Sharing Consumer Information Within Redbox's Own Regulated System Not Violation of VRPA: E.D. Mich. | Practical Law

Sharing Consumer Information Within Redbox's Own Regulated System Not Violation of VRPA: E.D. Mich. | Practical Law

In Cain v. Redbox Automated Retail, LLC, the US District Court for the Eastern District of Michigan granted summary judgment in favor of Redbox Automated Retail, LLC, holding that the plaintiff class consented to the disclosure of the video rental information at issue and that Redbox's disclosure of information within its own regulated system was not a violation of Michigan's Video Rental Privacy Act (VRPA).

Sharing Consumer Information Within Redbox's Own Regulated System Not Violation of VRPA: E.D. Mich.

by Practical Law Intellectual Property & Technology
Published on 05 Oct 2015 • USA (National/Federal)
In Cain v. Redbox Automated Retail, LLC, the US District Court for the Eastern District of Michigan granted summary judgment in favor of Redbox Automated Retail, LLC, holding that the plaintiff class consented to the disclosure of the video rental information at issue and that Redbox's disclosure of information within its own regulated system was not a violation of Michigan's Video Rental Privacy Act (VRPA).
On September 30, 2015, in Cain v. Redbox Automated Retail, LLC, the US District Court for the Eastern District of Michigan granted summary judgment in favor of Redbox Automated Retail, LLC, holding that:
  • The putative class action plaintiffs consented to the disclosure of their video rental transactions.
  • Redbox's disclosure of this information within its own regulated system was not a violation of Michigan's Video Rental Privacy Act (VRPA).
(No. 12-CV-15014, (E.D. Mich. Sept. 30, 2015).)
This case involved a class action brought against Redbox, a video rental company, for its alleged unlawful disclosure to third parties of certain personal information obtained from customers during Redbox's video rental process. Redbox operates self-service kiosks containing physical copies of DVD and Blu-ray discs in various commercial establishments, including grocery stores, drug stores and other retailers. Customers of Redbox can select movies by title from these kiosks and pay by swiping a credit card to receive a physical copy of the movie. During the transaction, customers may optionally enter an e-mail address to receive an electronic receipt and other notifications.
From June 2010 until about June 2011, Redbox's kiosks displayed a legend at the end of each video rental transaction requiring the consumer to click on a button marked "Check Out" before receiving a disc of the selected movie. The display then presented a notice that, by clicking on "Check Out," the consumer agrees to the terms of use accompanying the notice. No rental transaction could be completed without the customer affirmatively pressing the “Check Out” button and agreeing to be bound to by the terms of use.
From about June 2011 onward, Redbox modified this check-out practice for some kiosk locations. Each of these kiosks would display the legend, "By pressing 'pay' or 'use credits' you agree to the Terms.” Below the legend was a button labeled "Terms & Privacy" that allowed a customer to click into and review the Terms of Use and Privacy Policy before completing the transaction.
Redbox contracted with outside service vendors to aid it in performing various business functions. On November 11, 2012, the plaintiffs, who were customers of Redbox in Michigan between 2010 and 2013, brought this suit as a class action against Redbox claiming that:
  • Redbox disclosed their personal viewing information to four of its vendors.
  • These disclosures:
    • violated Michigan's VRPA, which limits sellers or renters of media from disclosing information relating to those sales or rentals;
    • breached the customers' movie rental contract with Redbox; and
    • resulted in Redbox's unjust enrichment.
Both parties filed motions for summary judgment. The plaintiffs argued, among other things, that even if they assented to the terms of use and the terms of use were binding against them, Redbox's terms of use did not include the language of the privacy policy that could allow it to make the challenged disclosures.
The court analyzed whether Redbox's disclosures were authorized by its terms of use and privacy policy, observing that:
  • The plaintiffs had clearly assented to the terms of use when making their rentals at Redbox kiosks by clicking on the check-out button, which was accompanied and succeeded by screen displays notifying the user of the terms expressed and incorporated in the parties' contract.
  • The plaintiffs had assented to Redbox's privacy policy because:
    • the terms of use explicitly stated that the user consents to any use of her information permitted under the Redbox privacy policy; and
    • although there was no clear language adopting or merging the privacy policy with the terms of use, the terms of use unambiguously stated that any activity consented to under the privacy policy was also consented to by accepting the terms of use.
  • Redbox's privacy policy states that it applies to the use and disclosure of customer information that includes (but is not limited to):
    • the customer's "Personal Information" as defined in the policy;
    • information collected through Redbox kiosks, websites, mobile applications and other Redbox platforms; and
    • the use of customer information to operate or improve the Redbox platform, to tailor its content, or for Redbox's internal business purposes.
This broad language negated the plaintiffs' argument that the disclosure of their video rental information was not permitted by the privacy policy because the policy only allowed disclosure of certain defined "Personal Information."
Notably, while Redbox's terms of use referred to its privacy policy four times, the court ruled that only the last of these references was worded in language sufficient to create a binding agreement. These references were:
  • On the first kiosk screen, "[p]lease also read the Redbox Privacy Policy below."
  • On the fifth kiosk screen, "[p]lease also review Redbox's privacy policy below.”
  • On the eighth kiosk screen, "[e]xcept as otherwise described in the Redbox Privacy Policy, any User Content will be treated as non-confidential and non-proprietary and we will not be liable for any use or disclosure of User Content."
  • On the sixteenth kiosk screen, in the "Indemnification" section, where customers agree to hold Redbox harmless from and against all claims arising from or relating to Redbox's "use of [customer] information as permitted under these Terms, the Privacy Policy, or any other written agreement."
Seizing upon this last provision, the court granted summary judgment in favor of Redbox, holding that:
  • All information disclosure by Redbox was within its own internal regulated system. Redbox therefore neither violated its privacy policy nor the VRPA, which is concerned primarily with external information sharing.
  • The plaintiffs' breach of contract and unjust enrichment claims must also fail, because they were contingent on the plaintiffs' fatally flawed VRPA claims.