As we’ve discussed before, standing is often a key issue in data-breach litigation.  Standing is also frequently at issue in another type of privacy case: litigation arising from violations of privacy rights created by statute.   

Privacy and consumer protection laws such as the Telephone Consumer Protection Act and the Fair Credit Reporting Act, which create private rights of action and provide for statutory damages, have been a fertile source of consumer class action litigation. The injuries in these cases often consist primarily—or solely—of the violation of rights created by the statute. Defendants frequently seek to dismiss these actions on standing grounds.  They argue that mere violation of a right created by statute does not by itself constitute an injury-in-fact under Article III.

In Spokeo v. Robins the Supreme Court provided some guidance for analyzing these standing challenges. This post examines Perry v. Cable News Network, a recent decision from the Eleventh Circuit that applied Spokeo. Perry involved a class action arising from an iPhone app’s alleged sharing of users’ video-watching history with a third party data analytics company without those users’ consent. The plaintiffs alleged this sharing violated the Video Privacy Protection Act (VPPA).

Statutory Violations and Standing Under Spokeo

In Spokeo, the Supreme Court considered whether the violation of a right created by statute (in that case, the Fair Credit Reporting Act) can, without more, be enough to establish Article III standing in federal court.  

The Supreme Court held that violation of a statutory right may constitute an injury-in-fact sufficient to establish Article III standing, but only if the plaintiff suffers “concrete” harm from that violation. The Supreme Court, however, did not explain precisely how a plaintiff might establish the requisite concreteness in a given case.

The Court did suggest that harm caused by the violation of a statutory right can be concrete—even without a showing of additional harm—where it “has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American Courts.” But a “bare procedural violation,” absent more, would not be sufficient.    

Since Spokeo, defendants in class actions founded on violations of statutorily-created privacy rights have frequently sought to dismiss for lack of standing, with mixed success. 

Streaming Didn’t Kill the Video Privacy Protection Act

In Perry, the statute in question was the VPPA. Subject to certain exceptions, the VPPA prohibits a “video tape service provider” from disclosing consumers’ personally identifiable video rental and sale records. The statute was famously enacted in 1988 in response to a newspaper’s publication of an article discussing Supreme Court nominee Judge Robert H. Bork’s rental history from a Washington, DC videotape rental store.

Although adopted in the VHS era, the statute has also been held to apply to modern-day video streaming services. In that context, the VPPA has been interpreted to prohibit disclosures that tie “specific people to the videos they watch.”

Watching You Watching Me

Perry centered on CNN’s iPhone app, which was available for free download from the iTunes store. The CNN app allowed users to watch recorded CNN video clips and the network’s coverage of live events. According to the complaint, CNN tracked and recorded app users’ viewing activity, and then, without their knowledge or consent, sent the collected records to a data analytics company called Bango. Those records included unique numeric identifiers that corresponded to users’ iPhones, but not the users’ names or other identifying information. Bango would then combine the records received from CNN with data collected from other sources to build a profile of users’ online behavior.

In a single count class action complaint, plaintiff Ryan Perry alleged that CNN’s disclosure of app users’ device identifiers and viewing activity to Bango without their consent violated the VPPA. He sought an injunction, as well as statutory and punitive damages for the violation of his “statutorily-defined right to privacy.”

In a pre-Spokeo decision, the trial court granted CNN’s motion to dismiss. It found after a brief discussion that Perry had standing to sue because he alleged a violation of the VPPA. But the court determined that Perry’s complaint did not state a claim under the VPPA, both because his allegations did not establish that he was a “consumer” under the statute and because the data disclosed by CNN to Bango did not constitute “personally identifiable information.”

Is the violation of a privacy interest in video-viewing history a concrete injury?

The Supreme Court decided Spokeo shortly after the trial court’s dismissal.  On appeal, CNN relied on Spokeo to argue that Perry lacked standing.

In its brief, CNN argued that Perry could not establish injury-in-fact under Spokeo because any violation of the VPPA, standing alone, did not give rise to a “concrete” harm. CNN reasoned that the disclosure of his video-viewing history to Bango did not cause personal embarrassment or damage to his employment prospects. Nor, contended CNN, did that disclosure otherwise resemble a harm that traditionally provided a basis for a lawsuit in English or American courts. 

The Eleventh Circuit disagreed. It explained that the “right of privacy” has been widely recognized by American courts to give individuals an interest in control over their personal information. It noted that the Supreme Court had previously recognized that an individual has an interest in preventing the disclosure of personal information. And it observed that the well-established tort of intrusion upon seclusion subjected defendants to liability for “the intrusion itself,” even without publication or other use of information gleaned through the intrusion.

The court thus concluded that a disclosure of personal information in violation of the VPPA is—even without a showing of additional harm—a concrete injury that can establish Article III standing.  

Although Perry won the standing battle, he ultimately lost the war. The Eleventh Circuit concluded that under an earlier decision in which it had interpreted the VPPA, Perry could not establish that his use of CNN’s free app made him a “consumer” protected by the statute. The court thus affirmed dismissal of Perry’s VPPA claim on that ground.

Lessons from Perry

Despite its affirmance of the dismissal of Perry’s claims, Perry can be viewed as a significant win for the plaintiffs’ bar on the standing front. That’s certainly true for VPPA cases in the Eleventh Circuit.

But the decision will also provide ammunition to plaintiffs seeking to ward off standing-based challenges in cases that allege violations of other privacy statutes. Provided they can credibly show that those statutes protect privacy interests that have been recognized by courts before, Perry’s reasoning would seem to insulate such claims against dismissal for lack of standing.

Author: Alex Pearce