I Know What You Watched Last Summer

The federal Video Privacy Protection Act, 18 U.S.C. § 2710 (the "VPPA"), requires, among other things, that a "video tape service provider" destroy customers' video material and services purchases and rental information as soon as practicable, but no later than one year from the date that the information is no longer necessary for the purpose for which it was collected. It also requires that the records not be disclosed without the customers' informed consent and an opportunity to opt out.

The law was passed by Congress in 1988 following concerns raised by the release of then-Supreme Court nominee Robert Bork's video rental records during his confirmation hearings. It has generated numerous putative class actions of late, each identifying a large class of individuals who purportedly are entitled to recover "actual damages but not less than liquidated damages in an amount of $2,500," as well as punitive damages, attorney's fees, costs and injunctive relief, all provided for under the VPPA. Sony Computer Entertainment America LLC ("SCEA") and Sony Network Entertainment International LLC ("SNEI") (collectively referred to as "Sony"), Best Buy Co., Inc., Netflix, Inc., and Redbox Automated Retail, Inc. are among those recently named as defendants in putative class actions premised on alleged violations of the VPPA.

Sony Prevails in Rodriguez v. Sony Computer Entertainment America LLC

In this latest case, plaintiff Daniel Rodriguez brought a putative class action against Sony claiming that Sony had wrongfully retained and disclosed consumers' personally identifiable information ("PII")—"information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider." Specifically, the plaintiff claimed that SCEA unlawfully disclosed its customers' PII to SNEI when SNEI took over the PlayStation Network, and that SNEI then unlawfully disclosed this PII to John Doe defendants for marketing and advertising purposes without the customers' consent and without giving them an opportunity to opt out. Further, the complaint alleged that Sony retains and stores their customers' movie and video game purchase and rental histories, collected in connection with sales and rentals of movies and video games through the PlayStation Network, for an indefinite period of time in violation of the VPPA. On April 20, U.S. District Judge Phyllis J. Hamilton of California's Northern District Court granted Sony's motion to dismiss the class claims, but granted the plaintiff leave to amend his claim against the Doe defendants.

The VPPA Permits the Disclosure of PII in Connection With a Transfer of Ownership

The court dismissed plaintiff's disclosure claim, relying on Subsection 2710(b)(2)(E) of the VPPA. This subsection permits the disclosure of PII "if the disclosure is incident to the ordinary course of business of the video tape service provider," which included the "transfer of ownership" of SCEA's assets to SNEI. She further concluded that the amended complaint failed "to state that a disclosure has affirmatively taken place, identify with particularity the person(s) or entity to whom such disclosure was made, or state that any such disclosure falls outside the scope of disclosures permitted under the VPPA."

The VPPA Does Not Provide a Private Right of Action Based Solely on an Allegedly Wrongful Retention of Sales and Rental Records

The court further dismissed plaintiff's retention claim, relying on the March 6, 2012 ruling in S

terk v. Redbox Automated Retail LLC

, 672 F.3d 535 (7th Cir. 2012) that the VPPA does not provide a private cause of action based solely on a video rental service provider's wrongful retention of records. She noted that the Seventh Circuit in Redbox had held that a "plaintiff may only sue for damages under the VPPA for unlawful ‘disclosure' of PII, not for the purportedly unlawful ‘retention' of PII."

Takeaway

The VPPA's damages provisions provide considerable incentive for class action plaintiffs to find an excuse to sue "any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials" holding sales or rental information. While defendants have been successful in defeating claims brought on the basis of retention of consumers' PII alone, these cases are a reminder for potential defendants to review their record retention policy, including to identify their practices and the point in time when such data is no longer needed, and to then delete records in accordance with their retention policy. Such companies should also put in place safeguards for the handling consumers' PII for their internal business needs and take care that inadvertent sharing of the data with third parties does not occur.

For a copy of this publication, click the link in the adjacent "Downloads" section.