Gerald E. Rosen, Chief Judge, United States District Court.
Plaintiffs Michelle Cain and Radha Sampat brought a putative class action against Defendant Redbox, a video rental company, based on Defendant's alleged unlawful disclosure to third parties of certain personal information obtained during Defendant's rental process. Plaintiffs assert three causes of action: (1) a violation of Michigan's Video Rental Privacy Act ("VRPA"), M.C.L. § 445.1711 et seq.; (2) breach of contract; and (3) unjust enrichment. The parties have now each moved separately for summary judgment pursuant to Rule 56 of the Federal Rules of Civil Procedure. The parties have fully
Since 2002, Defendant
When a Redbox customer makes a rental, she is required to click through several screens in order to select the disc or discs that she wants to rent and provide for payment. See id.; see also Sterk v. Redbox Automated Retail, LLC, No. 11 C 1729, 2013 WL 4451223, at *1 (N.D.Ill. Aug. 16, 2013). After the customer has done this, she must "check out" before receiving her disc or discs. Wokosin Decl., ¶¶ 15-16. Depending on the date on which the disc was rented, the "check out" screen would provide the customer with a prompt, requiring her to click a box to finalize the transaction. Id. From June 2010 until roughly June 2011, the kiosk would display, "By clicking on `Check Out' you agree to the following terms and conditions." Id. ¶ 15; June 2010 Kiosk Screen Shot, Dkt. # 48-7. The "Terms of Use," described in more detail below, would then be displayed directly below that language. Id. No rental transaction could be completed without the customer affirmatively pressing the "Check Out" button and agreeing to be bound to the Terms of Use. Id. Beginning around June 2011, depending on the particular kiosk location, the "check out" process was slightly modified due to new software installed on the kiosks — each kiosk would display, "By pressing `pay' or `use credits' you agree to the Terms." Wokosin Decl., ¶¶ 16-17, June 2011 Kiosk Screen Shot, Dkt. # 48-8. Below that language was a button labeled "Terms & Privacy" that allowed a customer to go to the Terms of Use and Privacy Policy to review them before completing the transaction. Id. As discussed in more detail below, there were two different versions of the Terms of Use and Privacy Policy in place during the period in which the transactions at issue in this case took place: one effective from roughly June 2010 to June 2011, and one effective from roughly June 2011 to July 2013. Both sets of agreements, though containing different language, have the same import as relevant here.
Redbox also contracts with various vendors to aid it in various business functions, "such as providing customer call center services, generating rental receipts that are emailed to customers at their request, sending marketing information to Redbox consumers, and using anonymized customer rental information for internal purposes." Wokosin Decl. ¶ 32. In order to do this, Redbox shares with those vendors various bits of information associated with customer transactions. At issue here is information that Redbox shared with four vendors: ExactTarget, Experian Marketing Solutions ("Experian"), Adobe Insight ("Adobe"), and Stream Global Services ("Stream").
First, Redbox employs ExactTarget to "generate[] rental and transactional receipts... when a movie is rented from a kiosk." Id. ¶ 40. "Given the nature of the email transaction receipt, ExactTarget, by definition, has movie transactional information (because it is sending the transactional receipt for that movie), and it also receives the specific email address that the customer provided for that transaction. Redbox does not provide the name or any other information about that customer." Id. ¶ 42. More specifically, as Plaintiff alleges, ExactTarget receives each "customer's email address, video title rented (or returned), kiosk location, and last four digits of the customer's credit card ... in order to enable ExactTarget to send emails and ads to that customer." Pl.'s Resp. to Def.'s Mot. for Summ. J., Dkt. # 61, at 3; see also Sarah Hatch Decl., Dkt. # 53-2, ¶¶ 8, 10, 12, 14.
Second, Redbox employs Experian to provide "marketing email services," which includes promotional emails sent to customers regarding new Redbox releases, and to "track promotion code redemptions." Wokosin Decl. ¶¶ 36-37. According to Redbox, it does not share any personal rental history with Experian; instead it shares "limited customer information," including a customer's email address and name. Id. Plaintiffs contend, however, that in order to perform its marketing email functions, Experian is provided with each customer's "birthdate, email address, credit card zip code, date of first rental, preferred genre, date of most recent rental, location of the kiosk last rented from, total number of rentals last made, total number of lifetime rentals, and the dates of any interactions with customer service." Pl.'s Resp. to Def.'s Mot. for Summ. J., Dkt. # 61, at 4; see also Redbox-Experian Data Stream, Dkt. 55-15.
Third, Redbox employed Adobe to provide "analytics services" that "allow Redbox to query customer behavior." Wokosin Decl. ¶ 35. Redbox stopped using Adobe's services in November 2012. Id. Redbox asserts that "customer rental information sent to Adobe Insight [was] anonymized such that it is impossible to determine what movie any particular individual rented." Accordingly, Redbox asserts that it
Finally, Redbox employs Stream "to perform ... customer service related functions, including providing call center support for customers. Redbox began using Stream in February 2010 so that it could more effectively handle incoming requests from customers as Redbox grew in size." Id. ¶ 44. Stream provides Redbox with "customer service agents" who answer customer service calls on behalf of Redbox. Id. ¶ 45. According to Redbox, these agents "have the ability to access a customer's personal rental history from Redbox's servers upon the request of that customer in order to process and respond to that consumer's service related request or inquiry. Stream does not possess a copy of Redbox's customer dataset, but instead only has access to it through credentials that Redbox administers and controls." Id. ¶ 46. As Plaintiffs characterize this, however, Redbox provides Stream "searchable access to ... customer data — including name, email, last four digits of credit card, state, zip code, and movie rented — which pulls up a list of customers matching that criteria and their rental histories." Pl.'s Resp. to Def.'s Mot. for Summ. J., Dkt # 61, at 5-6. Plaintiffs also provide some indication that Stream employees use Redbox customer information for training purposes, though it is not clear that any such training uses non-anonymous data. Id. at 6.
Plaintiffs here are both citizens of Michigan who have used the services of Redbox in the past, with Plaintiff Sampat renting a total of 31 times from November 2010 to January 2013, and Plaintiff Cain renting over 100 times from July 2010 to July 2013. Id. ¶¶ 9-10.
Pl.'s Compl., Dkt. # 1-1, ¶ 43. Plaintiffs claim that Redbox's conduct in disclosing
Prior to the filing of the instant motions, Defendant filed a Motion to Dismiss, asserting that Plaintiffs lacked standing to bring the suit under the VRPA because they failed to plead any damages; that the vendors that Defendant dealt with are Defendant's agents and that disclosure to them was not a violation of the VRPA; that all disclosures occurred in the "ordinary course of business," which Defendant asserted was excepted under the VRPA; that Plaintiffs consented to disclosure of their personal information; and that Plaintiffs' claims were barred by a one-year limitation period. See Def.'s Mot. to Dismiss, Dkt. # 10. The Court rejected Defendant's standing argument, and held that the remaining arguments required factual development and were best left for a Rule 56 motion. See Opinion and Order Denying Def.'s Mot. to Dismiss, Dkt. # 27.
The parties have now filed cross motions for summary judgment. Defendant re-raises all of the claims that it raised in its Motion to Dismiss, now armed with a factual record. See Def.'s Mot. for Summ. J., Dkt. # 46. Plaintiffs reject each of those arguments in their own Motion for Partial Summary Judgment, and assert that the Court should rule in their favor on the issue of liability.
Through their present motions, both parties seek summary judgment in their favor pursuant to Rule 56 of the Federal Rules of Civil Procedure. Under Rule 56, summary judgment is proper if the moving party "shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed. R. Civ. P. 56(a). As the Supreme Court has explained, "the plain language of Rule 56[] mandates the entry of summary judgment, after adequate time for discovery and upon motion, against a party who fails to make a showing sufficient to establish the existence of an element essential to that party's case, and on which that party will bear the burden of proof at trial." Celotex Corp. v. Catrett, 477 U.S. 317, 322, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986). In addition, where a moving party seeks an award of summary judgment in its favor on a claim or issue as to which it bears the burden of proof at trial, that party's "showing must be sufficient for the court to hold that no reasonable trier of fact could find other than for the moving party." Calderone v. United States, 799 F.2d 254, 259 (6th Cir.1986) (emphasis and citation omitted).
In deciding a motion brought under Rule 56, the Court must view the evidence in a light most favorable to the nonmoving party. Pack v. Damon Corp., 434 F.3d 810, 813 (6th Cir.2006). Yet, the nonmoving party may not rely on mere allegations or denials, but must "cit[e] to particular parts of materials in the record" as establishing that one or more material facts are "genuinely disputed." Fed. R. Civ. P. 56(c)(1). Further, "the mere existence of a scintilla of evidence that supports the nonmoving party's claims is insufficient to defeat summary judgment." Pack, 434 F.3d at 814 (alteration, internal quotation marks, and citation omitted).
This case involves relatively straightforward allegations of violations of the VRPA,
M.C.L. § 445.1712. The third section then provides various exceptions to section 2, including that "a record or information described in section 2 may be disclosed... [w]ith the written permission of the customer." M.C.L. § 445.1713. Last, section 4 classifies any violation as a criminal misdemeanor, and section 5 provides for a civil cause of action for violation of the statute, allowing for "[a]ctual damages, including damages for emotional distress, or $5,000.00, whichever is greater," as well as litigation and attorney fees. M.C.L. §§ 445.1714-1715.
In their Motions, the parties raise five distinct issues regarding Defendant's alleged violations. First, Defendant contends that no disclosure of the kind prohibited by the VRPA took place to any vendor except Stream; Plaintiff disagrees, asserting that disclosures made to ExactTarget, Experian, and Adobe also qualify as violations under the VRPA. Second, Defendant contends that Plaintiffs, and by extension all Redbox customers, consented to any disclosure through of the Terms of Use that customers must agree to before renting a movie. Third, Defendant contends that disclosures were made in the "ordinary course of business," which Defendant asserts is an implied exception to the VRPA that is incorporated from the federal Video Privacy Protection Act of 1988 ("VPPA"), 18 U.S.C. § 2710(b). Fourth, Defendant argues that the claims are time-barred by the one-year limitation period provided for in the Terms of Use. Fifth, Defendant reasserts that Plaintiffs lack standing because they have not suffered an injury in fact.
Defendant asserts that, regardless of any information allegedly disclosed to companies that it collaborates with, Plaintiffs provided "written permission" within the meaning of the VRPA by agreeing to the Terms and Conditions that all users of Redbox kiosks must agree to when renting discs. See Def.'s Mot. for Summ. J., at 16-19. Plaintiffs admit that they followed the
Pl.'s Resp. to Def.'s Mot. for Summ. J., Dkt.; # 61, at 16-17. The Court addresses each point in turn.
First, Plaintiffs assert that the Terms of Use provided in all Redbox transactions are not enforceable against Plaintiffs because "[u]nder the Uniform Electronic Transactions Act, which has been enacted into Michigan law, an electronic document cannot be enforced against a party who is unable to store or print that record." Pl.'s Resp. to Def.'s Mot. for Summ. J., at 17. The Uniform Electronic Transactions Act ("UETA"), M.C.L. § 450.831 et seq., which has been adopted by nearly every state, is a model law developed by the Uniform Law Commissioners that "represen[ts] the first national effort at providing some uniform rules to govern transactions in electronic commerce that should serve in every state." Michigan House Fiscal Agency Legislative Analysis, House Bill 5537 (Nov. 6, 2000). The Commissioners described the bill as "a procedural statute" with the fundamental purposes of "establish[ing] the legal equivalence of electronic records and signatures with paper writings and manually-signed signatures" and "removing perceived barriers to electronic commerce." Id. The act itself states that it should be construed to "[b]e consistent with reasonable practices concerning electronic transactions and with the continued expansion of those practices." M.C.L. § 450.836(b).
Plaintiffs assert two related theories under the UETA. First, they argue that because Redbox customers cannot "print or otherwise store a copy of the Terms of Use," those Terms violate the UETA and accordingly the Terms are not binding. Second, they assert that they have not supplied "written permission" within the meaning of the VRPA because the UETA requires that such information must be provided in a form capable of retention by the recipient. Specifically, they point to sections 8(1) and (3) of the UETA, which state:
M.C.L. § 450.838(1), (3). Plaintiffs contend that subsection (1) requires Redbox to show that each time a rental is consummated, "an electronic record capable of
There are several problems with Plaintiffs' theory. First, and perhaps most importantly, is the fact that Plaintiffs expressly agreed, in the Terms of Agreement, to an Illinois choice of law clause. See June 2010 Terms of Use, Dkt. # 48-5, at C00007 ("These Terms of Use, your access and use of the Kiosks, and the relationship between you and us are governed by the laws of the state of Illinois."); June 2011 Terms of Use, Dkt. # 48-9, at C00027 ("These terms and the interpretation of these terms will be governed and construed under the laws of the State of Illinois."). Critically, Illinois is one of the few states that has not adopted the UETA, and Plaintiffs point to no indication that the UETA should govern this transaction, especially as to Plaintiffs' theory that the Michigan UETA renders the Terms of Use not binding against them.
But even if the Michigan UETA were binding in this transaction, there is no reason to believe that Defendant's conduct violates it. The relevant provisions of the law here require that where a particular "law requires a person to ... deliver information in writing to another person," then that information must be "capable of retention by the recipient at the time of receipt." M.C.L. § 450.838(1).
Plaintiff eventually realizes this, and makes the better argument in their brief — stating that "Redbox fails to establish that pressing a button on a kiosk creates `an electronic record capable of retention' by Redbox, i.e., a record of Plaintiffs' permission that can be printed or stored." Id. at 17. The problem for Plaintiff is that this is simply not factually true, at least as based on the record here — indeed, information regarding the transaction is in fact retained by Defendant at the close of every transaction — such retention led to this very lawsuit. Plaintiff seems to imply that every transaction with every customer entered into by Defendant would have to result in separate and unique storage of the exact same agreement, i.e., a separate copy of the Terms of Use and Privacy Policy for each individual transaction. Not
Finally, independent of the UETA, Plaintiffs claim that they never provided assent to the Terms of Use when making their rentals. This argument is similarly unavailing. The parties agree that before a rental can be completed on one of Redbox's kiosks, the customer is confronted with a screen that states "By pressing `pay' or `use credits' you agree to the Terms." E.g., June 2011 Kiosk Screen Shot, Dkt. # 48-8. The parties disagree, however, on whether a customer would understand that "Terms" means the Terms of Use. Plaintiffs note that the final screen also includes the following terms, which they argue could confuse customers as to which terms apply to a sale:
June 2011 Kiosk Screen Shot, Dkt. # 48-8. The Court is not persuaded by Plaintiffs' argument, as even a cursory glance at the text would alert a customer to the fact that there are other terms incorporated into the contract. The screen explicitly tells customers to "[s]ee complete Terms," which quite obviously signals that more complete terms exist elsewhere. Further, this screen clearly capitalizes "Terms," demarcating the word as a proper noun and making clear that the "complete Terms" are the Terms of Use. Accordingly, the Court finds that Plaintiffs clearly assented to the Terms of Use when making their rentals a Redbox kiosks.
Next, Plaintiffs argue that, even if they assented to the Terms of Use and those Terms of Use were binding against them, Redbox's Privacy Policy, which contains the language that potentially allows it to disclose the information at issue here, was not contained within those Terms. Pl.'s Resp. to Def.'s Mot. for Summ. J., at 19-20. Defendant concedes that the Terms of Use language itself is silent on the subject of information disclosure, but notes that the Terms of Use references the Privacy Policy on multiple occasions, and accordingly, argues that the Privacy Policy is incorporated by reference into the Terms of Use.
As noted above, Illinois law governs the contract.
Here, the Terms of Use mentions the Privacy Policy four times: (1) on the first kiosk screen, stating "[p]lease also read the Redbox Privacy Policy below...;" (2) on the fifth kiosk screen, stating "[p]lease also review Redbox's privacy policy below;" (3) on the eighth kiosk screen, in the "User Comments and Postings" section, stating "[e]xcept as otherwise described in the Redbox Privacy Policy, any User Content will be treated as non-confidential and non-proprietary and we will not be liable for any use or disclosure of User Content;" and (4) on the sixteenth kiosk screen, in the "Indemnification" section, stating that customers "agree to ... hold [Defendant] harmless from and against any and all claims ... that directly or indirectly arise from or are otherwise directly or indirectly related to: ... (g) [Defendant's] use of [customer] information as permitted under these Terms, the Privacy Policy, or any other written agreement...." June 2011 Terms of Use, Dkt. # 48-9, at C01648, C01652, C01655, C01663.
Last, Plaintiffs argue that "even if [they] assented to and could be bound by the Terms of Use, and even if the Terms of Use incorporated the Privacy Policy, none of that establishes that Plaintiffs provided their "written permission" to disclose their protected information." Pl.'s Resp. to Def.'s Mot. for Summ. J., at 20-21.
June 2011 Privacy Policy, Dkt. # 48-12, at C01666 (emphasis added).
Thus, the critical task is determining what is the "information collected through the Redbox Platforms." "Redbox Platforms" is defined in the first sentence of the Privacy Policy, a sentence that is somewhat difficult to parse for a definition. The relevant language is as follows:
June 2011 Privacy Policy, Dkt. # 48-12, at C01666 (emphasis added). Although the above language is somewhat confusing, the definition of "Redbox Platforms" only makes sense if it includes the following three items: Redbox web sites, Redbox kiosks, and Redbox mobile applications. Given this definition, the relevant Privacy Policy section can be read as allowing Defendant to use information collected through the kiosks to be used to "provide related customer service," "tailor content recommendations and offers," "process... rental[s] or other transaction[s] [the customers] initiate," "provide [customers] with information, products or services that [Redbox] think[s] may interest [customers]," "process [customers'] registration," or "improve the Redbox Platforms or [Redbox's] services and for internal business purposes." Id.
Armed with that definition, we can now examine whether Plaintiffs consented to all of the disclosures that they alleged in their Complaint and supported with evidence in the record. Plaintiffs have alleged, and provided some evidence, that Defendant discloses to ExactTarget information including a customer's email address and movie title, for the purpose of sending emails to confirm certain customer actions, and also to show ads for snacks, Redbox promotions, and social media. Sending emails to customers to confirm actions falls squarely within "provid[ing] related customer service," just as ads for offerings and social media fall within "provid[ing] [customers] with information, products or services that [Redbox] think[s] may interest [customers]," both of which are functions that Plaintiffs agreed to by accepting the Terms of Use.
As to Experian and Adobe, Plaintiffs allege that Defendant discloses information containing a customer's name, email address, date of first rental, preferred genre, date of most recent rental, and total number of lifetime rentals, all for the purposes
Finally, third party vendor Stream allegedly has access to a database containing customer names and rental history. Plaintiffs' own filings admit that this database is for the purpose of providing customer service. Pl.'s Resp. to Def.'s Mot. for Summ. J., at 5-6. Plaintiffs' further assertion that Stream employees have free access to customer data does nothing to take that access outside of customer service. And Plaintiffs' assertion that Stream trainees use customers' data for training purposes further falls under "improv[ing] the Redbox Platforms or [Redbox's] services and for internal business purposes."
In whole, while Redbox undoubtedly engaged in internal sharing of Plaintiffs' personal and rental information, Plaintiffs clearly gave consent for all of the sharing that occurred. The palpable message of the Privacy Policy is that it allows virtually all sharing of information within Redbox's organization and partner organizations for the limited internal purpose of benefitting Redbox's services to customers and overall business. The Policy further makes clear that any disclosure of customer information for an external purpose is not consented — the type of disclosure that the VRPA is clearly most concerned with. Redbox clearly could not, for example, give or sell any customer data to a third party for a use unrelated to Redbox's own business. But Plaintiffs have provided no evidence that there was any such disclosure; instead, all of their evidence relates to Redbox's sharing of information within its own regulated system.
Accordingly, Plaintiffs' claims that Defendant disclosed information to third parties in violation of the VRPA must fail. Defendant has shown that its Terms of Use and portions of its Privacy Policy apply to every rental transaction, and that these documents provide the written permission required by the VRPA. Because Plaintiffs' claims of breach of contract and unjust enrichment are contingent on the success of its VRPA claims, those must fail as well.
For all the foregoing reasons,
IT IS HEREBY ORDERED that Defendant's Motion for Summary Judgment (Dkt. # 46) is
IT IS FURTHER ORDERED that Plaintiffs' Complaint is
June 2010 Privacy Policy, Dkt. # 48-6, at C00008. Though the June 2011 Privacy Policy applied for the majority of the transactions at issue here, the June 2010 Privacy Policy did apply for a few of the early transactions. For the purposes of this analysis, the Court finds the language similar enough to warrant the same conclusion.
