Kevin Sterk vs. Redbox Automated Retail, LLC, No. 1:2011cv01729 - Document 217 (N.D. Ill. 2013)
Court Description: MEMORANDUM OPINION AND ORDER signed by the Honorable Matthew F. Kennelly on 8/16/2013: For the reasons stated in this decision, the Court grants Redbox's motion for summary judgment 164 . The Clerk is directed to enter judgment in favor of the defendant. Mailed notice.(pjg, )
Download PDF
<![CDATA[
IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION KEVIN STERK and JIAH CHUNG, individually, and on behalf of a class of similarly situated individuals, Plaintiffs, vs. REDBOX AUTOMATED RETAIL, LLC, Defendant. ) ) ) ) ) ) ) ) ) ) ) Case No. 11 C 1729 MEMORANDUM OPINION AND ORDER MATTHEW F. KENNELLY, District Judge: Kevin Sterk and Jiah Chung have sued Redbox Automated Retail, LLC for violations of the Video Privacy Protection Act (VPPA) and breach of contract. They seek to represent a class of similarly situated individuals. Redbox has moved for summary judgment on plaintiffs claims. For the reasons stated below, the Court grants Redbox s motion. Background Redbox rents digital video discs (DVDs) to consumers through more than 30,000 automated self-service kiosks located throughout the United States. Plaintiffs are Redbox customers who rented DVDs from Redbox kiosks at various times between September 2008 and January 2012. When a customer rents a DVD from Redbox, he must enter his e-mail address and pay with a debit or credit card. Redbox admits that it assigns a unique customer identification number to each e-mail address and tracks each rental transaction associated with that e-mail address, including the title of the DVD, the location of the kiosk, and the time of the rental. Redbox retains that information in a central database. It does not dispute that the information it collects is personally identifiable information (PII) for purposes of the VPPA. 18 U.S.C. § 2710(a)(3) (defining PII as information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider ). Redbox concedes that it has not deleted plaintiffs PII that it obtained when they rented its DVDs, although it contends that it will delete any the PII of any customer who asks the company to delete it. Redbox hires a number of third-party vendors for internal business and customer service functions. Of the eight vendors that Redbox has identified, plaintiffs challenge only one vendor s access to and use of Redbox s PII database: Stream Global Services (Stream). In February 2010, Redbox hired Stream to operate its telephonic customer service requests, although Redbox continued to handle internally any customer service requests submitted electronically. Redbox admits that Stream employees have potential access to its entire database. Def. s Resp. to Pls. L.R. 56.1(b)(3) Statement of Material Facts at 5. Jeffrey Scott Padgett, a senior vice-president of business development at Stream, has submitted an affidavit detailing how Stream employees access Redbox s database. He states that Stream employees, upon request, can access a customer s PII by searching the customer s last name, the last four digits of a debit or credit card, a ZIP code or state, an e-mail address, a transaction identification number, or the barcode number from a Redbox DVD. When a Stream employee inputs a search, Redbox s database 2 yields data for all transactions that match the inputted search terms. Thus a Stream employee conceivably might access one customer s PII in response to a different customer s service request. Padgett states that Stream does not disclose any customer s information until the customer confirms his or her identity by providing the last four digits of the applicable credit or debit card, the ZIP code associated with the billing address of the card, and the full name of the cardholder. According to Padgett, Stream employees also access customers PII during training. Specifically, he states that employees in training access live customer accounts to learn how to respond to Redbox customer calls and how to address customer requests by using the [database] search functions. Pls. Ex. 1 at 2. The employees also enter random four-digit numbers into the search query, retrieving transactional data for actual Redbox customers whose credit card information corresponds to the random number. Padgett contends that each Stream employee must sign a non-disclosure agreement before gaining access to Redbox s database, even for training purposes. Nick Lullo, Redbox s customer service liaison, disputes that Stream employees are given actual customers PII during training. Lullo testified during his deposition that Stream employees undergoing training would not have access to real customer information; [they] would only have access to mock customer information[.] Pl. s Ex. 11 at 155. Plaintiffs sued Redbox under the VPPA for unlawfully retaining and disclosing their PII. Redbox previously moved to dismiss plaintiffs claim for unlawful retention, arguing that the VPPA does not provide a private right of action. The Court concluded that subsection 2710(c) authorizes a private right of action for violations of subsection 3 2710(e). Sterk v. Redbox Automated Retail, LLC, 806 F. Supp. 2d 1059, 1069 (N.D. Ill. 2011). The Court certified the question to the Seventh Circuit for interlocutory appeal. The Seventh Circuit accepted the appeal and reversed, ruling that subsection 2710(c) does not authorize a private right of action for damages for unlawful retention of personal information in violation of subsection 2710(e). Sterk v. Redbox Automated Retail, LLC, 675 F.3d 535, 537 (7th Cir. 2012). Plaintiffs then amended their complaint, and Redbox again moved to dismiss. The Court granted Redbox s motion in part and denied it in part. Sterk v. Redbox Automated Retail, LLC, No. 11 C 1729, 2012 WL 3006674, at *1 (N.D. Ill. July 23, 2012) ( Sterk 3 ). The Court assumes familiarity with all of these decisions. Plaintiffs surviving claims against Redbox include: (1) a claim for injunctive relief regarding Redbox s retention of their PII, (2) a claim for statutory and punitive damages and injunctive relief regarding Redbox s disclosure of their PII to Stream, and (3) a related breach of contract claim for Redbox s disclosure to Stream. Discussion Summary judgment is proper when the admissible evidence, construed in favor of the non-movant, reveals no genuine issue as to any material facts and establishes that the movant is entitled to judgment as a matter of law. Berry v. Chi. Transit Auth., 618 F.3d 688, 690 91 (7th Cir. 2010). A genuine issue of material fact exists if there is sufficient evidence to allow a reasonable jury to find in favor of the non-movant. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 250 (1986); Swearnigen-El v. Cook Cnty. Sheriff s Dep t, 602 F.3d 852, 859 (7th Cir. 2010). In deciding on a motion for summary judgment, a court view[s] the record in the light most favorable to the non-moving party and draw[s] all reasonable inferences in that party s favor. Groesch v. City of 4 Springfield, 635 F.3d 1020, 1022 (7th Cir. 2011). Plaintiffs allege that Redbox s continued retention of their PII and its disclosure of that information to Stream violate the VPPA. Redbox argues that the disclosure to Stream is incident to the ordinary course of its business and is therefore a permissible disclosure under the statute. Redbox further contends that it continues to need plaintiffs PII for a purpose for which it collected the information, and thus its retention of the information does not run afoul of the VPPA. Redbox has moved for summary judgment on all of plaintiffs claims, arguing that its actions were permissible under the VPPA as a matter of law, and alternatively that the Court lacks subject matter jurisdiction to adjudicate plaintiffs claims. A. Jurisdiction Redbox contends that the Court lacks subject matter jurisdiction because plaintiffs have not established any injury in fact and because the case is moot. The Court previously addressed Redbox s claim that plaintiffs lack standing in considering Redbox s motion to dismiss the current version of the complaint. See Sterk 3, 2012 WL 3006674, at *8 10. Redbox contends, however, that because the case has now reached summary judgment, plaintiffs must produce evidence affirmatively establishing their injury but have failed to do so. As this Court previously noted, the core component of standing is an essential and unchanging part of the case-or-controversy requirement of Article III. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). To establish standing, a plaintiff must show that: (1) she has suffered an injury in fact that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly 5 traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision. Kyles v. J.K. Guardian Sec. Servs., Inc., 222 F.3d 289, 294 (7th Cir. 2000); see also Bensman v. U.S. Forest Serv., 408 F.3d 945, 949 (7th Cir. 2005). Although Congress may not lower the requirements of Article III standing, it may enact statutes creating legal rights, the invasion of which creates standing, even though no injury would exist without the statute. Kyles, 222 F.3d at 294 (citing Linda R.S. v. Richard D., 410 U.S. 614, 617 n.3 (1973)). This Court previously decided that the VPPA creates such a right conferred by statute and that plaintiffs claims adequately allege that defendant invaded that right. Redbox argues that because plaintiffs admit that there are beneficial aspects of the company s disclosures to Stream, any alleged injury is negated. Yet plaintiffs concession that there is some benefit to Redbox s alleged violation of the VPPA does not amount to a concession that they may not be injured in fact by the unconsented disclosure. Plaintiffs allege that their privacy rights, recognized and protected by the VPPA, were violated when Redbox disclosed plaintiffs PII to a third-party vendor without their consent. Those contentions, along with the evidence that plaintiffs have produced showing that the disclosure actually occurred, are sufficient to confer standing. If the Court concludes, as it does below, that the VPPA permits Redbox s disclosure and retention of plaintiffs PII, then Redbox is entitled to summary judgment on the merits, not on jurisdictional grounds. ASARCO Inc. v. Kadish, 490 U.S. 605, 624 (1989) ( [A]lthough federal standing often turns on the nature and source of the claim asserted, it in no way depends on the merits of the [claim]. (internal quotation marks omitted)). 6 Similarly, the fact that Redbox agrees to delete a customer s PII if that customer affirmatively asks it to do so does not render moot plaintiffs unlawful retention claim under the VPPA. Even if Redbox deletes a customer s previous information upon request, the evidence indicates that it will collect and retain PII from any future rentals unless a further request is made. Additionally, the VPPA requires deletion of PII without any affirmative action by the customer. Thus Redbox may still run afoul of the VPPA despite its deletion policy, entitling plaintiffs to injunctive relief. City of Los Angeles v. Lyons, 461 U.S. 95, 101 02 (1983) (plaintiff must show past harm or that he is immediately in danger of sustaining some direct injury in the future); Sierakowski v. Ryan, 223 F.3d 440, 445 (7th Cir. 2000) ( [P]ast wrongs, while not sufficient to confer standing for injunctive relief, may be evidence that future violations are likely to occur. ). For these reasons, the Court has jurisdiction to consider the merits of plaintiffs claims. B. Plaintiffs disclosure claim The VPPA provides a cause of action against any video tape service provider (defined to include providers of prerecorded videos) who knowingly discloses, to any person, personally identifiable information concerning any consumer . . . . 18 U.S.C. § 2710(b)(1). Subsection 2710(b)(2), however, lists disclosures that the VPPA expressly permits, including any disclosure made incident to the ordinary course of business of the video tape service provider . . . . Id. § 2710(b)(2)(E). The VPPA defines ordinary course of business as only debt collection activities, order fulfillment, request processing, and the transfer of ownership . . . . Id. § 2710(a)(2). Redbox contends that Stream, a third-party vendor that Redbox retained to 7 respond to customer service requests, performs request processing services for Redbox and that the company s disclosure of information to Stream is therefore permitted under the VPPA. The Court agrees. It is undisputed that the only functions Stream performs for Redbox are customer support services and that Stream performs these services only in response to customers requests for information. It is difficult to imagine a more obvious illustration of request processing given the ordinary meaning of that term.1 Plaintiffs argue that the Senate Committee report on the VPPA demonstrates that request processing does not encompass customer service. The Senate Committee report states, in relevant part, that subsection 2710(a)(2) allows disclosure to permit video tape service providers to use mailing houses, warehouses, computer services, and similar companies for marketing to their customers. These practices are called order fulfillment and request processing. S. Rep. No. 100-599, at 9 (1988), reprinted in 1988 U.S.C.C.A.N. 4342-1, 4342-8. When interpreting a statute, a court always starts with the statute s express language and assume[s] that the legislative purpose is expressed by the ordinary meaning of the words used. United States v. Lock, 466 F.3d 594, 598 (7th Cir. 2006) (citing Am. Tobacco Co. v. Patterson, 456 U.S. 63, 68 (1982)); see also United States v. Balint, 201 F.3d 928, 932 (7th Cir. 2000). Courts look beyond the express language of a statute only where such language is ambiguous, or where a literal interpretation would lead to absurd results or thwart the goals of the statutory scheme. Merrill Lynch, Pierce, Fenner & Smith, Inc. v. Lauer, 49 F.3d 323, 326 27 (7th Cir. 1995); see also 1 There is no evidence that Stream has ever affirmatively reached out to any Redbox customer or provided any services for Redbox other than customer support. 8 Exxon Mobil Corp. v. Allapattah Servs., Inc., 545 U.S. 546, 568 (2005) ( Extrinsic materials have a role in statutory interpretation only to the extent they shed a reliable light on the enacting Legislature s understanding of otherwise ambiguous terms. ) As the Supreme Court noted in Exxon Mobil, reliance on legislative history can be especially problematic, because it is often murky, ambiguous, and contradictory and may give unrepresentative committee members . . . both the power and incentive to attempt strategic manipulations of legislative history to secure results they were unable to achieve through the statutory text. Exxon Mobil, 545 U.S. at 568. Plaintiffs concede that the lay meaning of subsection 2710(a)(2) would encompass disclosure of PII for customer services purposes. They argue, however, that the Senate Committee report displaces that otherwise clear meaning and defines both order fulfillment and request processing under subsection 2710(a)(2) as limited to marketing. Pls. Resp. to Def. s Mot. for Summ. J. at 7. This argument is unpersuasive. Congress specifically listed four separate categories that it considered to constitute the ordinary course of business of a video provider. Plaintiffs interpretation would essentially rewrite the statute and reduce the permissible categories to three: (1) debt collection, (2) ownership transfer, and (3) marketing. The Court finds no basis to effectively redraft the VPPA based on ambiguous language from a Senate committee report. If Congress had intended ordinary course of business to encompass only debt collection, ownership transfer, and marketing, it easily could have written the statutory definition that way. It did not do so, however. It would be inappropriate for the Court to reinterpret the statutory language it in a way that narrows the permissible purposes that Congress established 9 when it adopted the statute. See United States v. Berkos, 543 F.3d 392, 396 (7th Cir. 2008) ( We avoid interpreting a statute in a way that renders a word or phrase redundant or meaningless. ). The Court also notes that its reading of the statutory language is compatible with the Senate report s recognition that subsection 2710(b)(2)(E) takes into account that video tape service providers may use third parties in their business operations. S. Rep. No. 100-599, at 9. Redbox s disclosures to Stream are only for purposes of an internal service that Stream provides as a third-party vendor for Redbox namely, customer support services. The only disclosure made outside of this agency relationship is the one Stream makes to the customer himself, after the customer requests the information and only after verifying the customer s identity. Plaintiffs argue in the alternative that even if Redbox uses Stream in the ordinary course of its business, the VPPA does not allow Redbox to give Stream access to its entire database. Instead, plaintiffs contend that the VPPA allows Redbox to disclose a customer s PII only in response to a particular service request, and then only the limited PII that corresponds to the specific request. Plaintiffs point to alternative methods used by other companies that disclose PII to third-party vendors more narrowly than Redbox does vis-Ã -vis Stream. The fact that a video provider might be able to use an alternative method involving less disclosure to a third party hired for customer support services is beside the point. The VPPA does not impose a narrowest possible disclosure standard. More to the point, subsection 2710(b)(2)(E), by its terms, does not restrict disclosure in the manner that plaintiffs propose. Rather, it expressly permits Redbox to disclose PII 10 concerning any consumer if that disclosure is incident to the ordinary course of [its] business . . . . 18 U.S.C. § 2710(b)(2)(E) (emphasis added). Thus the VPPA focuses on the purpose of the disclosure to determine whether it is proper. As the Court has concluded, Redbox s disclosure of customer information to Stream for customer support services qualifies as disclosure for the purpose of request processing within the meaning of subsection 2710(a)(2) and is therefore incident to the ordinary course of Redbox s business. Stream s apparent ability to access Redbox s customer database in training employees similarly does not render Redbox s disclosure inappropriate under the VPPA. Redbox discloses its database to Stream incident to the ordinary course of Redbox s business namely, for request processing. The fact that Stream makes use of that database to train its employees to conduct that selfsame request processing does not alter the purpose for Redbox s disclosure of its customers PII. In sum, the Court concludes that plaintiffs cannot prevail in their claim against Redbox for unlawful disclosure under the VPPA. Because plaintiffs breach of contract claim against Redbox relies on violations of the VPPA, that claim also fails. See Sterk, 2012 WL 3006674, at *5 (plaintiffs breach of contract claim incorporates VPPA unlawful disclosure allegation). C. Plaintiffs disclosure claim Plaintiffs next claim that Redbox has unlawfully retained their PII in violation of subsection 2710(e). The Seventh Circuit previously determined that damages are not available to plaintiffs for any claim based on unlawful retention. Sterk, 672 F.3d at 539. Subsection 2710(e) requires a video tape service provider to destroy [PII] as 11 soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected and there are no pending requests or orders for access to such information under subsection (b)(2) or (c)(2) or pursuant to a court order. 18 U.S.C. § 2710(e). The Senate Committee report says that the phrase the purpose for which it was collected must be narrowly construed and may include only activities that are for the exclusive use of marketing goods and services to the customer. S. Rep. No. 100-599, at 10. The report further states that continued retention may not include activities that violate the intent of the statute, which is to protect [PII] from disclosure. Id. It is undisputed that one of the purposes for which Redbox collects and retains customers PII is to do targeted marketing of DVDs to them based upon their past rental history. Redbox sends e-mails to persons who previously rented DVDs from Redbox kiosks, suggesting other DVD titles based on the customer s prior rental history. Redbox contends that retaining plaintiffs and other past customers PII including their e-mail addresses and rental history is necessary to continue its targeted marketing campaign. Even now, Redbox continues to make use of plaintiffs PII for that purpose. For example, on February 11, 2012, Redbox sent Chung an e-mail recommending a particular DVD title based on her history of past Redbox DVD rentals. Redbox collected plaintiffs PII as part of its ongoing marketing campaign, and the evidence establishes beyond question that Redbox continues to retain the PII for that same purpose. That is sufficient to permit Redbox to retain the information under subsection 2710(e). Even if the Court construed that subsection as narrowly as the Senate report suggests allowing continued retention only for the exclusive use of 12 marketing goods and services to the consumer Redbox s continued retention of the PII nonetheless would be necessary within the meaning of subsection 2710(e). Id. The Court acknowledges that this application of the VPPA s destruction / retention provision effectively permits indefinite retention of information by a video vendor like Redbox, which does not require customers to pay any monthly or annual subscription fees to remain eligible to rent its videos. Because of the way it has structured its business model, Redbox has no way of knowing whether a given customer has decided to stop renting its products. Thus Redbox effectively considers any prior video renter to be a customer in perpetuity. This, in turn, permits Redbox to retain the customer s information for an indefinite period to continue to market videos to the customer. That may not have been what Congress believed would happen when it adopted the VPPA back in 1988, given then-existing business models and technology, but that is nonetheless the way Congress wrote the statute. If Congress wishes to limit the length of time that pay-as-you-go video providers like Redbox may retain customers PII, it is, of course, free to amend the statute. In sum, the evidence establishes that Redbox continues to retain plaintiffs PII for the purpose of marketing its products to them, the same purpose for which Redbox collected the information in the first place. No reasonable finder of fact could deny that retention of that information continues to be necessary for the purpose for which it was collected within the meaning of subsection 2710(e). For this reason, Redbox is entitled to summary judgment on plaintiffs unlawful retention claim. Conclusion For the reasons stated above, the Court grants Redbox s motion for summary 13 judgment [docket no. 164] and directs the Clerk to enter judgment in favor of the defendant. MATTHEW F. KENNELLY United States District Judge Date: August 16, 2013 14
]]>
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You
should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
