No Private Right of Action Over Sony Data Retention

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Jimmy H. Koo

Sept. 8 — The Video Privacy Protection Act doesn't provide a private right of action for the unlawful retention of personal information, the U.S. Court of Appeals for the Ninth Circuit affirmed Sept. 4.

Judge Johnnie B. Rawlinson also said that intra-corporate disclosures aren't unauthorized disclosures under the VPPA, 18 U.S.C. § 2710.

Plaintiff Daniel Rodriguez alleged that defendants Sony Computer Entertainment America LLC and Sony Network Entertainment International LLC violated the VPPA by retaining his personally identifiable information and disclosing his information between Sony entities. In 2008, Rodriguez used Sony's PlayStation Network to rent and purchase several video games and movies. However, he allegedly didn't rent or purchase any movies after Sony changed its streaming system in April 2010.

According to Rodriguez, Sony continued to store his PII relating to the movies he had rented or purchased in violation of the VPPA. He also alleged that Sony Computer unlawfully disclosed his PII to Sony Network when Sony Network took control over the PlayStation Network. Sony Network allegedly disclosed that information to John Doe defendants for marketing and advertising purposes.

Seventh Circuit's Decision in Sterk

Based on these allegations, Rodriguez sought statutory and punitive damages and injunctive relief. Subsequently, he filed a first amended class action complaint.

In April 2012, a federal district court in California dismissed putative class claims against the Sony entities, holding that the VPPA doesn't provide a private cause of action based solely on a video rental service's wrongful retention of rental records and that the disclosures were allowed under the VPPA. Doing so, the district court relied on the U.S. Court of Appeals for the Seventh Circuit's decision in Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535 (7th Cir. 2012).

Rodriguez filed a second amended complaint, but the district court dismissed the putative class action again, finding that the plaintiff simply repackaged his data retention claims and failed to amend his claims against non-Sony defendants.

Rodriguez appealed, contending that the district court erred by concluding that the VPPA doesn't provide a private right of action and by holding that the intra-corporate disclosures were exempt from the act. The appeals court disagreed on both accounts.

Issue of First Impression

Addressing an issue of first impression, the appeals court looked to the Seventh Circuit's decision in Sterk, which rejected the argument that the VPPA provides a private right of action. The Seventh Circuit held that the VPPA created a private right of action “only for unlawful disclosure of personal information and not for unlawful retention,” the appeals court said. Further, the Seventh Circuit found that granting relief for unlawful retention would be “illogical” because “no injury would occur absent disclosure.”

After examining the legislative history and the VPPA's structure, the appeals court held that the district court properly dismissed Rodriguez's unlawful retention claim for a lack of a private right of action. It also agreed that the plain language of the VPPA exempts the intra-corporate disclosures. “Rodriguez's subsequent attempt to thwart the statutory language by artfully pleading that Sony Network assumed the management of the PlayStation Network as opposed to assuming ownership is unconvincing, especially considering that the more recent pleading completely contradicts the earlier pleading,” it said.

Circuit Judge Richard C. Tallman and District Judge Raymond J. Dearie joined the opinion.

Edelson PC and The Reis Law Firm APC represented Rodriguez. Cooley LLP represented Sony.

To contact the reporter on this story: Jimmy H. Koo in Washington at

To contact the editor responsible for this story: Katie W. Johnson at

Full text of the court's opinion is available at


Request Bloomberg Law: Privacy & Data Security