Video Rental Company May Share Customers' Personally Identifiable Information with Contractor: Seventh Circuit | Practical Law

Video Rental Company May Share Customers' Personally Identifiable Information with Contractor: Seventh Circuit | Practical Law

In Sterk v. Redbox Automated Retail, LLC, the US Court of Appeals for the Seventh Circuit affirmed the US District Court for the Northern District of Illinois's summary judgment determination that a video rental company did not violate the Video Privacy Protection Act (VPPA) when it shared customers' personally identifiable information with a third party that operated its customer service call center.

Video Rental Company May Share Customers' Personally Identifiable Information with Contractor: Seventh Circuit

by Practical Law Intellectual Property & Technology
Published on 24 Oct 2014 • USA (National/Federal)
In Sterk v. Redbox Automated Retail, LLC, the US Court of Appeals for the Seventh Circuit affirmed the US District Court for the Northern District of Illinois's summary judgment determination that a video rental company did not violate the Video Privacy Protection Act (VPPA) when it shared customers' personally identifiable information with a third party that operated its customer service call center.
On October 23, 2014, in Sterk v. Redbox Automated Retail, LLC, the US Court of Appeals for the Seventh Circuit affirmed the US District Court for the Northern District of Illinois's judgment that a video rental company that outsourced its customer service to a third party and provided that company with its customers' personally identifiable information (PII) did not violate the Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710 (No. 13-3037, (7th Cir. Oct. 23, 2014)).
Redbox Automated Retail, LLC operated automated, self-service video rental kiosks but outsourced its customer-service operations to third-party service provider Stream Global Services. For Stream to be able to do its job, Redbox gave it access to Redbox's customer database, which included customer rental histories and credit card information.
Plaintiffs were Redbox customers who alleged that Redbox violated the VPPA by giving Stream access to their PII in the customer database. Redbox first moved to dismiss the complaint, arguing that plaintiffs lacked standing because they did not suffer an injury when Redbox disclosed their PII to Stream. The district court denied this portion of Redbox's motion.
Redbox later moved for summary judgment on plaintiffs' claims that its disclosure of their PII violated the VPPA. The district court granted Redbox's motion for summary judgment, holding that Redbox's disclosure to Stream was statutorily excepted from the VPPA. Plaintiffs appealed the district court's summary judgment award, and Redbox appealed the district court's standing decision.
On appeal, the Seventh Circuit affirmed the district court's:
  • Standing decision, explaining that even allegations of a "technical violation" of the VPPA satisfied plaintiffs' burden of demonstrating that they suffered an injury in fact.
  • Determination that Redbox's disclosure to Stream did not violate the VPPA, because it met a statutory exception.
The Seventh Circuit elaborated that even though the VPPA prohibits video tape service providers from disclosing consumers' PII, the statute excepts certain disclosures, including those incident to the video tape service provider's ordinary course of business, for example:
  • Debt collection activities.
  • Order fulfillment.
  • Request processing.
  • Transfer of ownership.
The Seventh Circuit determined that customer support services are an "obvious illustration" of request processing and therefore Redbox was not liable for any disclosure of this information. The Seventh Circuit explained that the permissibility of the disclosure under the VPPA depended on why Redbox disclosed the information. Because the disclosure was incident to Stream's request processing function, it fell within the statutory exception to the VPPA.