The US Supreme Court recently clarified that when a plaintiff alleges a procedural violation of a statutory right, courts must determine whether that alleged violation entails a degree of risk sufficient to meet Article III's concreteness requirements (Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016)). Bare procedural statutory violations without concrete harm would not satisfy Article III's injury-in-fact requirement (see Legal Update, Supreme Court Reverses Ninth Circuit for Incomplete Standing Analysis).

Addressing the Supreme Court's recent decision, the Third Circuit noted that intangible harms may still give rise to standing even if they are difficult to measure. Analyzing the standing elements in light of Spokeo, the Third Circuit found the plaintiff's alleged injury was:

The court also specifically held that Spokeo did not alter its previous standing analysis for similar statutory-based privacy related class action claims in In re Google Inc. Cookie Placement Consumer Privacy Litigation (806 F.3d 125 (3d Cir. 2015)). For more information on In re Google Inc., see Legal Updates, Standing for Consumers in Google Cookie Litigation: Third Circuit.

The VPPA prohibits providers of video tapes or other similar audio visual materials from knowingly disclosing information that identifies a person as having requested or obtained specific video materials or services to third parties.

Focusing first on Google, the court held that VPPA liability only attached to video providers disclosing information, not to the recipients of that information. Because the complaint did not allege any prohibited disclosures by Google, the court affirmed the claim's dismissal.

The court then turned to the VPPA's personally identifiable information (PII) definition, which it found to be ambiguous. Recognizing that contrasting positions taken by other courts reflect a fundamental disagreement over what kinds of information are sufficiently "personally identifying" for their disclosure to trigger liability, the court determined that the statute's legislative history required a narrow understanding of PII. While holding that PII includes more than just a person's name, it also determined that courts should closely tie the definition to information readily permitting an ordinary person to identify a specific individual's video watching behavior.

To account for these nuances, the court adopted a sliding scale analysis as a framework for deciding the question, rather than a set definition. Starting on one end with the classic example of a clerk disclosing a person's name and rented video, every step away makes a successful claim harder, until the identity linkage becomes too uncertain or dependent on detective work to trigger statute liability. Data elements on the spectrum might range, from:

Following this sliding scale analysis, the court held that IP addresses, digital cookie codes, or browser fingerprints would not allow average people to specifically identify an individual. It also rejected the allegation that Google could assemble otherwise anonymous pieces of data provided by Viacom to unmask the identity of individual children as too hypothetical to support liability under the VPPA.

This decision seemly conflicts with the US Court of Appeals for the First Circuit's recent decision in Yershov v. Gannett Satellite Information Network, Inc., finding the legislative history supported a broader PII definition that could include data elements such as mobile device ID and GPS coordinates (820 F.3d 482 (1st Cir. 2016). For more information on Yershov v. Gannett Satellite Information Network, Inc., see Legal Update, Free Mobile App Users Are Subscribers Under the VPPA: First Cir.. The Third Circuit, however, simply distinguished the cases based on their facts, indicating that the addition of GPS data, which individuals can easily convert into exact location information, just moved the sliding scale closer to the PII side.

The Plaintiff's other claims (Federal Wiretap, Stored Communications Act, New Jersey Computer Related Offenses Act, which New Jersey courts have interpreted in line with the federal Computer Fraud and Abuse Act, and California Invasion of Privacy Act) failed on the merits for the same reasons previously described in the Third Circuit's earlier In re Google Inc. Cookie Placement Consumer Privacy Litigation decision.

The court, however, reinstated the Plaintiff's New Jersey tort claims and remanded the case back to the district court for further proceedings, holding that: