            The recent class actions which have been filed against defendants do not allege the defendants made improper disclosures of personally identifiable information.  Instead they allege that the defendants failed to timely destroy the personally identifiable information as soon as practicable.  In one of the cases filed against Netflix, the plaintiff alleges that Netflix maintained a record of every video rental made by its customers, including the title(s) rented and stores this information for at least two-years after the customer cancels his Netflix account.  The plaintiff alleges that "Netflix maintains a veritable digital dossier on thousands if not millions of former subscribers, as well as billing/contact information, but also a highly detailed account of the individuals video programming viewing history."  The complaints filed against Redbox and Best Buy make similar allegations.  Plaintiffs have alleged that by retaining customers' video purchase histories the defendants violate Subsection (e) of the VPPA and are thus liable for the statutory damages of $2,500 per customer. 

 

The Plaintiff Class Action Bar is Seeking to Cash-In on the Statutory Damages Provision of the VPPA to Collect $2,500 Per Account.

 

            As indicated, in the recent cases filed the plaintiff class action bar is asserting that the defendants violated the VPPA by failing to timely destroy information and they are assuming and hoping that this occurred for thousand or even millions of accounts for which they can recover $2,500 per account, plus punitive damages and fees and costs.

 

            One Chicago based firm has emerged as preeminent plaintiff firm filing these cases.  This firm has already recently filed VPPA class actions against Netflix, Redbox and Best Buy.  Its predecessor firm also filed an action against Facebook (Lane v. Facebook, Inc. No. C 08-3845), alleging that Facebook's "Beacon" program, which monitored and published what users of the social networking site were buying or renting from Blockbuster, violated the VPPA and other privacy statutes.  The firm settled this case for $9.5 million and received $2,364,973.58 in attorney's fees and costs under the settlement.  Only a handful of class members received monetary damages and approximately $6 million of the settlement was to be used to establish a Privacy Foundation to fund projects and initiatives that promote the cause of online privacy, safety and security.  

 

You Should Conduct a VPPA Compliance Audit and Institute Procedures to Ensure Compliance - Lest You Become the Next Target of the Plaintiff Class Action Bar.           

 

            You should conduct a VPPA compliance audit to assess your compliance with the Act and to ensure procedures are in place to comply with the Act.  The audit should address at a minimum the following issues:

 

            1)         Are you a "video tape service provider" who is subject to the Act?

 

            2)         What types of "personally identifiable information" do you collect?

 

            3)         What types of "personally identifiable information" do you store or retain and for

                        what period of time do you retain it?

 

            4)         How secure is the "personally identifiable information" which you retain?

 

5)         What business reasons/needs exist to retain the "personally identifiable information" which you are retaining for the period of time you are retaining it?

 

6)         Can you document the date and method "personally identifiable information" is destroyed or deleted and is it truly destroyed or deleted (does it exist in back-up or disaster recovery files)?

 

7)         Are there procedures in place to prevent unauthorized disclosures of "personally identifiable information" and are employees aware of and trained regarding these procedures?

 

Ice Miller can assist you in designing and conducting a VPPA compliance audit to ensure you are in compliance and minimize the risk that you will become the target of a VPPA class action lawsuit.

 

            Bart Murphy is a partner in Ice Miller's Litigation Practice Group in its DuPage County, Ill. and Chicago, Ill. offices and he concentrates his practice on the defense of complex business litigation matters including the defense of class action litigation.  Murphy has defended clients in over 100 class actions involving a wide variety of issues.  He has 29 years of experience and prior to entering private practice served as an Assistant Cook County State's Attorney under Richard M. Daley and as an Assistant Illinois Attorney General under three Attorney Generals.  He has been recognized as an Illinois Super Lawyer in the area of Class Actions.  Murphy can be reached at (630) 955-6392 or bart.murphy@icemiller.com.

 

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice.  The reader must consult with legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.

 

March 21, 2011