Yershov v. Gannett Satellite Information Network, Inc.

RESPONSE to Motion re MOTION to Dismiss for Lack of Jurisdiction

D. Mass.July 14, 2016

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS ALEXANDER YERSHOV, individually and on behalf of all others similarly situated, Plaintiff, v. GANNETT SATELLITE INFORMATION NETWORK, INC. d/b/a USA TODAY, a Delaware corporation, Defendant. Case No.: 1:14-cv-13112 Judge F. Dennis Saylor IV PLAINTIFF’S RESPONSE IN OPPOSITION TO DEFENDANT’S MOTION TO DISMISS i TABLE OF CONTENTS INTRODUCTION .........................................................................................................................1 BACKGROUND ............................................................................................................................2 ARGUMENT ..................................................................................................................................3 I. The VPPA protects a concrete interest ............................................................................5 A. Congress identified a concrete, intangible interest in the privacy of an individual’s video-viewing choices ........................................................................5 B. The common law permitted suit for similar harms ............................................7 II. Gannett’s violation of the VPPA is directly connected to the concrete interest identified by Congress .......................................................................................................9 A. Akins and Public Citizen support Yershov’s standing to sue ...........................13 B. Courts across the country have concluded that a plaintiff has standing to sue when a statutory violation infringes on the underlying statutory interest ..................................................................................................15 III. Gannett’s suggestion that Yershov’s allegations are conclusory or implausible is without merit or relevance ..............................................................................................19 CONCLUSION ............................................................................................................................20 ii TABLE OF AUTHORITIES UNITED STATES SUPREME COURT CASES: Armstrong v. Exceptional Child Care Ctr., Inc., 135 S. Ct. 1378 (2015) ........................................4 Bell v. Hood, 327 U.S. 678 (1947) .................................................................................................20 Diamond v. Charles, 476 U.S. 54 (1986) ................................................................................ 18-19 Evers v. Dwyer, 358 U.S. 202 (1958) (per curiam) .......................................................................15 Fairchild v. Hughes, 258 U.S. 126 (1922) .....................................................................................10 FEC v. Akins, 524 U.S. 11 (1998) ............................................................................................ 12-14 GTE Sylvania, Inc. v. Consumers Union of U.S., Inc., 445 U.S. 382 (1980) ..................................8 Havens Realty Corp. v. Coleman, 455 U.S. 363 (1982) .......................................................... 14-15 Linda R.S. v. Richard D., 410 U.S. 614 (1973) .............................................................................15 Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) ............................................................ passim Nashville, C. & St. L. Ry. Co. v. Wallace, 288 U.S. 249 (1933) ......................................................9 O’Shea v. Littleton, 414 U.S. 488 (1974) ......................................................................................15 Public Citizen v. Dep’t of Justice, 491 U.S. 440 (1988) ..........................................................12, 14 Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) ..................................................................... passim Sprint Commc’ns Co., L.P. v. APCC Servs., Inc., 554 U.S. 269 (2008) ..........................................9 Steel Co. v. Citizens for a Better Environment, 523 U.S. 83 (1998) ................................................8 Valley Forge Christian Coll. v. Am. United for Separation of Church & State, Inc., 454 U.S. 464 (1982) ...........................................................................................................15 Varity Corp. v. Howe, 516 U.S. 489 (1996) ....................................................................................9 Warth v. Seldin, 422 U.S. 490 (1975) ............................................................................................15 Whitmore v. Arkansas, 495 U.S. 149 (1990) .................................................................................10 iii UNITED STATES CIRCUIT COURT OF APPEALS CASES: Aguilar v. USCIS, 510 F.3d 1 (1st Cir. 2007) ..................................................................................8 AngioDynamics, Inc. v. Biolitec AG, 2016 WL 2610669 (1st Cir. May 6, 2016) .........................20 Baur v. Veneman, 352 F.3d 625 (2d Cir. 2003) .............................................................................12 Church v. Accretive Health, Inc., 2016 WL 3611543 (11th Cir. July 6, 2016) .......................10, 15 Donahue v. City of Boston, 304 F.3d 110 (1st Cir. 2002) ..............................................................19 In re Nickeldeon Consumer Privacy Litig., 2016 WL 3513782 (3d Cir. June 27, 2016) .............................................................1, 11, 15 Katz v. Pershing, LLC, 672 F.3d 64 (1st Cir. 2012) ........................................................................4 Kerin v. Titeflex Corp., 770 F.3d 978 (1st Cir. 2014) ....................................................................18 Merrimon v. Unum Life Insurance Co., 758 F.3d 46 (1st Cir. 2014) ..............................................9 Pagan v. Calderon, 448 F.3d 16 (1st Cir. 2006) ............................................................................15 Pollard v. Law Office of Mandy L. Spaulding, 766 F.3d 98 (1st Cir. 2014) ................................3, 5 Portugues-Santana v. Rekomdiv Int’l, Inc., 725 F.3d 17 (1st Cir. 2013) ........................................8 Rodriguez v. Sony Computer Entm’t Am., LLC, 801 F.3d 1045 (9th Cir. 2015) .............................1 Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618 (7th Cir. 2014) ..........................................1 Torres Negron v. J&N Records, LLC, 504 F.3d 151 (1st Cir. 2007) ...............................................3 United States v. AVX Corp., 962 F.2d 108 (1st Cir. 1992) ............................................................20 Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482 (1st Cir. 2016) .................... passim UNITED STATES DISTRICT COURT CASES: Austin-Spearman v. AMC Network Entm’t LLC, 98 F. Supp. 3d 662 (S.D.N.Y. 2015) .............................................................................1, 19 Boelter v. Hearst Commc’ns, 2016 WL 3369541 (S.D.N.Y. June 17, 2016) ...................................................................19 iv Booth v. Appstack, Inc., 2016 WL 3030256 (W.D. Wash. May 24, 2016) ...................................16 Gubala v. Time Warner Cable, Inc., 2016 WL 3390415 (E.D. Wis. June 17, 2016) ............................................................................................ 17-18 Khan v. Children’s Nat’l Health System, 2016 WL 2946165 (D. Md. May 19, 2016) ......................................................................................................18 Mey v. Got Warranty, 2016 WL 3645195 (N.D.W. Va. June 30, 2016) ..............................................................................................16 Rogers v. Capital One Bank (USA), N.A., 2016 WL 3162592 (N.D. Ga. June 7, 2016) .....................................................................................................16 Ross v. AXA Equitable Life Ins. Co., 115 F. Supp. 3d 424 (S.D.N.Y. 2015) .................................19 Smith v. Ohio St. Univ., 2016 WL 3182675 (S.D. Ohio June 8, 2016) .........................................17 Stoops v. Wells Fargo Bank, N.A., 2016 WL 3566266 (W.D. Pa. June 24, 2016) ........................16 Thomas v. FTS USA, LLC, 2016 WL 3661960 (E.D. Va. June 30, 2016) .......................................2 Wall v. Mich. Rental, 2016 WL 3418539 (E.D. Mich. June 22, 2016) ..........................................17 OTHER CASES: Denis v. Leclerc, 1 Mart. (o.s.) 297 (Orleans 1811) ........................................................................7 Grigsby v. Breckinridge, 65 Ky. 480 (Ky. 1867) .............................................................................7 Prince Albert v. Strange, (1849) 41 Eng. Rep. 1171 (Ch.) ..............................................................7 Woolsey v. Judd, 11 How. Pr. 49 (N.Y. Sup. Ct. 1855) ...................................................................7 STATUTES and LEGISLATIVE HISTORY: 15 U.S.C. § 1681 ......................................................................................................................12, 17 18 U.S.C. § 2710 ......................................................................................................................1, 2, 6 47 U.S.C. § 551 ..............................................................................................................................17 MISCELLANEOUS Ari Ezra Waldman, Privacy as Trust: Sharing Personal Information in a Networked World, 69 U. Miami L. Rev. 559 (2015) ..............................................................................................7 v Neil M. Richards & Daniel J. Solove, Privacy’s Other Path: Recovering the Law of Confidentiality, 96 Geo. L.J. 123 (2007) ......................................................................... 7-8 H.R. Rep. No. 98-934 ....................................................................................................................18 S. Rep. No. 100-599 (1998) .......................................................................................................6, 18 1 INTRODUCTION Defendant Gannett Satellite Information Network has moved to dismiss Plaintiff Alexander Yershov’s lawsuit for lack of Article III standing. Gannett asserts that the Supreme Court’s recent decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), requires a plaintiff to allege consequential harm stemming from the violation of a statute to establish a cognizable injury-in-fact, and that Yershov makes no such allegations. But Gannett misreads Spokeo, which firmly rejected this argument. Instead, Spokeo confirms that when Congress identifies and protects a concrete interest by statute, a statutory violation that invades that interest results in a cognizable injury, even if the plaintiff suffers no additional harm. Id. at 1549-50. Thus, contrary to Gannett’s argument, Yershov has standing under Spokeo: Congress identified a real interest in the privacy of an individual’s video-viewing choices, and made invasion of that interest legally cognizable by enacting the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710. By disclosing Yershov’s video-viewing choices and violating the VPPA, Gannett invaded Yershov’s legally protected interest, and thus concretely harmed him. In fact, every court to consider this question-both before Spokeo and after-has concluded that allegations that a media company disclosed protected information to a third party in violation of the VPPA established plaintiff’s standing to sue. See Rodriguez v. Sony Computer Entm’t Am., LLC, 801 F.3d 1045, 1053 n.5 (9th Cir. 2015); Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618, 623 (7th Cir. 2014); In re Nickelodeon Consumer Privacy Litig., __ F.3d __, 2016 WL 3513782, at *7-*8 (3d Cir. June 27, 2016). See also Austin-Spearman v. AMC Network Entm’t LLC, 98 F. Supp. 3d 662, 666 (S.D.N.Y. 2015) (“Notably, every court to have addressed this question has reached the same conclusion, affirming that the VPPA establishes a privacy right sufficient to confer standing through its deprivation.”). Gannett strains to assert that Spokeo 2 marks a sea change in the law of standing. But that simply isn’t true. See Thomas v. FTS USA, LLC, 2016 WL 3661960, at *4-*5 (E.D. Va. June 30, 2016) (“Contrary to Defendants’ position, Spokeo did not change the basic requirements of standing.”). Gannett also attempts to relitigate the sufficiency of Yershov’s allegations. In relevant part these arguments were raised and rejected not only in Gannett’s previous motion to dismiss, but on appeal as well. Spokeo does not undermine the First Circuit’s conclusion that Yershov’s allegations are sufficient, or create an exception to the law-of-the-case doctrine. Gannett’s motion to dismiss (which curiously seeks dismissal with prejudice despite advancing only jurisdictional arguments) should be denied. BACKGROUND Yershov’s single claim for relief arises under the VPPA, which permits “subscribers” of “video tape service providers” to sue when a videotape service provider discloses “personally identifiable information” about the subscriber. 18 U.S.C. § 2710. Gannett, a media company, permits consumers to access the content of its flagship publication, USA Today, through a proprietary mobile smartphone application, the USA Today App. (Dkt. 1, ¶ 1.) Yershov elected to get his news through that App. (Id. ¶ 39.) Yershov alleges that every time he watches a video on the App, the App transmits to a third party (Adobe Analytics) the title of that video, along with the Android ID associated with Yershov’s phone and his GPS coordinates. (Id. ¶ 42.) Yershov alleges that this transmission violates the VPPA because Adobe uses information like Android ID to identify and track Yershov as he accesses the Internet. (Id. ¶¶ 19-29.) On Gannett’s initial motion to dismiss, this Court concluded that Yershov’s allegations did not pass muster under Fed. R. Civ. P. 8 only because he was not a “subscriber” of Gannett as that term is defined by the VPPA. (Dkt. 30, p. 21.) This Court, however, rejected Gannett’s 3 argument that Android ID and GPS information were not “personally identifiable information” under the Act. (Dkt. 30, pp. 8-11.) The Court concluded that “a person with access to a smartphone’s unique identifier could potentially learn a huge quantity of personal information about the user of that smartphone.” (Id. at 10.) On appeal, the First Circuit agreed with the latter conclusion: Yershov alleges, the appellate court concluded, “that Gannett disclosed information reasonably and foreseeably likely to reveal which USA Today videos Yershov has obtained.” 820 F.3d 482, 486 (1st Cir. 2016). Because Adobe is able to discern from Gannett’s disclosures what videos Alexander Yershov watched, Gannett has disclosed “personally identifiable information.” Id. The appellate court, however, parted ways with this Court on whether Yershov was a “subscriber” under the VPPA. Acknowledging that the question was “closer,” the court concluded that the relationship between Yershov and Gannett was sufficient to permit Yershov to invoke the protections of the statute. Id. at 487-89. Less than three weeks later, the Supreme Court decided Spokeo. ARGUMENT Because Gannett lodges a facial challenge to Yershov’s standing to sue, this Court asks simply whether the allegations in the complaint, taken as true, establish a basis for subject-matter jurisdiction. See Torres Negron v. J&N Records, LLC, 504 F.3d 151, 162-63 (1st Cir. 2007). To invoke federal jurisdiction, a litigant must have suffered an injury-in-fact that is traceable to the defendant’s conduct and redressable by a judicial decision. Spokeo, 136 S. Ct. at 1547. Gannett asserts that Yershov fails to establish only one of this “familiar triad”: a concrete injury-in-fact. Pollard v. Law Office of Mandy L. Spaulding, 766 F.3d 98, 102 (1st Cir. 2014). Gannett’s motion is premised entirely upon the notion that Spokeo holds that a statutory claim must be connected to some consequential harm to be actionable in federal court. But 4 Spokeo instead reaffirmed that Congress may by statute identify and protect concrete interests, and that violation of those interests constitutes an injury cognizable in federal court. Thus the standing inquiry is not, as Gannett suggests, a quest for some “palpable” or “real-world” harm. Rather, the key issue is whether Congress has identified and protected a concrete interest. As the Court held, “‘Congress has the power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before.’” Spokeo, 136 S. Ct. at 1549 (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 580 (1992)) (Kennedy, J., concurring in part and concurring in the judgment)); see id. at 1553 (Thomas, J., concurring) (“Congress can create new private rights and authorize private plaintiffs to sue based simply on the violation of those private rights.”). And where it has identified such a concrete interest, a statutory violation that invades that interest will establish injury in fact. In other words, Congress has the authority to define the substantive duties members of society owe each other, and to decide how those rights will be enforced. Cf. Armstrong v. Exceptional Child Care Ctr., Inc., 135 S. Ct. 1378, 1383-84 (2015). This principle has been a staple of this Circuit’s Article III jurisprudence for some time. See, e.g., Katz v. Pershing, LLC, 672 F.3d 64, 75 (1st Cir. 2012) (Congress “can raise to the status of legally cognizable injuries certain harms that might otherwise have been insufficient at common law, and they may confer the authority to sue for those harms on private persons.”). Spokeo simply clarifies that when applying this principle a Court must take care to ensure that an injury is concrete as well as particularized. See Spokeo, 136 S. Ct. at 1548. Determining whether a plaintiff has suffered a concrete injury by virtue of a statutory violation proceeds in two steps. First, the Court must determine whether the interest Congress gave statutory protection is concrete. In making that determination, “both history and the 5 judgment of Congress play important roles.” Spokeo, 136 S. Ct. at 1549. Second, the Court must determine whether the particular statutory violation alleged by the plaintiff invades the interest protected by the statute. See Lujan, 504 U.S. at 580 (Kennedy, J., concurring in part and concurring in the judgment) (“Congress must … identify the injury it seeks to vindicate and relate the injury to the class of persons entitled to bring suit.”). In other words, the statutory right-e.g., the plaintiff’s entitlement that the defendant will not disclose their protected information-must not be “divorced from” the statutorily protected interest-e.g., the privacy of the plaintiff’s protected information. Spokeo, 136 S. Ct. at 1549. As the First Circuit has said, “in cases in which a plaintiff's injury stems solely from the violation of a statute, the nature of the right that the statute confers is of paramount concern.” Pollard, 766 F.3d at 102. Here, both the judgment of Congress and history demonstrate that the VPPA protects a concrete interest. And the statutory violation alleged in this case bears a direct connection to that interest. Yershov has therefore suffered a concrete injury-in-fact. I. The VPPA protects a concrete interest. A. Congress identified a concrete, intangible interest in the privacy of an individual’s video-viewing choices. Congress is “well-positioned to identify intangible harms that meet minimum Article III requirements” Spokeo, 136 S. Ct. at 1549, and in determining whether the “intangible” harm to which Congress gave statutory protection is cognizable in federal court, the inquiry turns, as it always has, on whether the “legally protected interest,” the interest Congress has given statutory protection, is concrete. See id. at 1548-49. Here, the VPPA protects an individual’s concrete interest in the privacy of their video viewing choices. Congress judged that this information ought to remain private, and that certain individuals and businesses ought to be held liable for 6 breaching that privacy. Yershov therefore “need not allege any additional harm” beyond invasion of that right to allege a cognizable injury-in-fact. Id. at 1549-50. The Act was passed in the wake of the publication of the video rental records of then- Supreme Court nominee Robert Bork’s family by a reporter who had obtained them from a Washington, D.C. video store. S. Rep. No. 100-599, at 5 (1998), reprinted in 1988 U.S.C.C.A.N. 4342-1. “Members of Congress denounced the disclosure as repugnant to the right of privacy.” Yershov, 820 F.3d at 485. In passing the Act, Congress expressed concern not only for newsworthy invasions of privacy, but also for preventing subtler, more insidious invasions of privacy. As one senator explained: In an era of interactive television cables, the growth of computer checking and check-out counters, of security systems and telephones, all lodged together in computers, it would be relatively easy at some point to give a profile of a person and tell what they buy in a store, what kind of food they like, what sort of television programs they watch, who are some of the people they telephone. I think that is wrong. Id. at 5-6. Similarly, another senator noted: The advent of the computer means not only that we can be more efficient than ever before, but that we have the ability to be more intrusive than ever before. Every day Americans are forced to provide to businesses and others personal information without having any control over where that information goes. These records are a window into our loves, likes, and dislikes. Id. at 6-7. In short, “the trail of information generated by every transaction that is now recorded and stored in sophisticated record keeping systems is new, more subtle and pervasive form of surveillance.” Id. at 7. Concerned with these “information pools,” Congress enacted the VPPA. In passing the Act, Congress prohibited exactly the conduct alleged here: disclosure of a consumer’s video choices by his video provider. 18 U.S.C. § 2710(b)(1). Congress, in other words, created a real interest in the privacy of our video-viewing choices. Recognizing that “the [Supreme] Court stopped short of adopting an explicit right to personal information privacy,” S. 7 Rep. No. 100-599, at 4, Congress stepped into the breach. Congress thus identified an “intangible” harm-the disclosure of information concerning video-viewing choices-that it deemed to meet Article III’s requirements. See Lujan, 504 U.S. at 580 (Kennedy, J., concurring in part and concurring in the judgment). Congress’s judgment should be respected. B. The common law permitted suit for similar harms. Spokeo also reiterated that a statutorily protected interest is concrete if it bears “a close relationship” to a harm that was cognizable at common law. Spokeo, 136 S. Ct. at 1549. The VPPA meets that test, as well. The law has long provided a mechanism for preserving the confidentiality of private information. The VPPA’s requirement that video providers keep their users’ video selections confidential resembles the duty imposed by the tort of breach of confidentiality, which required individuals to preserve the privacy of information with which they were entrusted. The breach- of-confidence tort “has a long tradition in Anglo-American common law.” Ari Ezra Waldman, Privacy as Trust: Sharing Personal Information in a Networked World, 69 U. Miami L. Rev. 559, 617 (2015). One prominent example is Prince Albert v. Strange, (1849) 41 Eng. Rep. 1171 (Ch.), in which Prince Albert sued to enjoin publication of private etchings that had been provided to a printer solely to make a few copies. The court ordered the injunction to issue on the basis of “breach of trust, confidence, or contract” owed by the printer as merchant to the Prince. Id. at 1178-79 (“Every clerk employed in a merchant’s counting-house is under an implied contract that he will not make public that which he learns in the execution of his duty as clerk.”). American courts heard similar claims for breach of confidence, such as for dissemination of private writings. See Grigsby v. Breckinridge, 65 Ky. 480, 493 (Ky. 1867); Woolsey v. Judd, 11 How. Pr. 49, 79-80 (N.Y. Sup. Ct. 1855); Denis v. Leclerc, 1 Mart. (o.s.) 297, 320 (Orleans 8 1811). By the end of the nineteenth century, “a robust body of confidentiality law protecting private information from disclosure existed throughout the Anglo-American common law.” Neil M. Richards & Daniel J. Solove, Privacy’s Other Path: Recovering the Law of Confidentiality, 96 Geo. L.J. 123, 125 (2007). The VPPA, which likewise prohibits dissemination of private information, is simply an extension of the common-law tort of breach of confidence. The VPPA therefore protects a concrete interest. Gannett contends that there are two problems with this analogy, but neither of Gannett’s concerns are persuasive.1 First, Gannett argues that no analogy to a common-law “privacy right” can be made because the Commonwealth of Massachusetts does not recognize any freestanding, common-law right to privacy. (Dkt. 44-1, at 12-13.) But neither Spokeo nor any other case holds that a statutory interest must be closely related to a common-law right recognized by the particular jurisdiction in which the plaintiff resides. Rather, a common-law analogue to a statutory claim is helpful simply to ensure that a plaintiff’s claim is “in a form historically viewed as capable of resolution through the judicial process.” GTE Sylvania, Inc. v. Consumers Union of U.S., Inc., 445 U.S. 375, 382 (1980). As explained, Yershov’s claim of unlawful disclosure of private information is a species of a claim that historically was viewed as capable of judicial resolution. See also Steel Co. v. Citizens for a Better Environment, 523 U.S. 83, 102 (1998) (observing that the judicial power extends to “cases and controversies of the sort traditionally amenable to, and resolved by, the judicial process”) (emphasis added). 1 Gannett also suggests a third problem, but it can be dispatched quickly. Gannett suggests that “using a vendor to count video views” was not actionable at common law. (Similar versions of this refrain pop up elsewhere in Gannett’s brief for various purposes.) While the Court may, on a Rule 12(b)(1) motion, consider other evidentiary materials in the record if those materials supplement or clarify the allegations in the complaint, see Aguilar v. USCIS, 510 F.3d 1, 8 (1st Cir. 2007), statements of counsel (which are all Gannett offers) are not evidence, see Portugues- Santana v. Rekomdiv Int’l, Inc., 725 F.3d 17, 26-27 (1st Cir. 2013). Neither is it apparent how counsel’s statements bear on Gannett’s liability under the VPPA. 9 Gannett’s second concern-that the privacy protections of the VPPA do not mirror the protections available under the common law-is equally misplaced. Congress is not so constrained that it may protect rights derived from the common law only if it accepts them in their fossilized form. See Nashville, C. & St. L. Ry. Co. v. Wallace, 288 U.S. 249, 264 (1933) (“The judiciary clause of the Constitution … did not crystallize into changeless form the procedure of 1789 as the only possible means for presenting a case or controversy otherwise cognizable by the federal courts.”) Although “[h]istory and tradition offer a meaningful guide to the types of cases that Article III empowers federal courts to consider,” they are not immovable constraints. Sprint Commc’ns Co., L.P. v. APCC Servs., Inc., 554 U.S. 269, 274 (2008). The First Circuit’s opinion in Merrimon v. Unum Life Insurance Co., 758 F.3d 46 (2014), is instructive. There, the court concluded that plaintiffs alleging that an ERISA plan’s administrator violated ERISA’s strictures had standing even though neither plaintiff had suffered any monetary harm. Id. at 53. In so concluding, the court looked to the common law of trusts. Id. The court concluded that the common law of trusts provided a “meaningful guide” to identifying cognizable harms under ERISA even though “ERISA's standards and procedural protections partly reflect a congressional determination that the common law of trusts did not offer completely satisfactory protection.” Varity Corp. v. Howe, 516 U.S. 489, 497 (1996). Similarly here, the VPPA’s substantive regulations reflect a congressional determination that the common and constitutional law of privacy did offer completely satisfactory protections. II. Gannett’s violation of the VPPA is directly connected to the concrete interest identified by Congress. The second step of the Spokeo analysis asks whether the alleged statutory violation is connected to, not divorced from, the underlying statutory interest. See 136 S. Ct. at 1549. But as the Court made clear, this step is far more important when procedural rights are at issue. Id.; see 10 Lujan, 504 U.S. at 572 & n.7. This step can essentially be dispensed with here, as it can in most cases alleging violations of substantive statutory rights. See Church v. Accretive Health, Inc., __ F. App’x __, 2016 WL 3611543, at *3 n.2 (11th Cir. July 6, 2016) (“In Spokeo, the Court stated that a Plaintiff ‘cannot satisfy the demands of Article III by alleging a bare procedural violation.’ This statement is inapplicable to the allegations at hand, because Church has not alleged a procedural violation.”) Yershov alleges that Gannett violated a substantive statutory right of his, and that Gannett’s unlawful acts directly invaded his legally protected interest. Yershov has therefore suffered a concrete injury-in-fact. Ensuring that a connection exists between a procedural right and a statutorily protected interest is necessary because “‘procedural rights’ are special.” Lujan, 504 U.S. at 572 n.7. A plaintiff may vindicate a procedural right without altering the substantive result, i.e., the government may issue a revised environmental impact statement and still decide to build a federal facility next door. Id. But unless the disregard of the procedural requirement impairs a separate concrete interest of the plaintiff’s, a suit to enforce a procedural right is little more than a suit to ensure the defendant follows the law. Id. at 572-73; see Spokeo, 136 S. Ct. at 1551 (Thomas, J., concurring) (noting that Article III’s common-law history “required a further showing of injury for violations of ‘public rights’-rights that involved duties owed to the whole community, considered as a community”) (citation omitted). The Court has consistently concluded that claims alleging a defendant has failed to follow the law are not justiciable because they are not “appropriately resolved through the judicial process.” Whitmore v. Arkansas, 495 U.S. 149, 155 (1990); see, e.g., Fairchild v. Hughes, 258 U.S. 126, 129-30 (1922). But those same concerns carry far less force when a substantive statutory right is at issue. A claim premised on a statutory entitlement that a defendant will or will not act in a certain way 11 in regards to a particular individual is far afield from a suit seeking to enforce an “abstract, self- contained, noninstrumental ‘right’ to have the [defendant] observe the procedures required by law.” Lujan, 504 U.S. at 573. Thus, “the concrete-harm requirement does not apply as rigorously when a private plaintiff seeks to vindicate his own private rights.” Spokeo, 136 S. Ct. at 1552 (Thomas, J., concurring). True, the statutory violation must still bear a connection to the statutorily protected interest. See id. at 1549 (noting that a plaintiff does not “automatically” suffer a concrete injury from a statutory violation). But that connection will be immediate in most cases involving substantive statutory rights. Here, Gannett is alleged to have violated the substantive prohibitions of the VPPA that directly regulate the statutorily protected interest. See Yershov, 820 F.3d at 485-89. There is, therefore, an immediate connection between Gannett’s violation of the VPPA by disclosing Yershov’s choice in video materials and the invasion of Yershov’s statutorily protected interest in the nondisclosure of that information; the violation and the invasion are one and the same. Yershov has therefore suffered a concrete injury-in-fact. See In re Nickelodeon Consumer Privacy Litig., 2016 WL 3513782, at *7 (concluding in VPPA case that “while perhaps ‘intangible,’ the harm” at issue “is concrete in the sense that it involves a clear de facto injury, i.e., the unlawful disclosure of legally protected information”). Gannett’s three objections to this framework each misunderstand Spokeo. Gannett’s first objection relies on the Court’s statement that Article III “requires a concrete injury even in the context of a statutory violation” and so a plaintiff does not “automatically satisf[y] the injury-in- fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Spokeo, 136 S. Ct. at 1549. But it does not follow, as Gannett argues, that Article III always requires a concrete injury that is separate from the 12 statutory violation. (E.g., Dkt. 44-1, at 7.) As the Court made clear, if Congress has identified a concrete interest, and the alleged statutory violation is connected to that interest, a plaintiff “need not identify any additional harm beyond the one Congress has identified.” Spokeo, 136 S. Ct. at 1549 (emphasis in original) (citing FEC v. Akins, 524 U.S. 11 (1998), and Public Citizen v. Dep’t of Justice, 491 U.S. 440 (1988). Second, Gannett asserts that because the Fair Credit Reporting Act, at issue in Spokeo, protected a concrete interest, the Court’s holding that the plaintiff needed to suffer a further concrete injury to have standing establishes that the violation of statutory rights can never result in a concrete injury. (Dkt. 44-1 p. 8-11.) But the statutory right at issue in Spokeo was not the right to have accurate information published about the plaintiff. Instead, the interest protected by the statute was accurate information and fair treatment in the job and credit markets, but the right was simply that the defendant use “reasonable procedures to ensure maximum possible accuracy” in any report published about a plaintiff. 15 U.S.C. § 1681b. As the Court explained, remand was necessary to ensure that the defendant’s alleged impairment of the plaintiff’s procedural right was sufficiently connected to an invasion of the plaintiff’s statutorily protected interest. Spokeo, 136 S. Ct. at 1549-50. An unreasonable procedure may not result in the publication of inaccurate information, the Court wrote, or the type of inaccurate information published may not impair the plaintiff’s standing in the job or credit market. Id. The Court’s concerns have no role to play in this lawsuit. “[I]n this case, there is a tight connection between the type of injury which [Yershov] alleges and the fundamental goals of the statutes which he sues under-reinforcing [Yershov’s] claim of cognizable injury,” Baur v. Veneman, 352 F.3d 625, 635 (2d Cir. 2003): his private information has been disclosed in 13 violation of a statute that seeks to ensure the privacy of information that Congress has concluded should remain private. Third, Gannett tries to draw an almost incomprehensible parallel between Yershov’s claim and the claim alleged in Spokeo. Pointing to provisions of the VPPA that permit disclosure in certain instances, Gannett asserts that “the disclosures here are similarly procedural in nature.” (Dkt. 44-1, at 10.) This nonsensical analogy fails: Spokeo, Inc.’s publication of inaccurate information isn’t “procedural.” The right at issue in Spokeo was procedural because the statute required Spokeo, Inc. to use “reasonable procedures.” 136 S. Ct. at 1545 (emphasis added). And, the Court observed, there was no guarantee that Spokeo would publish accurate information if it used reasonable procedures. Id. at 1550. There is no “procedural” right here: The VPPA tells Gannett what (or what not) to do, not how to do it. There is no danger that Gannett will continue to knowingly disclose Yershov’s protected information if Gannett complies with the statute. A. Akins and Public Citizen support Yershov’s standing to sue. The conclusion that Yershov has standing to sue Gannett follows directly from Akins and Public Citizen, two cases relied on by the majority in Spokeo. In Akins, a group of plaintiffs sought to challenge the FEC’s classification of a political group, AIPAC. 524 U.S. at 16. Under the Federal Election Campaign Act, the plaintiffs asserted that they were entitled to information about AIPAC that was withheld because of the FEC’s allegedly incorrect classification. Id. The Court concluded the plaintiffs had standing: “The ‘injury in fact’ that [plaintiffs] have suffered consists of their inability to obtain information … that, on [plaintiffs’] view of the law, the statute requires that AIPAC make public.” Id. at 21. In other words, the FECA granted the plaintiffs a substantive right, and the FEC’s actions had invaded that right. In Yershov’s case, just as in Akins, no more is necessary to demonstrate concrete injury-in-fact. 14 Hidden within its prolix footnote discussing Nickelodeon, Gannett briefly suggests that the harm at issue in Akins was the “denial of information necessary to cast an informed vote.” (Dkt. 44-1, at 11 n.2.) That’s not at all what Akins says. In a discussion of whether the injury-in- fact in that case was sufficiently particularized the Akins Court noted that the “informational injury” created by the FEC’s alleged statutory violation was “directly related to voting,” which is an individual right. 524 U.S. at 24-25. The Court’s observation has nothing to do with concreteness. (And there is no dispute in this case that Yershov’s injury is particularized.) Public Citizen demonstrates Yershov’s standing just as clearly. There, the injury was the denial of information in alleged violation of the Federal Advisory Committee Act. 491 U.S. at 449. The law endowed the plaintiffs with a substantive right-entitlement to certain information-and they alleged that right was invaded by the unlawful withholding of that information. Id. It is much the same here: the VPPA endows Yershov with a substantive right- the privacy of certain information-and he alleges that right was invaded by the unlawful disclosure of that information. Under Public Citizen, Yerhsov has suffered a concrete injury. In its lengthy footnote Gannett also weakly attempts to distinguish Public Citizen by suggesting that the harm there was the denial of the ability to “scrutinize the workings of government.” (Dkt. 44-1, at 11 n.2.) Again, this is not what Public Citizen says. The Court was clear that a plaintiff who was wrongly denied requested information had Article III standing simply by virtue of that denial. 491 U.S. at 449 (“Our decisions ... have never suggested that those requesting information under it need show more than that they sought and were denied specific agency records.”). And while Akins and Public Citizen, not to mention Havens Realty Corp. v. Coleman, 455 U.S. 363 (1982), were about providing information to the plaintiff, rather than to third 15 parties, that is irrelevant. The injury that permits a plaintiff to bring suit will of course differ based on the contours of the interest identified and protected by Congress. The fact that the FACA and FECA protect seekers of information while the VPPA protects the subjects of information is immaterial to the question whether the defendant has invaded the interest protected by the statute. See also, e.g., Evers v. Dwyer, 358 U.S. 202, 204 (1958) (per curiam).2 B. Courts across the country have concluded that a plaintiff has standing to sue when a statutory violation infringes on the underlying statutory interest. Applying the principle illuminated in Akins and Public Citizen and confirmed in Spokeo, courts have concluded that plaintiffs alleging invasions of concrete, statutorily protected interests have standing to sue on the basis of that invasion and nothing more, including in the VPPA context. The Third Circuit’s decision in In re Nickelodeon holds that allegations that a defendant has disclosed personally identifiable information in violation of the VPPA “involves a clear de facto injury, i.e. the unlawful disclosure of legally protected information.” 2016 WL 3513782, at *7. As it relates to standing, Nickelodeon is indistinguishable from this case.3 The Eleventh Circuit’s order in Church v. Accretive Health, Inc., 2016 WL 3611543 (11th Cir. July 6, 2016), follows in the same vein. The plaintiff there alleged that the defendant violated the Fair Debt Collection Practices Act by sending the plaintiff a dunning letter lacking disclosures required by the Act. Id. at *1. The Court concluded the plaintiff had suffered a 2 Gannett’s argument is particularly untenable because it reads Spokeo to have, without saying so, dramatically limited a slew of authority holding that Congress can create legal rights the invasion of which confers standing. See Warth v. Seldin, 422 U.S. 490, 514 (1975); Linda R.S. v. Richard D., 410 U.S. 614, 617 n.3 (1973); O’Shea v. Littleton, 414 U.S. 488, 493 n.2 (1974); Valley Forge Christian Coll. v. Am. United for Separation of Church & State, Inc., 454 U.S. 464, 487 n.24 (1982). 3 In its page-long footnote devoted to distinguishing Nickelodeon, Gannett suggests the case lacks persuasive value because the parties submitted only letter briefs addressing Spokeo. But a court has an obligation to address standing whether or not the issue is raised by the parties. See Pagan v. Calderon, 448 F.3d 16, 26 (1st Cir. 2006). Purported infirmities in the presentation of standing issues are therefore irrelevant. 16 concrete injury-in-fact. Id. at *3 (citing Havens, 455 U.S. at 373). “Through the FDCPA,” the court reasoned, “Congress has created a new right-the right to receive the required disclosures in communications governed by the FDCPA-and a new injury-not receiving such disclosures.” Id. The plaintiff suffered a concrete injury “because she did not receive the required disclosures.” Id. No further harm was alleged or necessary to support the plaintiff’s standing. A quartet of cases arising under the Telephone Consumer Protection Act, three of which found standing under Spokeo, also illustrates this framework. The court in Mey v. Got Warranty, 2016 WL 3645195, at *4 (N.D.W. Va. June 30, 2016), observed that the “invasion of privacy” effected by unwanted phone calls was a concrete harm “because Congress so clearly identified it as a concrete harm.” Similarly the court in Booth v. Appstack, Inc., 2016 WL 3030256, at *5 (W.D. Wash. May 24, 2016), concluded that the harms resulting from unwanted phone calls- including not only the invasion of privacy but also wasted time and annoyance-were concrete under Spokeo because “Congress … agreed such an injury is sufficiently concrete to support standing.” And the court in Rogers v. Capital One Bank (USA), N.A., 2016 WL 3162592, at *2 (N.D. Ga. June 7, 2016), was blunt: “a violation of the TCPA is a concrete injury.” Id. Courts dismissing claims for lack of standing have likewise engaged in the same analysis, and typically toss cases in which the alleged statutory violation is unconnected to the statutorily protected interest. The final member of the TCPA quartet is one example: In Stoops v. Wells Fargo Bank, N.A., 2016 WL 3566266 (W.D. Pa. June 24, 2016), the court recognized that, in most cases, “a plaintiff demonstrates a violation of privacy interests, and therefore injury-in-fact, after receiving automated calls.” Id. at *9. But the plaintiff there had purchased around 40 cell phones simply to accumulate claims under the TCPA, which she filed “as a business.” Id. at *9- *11. As such, “Plaintiff’s privacy interests were not violated.” Id. at *11. (In fact, her claim was 17 more like the public rights claim at issue in Lujan.) Because the violation of the plaintiff’s statutory right did not impair the plaintiff’s statutorily protected interests, she suffered no injury. In Wall v. Mich. Rental, 2016 WL 3418539 (E.D. Mich. June 22, 2016), the plaintiffs’ claims arose under RICO, and the alleged predicate statutory violations involved a Michigan law that regulated a landlord’s use of security deposits. Id. at *3. The court reasoned that the plaintiffs lacked standing because “there is no assertion that Defendants spent the deposits, used them for their own benefit, or posed a risk of doing so-the sort of harms the statute was intended to prevent.” Id. In other words, because the alleged statutory violations bore no connection to the interests protected by the statute, the plaintiffs lacked standing. Smith v. Ohio St. Univ., 2016 WL 3182675 (S.D. Ohio June 8, 2016), is to the same effect. Smith arose, like Spokeo, under the FCRA. The alleged statutory violation there was that the defendant obtained plaintiffs’ authorization to run a credit report in connection with the plaintiffs’ job applications, but failed to do so in a separate form as required by the FCRA. Id. at *1. That one-off procedural violation did not invade the interest protected by the Act because the plaintiffs’ station in the job and credit market was not at risk of being impaired (the plaintiffs got the jobs they applied for). Without any other harm, there was no concrete injury. Id. at *4. Gannett counters with two cases, but neither case can bear the weight Gannett places on it. The first is Gubala v. Time Warner Cable, Inc., 2016 WL 3390415 (E.D. Wis. June 17, 2016). The plaintiff in Gubala presented a claim for unlawful retention of personally identifiable information under the Cable Act, 47 U.S.C. § 551(e). The court dismissed the claim on the grounds that the plaintiff had not alleged “a concrete injury as a result of the defendant’s retaining his personally identifiable information.” 2016 WL 3390415, at *4. The court did not engage in the analysis dictated by Spokeo but its holding is arguably consistent with Spokeo: the 18 Cable Act, among other things, is intended “to protect the privacy of cable subscribers.” H.R. Rep. No. 98-934, at 30. That interest is invaded by the disclosure of protected information, but retention on its own does not necessarily invade that interest. True, Gubala proceeded to opine on what that plaintiff would need to show to establish injury in a disclosure action. But Gannett’s reliance on the court’s further musings is doubly misplaced: They were (1) dicta, and (2) wrong. The court was neither presented with a disclosure claim, nor did it attempt to engage in the analysis set forth in Spokeo to determine whether violation of the statutory right to nondisclosure invaded the statutory interest in preserving the privacy of certain information. See Gubala, 2016 WL 3390415, at *4.4 And the court in Khan v. Children’s Nat’l Health System, __ F. Supp. 3d __, 2016 WL 2946165 (D. Md. May 19, 2016), Gannett’s second case, was presented with a different question entirely. The question addressed by that order is whether a data breach, on its own, creates injury-in-fact. Id. at *3-*6. The court answered that question in the negative. Id. at *5. Briefly addressing the plaintiff’s claim that she had suffered injury-in-fact by virtue of alleged violations of state consumer-protection laws, the court noted that “Khan has failed to connect the alleged statutory and common law violations to a concrete harm.” Id. at *7. Whatever the court meant, Khan cannot stand for the proposition that invasion of a legally protected interest created by state statute cannot be a concrete injury-in-fact. See Diamond v. Charles, 476 U.S. 54, 65 n.17 (1986) 4 While Gubala is dubious on its own, it has at-best-uncertain application to the VPPA. As the Senate Report for the VPPA explains, the purpose of the VPPA’s regulation of the retention of information “is to reduce the chances that an individual’s privacy will be invaded.” S. Rep. No. 100-599, at 15. That Congressional declaration would appear to support standing on a material-risk-of-harm theory under Spokeo. In future-harm cases, the First Circuit has observed that “standing is more frequently found” when the risk of harm derives from a “present injury [] linked to a statute … that allegedly has been or will soon be violated.” Kerin v. Titeflex Corp., 770 F.3d 978, 982 (1st Cir. 2014). In such a case the standing inquiry is “easier” because Congress has “already identified the risk as injurious.” Id. 19 (“The Illinois Legislature, of course, has the power to create new interests, the invasion of which may confer standing. In such a case, the requirements of Art. III may be met.”).5 In short, courts recognize that a plaintiff is concretely injured when a violation of the plaintiff’s statutory right invades the plaintiff’s statutorily protected interests. See Donahue v. City of Boston, 304 F.3d 110, 117 n.6 (1st Cir. 2002) (“Congress may define an injury ... in a way that provides the basis for standing even in the absence of other injury to the plaintiff.”). Yershov therefore has standing to sue Gannett because it violated his rights under the VPPA and therefore invaded his legally protected interest in the privacy of his video-viewing choices. III. Gannett’s suggestion that Yershov’s allegations are conclusory or implausible is without merit or relevance. Finally, Gannett argues that Yershov failed sufficiently to allege that Adobe actually was able to identify him from Gannett’s disclosures and thus that Yershov has not suffered injury-in- fact. (Dkt. 44-1, at 16.) This argument is frivolous. The argument is, in the first place, foreclosed by the law of the case. The First Circuit’s opinion necessarily concludes that Yershov sufficiently alleges that Adobe can identify him. The court wrote that “according to the complaint, when Gannett makes such a disclosure to Adobe, it knows that Adobe has the ‘game program,’ so to speak, allowing it to link the GPS address and device identifier information to a certain person by name, address, phone number, and more.” 820 F.3d at 486. The fact that Adobe, under Yershov’s allegations, had the “game program”- 5 The court in Boelter v. Hearst Commc’ns, 2016 WL 3369541, at *3 & n.4 (S.D.N.Y. June 17, 2016), suggested that “economic harm” was necessary to assert a state-law statutory claim, writing that Spokeo did not “upset the Court's conclusion here that the violation of a statute by itself is insufficient to confer standing to sue.” The decision appears to follow decisions of the Southern District of New York reasoning that a state legislature’s power to create legal rights enforceable in federal court is far more limited than Congress’s. E.g., Ross v. AXA Equitable Life Ins. Co., 115 F. Supp. 3d 424, 434 (S.D.N.Y. 2015). If that is true, then the case is irrelevant. If Boelter applies to all statutory rights, then it “fundamentally underestimates Congress's ability to confer standing through statutory enactment.” Austin-Spearman, 98 F. Supp. 3d at 666. 20 that is, that Adobe could identify Yershov from Gannett’s disclosures-was central to the court’s conclusion that Gannett’s disclosures constituted “personally identifiable information.” See id. 6 “The law of the case doctrine forecloses reconsideration of issues that were decided-or that could have been decided-during prior proceedings,” including “legal rulings explicitly or implicitly decided by an earlier appellate decision in the same case.” AngioDynamics, Inc. v. Biolitec AG, 2016 WL 2610669, at *3 (1st Cir. May 6, 2016). Thus, Gannett’s argument that Yershov’s “injury” relies on a “lengthy chain of assumptions and speculation about what a third- party might do” because “nowhere does [Yershov] identify facts supporting the inference that Adobe had a profile on him” is doomed to failure. (Dkt. 44-1, at 2.) As the Court of Appeals held, “here the linkage [between disclosure and identification], as plausibly alleged, is both firm and readily foreseeable to Gannett.” Yershov, 820 F.3d at 486. Second, this argument goes to the merits. “Jurisdiction … is not defeated as [Defendant] seem[s] to contend, by the possibility that the averments might fail to state a cause of action on which [Yershov] could actually recover.” Bell v. Hood, 327 U.S. 678, 682 (1947). CONCLUSION Gannett’s motion to dismiss should be denied. Respectfully submitted, ALEXANDER YERSHOV, individually and on behalf of all others similarly situated, Dated: July 14, 2016 By: s/ J. Dominick Larry One of Plaintiff’s Attorneys 6 Perhaps anticipating a law-of-the-case objection, Gannett quotes United States v. AVX Corp., 962 F.2d 108 (1st Cir. 1992), to imply that allegations supporting standing are held to a “heightened” standard. (Dkt. 44-1, at 17-18.) But AVX Corp. predates Lujan, which holds that a plaintiff’s burden to establish standing corresponds to the plaintiff’s burden on the merits. 504 U.S. at 561. Because the First Circuit has credited Yershov’s relevant allegations in the Rule 12(b)(6) context, the allegations must be credited on this motion under Rule 12(b)(1), as well. 21 Benjamin H. Richman (admitted pro hac vice) brichman@edelson.com J. Dominick Larry (admitted pro hac vice) nlarry@edelson.com J. Aaron Lawson (application for admission pro hac vice pending) alawson@edelson.com EDELSON PC 350 North LaSalle St., 13th Floor Chicago, Illinois 60654 Tel: 312.589.6370 Fax: 312.589.6378 Erica C. Mirabella (#676750) erica@mirabellallc.com MIRABELLA LAW LLC 132 Boylston Street, 5th Floor Boston, Massachusetts 02116 Tel: 617.580.8270 Fax: 617.583.1905 Counsel for Plaintiff and the Putative Class 22 CERTIFICATE OF SERVICE I hereby certify that this document filed through the ECF system will be sent electronically to the registered participants as identified on the Notice of Electronic Filing (NEF) and paper copies will be sent to those indicated as non-registered participants on July 14, 2016. s/ J. Dominick Larry