Cain et al v. Redbox Automated Retail, LLC
Filing
90
OPINION and ORDER Regarding the Parties' 46 , 52 Cross Motions for Summary Judgment. Signed by District Judge Gerald E. Rosen. (SBur)
UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF MICHIGAN
SOUTHERN DIVISION
MICHELLE CAIN and RADHA SAMPAT,
individually, and on behalf of all others
similarly situated,
Plaintiffs,
No. 12-CV-15014
Hon. Gerald E. Rosen
Magistrate Judge R. Steven Whalen
vs.
REDBOX AUTOMATED RETAIL, LLC,
Defendant.
___________________________________/
OPINION AND ORDER REGARDING THE PARTIES’ CROSS MOTIONS
FOR SUMMARY JUDGMENT
I.
INTRODUCTION
Plaintiffs Michelle Cain and Radha Sampat brought a putative class action
against Defendant Redbox, a video rental company, based on Defendant’s alleged
unlawful disclosure to third parties of certain personal information obtained during
Defendant’s rental process. Plaintiffs assert three causes of action: (1) a violation
of Michigan’s Video Rental Privacy Act (“VRPA”), M.C.L. § 445.1711 et seq.; (2)
breach of contract; and (3) unjust enrichment. The parties have now each moved
separately for summary judgment pursuant to Rule 56 of the Federal Rules of Civil
Procedure.
The parties have fully briefed both motions and have also filed
1
supplemental material with this Court.
Having reviewed and considered the
parties’ briefs, supplemental authorities, supporting documents and the entire
record of this matter, the Court has determined that the pertinent allegations and
legal arguments are sufficiently addressed in these materials and that oral argument
would not assist in the resolution of this motion. Accordingly, the Court will
decide the motions “on the briefs.” See Local Rule 7.1(e)(2), U.S. District Court,
Eastern District of Michigan. This Opinion and Order sets forth the Court’s ruling.
II.
PERTINENT FACTS
Since 2002, Defendant1 has operated a movie rental business that allows
customers to rent physical copies of DVD and Blu-ray discs through a nationwide
network of self-service kiosks. Michael Wokosin Decl., Dkt. # 46, ¶¶ 3-4. These
kiosks are located in or just outside various cooperating establishments, such as
grocery stores, retailers, drug stores, and convenience stores. Id. ¶ 4. When
renting a video at a kiosk, customers select one or more movies by title, pay by
swiping a credit card or other payment card, and then take their disc or discs,
which is dispensed automatically from the kiosk’s inventory through a slot.
During the transaction, customers are provided the option of entering their email
address in order to receive a transactional receipt and other notifications, but there
is no requirement that they do so. Id.
1
Defendant is a Delaware Limited Liability Company with its principal place of
business in Illinois. Pl.’s Compl., Dkt # 1-1, ¶ 7.
2
When a Redbox customer makes a rental, she is required to click through
several screens in order to select the disc or discs that she wants to rent and provide
for payment. See id.; see also Sterk v. Redbox Automated Retail, LLC, No. 11 C
1729, 2013 WL 4451223, at *1 (N.D. Ill. Aug. 16, 2013). After the customer has
done this, she must “check out” before receiving her disc or discs. Wokosin Decl.,
¶¶ 15-16. Depending on the date on which the disc was rented, the “check out”
screen would provide the customer with a prompt, requiring her to click a box to
finalize the transaction. Id. From June 2010 until roughly June 2011, the kiosk
would display, “By clicking on ‘Check Out’ you agree to the following terms and
conditions.” Id. ¶ 15; June 2010 Kiosk Screen Shot, Dkt. # 48-7. The “Terms of
Use,” described in more detail below, would then be displayed directly below that
language. Id. No rental transaction could be completed without the customer
affirmatively pressing the “Check Out” button and agreeing to be bound to the
Terms of Use. Id. Beginning around June 2011, depending on the particular kiosk
location, the “check out” process was slightly modified due to new software
installed on the kiosks -- each kiosk would display, “By pressing ‘pay’ or ‘use
credits’ you agree to the Terms.” Wokosin Decl., ¶¶ 16-17, June 2011 Kiosk
Screen Shot, Dkt. # 48-8. Below that language was a button labeled “Terms &
Privacy” that allowed a customer to go to the Terms of Use and Privacy Policy to
review them before completing the transaction. Id. As discussed in more detail
3
below, there were two different versions of the Terms of Use and Privacy Policy in
place during the period in which the transactions at issue in this case took place:
one effective from roughly June 2010 to June 2011, and one effective from roughly
June 2011 to July 2013. Both sets of agreements, though containing different
language, have the same import as relevant here.
The Terms of Use, discussed in more detail in the analysis section below,
contain detailed contractual language, including required charges, return timing,
limitations on use, and procedures for disputes. The Terms also contain an Illinois
choice of law clause, which the parties do not dispute. Importantly, the Terms
refer on several occasions to the applicable Privacy Policy, which describes the
ways in which the customer authorizes Redbox to use certain “personal
information” and other data collected by Redbox during the transaction.
As
explained below, these agreements form the crux of the debate in this case.
Redbox also contracts with various vendors to aid it in various business
functions, “such as providing customer call center services, generating rental
receipts that are emailed to customers at their request, sending marketing
information to Redbox consumers, and using anonymized customer rental
information for internal purposes.” Wokosin Decl. ¶ 32. In order to do this,
Redbox shares with those vendors various bits of information associated with
customer transactions. At issue here is information that Redbox shared with four
4
vendors: ExactTarget, Experian Marketing Solutions (“Experian”), Adobe Insight
(“Adobe”), and Stream Global Services (“Stream”).
First, Redbox employs ExactTarget to “generate[] rental and transactional
receipts . . . when a movie is rented from a kiosk.” Id. ¶ 40. “Given the nature of
the email transaction receipt, ExactTarget, by definition, has movie transactional
information (because it is sending the transactional receipt for that movie), and it
also receives the specific email address that the customer provided for that
transaction. Redbox does not provide the name or any other information about that
customer.” Id. ¶ 42. More specifically, as Plaintiff alleges, ExactTarget receives
each “customer’s email address, video title rented (or returned), kiosk location, and
last four digits of the customer’s credit card . . . in order to enable ExactTarget to
send emails and ads to that customer.” Pl.’s Resp. to Def.’s Mot. for Summ. J.,
Dkt. # 61, at 3; see also Sarah Hatch Decl., Dkt. # 53-2, ¶¶ 8, 10, 12, 14.
Second, Redbox employs Experian to provide “marketing email services,”
which includes promotional emails sent to customers regarding new Redbox
releases, and to “track promotion code redemptions.” Wokosin Decl. ¶¶ 36-37.
According to Redbox, it does not share any personal rental history with Experian;
instead it shares “limited customer information,” including a customer’s email
address and name. Id. Plaintiffs contend, however, that in order to perform its
marketing email functions, Experian is provided with each customer’s “birthdate,
5
email address, credit card zip code, date of first rental, preferred genre, date of
most recent rental, location of the kiosk last rented from, total number of rentals
last made, total number of lifetime rentals, and the dates of any interactions with
customer service.” Pl.’s Resp. to Def.’s Mot. for Summ. J., Dkt. # 61, at 4; see
also Redbox-Experian Data Stream, Dkt. 55-15.2
Third, Redbox employed Adobe to provide “analytics services” that “allow
Redbox to query customer behavior.” Wokosin Decl. ¶ 35. Redbox stopped using
Adobe’s services in November 2012. Id. Redbox asserts that “customer rental
information sent to Adobe Insight [was] anonymized such that it is impossible to
determine what movie any particular individual rented.” Accordingly, Redbox
asserts that it did not provide Adobe with any customer names, email addresses,
credit card numbers, addresses, or any other information that might identify a
person.
Id.
Plaintiff, however, maintains that Plaintiffs’ personal and rental
information -- including email address, credit card zip code, date of most recent
rental, location of most recent rental, total rentals made, and total lifetime rentals -were also transmitted to Adobe to perform analytics, though the deposition excepts
that Plaintiffs cite for this proposition do not seem to support it. Pl.’s Resp. to
Def.’s Mot. for Summ. J., at 5; Wokosin Dep., Dkt. # 55-9, at 86; Hoersten Dep.,
Dkt. # 55-4, at 177.
2
Though both parties seem to agree that Experian receives each renter’s name, no
name appears to be present in the data stream provided by Plaintiffs.
6
Finally, Redbox employs Stream “to perform . . . customer service related
functions, including providing call center support for customers. Redbox began
using Stream in February 2010 so that it could more effectively handle incoming
requests from customers as Redbox grew in size.” Id. ¶ 44. Stream provides
Redbox with “customer service agents” who answer customer service calls on
behalf of Redbox. Id. ¶ 45. According to Redbox, these agents “have the ability to
access a customer’s personal rental history from Redbox’s servers upon the request
of that customer in order to process and respond to that consumer’s service related
request or inquiry. Stream does not possess a copy of Redbox’s customer dataset,
but instead only has access to it through credentials that Redbox administers and
controls.” Id. ¶ 46. As Plaintiffs characterize this, however, Redbox provides
Stream “searchable access to . . . customer data -- including name, email, last four
digits of credit card, state, zip code, and movie rented -- which pulls up a list of
customers matching that criteria and their rental histories.” Pl.’s Resp. to Def.’s
Mot. for Summ. J., Dkt # 61, at 5-6. Plaintiffs also provide some indication that
Stream employees use Redbox customer information for training purposes, though
it is not clear that any such training uses non-anonymous data. Id. at 6.
Plaintiffs here are both citizens of Michigan who have used the services of
Redbox in the past, with Plaintiff Sampat renting a total of 31 times from
November 2010 to January 2013, and Plaintiff Cain renting over 100 times from
7
July 2010 to July 2013. Id. ¶¶ 9-10. 3 On November 11, 2012,4 Plaintiffs filed a
complaint in this Court, predicating jurisdiction on the Class Action Fairness Act
of 2005, 28 U.S.C. § 1332(d), 5 and alleging claims based on Redbox’s practices on
behalf of themselves and a putative class defined as
[a]ll Michigan residents who had their Personal Viewing Information
disclosed by Redbox to a third party “service support” vendor or any
other third party without written consent.
Pl.’s Compl., Dkt. # 1-1, ¶ 43. Plaintiffs claim that Redbox’s conduct in disclosing
information to ExactTarget, Experian, Adobe, and Steam violates Michigan’s Video
Rental Privacy Act (“VRPA”), M.C.L. § 445.1711 et seq., which provides various
limitations on sellers or renters of media from disclosing information relating to
those sales or rentals. Id. ¶¶ 51-64. Plaintiffs also allege breach of contract and
unjust enrichment under Michigan law. Id. ¶¶ 65-85.
3
Plaintiff’s complaint focuses on only a subset of these rentals. See Pl.’s Compl.,
Dkt. # 1-1, ¶¶ 27, 35.
4
As these dates make clear, and at Defendant repeatedly notes in its briefs,
Plaintiffs continued to rent from Redbox even after the filing of this lawsuit.
5
Defendant did not challenge subject matter jurisdiction under CAFA, though
Plaintiffs’ various briefings and filings do not make entirely explicit how the $5
million amount in controversy requirement will be met in this case. The VRPA
allows a plaintiff to recover “[a]ctual damages, including damages for emotional
distress, or $5,000.00, whichever is greater.” M.C.L. § 445.1715. Assuming each
Plaintiff in the class could only recover the $5,000 minimum, the class would need
to contain at least 1,000 Plaintiffs in order to reach the CAFA threshold. Given
Defendant’s high volume of transactions, however, this is not an unreasonable
class size, and presumably, the violations the named Plaintiffs allege here would
apply to every transaction that Redbox makes in Michigan.
8
Prior to the filing of the instant motions, Defendant filed a Motion to
Dismiss, asserting that Plaintiffs lacked standing to bring the suit under the VRPA
because they failed to plead any damages; that the vendors that Defendant dealt
with are Defendant’s agents and that disclosure to them was not a violation of the
VRPA; that all disclosures occurred in the “ordinary course of business,” which
Defendant asserted was excepted under the VRPA; that Plaintiffs consented to
disclosure of their personal information; and that Plaintiffs’ claims were barred by
a one-year limitation period. See Def.’s Mot. to Dismiss, Dkt. # 10. The Court
rejected Defendant’s standing argument, and held that the remaining arguments
required factual development and were best left for a Rule 56 motion. See Opinion
and Order Denying Def.’s Mot. to Dismiss, Dkt. # 27.
The parties have now filed cross motions for summary judgment. Defendant
re-raises all of the claims that it raised in its Motion to Dismiss, now armed with a
factual record. See Def.’s Mot. for Summ. J., Dkt. # 46. Plaintiffs reject each of
those arguments in their own Motion for Partial Summary Judgment, and assert
that the Court should rule in their favor on the issue of liability.
III.
A.
DISCUSSION
Rule 56 Standard
Through their present motions, both parties seek summary judgment in their
favor pursuant to Rule 56 of the Federal Rules of Civil Procedure. Under Rule 56,
9
summary judgment is proper if the moving party “shows that there is no genuine
dispute as to any material fact and the movant is entitled to judgment as a matter of
law.” Fed. R. Civ. P. 56(a). As the Supreme Court has explained, “the plain
language of Rule 56[ ] mandates the entry of summary judgment, after adequate
time for discovery and upon motion, against a party who fails to make a showing
sufficient to establish the existence of an element essential to that party’s case, and
on which that party will bear the burden of proof at trial.” Celotex Corp. v. Catrett,
477 U.S. 317, 322 (1986). In addition, where a moving party seeks an award of
summary judgment in its favor on a claim or issue as to which it bears the burden
of proof at trial, that party’s “showing must be sufficient for the court to hold that
no reasonable trier of fact could find other than for the moving party.” Calderone
v. United States, 799 F.2d 254, 259 (6th Cir. 1986) (emphasis and citation
omitted).
In deciding a motion brought under Rule 56, the Court must view the
evidence in a light most favorable to the nonmoving party. Pack v. Damon Corp.,
434 F.3d 810, 813 (6th Cir. 2006). Yet, the nonmoving party may not rely on mere
allegations or denials, but must “cit[e] to particular parts of materials in the record”
as establishing that one or more material facts are “genuinely disputed.” Fed. R.
Civ. P. 56(c)(1). Further, “the mere existence of a scintilla of evidence that
supports the nonmoving party’s claims is insufficient to defeat summary
10
judgment.”
Pack, 434 F.3d at 814 (alteration, internal quotation marks, and
citation omitted).
B.
Analysis
This case involves relatively straightforward allegations of violations of the
VRPA, which, as the court previously noted, “is a state statute that lacks any
significant litigation history.”
Halaburda v. Bauer Pub. Co., LP, 2013 WL
4012827, at *2 (E.D. Mich. Aug. 6, 2013). The VRPA is a short act, containing
only five sections.
The first section defines “Customer,” “Employee,” and
“Employer” for the purposes of the Act (none of these definitions are at issue
here). The second provides the VRPA’s primary protections, broadly limiting the
extent to which persons selling, renting, or lending various media items may
disclose details regarding those transactions:
Except as provided in section 3 or as otherwise provided by law, a
person, or an employee or agent of the person, engaged in the business
of selling at retail, renting, or lending books or other written materials,
sound recordings, or video recordings shall not disclose to any person,
other than the customer, a record or information concerning the
purchase, lease, rental, or borrowing of those materials by a customer
that indicates the identity of the customer.
M.C.L. § 445.1712. The third section then provides various exceptions to section
2, including that “a record or information described in section 2 may be
disclosed . . . [w]ith the written permission of the customer.” M.C.L. § 445.1713.
Last, section 4 classifies any violation as a criminal misdemeanor, and section 5
11
provides for a civil cause of action for violation of the statute, allowing for
“[a]ctual damages, including damages for emotional distress, or $5,000.00,
whichever is greater,” as well as litigation and attorney fees. M.C.L. §§ 445.17141715.
In their Motions, the parties raise five distinct issues regarding Defendant’s
alleged violations.
First, Defendant contends that no disclosure of the kind
prohibited by the VRPA took place to any vendor except Stream; Plaintiff
disagrees, asserting that disclosures made to ExactTarget, Experian, and Adobe
also qualify as violations under the VRPA. Second, Defendant contends that
Plaintiffs, and by extension all Redbox customers, consented to any disclosure
through of the Terms of Use that customers must agree to before renting a movie.
Third, Defendant contends that disclosures were made in the “ordinary course of
business,” which Defendant asserts is an implied exception to the VRPA that is
incorporated from the federal Video Privacy Protection Act of 1988 (“VPPA”), 18
U.S.C. § 2710(b). Fourth, Defendant argues that the claims are time-barred by the
one-year limitation period provided for in the Terms of Use. Fifth, Defendant
reasserts that Plaintiffs lack standing because they have not suffered an injury in
fact.6 Defendant’s success on any one of these grounds functions to bar Plaintiffs’
6
The Court previously addressed, and rejected, this argument, in its Opinion and
Order Denying Defendant’s Motion to Dismiss, Dkt. # 26. Defendant re-raises the
12
recovery, and accordingly, as discussed below, the Court need not reach all of the
issues.
1.
Plaintiffs Provided Consent for Defendant to Disclose Information
to ExactTarget, Experian, Adobe, and Stream
Defendant asserts that, regardless of any information allegedly disclosed to
companies that it collaborates with, Plaintiffs provided “written permission” within
the meaning of the VRPA by agreeing to the Terms and Conditions that all users of
Redbox kiosks must agree to when renting discs. See Def.’s Mot. for Summ. J., at
16-19. Plaintiffs admit that they followed the required process regarding Redbox’s
terms and conditions when using the kiosks, but they challenge that this did not
constitute “written permission” within the meaning of the VRPA for three reasons:
First, under Michigan law, Plaintiffs are not bound by Redbox’s
Terms of Use, an electronic document they were unable to print or
store during their kiosk transactions. Second, even if Plaintiffs were
bound by the Terms of Use, it does not . . . incorporate the Privacy
Policy. Third, even if the Terms of Use did incorporate the Privacy
Policy, Redbox fails to establish that Plaintiffs provided written
permission to disclose their protected information as required by the
VRPA.
Pl.’s Resp. to Def.’s Mot. for Summ. J., Dkt.; # 61, at 16-17. The Court addresses
each point in turn.
A.
Plaintiffs Are Bound by the Terms of Use
issue merely to preserve it for any future appeal. Def.’s Mot. for Summ. J., Dkt. #
46, at 23-24. Accordingly, the Court does not address the issue again here.
13
First, Plaintiffs assert that the Terms of Use provided in all Redbox
transactions are not enforceable against Plaintiffs because “[u]nder the Uniform
Electronic Transactions Act, which has been enacted into Michigan law, an
electronic document cannot be enforced against a party who is unable to store or
print that record.” Pl.’s Resp. to Def.’s Mot. for Summ. J., at 17. The Uniform
Electronic Transactions Act (“UETA”), M.C.L. § 450.831 et seq., which has been
adopted by nearly every state, is a model law developed by the Uniform Law
Commissioners that “represen[ts] the first national effort at providing some
uniform rules to govern transactions in electronic commerce that should serve in
every state.” Michigan House Fiscal Agency Legislative Analysis, House Bill
5537 (Nov. 6, 2000). The Commissioners described the bill as “a procedural
statute” with the fundamental purposes of “establish[ing] the legal equivalence of
electronic records and signatures with paper writings and manually-signed
signatures” and “removing perceived barriers to electronic commerce.” Id. The
act itself states that it should be construed to “[b]e consistent with reasonable
practices concerning electronic transactions and with the continued expansion of
those practices.” M.C.L. § 450.836(b).
Plaintiffs assert two related theories under the UETA. First, they argue that
because Redbox customers cannot “print or otherwise store a copy of the Terms of
Use,” those Terms violate the UETA and accordingly the Terms are not binding.
14
Second, they assert that they have not supplied “written permission” within the
meaning of the VRPA because the UETA requires that such information must be
provided in a form capable of retention by the recipient. Specifically, they point to
sections 8(1) and (3) of the UETA, which state:
(1) If parties have agreed to conduct a transaction by electronic means
and a law requires a person to provide, send, or deliver information in
writing to another person, the requirement is satisfied if the
information is provided, sent, or delivered in an electronic record
capable of retention by the recipient at the time of receipt. An
electronic record is not capable of retention by the recipient if the
sender or its information processing system inhibits the ability of the
recipient to print or store the electronic record.
***
(3) If a sender inhibits the ability of a recipient to store or print an
electronic record, the electronic record is not enforceable against the
recipient.
M.C.L. § 450.838(1), (3). Plaintiffs contend that subsection (1) requires Redbox to
show that each time a rental is consummated, “an electronic record capable of
retention” is created and sent to Redbox from the kiosk used. And they further
contend that subsection (3) means that the Terms of Use are not enforceable
against them because, at each kiosk used, the Terms of Use are in a form that is
neither able to be stored nor printed.
There are several problems with Plaintiffs’ theory. First, and perhaps most
importantly, is the fact that Plaintiffs expressly agreed, in the Terms of Agreement,
to an Illinois choice of law clause. See June 2010 Terms of Use, Dkt. # 48-5, at
15
C00007 (“These Terms of Use, your access and use of the Kiosks, and the
relationship between you and us are governed by the laws of the state of Illinois.”);
June 2011 Terms of Use, Dkt. # 48-9, at C00027 (“These terms and the
interpretation of these terms will be governed and construed under the laws of the
State of Illinois.”). Critically, Illinois is one of the few states that has not adopted
the UETA, and Plaintiffs point to no indication that the UETA should govern this
transaction, especially as to Plaintiffs’ theory that the Michigan UETA renders the
Terms of Use not binding against them. 7
But even if the Michigan UETA were binding in this transaction, there is no
reason to believe that Defendant’s conduct violates it. The relevant provisions of
the law here require that where a particular “law requires a person to . . . deliver
information in writing to another person,” then that information must be “capable
of retention by the recipient at the time of receipt.”
M.C.L. § 450.838(1).8
Plaintiff initially attempts to argue that the inability of Redbox customers to retain
a copy of the Terms of Use at the kiosk itself violates this provision of the UETA.
7
Illinois does have its own similar Act, called the Electronic Commerce Security
Act. 5 ILCS 175/1-101; see also Princeton Indus., Products, Inc. v. Precision
Metals Corp., No. 13 C 7160, 2015 WL 4880843, at *5 (N.D. Ill. Aug. 17, 2015)
(describing Electronic Commerce Security Act). That Act contains some
provisions like the UETA, but does not contain provisions with effective language
like that which Plaintiff attempts to rely on here. Even if it did, Plaintiff has
waived any such argument by failing to raise it in its briefing.
8
Much like the VRPA, there is relatively little caselaw regarding the UETA, and
no Michigan court, at least as far as the Court could find, has interpreted the
statute.
16
Pl.’s Resp. to Def.’s Mot. for Summ. J., at 17 (“Redbox can point to nothing in the
record suggesting that customers can print or otherwise store a copy of the Terms
of Use to which Redbox purports to bind them.”). Plaintiff is confused on this
point -- there is no law asserted that requires Redbox to deliver any information to
Plaintiff in writing. Accordingly, the UETA places no obligation on Redbox to
allow Plaintiffs to retain the Terms of Use -- Redbox is the recipient of the
information that must be “delivered in writing.”
Plaintiff eventually realizes this, and makes the better argument in their
brief -- stating that “Redbox fails to establish that pressing a button on a kiosk
creates ‘an electronic record capable of retention’ by Redbox, i.e., a record of
Plaintiffs’ permission that can be printed or stored.” Id. at 17. The problem for
Plaintiff is that this is simply not factually true, at least as based on the record here
-- indeed, information regarding the transaction is in fact retained by Defendant at
the close of every transaction -- such retention led to this very lawsuit. Plaintiff
seems to imply that every transaction with every customer entered into by
Defendant would have to result in separate and unique storage of the exact same
agreement, i.e., a separate copy of the Terms of Use and Privacy Policy for each
individual transaction. Not only would this be incredibly wasteful -- resulting in
millions of copies of the exact same Terms of Use and Privacy Policy document -it does not fit with the actual language of the statute, which requires only that the
17
information sent be “capable of retention.” The information sent here, via the
customer’s pressing of either the “pay” or “use credits” button on the kiosk, is
unquestionably capable of being retained by Redbox, and is in fact actually
retained in the various bits of information at issue here.
Plaintiffs fail to
understand that these provisions of the UETA serve essentially as a protector of the
statute of frauds in electronic documents, ensuring that written assent is capable of
being retained where such written assent is required by law. Even if the UETA
were applicable here, Defendant’s procedures surely would have satisfied it.
Finally, independent of the UETA, Plaintiffs claim that they never provided
assent to the Terms of Use when making their rentals. This argument is similarly
unavailing. The parties agree that before a rental can be completed on one of
Redbox’s kiosks, the customer is confronted with a screen that states “By pressing
‘pay’ or ‘use credits’ you agree to the Terms.” E.g., June 2011 Kiosk Screen Shot,
Dkt. # 48-8.
The parties disagree, however, on whether a customer would
understand that “Terms” means the Terms of Use. Plaintiffs note that the final
screen also includes the following terms, which they argue could confuse
customers as to which terms apply to a sale:
Daily rental charges don’t include applicable tax. Discs kept after 9
p.m. the next day, and each day after, are subject to additional daily
rental charges. If you keep a disc for the maximum rental period, it’s
yours to keep, and no further charges apply. See complete Terms for
the rules for renting from Redbox. Maximum rental period: DVD (25
days), Blu-ray® (23 days), Games (30 days).
18
June 2011 Kiosk Screen Shot, Dkt. # 48-8.
The Court is not persuaded by
Plaintiffs’ argument, as even a cursory glance at the text would alert a customer to
the fact that there are other terms incorporated into the contract. The screen
explicitly tells customers to “[s]ee complete Terms,” which quite obviously signals
that more complete terms exist elsewhere. Further, this screen clearly capitalizes
“Terms,” demarcating the word as a proper noun and making clear that the
“complete Terms” are the Terms of Use.
Accordingly, the Court finds that
Plaintiffs clearly assented to the Terms of Use when making their rentals a Redbox
kiosks.
B.
Redbox’s Privacy Policy is Partially Incorporated in
the Terms of Use
Next, Plaintiffs argue that, even if they assented to the Terms of Use and
those Terms of Use were binding against them, Redbox’s Privacy Policy, which
contains the language that potentially allows it to disclose the information at issue
here, was not contained within those Terms. Pl.’s Resp. to Def.’s Mot. for Summ.
J., at 19-20. Defendant concedes that the Terms of Use language itself is silent on
the subject of information disclosure, but notes that the Terms of Use references
the Privacy Policy on multiple occasions, and accordingly, argues that the Privacy
Policy is incorporated by reference into the Terms of Use.
19
As noted above, Illinois law governs the contract.9 Under Illinois law, “[i]n
order for a contract to incorporate all or part of another document by reference, the
reference must show an intention to incorporate the document and make it part of
the contract.” Bd. of Managers of Chestnut Hills Condo. Ass’n v. Pasquinelli, Inc.,
354 Ill. App. 3d 749, 755, 822 N.E.2d 12, 17 (2004). However, “[t]o be construed
as incorporating an entire second document, a contract must display an intention to
completely adopt that document, not merely require compliance with specified
portions.” Hayes v. M & T Mortg. Corp., 906 N.E.2d 638, 641 (Ill. App. Ct. 2009)
(emphasis added) (citation omitted).
Here, the Terms of Use mentions the Privacy Policy four times: (1) on the
first kiosk screen, stating “[p]lease also read the Redbox Privacy Policy
below . . . ;” (2) on the fifth kiosk screen, stating “[p]lease also review Redbox’s
privacy policy below;” (3) on the eighth kiosk screen, in the “User Comments and
Postings” section, stating “[e]xcept as otherwise described in the Redbox Privacy
Policy, any User Content will be treated as non-confidential and non-proprietary
and we will not be liable for any use or disclosure of User Content;” and (4) on the
sixteenth kiosk screen, in the “Indemnification” section, stating that customers
“agree to . . . hold [Defendant] harmless from and against any and all claims . . .
that directly or indirectly arise from or are otherwise directly or indirectly related
9
On this issue, the parties agree that Illinois law controls. See Pl.’s Resp. to Def.’s
Mot. for Summ. J., at 20 n.11.
20
to: . . . (g) [Defendant’s] use of [customer] information as permitted under these
Terms, the Privacy Policy, or any other written agreement . . . .” June 2011 Terms
of Use, Dkt. # 48-9, at C01648, C01652, C01655, C01663.10 Reviewing the
language, the Court finds that the Terms of Use do not display a clear intention to
“completely adopt” the Privacy Policy in its entirety. Compare Hayes v. M & T
Mortgage Corp., 906 N.E.2d 638, 641 (Ill. App. Ct. 2009), with Gillespie Cmty.
Unit Sch. Dist. No. 7, Macoupin Cnty. v. Wight & Co., 2012 WL 7037447, at *7
(Ill. App. Ct. Sep. 11, 2012) (finding completely incorporated second document
where the first document explicitly states that the two will “together constitute the
‘Agreement’”).
Instead, it merely requires compliance “only with specified
portions” of the Privacy Policy, namely in the fourth reference. McWhorter v.
Realty World-Star, Inc., 525 N.E.2d 1205, 1208 (Ill. App. Ct. 1988). The first two
references simply ask customers to read the Privacy Policy -- they do not state that
it will be binding in any way. The third relates to User Content 11 and only
10
An earlier version of the Terms of Use, effective from approximately June 2010
to June 2011, more directly referenced the Privacy Policy, stating, “Our personal
information practices are governed by our Privacy Policy, the terms of which are
incorporated herein. Please review our Privacy Policy on our Website at
www.redbox.com to understand our practices.” June 2010 Terms of Use, Dkt. #
48-5, at C00006.
11
“User Content” is content that is created in “user comment areas, message
boards or Other Interactive areas on the Redbox Platforms” which are provided “to
give users of the Redbox Platforms a forum to express their opinions and share
their ideas, information, materials, and other user-generated content.” June 2011
Terms of Use, at C00023.
21
describes the Privacy Policy as an exception to the rule stated in the Terms of Use.
The fourth reference, however, explicitly indicates that Defendant cannot be held
liable for use of customers’ information in accordance with the Privacy Policy.
The language of that clause is explicit, and accordingly, Plaintiffs have consented
to any “use of [customer] information as permitted under . . . the Privacy Policy.”
June 2011 Terms of Use, Dkt. # 48-9, at C01663. In that sense, even though, even
though there is not clear language adopting or merging the Privacy Policy with the
Terms of Use, any activity that is consented to under the Privacy Policy will also
be consented to by accepting the Terms of Use.
C.
By Accepting the Terms of Use, Plaintiffs Provided Written
Permission to Allow Defendant to Disclose Information for
the Purposes Outlined in the Privacy Policy
Last, Plaintiffs argue that “even if [they] assented to and could be bound by
the Terms of Use, and even if the Terms of Use incorporated the Privacy Policy,
none of that establishes that Plaintiffs provided their “written permission” to
disclose their protected information.” Pl.’s Resp. to Def.’s Mot. for Summ. J., at
20-21. 12
Assessment of this argument requires examination of the relevant
provisions of the Privacy Policy. The Policy states:
Our Use of Information Collected Through the Platforms
12
Plaintiffs make no argument, other than their UETA argument described above,
that acceptance of the Terms of Use by clicking is not “written” within the
meaning of the VERPA.
22
Redbox may use information collected through the Redbox Platforms,
including your Personal Information, to: (1) allow you to participate
in features we offer or to provide related customer service, including,
without limitation, to respond to your questions, complaints or
comments; (2) tailor content recommendations and offers we display
to you; (3) process a rental or other transaction you initiate; (4)
provide you with information, products or services that you have
requested or that we think may interest you; (5) process your
registration, including verifying your e-mail address is active and
valid; (6) improve the Redbox Platforms or our services and for
internal business purposes; . . . .
June 2011 Privacy Policy, Dkt. # 48-12, at C01666 (emphasis added). 13 At the
outset, Plaintiffs note that “Personal Information” is defined within the privacy
13
As with the Terms of Use, there was an earlier version of the Privacy Policy that
was effective from approximately June 2010 to June 2011. That version contained
substantially similar language to the version effective in June 2011:
Companies may from time to time be engaged by Redbox to perform
a variety of functions, such as fulfilling orders, assisting with
promotions, providing technical services for our web site, etc. These
companies may have access to personal information if needed to
perform such functions. However, these companies may only use
such personal information for the purpose of performing that function
and may not use it for any other purpose.
Redbox does not sell, transfer or disclose personal information to third
parties. However, we may on occasion send marketing information
on behalf of one of our business partners about products or services
they provide that may be of interest to you. Redbox will not share
your personal information with such partners but rather will send a
mailing or email on behalf of those partners.
June 2010 Privacy Policy, Dkt. # 48-6, at C00008. Though the June 2011 Privacy
Policy applied for the majority of the transactions at issue here, the June 2010
Privacy Policy did apply for a few of the early transactions. For the purposes of
23
policy as “information that identifies you as a specific individual, such as your
name, phone number, e-mail address or payment information.” Id. at C01667.
Plaintiffs then assert that “[n]owhere does the Privacy Policy state that it will
disclose the other kinds of protected information that were disclosed here, such as
movie titles, kiosk locations, and dates of rentals. Thus, even if the Privacy Policy
applied, it in no way establishes that customers like Plaintiffs consented to the
disclosure of information protected by the VRPA but not listed in the Privacy
Policy’s definition of Personal Information.” Pl.’s Resp. to Def.’s Mot. for Summ.
J., at 19. What Plaintiffs fail to recognize, however, is that the Policy allows for
use of “information collected through the Redbox Platforms, including your
Personal Information.” In the Policy, “Personal Information” is a subset of the
“information collected through the Redbox Platforms,” and therefore any
permission to disclose information would concern the broader term. See, e.g.,
BLACK’S LAW DICTIONARY (10th ed. 2014) (defining “include” to mean “[t]he
participle including typically indicates a partial list . . . But some drafters use
phrases such as including without limitation and including but not limited to -which mean the same thing.”).
Thus, the critical task is determining what is the “information collected
through the Redbox Platforms.” “Redbox Platforms” is defined in the first sentence
this analysis, the Court finds the language similar enough to warrant the same
conclusion.
24
of the Privacy Policy, a sentence that is somewhat difficult to parse for a definition.
The relevant language is as follows:
This Privacy Policy applies to the Redbox web sites that post this
policy (including, without limitation, Redbox.com) (each a “Site”),
and to information collected through Redbox kiosks and Redbox
mobile applications, including any available interactive features,
downloads, applications, widgets or other outlets made available
through a Redbox web site or that interact with a Redbox web site,
and that post or include a link to this Privacy Policy, regardless of
whether accessed via computer, mobile device or otherwise
(collectively, the “Redbox Platforms”).
June 2011 Privacy Policy, Dkt. # 48-12, at C01666 (emphasis added). Although
the above language is somewhat confusing, the definition of “Redbox Platforms”
only makes sense if it includes the following three items: Redbox web sites,
Redbox kiosks, and Redbox mobile applications.
Given this definition, the
relevant Privacy Policy section can be read as allowing Defendant to use
information collected through the kiosks to be used to “provide related customer
service,” “tailor content recommendations and offers,” “process . . . rental[s] or
other transaction[s] [the customers] initiate,” “provide [customers] with
information, products or services that [Redbox] think[s] may interest [customers],”
“process [customers’] registration,” or “improve the Redbox Platforms or
[Redbox’s] services and for internal business purposes.” Id.
Armed with that definition, we can now examine whether Plaintiffs
consented to all of the disclosures that they alleged in their Complaint and
25
supported with evidence in the record. Plaintiffs have alleged, and provided some
evidence, that Defendant discloses to ExactTarget information including a
customer’s email address and movie title, for the purpose of sending emails to
confirm certain customer actions, and also to show ads for snacks, Redbox
promotions, and social media. Sending emails to customers to confirm actions
falls squarely within “provid[ing] related customer service,” just as ads for
offerings and social media fall within “provid[ing] [customers] with information,
products or services that [Redbox] think[s] may interest [customers],” both of
which are functions that Plaintiffs agreed to by accepting the Terms of Use.
As to Experian and Adobe, Plaintiffs allege that Defendant discloses
information containing a customer’s name, email address, date of first rental,
preferred genre, date of most recent rental, and total number of lifetime rentals, all
for the purposes of marketing emails, tracking, and data analytics. Certainly, the
marketing emails fall under “provid[ing] [customers] with information, products or
services that [Redbox] think[s] may interest [customers].” The tracking and data
analytics are less clear, but they appear to fall under either “improv[ing] the
Redbox Platforms or [Redbox’s] services and for internal business purposes” or
“tailor[ing] content recommendations and offers.” For example, the data analytics
performed by third party vendor Adobe are specifically used, as Plaintiffs assert,
for the purpose of determining “what e-mails have gone out [to customers] and the
26
corresponding data associated with those e-mails” regarding how users react to the
emails with rental habits. Pl.’s Mot. for Summ. J., Dkt. # 53, at 12. This fits
within the category of “improv[ing] the Redbox Platforms or [Redbox’s] services
and for internal business purposes,” or “tailor[ing] content recommendations and
offers.”
Finally, third party vendor Stream allegedly has access to a database
containing customer names and rental history. Plaintiffs’ own filings admit that
this database is for the purpose of providing customer service. Pl.’s Resp. to Def.’s
Mot. for Summ. J., at 5-6. Plaintiffs’ further assertion that Stream employees have
free access to customer data does nothing to take that access outside of customer
service. And Plaintiffs’ assertion that Stream trainees use customers’ data for
training purposes further falls under “improv[ing] the Redbox Platforms or
[Redbox’s] services and for internal business purposes.”
In whole, while Redbox undoubtedly engaged in internal sharing of
Plaintiffs’ personal and rental information, Plaintiffs clearly gave consent for all of
the sharing that occurred. The palpable message of the Privacy Policy is that it
allows virtually all sharing of information within Redbox’s organization and
partner organizations for the limited internal purpose of benefitting Redbox’s
services to customers and overall business. The Policy further makes clear that
any disclosure of customer information for an external purpose is not consented -27
the type of disclosure that the VRPA is clearly most concerned with. Redbox
clearly could not, for example, give or sell any customer data to a third party for a
use unrelated to Redbox’s own business. But Plaintiffs have provided no evidence
that there was any such disclosure; instead, all of their evidence relates to
Redbox’s sharing of information within its own regulated system.
Accordingly, Plaintiffs’ claims that Defendant disclosed information to third
parties in violation of the VRPA must fail. Defendant has shown that its Terms of
Use and portions of its Privacy Policy apply to every rental transaction, and that
these documents provide the written permission required by the VRPA. Because
Plaintiffs’ claims of breach of contract and unjust enrichment are contingent on the
success of its VRPA claims, those must fail as well.14
IV.
CONCLUSION
For all the foregoing reasons,
IT IS HEREBY ORDERED that Defendant’s Motion for Summary
Judgment (Dkt. # 46) is GRANTED.
IT IS FURTHER ORDERED that and Plaintiffs’ Motion for Partial
Summary Judgment (Dkt. # 52) is DENIED.
14
Because Plaintiffs’ consent to the Terms of Use precludes their recovery in full,
the Court need not resolve the parties’ remaining arguments, though they raise
interesting issues regarding the scope of the VRPA, especially as it relates to
disclosure to potential agents (rather than public disclosure) and to disclosure that
occurs in the “ordinary course of business,” a recognized exception under the
related VPPA. These important issues will remain for another day.
28
IT IS FURTHER ORDERED that Plaintiffs’ Complaint is DISMISSED
WITH PREJUDICE.
IT IS SO ORDERED.
Dated: September 30, 2015
s/Gerald E. Rosen
Chief Judge, United States District Court
I hereby certify that a copy of the foregoing document was served upon the parties
and/or counsel of record on September 30, 2015, by electronic and/or ordinary
mail.
s/Julie Owens
Case Manager, (313) 234-5135
29
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?