Austin-Spearman v. AMC Network Entertainment LLC et al

RESPONSE in Opposition to Motion re: 17 MOTION to Dismiss the Complaint. . Document

S.D.N.Y.December 1, 2014

IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF NEW YORK ---------------------------------------------------------------x : ETHEL AUSTIN-SPEARMAN, individually : Case No.: 1:14-cv-06840 (NRB) and on behalf of all others similarly situated, : : Plaintiff, : : v. : : AMC NETWORK ENTERTAINMENT LLC, a : a New York limited liability company, and AMC : NETWORKS, INC., a Delaware corporation , : : Defendants. : : ---------------------------------------------------------------x PLAINTIFF’S OPPOSITION TO DEFENDANTS’ MOTION TO DISMISS Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 1 of 24 i TABLE OF CONTENTS INTRODUCTION..........................................................................................................................1 FACTUAL BACKGROUND ........................................................................................................3 ARGUMENT ..................................................................................................................................5 I. DEFENDANTS’ ATTACKS ON STANDING FALL FLAT—PLAINTIFF SUFFERED AN INJURY IN FACT FROM AMC’S DISCLOSURE OF HER VIDEO PII ................................................................................................................5 A. AMC’s Violation of Plaintiff’s Statutorily Created Privacy Rights Under the VPPA is Alone Sufficient to Establish Standing ............................................6 B. Austin-Spearman Pleads that She Was Personally Identified by Defendants’ Disclosures and, Thus, Her Injuries Are Actual and Not Speculative ............................................................................................................12 II. PLAINTIFF’S VPPA CLAIM SURVIVES ...................................................................13 A. Plaintiff is a “Subscriber” Under the VPPA ......................................................14 B. Plaintiff Alleges the Additional Requisite Elements of her VPPA Claim— Her Facebook ID is “Personally Identifiable Information” and Defendants Acted Knowingly..............................................................................16 1. Plaintiff’s Facebook ID is personally identifiable information............17 2. The Complaint shows Defendants made knowing disclosures ............18 CONCLUSION ...........................................................................................................................19 Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 2 of 24 ii TABLE OF AUTHORITIES United States Supreme Court Cases Allen v. Wright, 468 U.S. 737 (1984) ...........................................................................................10 Arizona Christian Sch. Tuition Org. v. Winn, 131 S. Ct. 1436 (2011) ............................................9 Bantam Books, Inc. v. Sullivan, 372 U.S. 58 (1963)........................................................................6 Bell Atlantic Corp. v. Twombly, 550 U.S. 554 (2007) ...................................................................13 Clapper v. Amnesty Int’l, 133 S. Ct. 1138 (2013)..........................................................................12 Erickson v. Pardus, 551 U.S. 89 (2007) .......................................................................................13 Fed. Election Comm’n v. Akins, 524 U.S. 11 (1998) .......................................................................7 Havens Realty Corp. v. Coleman, 455 U.S. 363 (1982) ..............................................................6, 7 Linda R.S. v. Richard D., 410 U.S. 614 (1973) ...............................................................................6 Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) ..............................................................10, 12 Raines v. Byrd, 521 U.S. 811 (1997) ...............................................................................................9 Summers v. Earth Island Inst., 555 U.S. 488 (2009) ......................................................................9 Warth v. Seldin, 422 U.S. 490 (1975) .......................................................................................6, 12 United States Circuit Court of Appeals Cases Blue Tree Hotels Inv. (Canada), Ltd. v. Starwood Hotels & Resorts Worldwide, Inc., 369 F.3d 212 (2d Cir. 2004)...............................................................................................13 Donoghue v. Bulldog Investors Gen. P'ship, 696 F.3d 170 (2d Cir. 2012) .......................2, 6, 7, 12 Edwards v. First Am. Corp., 610 F.3d 514 (9th Cir. 2010) ............................................................6 Galiano v. Fid. Nat'l Title Ins. Co., 684 F.3d 309 (2d Cir. 2012) ...................................................6 Graczyk v. West Pub. Co., 660 F.3d 275 (7th Cir. 2011) ...............................................................8 Horvath v. Keystone Health Plan E., Inc., 333 F.3d 450 (3d Cir. 2003) .......................................11 Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 3 of 24 iii In re Carter, 553 F.3d 979 (6th Cir. 2009) ......................................................................................6 Kendall v. Employees Ret. Plan of Avon Products, 561 F.3d 112 (2d Cir. 2009) ...................10, 11 Klimas v. Comcast Cable Comm., 465 F.3d 271 (6th Cir. 2006) ...................................................8 Kyles v. J.K. Guardian Sec. Servs., Inc., 222 F.3d 289 (7th Cir. 2000) .........................................7 Robinson v. Gov't of Malaysia, 269 F.3d 133 (2d Cir. 2001) ..........................................................5 Sterk v. Redbox Automated Retail 672 F.3d 535 (7th Cir. 2012).....................................................2 Sweet v. Sheahan, 235 F.3d 80 (2d Cir. 2000). ..............................................................................13 United States v. Dauray, 215 F.3d 257 (2d Cir. 2000) ..................................................................14 United States District Court Cases Ellis v. The Cartoon Network, Inc., No. 14-cv-484, 2014 WL 5023535 (N.D. Ga. Oct. 8, 2014) ..............................................................................................2, 8, 15 Halaburda v. Bauer Publishing Co., No. 12-cv-12831, 2013 WL 4012827 (E.D. Mich. Aug. 6, 2013) ...................................................................................................9 In re Hulu Privacy Litig., No. 11-cv-3764, 2012 WL 3282960 (N.D. Cal Aug. 10 2012) .................................................................................... 7, 15-16, 18 In re Hulu Privacy Litig., No. 11-cv-3764, 2013 WL 6773794 (N.D. Cal. Dec. 20, 2013) ....2, 7, 8 In re Hulu Privacy Litig., No. 11-cv-3764, 2014 WL 1724344 (N.D. Cal. Apr. 28, 2014) ........................................................................................7, 17, 18 In re Nickelodeon Consumer Privacy Litig., MDL No. 2443, 2014 WL 3012873 (D.N.J. July 2, 2014) ..................................................................................................2, 8, 18 Kean for Cong. Comm. v. Fed. Election Comm’n, 398 F. Supp. 2d 26 (D.D.C. 2005) ...................7 Kinder v. Meredith Corp., No. 14- cv-11284, 2014 WL 4209575 (E.D. Mich. Aug. 26, 2014) ................................................................................................8 Statutes and Regulations 18 U.S.C. § 2710 .................................................................................................................... passim Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 4 of 24 1 INTRODUCTION To supplement the programming offered on their eponymous cable television channel, Defendants AMC Network Entertainment LLC and AMC Networks, Inc. (collectively, “Defendants” or “AMC”) operate a website (www.amctv.com) where consumers can watch video clips and episodes of AMC shows. Unbeknownst to those consumers, however, Defendants disclose their video viewing records when they visit and use the website—along with their personally identifiable Facebook IDs—to a third party, Facebook, in violation of the Video Privacy Protection Act (“VPPA” or “the Statute”), 18 U.S.C. § 2710, which expressly prohibits such disclosures. Plaintiff Ethel Austin-Spearman (“Plaintiff” or “Austin-Spearman”) is one of many consumers who viewed video materials on Defendants’ website and subsequently had her Facebook ID and video viewing history disclosed to Facebook without authorization. Having had her privacy rights violated, coupled with the fact that this is clearly a widespread practice on the part of AMC, Plaintiff brings this putative class action complaint against Defendants for their systematic violations of the VPPA. Defendants have moved to dismiss Plaintiff’s Complaint on two bases: (1) that Plaintiff has not alleged injury-in-fact sufficient to confer Article III standing because a statutory violation of the VPPA, without more, is insufficient, and (2) that Plaintiff is not a “subscriber” under the VPPA. In a footnote, Defendants raise a third challenge (although not as a basis for dismissal): that there was no “knowing” disclosure of “personally identifiable information” (“PII”), and as a corollary, a consumer’s Facebook ID is not PII within the meaning of the VPPA. As explained below, none of these arguments warrant dismissal. First, while Defendants do a decent job of twisting the Supreme Court’s words on the issue of standing, the reality is that Defendants’ argument defies decades of Supreme Court and Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 5 of 24 2 circuit court precedent (in this Circuit as well as others) holding that injury-in-fact can be established from the deprivation of a legal right conferred by statute. See, e.g., Donoghue v. Bulldog Investors Gen. P'ship, 696 F.3d 170, 178-80 (2d Cir. 2012). Further—as Defendants themselves acknowledge—the overwhelming majority of courts to consider the VPPA have held, as a matter of law, that a violation of the Statute is sufficient to confer Article III standing, even without a showing of actual damages. See In re Hulu Privacy Litig., No. 11-cv-3764, 2013 WL 6773794 (N.D. Cal. Dec. 20, 2013); Ellis v. The Cartoon Network, Inc., No. 14-cv-484, 2014 WL 5023535 (N.D. Ga. Oct. 8, 2014); Sterk v. Redbox Automated Retail 672 F.3d 535 (7th Cir. 2012); In re Nickelodeon Consumer Privacy Litig., MDL No. 2443, 2014 WL 3012873 (D.N.J. July 2, 2014). Defendants provide no justification for why this Court should find differently. Second, under the relevant authority and common, “plain meaning” usage, Plaintiff is a subscriber under the VPPA because she used Defendants’ video streaming services to access and view video content on the AMC website. In doing so, Plaintiff provided Defendants with information linking her activities on the AMC website to her Facebook ID and account, and also allowed access to the cookies installed on her computer—which AMC’s source code thereafter used to collect and transmit information. Accordingly, these actions take Plaintiff beyond a mere visitor to the website and make her a subscriber as contemplated by the VPPA. Third, to address Defendants’ “not addressed in this Motion” arguments, (Def. Mot. at 11 n.5), a user’s Facebook ID constitutes personally identifiable information in this context, because it is uniquely associated with and links to an individual’s unique Facebook account (which contains an individual’s name, location, picture, and other identifying information)—a conclusion supported by the reasoning of other courts that have examined the VPPA and other privacy-related allegations. Likewise, the pleadings show that Defendants could only have made Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 6 of 24 3 such disclosures knowingly, as they intentionally designed their website to include Facebook’s source code, which enabled the transfer of their users’ PII. For these reasons, and as explained further below, the Court should deny Defendants’ motion in its entirety. FACTUAL BACKGROUND Best known for their cable television channel, Defendants are a leading entertainment company that offers consumers a variety of television programming accessible through its television channel or online though its websites. (Class Action Complaint [“Compl.”], Dkt. 1, ¶ 1.) Consumers who visit Defendants’ website (www.amctv.com) can access a wide array of television programming, such as clips and episodes of AMC’s many popular television shows. (Id. ¶ 11.) Unbeknownst to consumers who choose to view content on the website, however, Defendants disclose private information about each user (including the user’s personally identifiable Facebook ID1 and the titles of videos and programming he or she watched (collectively, “Video PII”)) to third party Facebook.2 (Id. ¶ 13.) For their part, Defendants make no attempt to obtain, nor do they obtain, their users’ written consent before making such disclosures. Id. Rather, Defendants secretly collect and disclose consumers’ Video PII using source code (designed by Facebook) that Defendants have integrated into the AMC website. (Id. ¶¶ 14, 18, 19.) The operation of that code is relatively simple. When a user visits the AMC website, the 1 A Facebook ID is a unique numeric string assigned by Facebook to a specific user when their account is first created and links directly to a user’s Facebook profile page. (Id. ¶ 19.) 2 Although primarily recognized as a social network, Facebook is also a data broker that collects and sells a wide range of personal consumer data. (Id. ¶ 29.) Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 7 of 24 4 integrated source code searches the user’s web browser to look for and identify the user’s Facebook ID. (Id. ¶ 19.) Then, when a person views video clips on AMC’s website, Defendants (through their website) initiate a transmission to Facebook that includes the value “www.amctv.com,” the visitor’s Facebook ID, and hyperlinks of any video materials that the user has clicked on or watched. (Id. ¶¶ 24, 25.) As a result of these data transmissions, Defendants send Facebook a full record of: (i) the Facebook ID of the visitor browsing AMC’s website, along with (ii) the exact titles of the audiovisual material (i.e., the videos or video clips) that they viewed. (Id. ¶ 26.) Facebook stores and uses this information as part of its analytics and advertising platform. (Id. ¶ 30.) Plaintiff Ethel Austin-Spearman has been a member of Facebook’s social network since 2007. (Compl. ¶ 36.) Starting in 2013, Plaintiff began visiting the AMC website to, among other things, watch video clips of AMC’s The Walking Dead television show. (Id. ¶ 37.) Plaintiff had no knowledge that this information was being disclosed to Facebook, and indeed, never consented, agreed or otherwise permitted AMC to disclose her Video PII to any third party companies. (Id. ¶ 38) Nevertheless, each time Plaintiff viewed video clips using the AMC website, Defendants disclosed her Video PII to the third party social network and data broker Facebook. (Id. ¶ 40.) Upon learning of these unlawful disclosures of her Video PII, on August 22, 2014, Plaintiff brought this putative class action lawsuit to redress Defendants’ willful violations of her and the putative class’ privacy rights. (Dkt. 1.) In response to the Complaint, on October 23, 2014, AMC moved for dismissal of Plaintiff’s VPPA claim. (Dkt. 17.) Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 8 of 24 5 ARGUMENT I. DEFENDANTS’ ATTACKS ON STANDING FALL FLAT—PLAINTIFF SUFFERED AN INJURY IN FACT FROM AMC’S DISCLOSURE OF HER VIDEO PII. Though Defendants begin their attack under Rule 12(b)(1) by claiming Plaintiff lacks Article III standing, the Complaint’s allegations show Plaintiff suffered an injury-in-fact from Defendants’ violation of her statutorily-granted right to privacy under the VPPA. Under a motion to dismiss pursuant to Rule 12(b)(1), a defendant may challenge either the legal or factual sufficiency of the plaintiff's assertion of jurisdiction. Robinson v. Gov't of Malaysia, 269 F.3d 133, 140 (2d Cir. 2001). Where, as here, a defendant challenges only the legal sufficiency of the jurisdictional allegations, “the court must take all facts alleged in the complaint as true and draw all reasonable inferences in favor of plaintiff.” Id. Here, Defendants contend that Plaintiff lacks Article III standing to bring her claims under the VPPA because a statutory violation alone does not constitute injury-in-fact and Plaintiff fails to allege more. (Mot. at 6.) This argument, however, fails because it both misapplies relevant precedent and misreads Plaintiff’s claims. As explained below, Plaintiff alleges that the VPPA conferred upon her a specific statutorily-granted right to the privacy of her video viewing records, and that Defendants violated this right by disclosing her Video PII to third parties. By doing so, Plaintiff sufficiently alleges that Defendants caused her to suffer an injury-in-fact pursuant to the Statute. And as well-established precedent acknowledges, such a violation is a sufficiently concrete and particularized injury for the purposes of Article III standing. Accordingly, Defendants’ request for dismissal under Rule 12(b)(1) should be denied in its entirety. Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 9 of 24 6 A. AMC’s Violation of Plaintiff’s Statutorily Created Privacy Rights Under the VPPA is Alone Sufficient to Establish Standing. As an initial matter, it is well established (in this Circuit and others) that the violation of a statutorily created right, even without more, is sufficient to confer Article III standing. As the Supreme Court noted, “Congress can enact statutes creating legal rights, the invasion of which creates standing, even though no injury would exist without the statute.” Linda R.S. v. Richard D., 410 U.S. 614, 617 n.3 (1973); see also Warth v. Seldin, 422 U.S. 490, 500 (1975); Havens Realty Corp. v. Coleman, 455 U.S. 363, 373–74 (1982). In such cases, the standing question “is whether the constitutional or statutory provision on which the claim rests properly can be understood as granting persons in the plaintiff’s position a right to judicial relief.” Warth, 422 U.S. at 500; see also Donoghue v. Bulldog Investors Gen. P'ship, 696 F.3d 170, 180 (2d Cir. 2012) cert. denied, 133 S. Ct. 2388 (2013) (“While this particular legal right might not have existed but for the enactment of § 16(b), Congress’s legislative authority to broaden the injuries that can support constitutional standing is beyond dispute.”); In re Carter, 553 F.3d 979, 988 (6th Cir. 2009) (“Congress no doubt has the power to create new legal rights, and it generally has the authority to create a right of action whose only injury-in-fact involves the violation of that statutory right”); Bantam Books, Inc. v. Sullivan, 372 U.S. 58, 64 n.6 (1963) (violation of statutory right causes “a legal injury” sufficient to confer standing); Edwards v. First Am. Corp., 610 F.3d 514, 517 (9th Cir. 2010) cert dismissed as improvidently granted, 132 S. Ct. 2536 (2012).3 Here, an examination of the VPPA shows that it expressly confers a right to privacy in 3 The holding in Edwards has been cited with approval in this Circuit. See Galiano v. Fid. Nat'l Title Ins. Co., 684 F.3d 309, 315 n. 9 (2d Cir. 2012) (noting Edwards remains good law and “has been cited approvingly in [the Second Circuit]”). Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 10 of 24 7 the viewing of video materials, and a right of enforcement on any “person aggrieved by any act of a person in violation of” its provisions. 18 U.S.C. § 2710. Where, as here, a statute confers a substantive right and provides that a “person aggrieved” by its violation may sue, such a person has “suffer[ed] an injury ‘in precisely the form the statute was intended to guard against.’” Kyles v. J.K. Guardian Sec. Servs., Inc., 222 F.3d 289, 298 (7th Cir. 2000) (quoting Havens Realty Corp. v. Coleman, 455 U.S. 363, 373 (1975)); see also Fed. Election Comm’n v. Akins, 524 U.S. 11, 19–20 (1998); Kean for Cong. Comm. v. Fed. Election Comm’n, 398 F. Supp. 2d 26, 36 (D.D.C. 2005) (“[Defendant’s] argument that plaintiff needs an additional injury, beyond” the right conferred by statute “would completely eviscerate Akins.”); Donoghue, 696 F.3d 170 at 177 (“That fiduciary duty was created by [statute] and it conferred upon Invesco an enforceable legal right to expect Bulldog to refrain from engaging in any short-swing trading in its stock. The deprivation of this right establishes Article III standing.”) In light of this, numerous courts have held that the disclosure of an individual’s Video PII is in and of itself the injury required for Article III standing under the VPPA. See In re Hulu Privacy Litig. [“Hulu II”], No. 11-cv-3764, 2013 WL 6773794, at *5 (N.D. Cal. Dec. 20, 2013).4 As the Hulu II court noted when confirming that no injury beyond disclosure is necessary for standing to assert a VPPA claim, subsection (b) of the text of the VPPA “refers to the ‘aggrieved person’ in the singular and precedes it with a definite article.” Hulu II, 2013 WL 6773794 at *5. “Thus, the ‘aggrieved person’ is the consumer whose information was disclosed” and as “[s]ubsection (b) does not refer to ‘an aggrieved person’ or ‘any person aggrieved’ [t]he 4 Plaintiff cites to three separate decisions from the In re Hulu Privacy Litigation case. For purposes of clarification, the three cases will be designated according to the date of issue. See “In re Hulu I,” 2012 WL 3282960 (N.D. Cal Aug. 10, 2012); “In re Hulu II,” 2013 WL 6773794 (N.D. Cal. Dec. 20, 2013), and “In re Hulu III,” 2014 WL 1724344 (N.D. Cal. Apr. 28, 2014). Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 11 of 24 8 consumer, therefore, is ‘aggrieved’ based solely on the disclosure of personally identifiable information to third parties.” Id. Accordingly, the Hulu II court recognized that: The “any aggrieved person” language in subsection (c) establishes that any person who meets the definition of “the aggrieved person” in subsection (b)(2) (which demonstrated an injury-in-fact for Article III standing purposes) ‘may bring’ a federal lawsuit. 18 U.S.C. § 2710(c)(1). The Court then ‘may award actual damages but not less than liquidated damages of $2,500.’ Id. § 2710(c)(2). Nothing in subsection (c) (or any other part of the statute) requires an injury beyond a violation of subsection (b). Id. 5 See also Ellis v. The Cartoon Network, Inc., No. 14-cv-484, 2014 WL 5023535 at *2 (N.D. Ga. Oct. 8, 2014) (holding that “because the Plaintiff is alleging a violation of the VPPA, he alleges an injury.”); In re Nickelodeon Consumer Privacy Litig., MDL No. 2443, 2014 WL 3012873 at *4 (D.N.J. July 2, 2014) (noting that “whether or not Plaintiffs have alleged injury- in-fact in the form of economic harm is not dispositive to the standing analysis” and finding that “if Plaintiffs can state valid claims for violations of statutes that codify certain of their privacy rights, the Court will not prevent Plaintiffs from suing to enforce those rights because of doubts about whether they have suffered concrete monetary harm.”). Despite recognizing the weight of authority contrary to its position (Def. Mot. 8-9), 5 Courts across the nation have routinely applied such principles in concluding that statutory violations of consumer privacy statutes, like the VPPA, are sufficient to confer standing. See, e.g., Graczyk v. West Pub. Co., 660 F.3d 275, 278 (7th Cir. 2011) (finding no monetary harm necessary to state a claim under the Driver’s Privacy Protection Act, as “Congress has defined the relevant injury under the DPPA as ‘obtain[ment], disclos[ure], or [use]’”) (citation omitted); Klimas v. Comcast Cable Comm., 465 F.3d 271, 275– 76 (6th Cir. 2006) (finding standing where plaintiff alleged violations of the Cable Act’s privacy provisions, with no claim of economic harm); Kinder v. Meredith Corp., No. 14- cv-11284, 2014 WL 4209575, at *2 (E.D. Mich. Aug. 26, 2014) (noting that “pursuant to Warth, the Michigan legislature can create new legal rights by virtue of enacting a statute,” and finding that plaintiff had Article III standing to sue under Michigan’s companion statute to the VPPA where she “alleged that [the defendant] violated her rights pursuant to the [Act] by improperly disclosing and selling her personal information.”). Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 12 of 24 9 Defendants nevertheless say that “binding Supreme Court precedent” dictates that this Court should rule differently.6 Yet the few cases that Defendants cite in support either fail to address the issue at hand or are distinguishable on the facts. For instance, though Defendants rely heavily on Raines v. Byrd, 521 U.S. 811 (1997)7 and Summers v. Earth Island Inst., 555 U.S. 488 (2009) in support of their argument against standing, neither of those cases considered the matter at hand—whether the violation of statutorily-granted rights alone can constitute injury-in-fact to support Article III standing. See Raines, 521 U.S. at 829 (finding “diminution of legislative power” suffered by individual members of Congress did not constitute a sufficiently concrete and personalized injury for Article III standing); Summers, 555 U.S. at 296 (finding that “deprivation of procedural right without some concrete interest that is affected by the deprivation” is insufficient to confer Article III standing). Unlike those cases, Plaintiff’s 6 Defendants’ argument that allowing a statutory violation (without more) to confer standing would “improperly collapse [] injury-in-fact, causation, and redressability into a single question of redressability” is both unsupported and nonsensical. (Def. Mot. 9.) As stated in the Complaint, Plaintiff alleges (i) that Defendants’ disclosure and transmission of Plaintiff’s Video PII violates her privacy rights under the VPPA and constitutes an injury-in-fact; (ii) that her injury is completely traceable to Defendants’ actual and intentional conduct in disclosing her PII, and (iii) that Defendants can and should be held accountable for their violation of the VPPA, such that her injuries are redressable. (See Compl. ¶¶ 36-40, 49-58.) Further, the existence or amount of economic damages does not affect the culpability of Defendants’ conduct in any way. Not surprisingly, Defendants cannot cite to any legal authority in support of their novel theory (Defendants’ only cited case of Arizona Christian Sch. Tuition Org. v. Winn, 131 S. Ct. 1436 (2011) is inapposite—Arizona did not discuss causation in the context of any statutory violation, but rather, addressed taxpayer standing to challenge a state statute on constitutional grounds). 7 Other courts have likewise noted that Raines does not concern whether statutory violations could constitute an injury-in-fact under Article III. See Halaburda v. Bauer Publishing Co., No. 12-cv-12831, 2013 WL 4012827 at *5 (E.D. Mich. Aug. 6, 2013) (“[T]he issue in Raines was altogether different than that in this case. There, six members of the U.S. Congress whose votes on a particular law were in the minority, sought to invalidate a federal law as unconstitutional. Plaintiffs in Raines were found to lack Article III standing for the reason that they had alleged only a ‘wholly abstract and widely dispersed’ institutional injury, and no individual injury.”) (internal citations omitted). Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 13 of 24 10 allegations do not concern an individual’s ability to enforce certain procedural rights dictated by statute, but rather, address the direct violation of substantive rights granted by statute. Defendants’ other cases are likewise inapposite. See Allen v. Wright, 468 U.S. 737 (1984) (finding plaintiffs lacked standing to sue IRS for failure to deny tax-exempt status to racially discriminatory schools); Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (finding wildlife organizations failed to demonstrate injury in fact sufficient to challenge regulations concerning the Endangered Species Act that were issued by the government); see also Donaghue, 696 F.3d at 175 (describing Lujan as “stating that nothing in denying standing to citizens at large to enforce public rights contradicts [the] principle that statutes may confer rights on specified individuals, the breach of which suffices for standing.”)8 Unlike in Allen and Lujan, where plaintiffs sought to enforce general rights that had been conferred by statute upon the public (without the allegation that any of their specific individual rights had been violated), Plaintiff alleges that Defendants directly violated her individual statutorily-granted right to the privacy of her video viewing materials by disclosing her Video PII to third parties. As such, Plaintiff’s allegations of injury are both personal and specific. The sole Second Circuit case that Defendants rely upon, Kendall v. Employees Ret. Plan of Avon Products, 561 F.3d 112 (2d Cir. 2009), also fails to lend support. In Kendall, the plaintiff brought ERISA claims against her employer, asserting that she had standing to sue because her employer breached its fiduciary duty to comply with the statute.9 Id. at 119. The court dismissed 8 The court in Lujan further noted that the “[s]tatutory broadening of the categories of injuries that may be alleged in support of standing is a different matter from abandoning the requirement that the party seeking review must himself have suffered an injury.” Lujan v. Defenders of Wildlife, 504 U.S. at 578 (internal quotation marks and brackets omitted). 9 Kendall is likewise distinguishable because it concerned a claim brought under ERISA, Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 14 of 24 11 plaintiff’s claims for lack of standing, noting that “[e]ven in cases where plaintiffs need not show an individualized harm, they must still allege some injury in the form of a deprivation of a right as a result of a breach of fiduciary duty conferred by ERISA,” and finding plaintiff’s sole allegation that defendant’s breach “deprived her of a right to a plan that complies with ERISA” was insufficient. Id. at 121. The Kendall court contrasted the situation with that of Horvath v. Keystone Health Plan E., Inc., 333 F.3d 450 (3d Cir. 2003), where the Third Circuit found standing without the allegation of actual harm when plaintiff was allegedly “harmed by the deprivation of a specific right to receive information.” Kendall, 561 F.3d at 121. Thus, contrary to AMC’s interpretation, Kendall does not stand for the broad proposition that a statutory violation cannot confer standing without further injury—rather, Kendall requires that plaintiffs allege the specific rights that any statutory breach has infringed upon. In fact, the Kendall court itself recognized that where a statute gives a person “in the plaintiff’s position a right to judicial relief,” the “invasion of [a right created by statute] creates standing.” Kendall, 561 F.3d at 118 (quoting Warth, 422 U.S. at 500) (emphasis added). In this case, and as even Defendants acknowledge (Def. Mot. 7), Plaintiff contends that the VPPA conferred upon her a specific right to privacy over her personally identifiable video rental history and further, that Defendants deprived her of this right when they disclosed her Video PII to Facebook. Even under the purview of Kendall, such allegations are sufficient to confer standing. What’s more, the Second Circuit subsequently confirmed its holding in Kendall, noting that cases involving statutes conferring a “specific right” on plaintiffs are “distinguishable from which permits plan members to sue on behalf of the plan but does not “confer a right to every plan participant to sue [] for alleged ERISA violations without a showing that they were injured by the alleged breach of the duty.” Kendall, 561 F.3d at 120. Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 15 of 24 12 Kendall []” (which alleged a general breach of fiduciary duty) and that in distinguishing these cases, “a plaintiff's claim of injury in fact depends on legal rights conferred by statute, it is the particular statute and the rights it conveys that guide the standing determination.” Donoghue, 696 F.3d at 178 (citing Warth v. Seldin, 422 U.S. at 500). And as the Donaghue court further explained, Congress’s enactment of Section 16(b) of the Securities Exchange Act of 1934— which conferred upon shareholders a legal right to the trading profits received from improper short swing trading—“did not eliminate the injury requirement of standing,” but rather, “it created legal rights that clarified the injury that would support standing.” Donoghue, 696 F.3d at178-80. Here, the VPPA confers upon consumers a specific legal right of privacy over their personally identifiable video rental records, the breach of which confers standing. Accordingly, as Plaintiff alleges that AMC violated her statutorily-granted right to privacy under the VPPA, she sufficiently pleads an injury-in-fact for the purposes of Article III standing. B. Austin-Spearman Pleads that She Was Personally Identified by Defendants’ Disclosures and Thus, Her Injuries Are Actual and Not Speculative. Defendants assert that Plaintiff’s injuries are speculative and that she “has not pled any real threat of future harm.” (Def. Mot. 10.) AMC misstates the issue. Plaintiff’s claims under the VPPA do not arise from the threat of future harm resulting from Facebook’s potentially harmful usage of her information. Instead, as explained in Section I.A, supra, her injuries have already occurred as a result of Defendants’ disclosure of her Video PII in violation of her statutorily granted rights under the VPPA. (Compl. ¶ 40.) Accordingly, Plaintiff’s injury (as well as those of the putative class) is “actual,” rather than “conjectural” or “hypothetical.” See Clapper v. Amnesty Int’l, 133 S. Ct. 1138, 1147 (2013); Lujan, 504 U.S. at 560. Accordingly, Defendants’ reliance on Clapper v. Amnesty Int’l for the proposition that the “mere hypothetical threat of Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 16 of 24 13 future harm” is insufficient to establish injury, (Def. Mot. 10), simply misses the point. 133 S. Ct. at 1147. II. PLAINTIFF’S VPPA CLAIM SURVIVES. Next, though Defendants contend that the pleadings fails to state a claim upon which relief can be granted, Plaintiff sufficiently pleads each element of her claim under the VPPA. On a Rule 12(b)(6) motion to dismiss, the court “must accept as true the allegations contained in the complaint and draw all reasonable inferences in favor of the nonmoving party.” Blue Tree Hotels Inv. (Canada), Ltd. v. Starwood Hotels & Resorts Worldwide, Inc., 369 F.3d 212, 217 (2d Cir. 2004). A complaint need not plead “[s]pecific facts,” but instead, must contain a statement of the claim that “give[s] the defendant fair notice of what the . . . claim is and the grounds upon which it rests.” Erickson v. Pardus, 551 U.S. 89, 93 (2007) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 554, 555 (2007)). Dismissal pursuant to Rule 12(b)(6) “is inappropriate unless it appears beyond doubt that the plaintiff can prove no set of facts which would entitle him or her to relief.” Sweet v. Sheahan, 235 F.3d 80, 83 (2d Cir. 2000). Defendants attack both the legal and factual sufficiency of the pleadings, claiming (i) that Austin-Spearman is not a “subscriber” to AMC’s services and therefore not a “consumer” under the VPPA, (ii) that a user’s Facebook ID is not personally identifiable information under the Statute, and (iii) that Plaintiff fails to plead that Defendants’ disclosures were made knowingly.10 Each of these arguments fail. First, both the plain meaning of the terms and court guidance show 10 As noted above, Defendants only raise the “subscriber” challenge as a basis for dismissal. (See Def. Mot. at 11-14.) Defendants raise points (ii) and (iii)—concerning whether a Facebook ID is personally identifiable information, or whether its disclosures were made knowingly—in a footnote, where Defendants explain that the points (and, apparently, others that Defendants chose not to name) are “not addressed in [their] Motion.” (Def. Mot. 11 n.5.) In any event, and for the sake of completeness, Plaintiff addresses points (ii) and (iii) here. Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 17 of 24 14 that Plaintiff is a subscriber under the VPPA, and that her Facebook ID is personally identifiable information. Second, when viewed in its entirety, the Complaint demonstrates that Defendants’ disclosures were made knowingly. Accordingly, Defendants’ arguments for dismissal under Rule 12(b)(6) fail as well. A. Plaintiff is a “Subscriber” Under the VPPA. Defendants say that Plaintiff’s claims fail as a matter of law because she is not a “subscriber” of AMC, and therefore, not a “consumer” under the VPPA. (Def. Mot. 12.) According to Defendants, Plaintiff purportedly cannot meet the definition of a subscriber because she “has no relationship with AMC,” “did not pay to visit [the AMC website],” and did not register or sign up for any personal user ID or profile with AMC.11 (Id.) But neither the plain language of the term—nor the courts who’ve examined it—require those elements, and as such, Defendants' challenge fails. First, although the VPPA defines “consumer” as “any renter, purchaser, or subscriber of goods or services from a video service provider” (18 U.S.C. § 2710(a)(1)), it does not define the term “subscriber.” See 18 U.S.C. § 2710(a). As such, the Court must interpret the term by using its “plain” and “ordinary, common-sense meaning.” United States v. Dauray, 215 F.3d 257, 260 (2d Cir. 2000). In the context of online services like AMC’s website, “subscribe” means “[a]n arrangement by which access is granted to an online service.”12 The only two courts who have 11 Though this issue is not properly before the Court on a motion to dismiss, Defendants repeatedly contend that AMC has no knowledge of Plaintiff’s identity and that it never received any of her personal information. (Def. Mot. 1, 13.) Discovery will show, however, that Plaintiff possesses promotional e-mails sent from AMC to her private email address—which defeats Defendants’ contentions outright. 12 See, e.g., subscribe (1.1), Oxford Dictionaries, http://www.oxforddictionaries.com/ definition/english/subscribe (last accessed Nov. 11, 2014); subscribe, Encyclopedia.com, Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 18 of 24 15 considered this issue confirm such a reading. See In re Hulu I, 2012 WL 3282960, at *8 (finding plaintiffs to be subscribers where they alleged that they were “subscribers” and that “[t]hey visited hulu.com and viewed video content,” “regardless of whether they were registered and logged in.”)13; Ellis, 2014 WL 5023535, at *2 (“[Plaintiff] downloaded the CNN App and used it to watch video clips. His Android ID and viewing history were transmitted to Bango. These facts suffice to qualify the Plaintiff as a ‘subscriber,’ and as such, a ‘consumer.’”). Further, both the Hulu I and Ellis courts expressly noted that the definition of subscriber under the VPPA does not imply or require the payment of money. See In re Hulu., 2012 WL 3282960, at *8 (“And while the terms ‘renter’ and ‘buyer’ necessarily imply payment of money, the term ‘subscriber’ does not. If Congress wanted to limit the word ‘subscriber’ to ‘paid subscriber,’ it would have done so.”). Nor does the term require that a plaintiff register for or be logged into any account. Ellis, 2014 WL 5023535, at *2 (“[I]ndividuals do not have to log in or register to be considered subscribers.”) Rather, as the Hulu I and Ellis courts explain, the term subscriber requires only that a plaintiff “pleads more than simply visiting a website,” Id. (citing In re Hulu I at *8), whether it be using defendant’s mobile app to watch videos, Ellis, 2014 WL 5023535, at *2, or using defendant’s video-streaming services to watch video content, In re Hulu http://www.encyclopedia.com/topic/subscribe.aspx (last accessed Dec. 1, 2014). 13 Defendants’ attempts to distinguish the Hulu I case are unavailing. Though AMC claims that the Hulu I court found plaintiffs to be subscribers because they “signed up for a Hulu account, became registered users, received a Hulu ID, established Hulu profiles, and used Hulu’s streaming services,” (see Def. Mot. 13) (quoting In re Hulu I, 2012 WL 3282960, at *8), the quoted language is not from the court’s holding, but rather from its recitation of the plaintiffs’ argument. See In re Hulu, 2012 WL 3282960 at *7. (“Plaintiffs respond that they signed up for a Hulu account, became registered users, received a Hulu ID, established Hulu profiles, and used Hulu’s video streaming services. [citing] Opposition, ECF No. 58 at 13.”) (emphasis added).) The Hulu court actually held that the plaintiffs were “subscribers” because “[t]hey visited hulu.com and viewed video content,” and noted that “their data [was] tracked regardless of whether they were registered and logged in.” Id. at *8. Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 19 of 24 16 I, 2012 WL 3282960 at *7. Here, as in Hulu I and Ellis, Plaintiff’s allegations fit the common usage of “subscribe” in the online context. More than merely visiting the AMC website—Plaintiff accessed the website while logged-on to her Facebook account, thus providing Defendants with her Facebook ID and linking her visit on the AMC website to her unique and personally identifying Facebook account. (Compl. ¶ 36.) Plaintiff’s activity on the website likewise provided Defendants with access to the cookies installed on her computer, which Defendants' source code thereafter used to collect and transmit information about her website activity. (Id. ¶ 24.) She further used Defendants’ video streaming services to access and view video content on the site. (Id. ¶¶ 40, 51.) And, of course, Defendants thereafter disclosed her Video PII to third parties. (Id. ¶ 52.)14 Accordingly, under the facts alleged, Austin-Spearman is a subscriber under the VPPA. B. Plaintiff Alleges the Additional Requisite Elements of her VPPA Claim— Her Facebook ID is “Personally Identifiable Information” and Defendants Acted Knowingly. Defendants likewise preview, in a throwaway footnote, two more challenges for Plaintiff’s VPPA claim, including that Plaintiff’s Facebook ID is not personally identifiable information under the Statute and that the Complaint fails to allege that Defendants' conduct was 14 Though such allegations more than show that Plaintiff is a subscriber under the VPPA, Plaintiff will gladly provide additional details regarding her activities and complex interaction with the AMC website in an amended pleading should the Court require. For example, analyses of network traffic transmitted while browsing AMC’s website shows that, in addition to the Facebook disclosures, AMC collects and sends user data—including unique identifiers—to numerous other analytics and advertising companies (including Scorecard Research—the recipient of user data in Hulu). These facts reveal (and discovery will show) that AMC’s website is a robust online service that identifies, tracks, and strategically discloses information about the behavior of its users (like Plaintiff) to third parties. Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 20 of 24 17 done knowingly. (Def. Mot. 11, n.5.)15 Though Defendants contend that such issues will ultimately doom Plaintiff’s VPPA claim, their Motion does address them as a basis for dismissal. In either case, and regardless of when/whether Defendants choose to advance them, an examination of the law and pleadings show that Defendants' additional arguments will fail as well. 1. Plaintiff’s Facebook ID is personally identifiable information. To start, Defendants contend that Plaintiff’s Facebook is not PII under the circumstances—a position that ignores clear, on-point guidance provided for this very issue. As the Hulu court noted when facing nearly identical circumstances, a user’s Facebook ID constitutes personally identifiable information. The VPPA defines “personally identifiable information” (“PII”) as “includ[ing] information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3) (emphasis added). That definition does not limit PII to traditional methods of identification like names and addresses, but instead, “plainly encompasses other means of identifying a person.” In re Hulu Privacy Litigation (“Hulu III”), No. C 11-03764, 2014 WL 1724344, at *7 (N.D. Cal. Apr. 28, 2014). The disclosures in Hulu III are identical to those in this case. There, like here, the Hulu plaintiff alleged that the defendant disclosed to Facebook (using code installed on defendant’s webpage) its users’ Facebook IDs, along with the titles of the videos that they watched. Id. After 15 Defendants’ passing references that (i) there were no disclosures of PII by Defendants, (ii) that Defendants are not a “video tape service provider” under the VPPA, and (iii) that a class cannot be certified in this case (Def. Mot. 11, n.5), are contentions set forth without a shred of support and will be further addressed at a later juncture—should Defendants choose to raise them. Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 21 of 24 18 setting forth its detailed analysis, the Hulu III court held that where a video service provider discloses a unique identifier and video history to a third party, which uses that information to identify a specific individual and the video materials that person viewed, the information disclosed is PII and, consequently, permitted plaintiff’s claims regarding the disclosure of their Facebook IDs to survive summary judgment. Id. at *11. See also In Re Hulu I, 2012 WL 3282960 at *8 (“The information transmitted to Scorecard and Facebook included information that identified Plaintiffs and Class Members personally. [] As to Facebook, Hulu included their Facebook IDs, connecting the video content information to Facebook's personally identifiable user registration information.”). Other courts have validated the reasoning supporting Hulu’s holding. In re Nickelodeon Consumer Privacy Litig., No. CIV.A. 12-07829, 2014 WL 3012873, at *12 (D.N.J. July 2, 2014) (“Simply put, in a socially networked world a Facebook ID is at least arguably ‘akin’ to an actual name that serves without more to identify an actual person.”). Although Defendants are aware of and allude to the Hulu court’s holding, they provide no explanation for why the holding should not be applied here. Accordingly, and as Plaintiff will show at a later time, should Defendants raise this challenge in earnest, Plaintiff’s Facebook ID is PII under the VPPA. 2. The Complaint shows Defendants made knowing disclosures. Next, Defendants contend that there was no "knowing" disclosure of Plaintiff’s information, as required by the Statute. (Def. Mot. at 11 n. 8.) An examination of the Complaint, however, tells a different story. The Complaint shows—many times over—that Defendants' disclosures were made purposefully and knowingly. Plaintiff alleges that Defendants configured their website to send PII to Facebook by embedding source code, which added Facebook’s Social Plugins on the Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 22 of 24 19 AMC webpages and enabled the disclosures at Issue. (Compl. ¶ 23.) Next, it alleges that Defendants, through the AMC website, initiate the transmissions to Facebook containing its users’ Video PII. (Id. ¶ 24.) (emphasis added). And finally, the Complaint notes that AMC does not seek the consent of its users to share or otherwise disclose their PII and video viewing records before taking such actions. (Id. ¶ 13.) Accordingly, when viewed in its entirety, the Complaint sets forth allegations showing that AMC disclosed its users’ PII knowingly, as it took steps to design its website to do so. CONCLUSION For the reasons stated above, Plaintiff Ethel Austin-Spearman, individually and on behalf of all others similarly situated, respectfully requests that this Honorable Court deny AMC’s Motion to Dismiss and award such other relief as it deems necessary, reasonable, and just. Respectfully submitted, ETHEL AUSTIN-SPEARMAN, individually and on behalf of all others similarly situated, Dated: December 1, 2014 By:/s/: Benjamin S. Thomassen One of Plaintiff’s Attorneys Andrew Kravis (Reg. No. 5123658) akravis@kravisfile.com KRAVIS & FILE, P.C. 1 Meadowlands Plaza, Suite 200 East Rutherford, New Jersey 07073 Rafey S. Balabanian* rbalabanian@edelson.com Benjamin S. Thomassen* bthomassen@edelson.com Alicia E. Hwang* ahwang@edelson.com EDELSON PC 350 North LaSalle Street, Suite 1300 Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 23 of 24 20 Chicago, Illinois 60654 Tel: 312.589.6370 Fax: 312.589.6378 *Admitted pro hac vice Counsel for Plaintiff and the Putative Class Case 1:14-cv-06840-NRB Document 24 Filed 12/01/14 Page 24 of 24