Data Privacy Monitor - Commentary on Data Privacy, Security and Social Media Subjects

During 2012, privacy class actions continued to trend toward two major categories: 1) actions that arose out of a data breach event and 2) actions brought to prosecute an alleged consumer privacy right. 

Article III Standing in Data Breach Class Actions

A key issue in data breach class actions is the question of what types of injuries are necessary to confer standing to sue.  In general, many of the federal district courts that have dismissed data breach class actions due to a failure to allege or prove injury have done on Article III standing grounds.  As a general proposition, it remains true that plaintiffs have not been able to establish standing where the conduct and harm alleged was simply use or disclosure of personal information, and where the complaint only alleged hypothetical or future injury. However, there are signs that courts may be more willing to consider what were once considered speculative injuries as sufficient to confer Article III standing.

In Resnick v. Avmed, Inc., the 11th Circuit reversed the dismissal of all but two claims in a class action that arose from a data breach.  In Resnick, two unencrypted Avmed laptops containing personal health information (“PHI”) and personally identifiable information (“PII”) for approximately 1.2 million Avmed customers were stolen, and the plaintiffs alleged that they were the victims of identity fraud approximately 10 to 14 months after the theft.  The Southern District of Florida dismissed plaintiffs’ claims, in part because the complaint failed to allege cognizable injury. 

The Eleventh Circuit reversed on all but two counts.  The court held that the plaintiffs properly alleged an injury in fact that was fairly traceable to the Avmed theft by alleging that they were careful with their own PII, that they were the victims of identity theft, and that their identities were stolen only after the Avmed incident. And, because Plaintiffs alleged they suffered monetary damages, the court held that their alleged injuries were cognizable and redressable.   Based on similar reasoning, the court also found that under the Twombly standard of federal pleading, the plaintiffs had properly alleged causation for purposes of their common law claims.  The court further found that the plaintiffs stated an unjust enrichment claim because they paid Avmed premiums, part of which allegedly went to Avemd’s data security expenses.

Likewise, in In re: Sony Gaming Networks and Customer Data Security Breach Litigation, the court found that the plaintiffs had alleged sufficient injury to establish Article III standing.  Citing to Krottner v. Starbucks, which held that future injury could be cognizable if it were “real and immediate” rather than “conjectural” or “hypothetical,” the court found that under the circumstances, by “alleg[ing] that their sensitive Personal Information was wrongfully disseminated, thereby increasing the risk of future harm,” the plaintiffs had stated “a cognizable loss sufficient to satisfy Article III’s injury-in-fact requirement.”  The court largely dismissed the plaintiffs’ claims for failure to state a claim, however, because those alleged injuries, while sufficient for standing purposes, were not sufficient for purposes of stating a claim under the law. 

One key difference between Avmed and Sony is the inability of the plaintiffs in the Sony case to allege any identity theft or out-of-pocket expenses resulting from the breach.  Thus, the probability of a dismissal for lack of injury or standing in a data breach class action appears to be higher where there is no evidence of identity theft or other use of any compromised information. 

Claims for Statutory Damages

Plaintiffs have had some success in avoiding the standing or lack of injury defense by bringing claims for statutory damages.  With respect to state claims, over the last several years, plaintiffs have frequently brought claims under state consumer protection statutes and state data breach statutes. 

The second key category of privacy cases are those brought under a federal or state consumer privacy statute.  Federal consumer privacy statutes include the Fair Credit Reporting Act as amended by the Fair and Accurate Credit Transactions Act (FCRA/FACTA) (15 U.S.C.A. § 1681 et seq.); the Telephone Consumer Protection Act (TCPA) (47 U.S.C.A. § 227); the Driver’s Privacy Protection Act (DPPA) (18 U.S.C.A. §§ 2721–25); the Electronic Communications Privacy Act (ECPA) (18 U.S.C.A. §§ 2510–22); and the Video Privacy Protection Act (VPPA) (18 U.S.C.A. § 2710).

Several high profile cases were litigated or settled this year under the VPPA, which provides for damages of $2,500.00 per violation for improper retention or disclosure of a consumer’s video viewing history, including cases against Netflix, Blockbuster, Redbox, and Hulu.  Perhaps the most significant development in the law as it relates to the VPPA this year was the ruling in In re Hulu Privacy Litigation that rejected Hulu’s argument that the VPPA does not apply to online video providers. 

Also trending this year were claims under the TCPA, which provides for statutory damages of $500 or $1,500 per violation (for willful violations), alleging liability premised on unsolicited text messages.  A significant decision this year in the TCPA area was handed down by the U.S. Supreme Court in Mims v. Arrow Financial Services, LLC, in which the Court held that TCPA claims arise under federal law and may be asserted in federal court even absent diversity of citizenship jurisdiction.  Prior to Mims, the federal circuits disagreed over whether the TCPA provided for federal question jurisdiction or whether jurisdiction was limited to state courts and federal suits brought or removed on diversity jurisdiction.

As in the data breach cases, a common question that arises in statutory damages cases is whether the named plaintiff must prove some sort of injury to herself and/or members of the putative class in order to recover statutory damages.  In some situations, courts have held that no proof of injury is required at all for the recovery of statutory damages; however, in some cases, such as this year’s decision in Sterk v. Best Buy Stores, L.P., defendants have been successful in arguing for dismissal on the grounds that the plaintiff had alleged no plausible actual injury.  

The problem for all parties in these cases seeking statutory damages is that the damages, when aggregated over hundreds, thousands, or even millions of consumers, can become crippling to the defendant.  Accordingly, constitutionally excessive damages is a defense that defendants frequently raise in these cases, though no reported decision appears to have decided the viability of the defense. 

Class Certification and Settlement

To date, class certification battles have been rare in cases arising out of data breach, which is likely explained by the fact that so many defendants have been successful disposing of cases prior to certification. With respect to consumer privacy cases, particularly those that arise out of a defendant’s privacy policies, the statutory privacy claims are often litigated on the merits, with little argument around the issue of whether a class can be properly certified, though that certainly is not always the case.  For example, in Local Baking Products, Inc. v. Kosher Bagel Munch, Inc., the New Jersey appellate court decided this year, after reviewing cases on both sides of the issue, that TCPA claims were not suitable for class certification because class treatment is not a superior method for handling claims because the statutory damages regime incentivizes individual actions. Further, the court found, common issues did not predominate because of individualized issues over whether calls and faxes were authorized by the consumer.

Frequently, privacy class actions are certified for settlement purposes, and given the immense exposure under statutory damages provisions, settlement at even close to the maximum aggregate value of the claims is a practical impossibility, which creates challenges for both the parties and the courts.  Cases are commonly settled for coupons or services, injunctive relief or compliance monitoring (i.e., changes in privacy policies), cy pres awards, or monetary relief to class members in the cases where statutory damages are sought.  And while most privacy class action settlements have been approved, in some cases, the courts have been skeptical. 

For instance, the district court in Fraley v. Facebook declined to grant preliminary approval to a proposed settlement in November.  In Fraley, the plaintiffs charged that Facebook violated its own privacy policies as it related to the use of Facebook subscribers’ information in connection with the “sponsored stories” advertising service.  The proposed settlement called for a $20 million settlement fund, half of which was earmarked for class counsel, and the other half of which would be distributed as cy pres awards.  Judge Richard Seeborg specifically questioned the adequacy of compensation to the class in light of the $750 per violation that would be recoverable under the statute at issue.  Judge Seeborg ultimately granted preliminary approval, however, of a revised settlement that allowed for payments of up to $10 per class member.

The Sixth Circuit Court of Appeals has upheld the dismissal of a purported class action lawsuit brought under the federal Driver's Privacy Protection Act, 18 U.S.C. § 2127, et. seq. (“DPPA”). 

Plaintiffs’ claims in Wiles v. Ascom  Transport System, Inc., Case No. 11-5342, were based on the bulk obtainment of personal information from Kentucky motor vehicle records.  Named plaintiffs, all residents of Kentucky, brought the proposed class action suit against defendant Ascom, and others, claiming that the DPPA and their common law right to privacy were violated by Ascom’s purchase, use, and reselling of personal information contained in their motor vehicle records without a permissible purpose under the act.

In December 2010, the U.S. District Court for the Western District of Kentucky ruled that the bulk purchase of motor vehicle records without a "specific need for every record" does not violate the DPPA, a ruling which ultimately resulted in the dismissal of the action in its entirety in February 2010 on motion of Ascom.   Plaintiffs appealed to the Sixth Circuit. 

On April 30, 2012, in an opinion written by Lawrence P. Zatkoff, a U.S. district judge sitting by designation, the Sixth Circuit affirmed the lower court’s ruling.  Plaintiffs’ claim relied on the premise that Ascom did not have a permissible purpose or use in mind for each and every individual record at the time that it purchased the motor vehicle records in bulk.  The court thus framed the issue as whether or not the “bulk obtainment of such records for the purpose of ‘stockpiling’ such records violates the DPPA.”  The court held that it did not.

Citing to cases from the Fifth, Seventh, and Eight Circuits, as well as its own recent opinion in Roth v. Guzman, 650 F.3d 603, the court noted that the plaintiffs did not cite to any authority that would support the conclusion the DPPA limits disclosure of personal information to one individual at a time or requires immediate use of the information.  Rather, the court found, “the legislative history (of the DPPA) clearly establishes that Congress did not intend to alter the traditional method of bulk disclosures by states, subject to the express limitations set forth in the DPPA."  Moreover, the court held that obtaining personal information solely for the purpose of reselling it is permitted by the DPPA if the information will be used by the buyer only for permitted purposes. 

As to the common law privacy claim, the court held that it failed as a matter of law because plaintiffs had no reasonable expectation of privacy in the personal information contained in the records, nor did they allege that Ascom disclosed, or caused to be disclosed, their personal information to the public.

The opinion may be read here. 

There were no bombshells or truly groundbreaking decisions in 2011.  Courts continued to dismiss claims filed in the wake of data breaches based on findings that the plaintiffs had failed to identify any cognizable harm sufficient to achieve Article III standing or to demonstrate actual damages.  A few decisions, however, show an evolution in the theories of harm alleged by plaintiffs that are getting plaintiffs closer to advancing past the initial pleading stage.  Plaintiffs also continued to rely on statutory claims to obtain standing and recover statutory damages, both in cases involving data breaches and social media.

Data Breach Litigation

Two of the most notable decisions related to the evolving theories of standing and harm were in the Claridge v. RockYou and Anderson v. Hannaford Brothers cases. 

• RockYou, a social network application maker, faced a class action after disclosing a breach the exposed the log-in credentials (e-mail address and password) of 32 million users.  The plaintiff, to demonstrate standing and harm, alleged that RockYou users “pay” for RockYou’s product by giving their personal information with the promise that RockYou would use commercially reasonable efforts to secure their information.  In overruling RockYou’s motion to dismiss, the court determined that the plaintiff had established standing and alleged harm based on the allegation that the breach of the personal information caused the plaintiff to lose some ascertainable but unidentified value and/or property right in the personal information.  Plaintiffs in other lawsuits that followed, including breaches of online gaming providers, immediately latched onto the recognition of a potential property right in personal information.  Despite surviving RockYou’s motion to dismiss with his breach of contract and negligence claims intact, the plaintiff ultimately agreed to a very modest proposed settlement.  
• The Hannaford Brothers supermarket chain faced class action lawsuits after a 2008 disclosure that hackers had stolen more than 4 million credit and debit card numbers.  Consistent with the outcome in similar prior cases, U.S. District Court for the District of Maine Judge Hornby dismissed the claims of all parties (except those who had not been reimbursed for actual fraudulent charges) upon finding that a merchant is not liable for collateral consequences of a data breach, such as a customer’s fear of future fraudulent transactions might happen in the future or even the customer’s expenditure of time and effort to protect.  On appeal, the First Circuit reversed the district court’s decision based on the conclusion that reasonable out-of-pocket expenses necessary to mitigate future harm, such as replacement card costs and identity theft insurance, are indeed recoverable.  The First Circuit distinguished Hannaford from other cases where circuit courts found an increased risk of identity theft was not sufficient to show an “injury-in-fact” (Picsciotta v. Old Nat’l Bancorp, Resnick v. AvMed, Reilly v. Ceridian) by concluding that the hacker’s specific targeting of payment card data and the resulting fraudulent charges that occurred made it reasonable for plaintiffs to take steps to protect against such misuse. 

Statutory Claims

At the federal level, plaintiffs have established standing in privacy and data breach cases by alleging violations of federal statutes.  For example, in lawsuits against Zynga and Facebook, courts determined that alleging violations of the Wiretap Act was sufficient meet confer Article III standing.  The federal statutes that often appear in class action lawsuits following data breaches or other privacy issues, which provide for the recovery of statutory damages and attorney’s fees, include the Electronic Communications Privacy Act, Stored Communications Act, Video Privacy Protection Act, and the Driver’s Privacy Protection Act. 

At the state level, California continued to be a hotbed for statute-based privacy litigation.  And one law in particular—the Song-Beverly Credit Card Act of 1971—wreaked havoc on retailers with California operations.  The Song-Beverly Act prohibits retailers from requesting and recording "personal identification information" as a condition of a credit card transaction.  Through 2010, California appellate courts consistently ruled that a ZIP code did not fall under the statutory definition of “personal identification information.”  However, in February 2011, the California Supreme Court issued a decision in Pineda v. Williams-Sonoma finding that a ZIP code constitutes “personal identification information.”  Accordingly, unless a statutory exception applies, a retailer that requests or requires that a customer provide a zip code as a condition of accepting a credit card transaction violates the Song-Beverly Act and is subject to a civil penalty of up to $250 for the first violation and up to $1,000 for each subsequent violation.  The plaintiff’s bar reacted quickly to the Pineda decision—over 100 class-action complaints have been filed.

For breaches involving patient personal information, California health care providers like HealthNet and Stanford are facing class actions based on California’s Confidential Medical Information Act (CMIA).  The CMIA provides for statutory damages of $1,000 per violation, which could result in billion dollar judgments for large-scale breaches if the plaintiffs are not required to demonstrate proof of actual harm to recover statutory damages.   

However, alleging a statutory violation may not be enough to overcome the absence of actual harm problem that often exists in data breach and privacy cases.  Rather, as the Northern District of California recently held in the Cohen v. Facebook case premised on an alleged violation of a California publicity law, courts have held that plaintiffs must still establish a cognizable injury even when minimum statutory damages are available.

Cases to Watch in 2012

• Statutory Damages. First American Financial Corporation v. Denise P. Edwards, United States Supreme Court.  The issue is whether a plaintiff has statutory and Article III standing to recover statutory damages for a violation of the Real Estate Settlement Procedures Act of 1974 (RESPA) in the absence of any financial injury. 
• Actual Harm.  FAA v. Cooper, United States Supreme Court.  A pilot sued the Privacy Act and is seeking seeking emotional distress damages after the Social Security Administration disclosed to the FAA that the pilot was HIV positive.  A Supreme Court decision finding emotional distress damages to be recoverable could impact the harm analysis in data breach litigation. 
• Offshore Data.  Stein v. Bank of America Corp., No. 1:11-cv—1400 (D.D.C.).  Stein filed a class action alleging that Bank of America violated the Right to Financial Privacy Act (RFPA) by transferring customer data to its subsidiaries in India, Costa Rica, Mexico, and the Philippines.  The RFPA prohibits financial institutions from providing the government access to customer records.  The plaintiff alleges that, because the Fourth Amendment does not apply extraterritorially, the government can conduct electronic surveillance abroad and gain access to customer financial records. 
• Song-Beverly.  Although collecting ZIP codes may violate the law, there are unresolved issues related to whether the Pineda decision applies retroactively, the application to online transactions, and class certification.  Moreover, similar laws in up to 15 other states may generate similar litigation.  Several such lawsuits have been filed in New Jersey.