The Video Privacy Protection Act (“VPPA”) limits how video tape service providers permissibly may disclose and retain a consumer’s personal information. In a case of first impression for the Ninth Circuit, on September 4, 2015 the Ninth Circuit affirmed dismissal of a class action VPPA claim against two related Sony entities. Rodriguez v. Sony Computer Entertainment America, LLC et al., No. 12-17391 (September 4, 2015). Plaintiff Rodriguez’s complaint alleged that Sony Computer Entertainment America, LLC (“Sony Computer”) violated the VPPA regarding data it obtained through the PlayStation Network by (1) maintaining and storing customer personal information beyond the time authorized by the VPPA and (2) improperly sharing customer personal information between related Sony entities. The Ninth Circuit rejected both arguments and affirmed the district court’s dismissal.
No Private Right of Action for Alleged Violations of the VPPA’s Data Retention Limitations
First, the court held that there was no private right of action for Rodriguez to allege violations of the VPPA’s data retention limitations. With limited exceptions, the VPPA provides that video service providers “shall destroy personally identifiable information as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected.” 18 U.S.C. § 2710(e). Rodriguez alleged that Sony Computer violated the VPPA by maintaining and storing customer personal information beyond one year.
Without considering the merits of the allegation, the Ninth Circuit held that Rodriguez could not bring such a claim regarding data retention under the VPPA. The court noted that both the Seventh Circuit (Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535 (7th Cir. 2012)) and the Sixth Circuit (Daniel v. Cantrell, 375 F.3d 377 (6th Cir. 2004)) had ruled that no private cause of action existed to enforce this particular provision of the VPPA. Among other things, the Ninth Circuit observed that awarding damages solely for unlawful retention would be illogical, because a consumer suffers no injury unless that personal information is unlawfully disclosed. Likewise, nothing in the VPPA’s legislative history reflected a Congressional intent to create a private right of action for the Act’s retention limitations. Without a private right of action, Rodriguez’s claim regarding retention was properly dismissed.
Transfer of Data Between Corporate Entities May Fall Within a VPPA Exemption
Second, the Ninth Circuit considered whether the transfer of data between Sony Computer and Sony Network Entertainment International, LLC (“Sony Network”) was an impermissible “disclosure” under the VPPA. Rodriguez alleged that Sony Computer initially held the customer data related to the PlayStation Network, but that after his registration, the affiliated Sony Network took control of the PlayStation Network and its related services and thus took control of his personal information as well. Rodriguez alleged that this disclosure among affiliates violated the VPPA. The Ninth Circuit affirmed the lower court’s dismissal of this allegation, holding that the disclosure fell within a VPPA exemption allowing disclosures that are “incident to the ordinary course of business of the video tape service provider.” 18 U.S.C. § 2710(b)(2)(E). In turn, the VPPA defines “ordinary course of business as “debt collection activities, order fulfillment, request processing, and the transfer of ownership.” 18 U.S.C. § 2710(a)(2).
Rodriguez’s theory regarding the relationship between Sony Computer and Sony Network changed, between his First Amended Complaint and his Second Amended Complaint. In his First Amended Complaint, Rodriguez alleged that Sony Computer “shared, sold, and/or transferred” his personal information to Sony Network after Sony Network “took over the [PlayStation Network].” The Ninth Circuit agreed with the district court’s dismissal of the complaint because the “plain language of the Act exempts the transfer of ownership alleged in the First Amended Complaint.”
In his Second Amended Complaint, Rodriguez alleged that (1) Sony Network only assumed management—but not ownership—of the PlayStation Network, and (2) the Sony entities also unlawfully disclosed data prior to Sony Network’s assumption of management. As an initial matter, the Ninth Circuit held that the determination of whether the VPPA exemption applies could indeed be resolved as a matter of law on a motion to dismiss. And notably, Rodriguez in his Second Amended Complaint did not describe why the Sony entities disclosed personal information with each other—he alleged only that such disclosure was unlawful and not pursuant to any transfer of ownership. Despite the lack of factual allegations concerning the purposes of the disclosures, the Court still determined that these “intra-corporate disclosures are not unauthorized disclosures under the Act” because where a video tape service provider “use[s] third parties in their business operations” the “functions performed by these third parties fall within the definition of ‘order fulfillment’ or ‘request processing.’” Significantly, the Ninth Circuit opinion did not address Rodriguez’s allegations that intra-corporate disclosures were made before Sony Network assumed management of the PlayStation Network. Instead, the Court focused on the allegation that at some point, Sony Network took over the “management” of the PlayStation Network, and this “fall[s] comfortably within the” VPPA’s exemptions.
The wider significance (potentially) of the Ninth Circuit’s reasoning is that it effectively expanded “order fulfilling” and “request processing” to include broader management duties: this arguably paves the way for other courts to reasonably construe these same terms to include other service providers that fulfill important corporate functions. Indeed, the Ninth Circuit cited with approval the Seventh Circuit’s ruling in Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618 (7th Cir. 2014) in which the Seventh Circuit found no VPPA violation where Redbox disclosed customer data to a service provider that serviced Redbox customers. The Ninth Circuit’s failure to address Rodriguez’s allegations that disclosures were made prior to any change in management of the PlayStation Network also suggests that courts view VPPA claims based on intra-corporate disclosures with disfavor. On the other hand, the Ninth Circuit did not issue a blanket holding that all intra-corporate disclosures fall within a VPPA exemption—so VPPA-covered entities should always carefully consider this and other precedent when deciding whether to disclose consumer data to corporate affiliates and service providers.
