Yershov v. Gannett Satellite Info. Network, Inc.

• Citation: 820 F.3d 482
• Decision Date: 29 April 2016
• Docket Number: No. 15–1719.,15–1719.
• Parties: Alexander YERSHOV, Plaintiff, Appellant, v. GANNETT SATELLITE INFORMATION NETWORK, INC., d/b/a USA Today, Defendant, Appellee.
• Court: United States Courts of Appeals. United States Court of Appeals (1st Circuit)

820 F.3d 482

Alexander YERSHOV, Plaintiff, Appellant

v.GANNETT SATELLITE INFORMATION NETWORK, INC., d/b/a USA Today, Defendant, Appellee.

No. 15–1719.

United States Court of Appeals, First Circuit.

April 29, 2016.

Ryan D. Andrews, with whom Roger Perlstadt and Edelson PC were on brief, for appellant.

Marc J. Zwillinger, with whom Jeffrey G. Landis, Jacob A. Sommer, ZwillGen PLLC, Heather B. Repicky, and Nutter McClennen & Fish LLP were on brief, for appellee.

Before THOMPSON, Circuit Judge, SOUTER, Associate Justice,^* and KAYATTA, Circuit Judge.

KAYATTA

, Circuit Judge.

Plaintiff Alexander Yershov brings this putative class-action lawsuit against Defendant Gannett Satellite Information Network, Inc. (“Gannett”) for allegedly disclosing information about Yershov to a third party in violation of the Video Privacy Protection Act of 1988, Pub. L. No. 100–618, § 2, 102 Stat. 3195

(codified as amended at 18 U.S.C. § 2710 ) (“VPPA” or the “Act”). In ruling on a motion to dismiss the complaint under Federal Rule of Civil Procedure 12(b)(6), the district court found that the information Gannett disclosed concerning Yershov was “personally identifiable information” (“PII”) under the VPPA, 18 U.S.C. § 2710(a)(3), but that Yershov was not a “renter, purchaser, or subscriber” of or to Gannett's video content and, therefore, not a “consumer” protected by the Act, id. § 2710(a)(1), (b)(1). We agree with the district court that the information disseminated by Gannett concerning Yershov was PII, but we also find that the complaint adequately alleges that Yershov was a “consumer” under the VPPA. We therefore reverse the dismissal of the complaint and remand this case for further proceedings.

I.

We begin with the facts alleged in the complaint, simply assuming them to be true. Davis v. Coakley, 802 F.3d 128, 130 (1st Cir.2015)

. Gannett is an international media company that produces news and entertainment programming, including the newspaper USA Today. In addition to offering USA Today in printed form, Gannett digitally offers this content through a proprietary mobile software application called the “USA Today Mobile App” (the “App”). The App allows users to access news and entertainment media content, including videos, on their mobile devices.

To install the App on an Android device, users must visit the Google Play Store—an online digital media platform run by Google—and then download the App to their device. When opened for the first time, the App presents a screen that seeks the user's permission for it to “push” or display notifications on the device. After choosing “Yes” or “No,” the user is directed to the App's main user interface. During this process, the App does not seek or obtain the user's consent to disclose anything about the user to third parties. Nevertheless, each time the user views a video clip on the App, Gannett sends to Adobe Systems Incorporated (“Adobe”) (1) the title of the video viewed, (2) the GPS coordinates of the device at the time the video was viewed, and (3) certain identifiers associated with the user's device, such as its unique Android ID.¹

Adobe is an unrelated third party that offers data analytics and online marketing services to its clients by collecting information about consumers and their online behavior. A unique identifier such as an Android ID allows Adobe “to identify and track specific users across multiple electronic devices, applications, and services” that a consumer may use. Adobe takes this and other information culled from a variety of sources to create user profiles comprised of a given user's personal information, online behavioral data, and device identifiers. The information contained in these profiles may include, for example, the user's name and address, age and income, “household structure,” and online navigation and transaction history. These digital dossiers provide Adobe and its clients with “an intimate look at the different types of materials consumed by the individual” that “may reveal, or help create inferences about,” a user's traits and preferences. They also allow Adobe's clients, such as Gannett, “to, among other things, accurately target advertisements to its users.”

In late 2013, Yershov downloaded and installed the App on his Android mobile device. Yershov does not allege that he opted to receive push notifications, so we will assume that he did not. Yershov then used the App to read news articles and watch numerous video clips. At no time did he consent, agree, or otherwise permit Gannett to disclose any information about him to third parties, nor did Gannett provide him with the opportunity to prevent such disclosures. Nevertheless, each time Yershov watched a video clip on the App, Gannett disclosed to Adobe the title of the viewed video, Yershov's unique Android ID, and the GPS coordinates of Yershov's device at the time the video was viewed. Using this information, Adobe was able to identify Yershov and link the videos he had viewed to his individualized profile maintained by Adobe.

II.

We review de novo a district court's decision to dismiss a complaint for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6)

. Cardigan Mountain Sch. v. N.H. Ins. Co., 787 F.3d 82, 84 (1st Cir.2015). In conducting this review, “we accept as true all well-pled facts alleged in the complaint and draw all reasonable inferences in [the plaintiff's] favor.” Evergreen Partnering Grp., Inc. v. Pactiv Corp., 720 F.3d 33, 36 (1st Cir.2013). A plaintiff's allegations are sufficient to overcome a Rule 12(b)(6) motion if they contain “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 569, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007).

Congress enacted the VPPA in response to a profile of then-Supreme Court nominee Judge Robert H. Bork that was published by a Washington, D.C., newspaper during his confirmation hearings. S. Rep. No. 100–599, at 5

(1988), reprinted in 1988 U.S.C.C.A.N. 4342–1. The profile contained a list of 146 films that Judge Bork and his family had rented from a video store. Id. Members of Congress denounced the disclosure as repugnant to the right of privacy. Id. at 5–8. Congress then passed the VPPA “[t]o preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar audio visual materials.” Id. at 1.

To effectuate this purpose, Congress in the VPPA created a civil remedy against a “video tape service provider” for “knowingly disclos[ing], to any person, personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1)

.² The statute defines the two terms at issue in this case as follows:

(1) the term “consumer” means any renter, purchaser, or subscriber of goods or services from a video tape service provider;

...

(3) the term “personally identifiable information” includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider[.]

Id. § 2710(a)(1), (3)

.

A.

We agree with the district court that the information about Yershov that Gannett disclosed to Adobe fits the definition of PII. The statutory term “personally identifiable information” is awkward and unclear. The definition of that term (“identifies a person as having [obtained a video]”) adds little clarity beyond training our focus on the question whether the information identifies the person who obtained the video. See id. § 2710(a)(3). Nevertheless, the language reasonably conveys the point that PII is not limited to information that explicitly names a person. Had Congress intended such a narrow and simple construction, it would have had no reason to fashion the more abstract formulation contained in the statute. See United States v. New Eng. Coal & Coke Co., 318 F.2d 138, 144 (1st Cir.1963)

. Moreover, the language Congress did use to define PII begins with the word “includes.” 18 U.S.C. § 2710(a)(3). That word normally implies that the proffered definition falls short of capturing the whole meaning. See

In re Fahey, 779 F.3d 1, 5–6 (1st Cir.2015) (explaining how its interpretation satisfied “the premise that when a statute states that the universe of X ‘includes' Y, one normally presumes that Y is merely an example of what is in X, and that X includes more than Y”). Here, we also have the benefit of the official Senate Report expressly stating that the drafters' aim was “to establish a minimum, but not exclusive, definition of personally identifiable information.” S. Rep. No. 100–599, at 12. This makes sense. Many types of information other than a name can easily identify a person. Revealing a person's social security number to the government, for example, plainly identifies the person. Similarly, when a football referee announces a violation by “No. 12 on the offense,” everyone with a game program knows the name of the player who was flagged.

Here, the complaint and its reasonable inferences describe what for very many people is a similar type of identification, effectively revealing the name of the video viewer. To use a specific example, imagine Gannett had disclosed that a person viewed 146 videos on a single device at 2 sets of specified GPS coordinates. Given how easy it is to locate a GPS coordinate on a street map,³ this disclosure would enable most people to identify what are likely the home and work addresses of the viewer (e.g., Judge Bork's home and the federal courthouse). And, according to the complaint, when Gannett makes such a disclosure to Adobe, it knows that Adobe has the “game program,” so to speak, allowing it to link the GPS address and device identifier information to a certain person by name, address, phone number, and more. While there is certainly a point at which the linkage of information to identity becomes too uncertain, or too dependent on too much yet-to-be-done, or unforeseeable detective work, here the linkage, as plausibly alleged, is both firm...