Redbox v. Sterk and Chung: Defining ‘Ordinary Course of Business’ Under the Video Privacy Protection Act
Introduction
In Redbox Automated Retail, LLC v. Sterk and Chung, 770 F.3d 618 (7th Cir. 2014), the United States Court of Appeals for the Seventh Circuit addressed critical questions surrounding the permissible disclosure of personally identifiable information (PII) under the Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710. The plaintiffs, Kevin Sterk and Jiah Chung, alleged that Redbox violated the VPPA by disclosing their video rental information to Stream Global Services (Stream), a third-party customer service provider. The key issue centered on whether such disclosures fell within the VPPA's exception for disclosures in the "ordinary course of business," specifically "request processing."
Summary of the Judgment
The district court granted summary judgment in favor of Redbox, concluding that the company’s disclosure of customer PII to Stream was incident to Redbox’s ordinary course of business, particularly under the exception for "request processing." The plaintiffs appealed, challenging both the summary judgment and the district court’s refusal to allow additional discovery. The Seventh Circuit affirmed the lower court’s decision, agreeing that Redbox's disclosures to Stream were permissible under the VPPA’s statutory exceptions.
Analysis
Precedents Cited
The court referenced several key precedents to support its interpretation of the VPPA:
- Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535 (7th Cir. 2012): Addressed the scope of the VPPA’s private right of action concerning improper retention of records.
- Graczyk v. West Publishing Co., 660 F.3d 275 (7th Cir. 2011): Similar to the current case, it dealt with the Driver’s Privacy Protection Act (DPPA) and upheld the permissibility of third-party disclosures in the context of record-keeping for legitimate business purposes.
- Exxon Mobil Corp. v. Allapattah Servs., Inc., 545 U.S. 546 (2005): Discussed the role of extrinsic materials in statutory interpretation, emphasizing their limited use in clarifying ambiguous statutory terms.
- ANDERSON v. LIBERTY LOBBY, INC., 477 U.S. 242 (1986): Established the standards for summary judgment under Federal Rule of Civil Procedure 56.
Legal Reasoning
The court's legal reasoning revolved around the interpretation of the VPPA’s exceptions to the prohibition against disclosing PII. The VPPA allows disclosures that are "incident to the ordinary course of business," which includes "request processing." The court analyzed whether Redbox’s disclosure to Stream for customer service purposes fit within this exception.
The plaintiffs contended that Redbox’s disclosure was proactive and not directly related to specific customer requests, thereby exceeding the intended scope of "request processing." However, the court rejected this argument, emphasizing that the underlying purpose of the disclosure—to facilitate customer service requests—aligned with the statutory exception. The court also noted that the VPPA was enacted before the advent of automated kiosks, implying that the legislation was intended to cover various forms of customer interactions, including those facilitated by third-party service providers.
Additionally, the court addressed the plaintiffs' standing, affirming that alleging a violation of the VPPA sufficiently demonstrated an injury in fact, even in the absence of demonstrable financial harm.
Impact
This judgment clarifies the boundaries of the VPPA's exceptions, particularly in the context of modern, automated service models. By affirming that disclosures to third-party service providers engaged in reasonable customer service functions fall within the "ordinary course of business," the court provides guidance for companies on how to manage customer data without violating privacy statutes.
The decision also underscores the importance of understanding statutory language and legislative intent, especially when adapting older laws to contemporary business practices.
Complex Concepts Simplified
- Video Privacy Protection Act (VPPA): A federal law enacted in 1988 to protect the privacy of individuals' video rental and purchase records, prohibiting the disclosure of such information without consent, except under specific exceptions.
- Personally Identifiable Information (PII): Information that can be used to identify an individual, such as rental history, addresses, or credit card details.
- Ordinary Course of Business: Activities that are regular and routine within a company's operations. Under the VPPA, certain disclosures of PII are permitted if they are necessary for standard business functions like order fulfillment or request processing.
- Request Processing: Handling and responding to customer inquiries or issues, which may require accessing customer PII to resolve problems effectively.
- Summary Judgment: A legal decision made by a court without a full trial, typically when there is no dispute over the key facts of the case, allowing the court to decide the case based solely on legal arguments.
Conclusion
The Seventh Circuit’s decision in Redbox v. Sterk and Chung reinforces the interpretation of the VPPA in favor of accommodating modern business practices without compromising customer privacy. By affirming that disclosures to third-party service providers like Stream for request processing are within the law, the court provides a clear framework for companies to manage customer data responsibly. This judgment not only resolves the specific dispute between Redbox and its customers but also sets a precedent that will guide future cases involving data privacy and third-party disclosures under the VPPA.