By Logan Cochran, Judge K.K. Legett Fellow at Washington Legal Foundation and a rising third-year student at Texas Tech University School of Law.
For the second time in less than a year, the U.S. Court of Appeals for the Third Circuit has ruled on minor consumers’ claims that Google and Viacom had “unlawfully collected personal information about them on the Internet, including what webpages they visited and what videos they watched on Viacom’s websites.” In re Nickelodeon Consumer Privacy Litigation. Although several issues raised by the plaintiffs substantially overlapped with the Third Circuit’s November 2015 decision In re Google Inc. Cookie Placement Consumer Privacy Litigation, two claims involved questions of first impression for the court: (1) a violation of the federal Video Privacy Protection Act (VPPA), and (2) an alleged invasion of privacy under New Jersey law.
In discussing the VPPA, the court examined whether Google, by simply receiving information provided by Viacom, violated the law. In interpreting the VPPA, the Third Circuit held that “the law permits plaintiffs to sue only a person who discloses such information, not a person who receives such information.” The court, therefore, affirmed the district court’s dismissal of Google from the case. Furthermore, in determining whether Viacom actually disclosed personally identifiable information, the court held that the VPPA’s “prohibition on the disclosure of personally identifiable information applies only to the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.” Importantly, both the district court and the Third Circuit agreed that the information collected from static digital identifiers did not rise to the level of information that could identify a specific individual’s behavior. A lengthy discussion covering congressional intent as well as statutory construction supported the court’s holding.
The majority of federal courts have adopted the rationale of the Northern District of California’s holding from In re Hulu Privacy Litigation on the issue of static digital identifiers. In an April 29, 2016 decision, however, the First Circuit held that “any unique identifier—including a person’s smartphone ID—is personally identifiable information.” Yershov v. Gannett Satellite Information Network. As the Third Circuit noted in In re Nickelodeon, its holding and Yershov are not at odds because the First Circuit’s conclusion “merely demonstrates that GPS coordinates contain more power to identify a specific person than … an IP address, a device identifier, or a browser fingerprint.”
On the other issue of first impression, the Third Circuit held that the plaintiffs had adequately lodged a successful New Jersey state-law claim for intrusion upon seclusion and remanded to the district court. While Google escaped this claim, Viacom did not.
Before assessing these issues of first impression, the In re Nickelodeon court discussed arguments that, in the court’s words, were “foreclosed by our decision in Google.” One argument was that the court lacked jurisdiction over the claims because the plaintiffs couldn’t establish Article III standing. The Third Circuit decided Google, however, prior to the Supreme Court’s May 16, 2016 Spokeo v. Robins decision. The In re Nickelodeon panel addressed this inconvenient truth by asserting that Spokeo “does not alter our prior analysis in Google.” This is a peculiar conclusion. In Google, the Third Circuit reasoned that the VPPA granted the plaintiffs “injury in law” by defining a statutory violation as a redressable harm. Spokeo clearly dictates that a bare statutory violation cannot establish constitutional standing. Courts must determine, above and beyond a statute’s creation of injury in law, whether the harm is “particularized” and “concrete.”
The In re Nickelodeon court endeavored to sidestep this apparent contradiction. Though disclosure of personal information is an “intangible” (and thus not a concrete) harm, the court argued, it is one that Congress has “traditionally … regarded as providing a basis for a lawsuit.” In support of that argument, the court cited to a passage from its Google decision, which had invoked a 2004 Supreme Court decision, Doe v. Chao. That case involved disclosure of a man’s Social Security Number and the Privacy Act of 1974. Businesses’ access to video-viewing preferences is far from analogous to identity theft in terms of harms arising from unauthorized information release. The Third Circuit erred in finding that the plaintiffs still had standing post-Spokeo.
However, the court’s statutory interpretation of the relevant VPPA provision properly limited the law’s application and should deter future VPPA class-action litigation in the Third Circuit. That is an admirable outcome. But the panel should have issued a more definitive rebuke to the plaintiffs’ bar by ruling that the minor children lacked standing to sue Google and Viacom. Under the rationale of In re Nickelodeon, courts should defer to Congress’s decision on what constitutes harm when assessing standing. But the Supreme Court held in Spokeo that judges still must assess whether individual plaintiffs suffered concrete and particularized harm. Other circuits should bear in mind when considering claims under the VPPA and similar federal laws that even when Congress has specified some kind of harm as cognizable, individual plaintiffs still have to show that they suffered that harm in a concrete and particularized way.