Redbox Disclosure of Customer Data To Call Center Is Lawful, 7th Cir. Rules

By Katie W. Johnson

Oct. 24 — Video rental service Redbox Automated Retail LLC's disclosure of customer information to a third party that handles customer service inquiries doesn't violate the Video Privacy Protection Act, the U.S. Court of Appeals for the Seventh Circuit affirmed Oct. 23.

When the VPPA was enacted in 1988, the “ordinary course” of a rental store's business would have included customer service interactions between the store's staff and the customer, Judge Joel M. Flaum said. For that reason, Redbox's disclosure of customer information to a company to which it outsourced customer service fell within the VPPA's “ordinary course of business” exception. The VPPA regulates the release of video tape rental or sales records.

Although the court affirmed summary judgment in favor of Redbox, it ruled that the plaintiffs had standing simply on the basis of their allegation that Redbox disclosed their personal information in violation of the VPPA.

The standing issue in this ruling is important because it demonstrates that courts are “continuing to go down the path of granting Article III standing based on statutory damages,” Christin McMeley, a partner at Davis Wright Tremaine LLP, in Washington, told Bloomberg BNA Oct. 24.

The good news for businesses is that the court recognized how the nature of video rentals have changed since the VPPA was enacted, as well as the “operational support that’s needed to effectuate that change,” McMeley added.

The appellate court's decision marks the second time it has addressed Redbox's handling of customer information in this case. In 2012, the court ruled that the VPPA didn't provide a private cause of action based solely on a video rental service's wrongful retention of rental records.

Customer Service Operations Outsourced

Redbox operates automated self-service kiosks at which customers can rent DVDs and Blu-ray discs, and it outsources its customer service operations to Stream Global Services. To enable Stream to fields inquiries from Redbox customers through a call center, Redbox provides the company with access to its customer service database, the court explained.

Plaintiffs Kevin Sterk and Jiah Chung sued Redbox, alleging that it unlawfully disclosed and retained their personally identifiable information (PII) in violation of the VPPA, 18 U.S.C. § 2710, which prohibits a “video tape service provider” from knowingly disclosing a consumer's PII and requires the destruction of PII when it is no longer needed.

In March 2012, the Seventh Circuit reversed a ruling by the U.S. District Court for the Northern District of Illinois denying Redbox's motion to dismiss. The appellate court held that Redbox customers couldn't pursue a claim for liquidated statutory damages for mere data retention.

On remand a few months later, the district court partially granted Redbox's renewed motion to dismiss, rejecting the plaintiffs' attempt to predicate their VPPA data retention claim on the Stored Communications Act.

In August 2013, the district court granted summary judgment in Redbox's favor, concluding that the company's disclosure of customer PII to Stream fell under the VPPA's ordinary course of business exception because it constituted “request processing”. The plaintiffs appealed.

Plaintiffs Have Standing …

The Seventh Circuit first rejected Redbox's argument that a “mere technical violation” of the VPPA was insufficient to establish standing.

The court said that “ ‘technical' violations of the statute (i.e., impermissible disclosures of one's sensitive, personal information) are precisely what Congress sought to illegalize by enacting the VPPA.”

“By alleging that Redbox disclosed their personal information in violation of the VPPA, Sterk and Chung have met their burden of demonstrating that they suffered an injury in fact that success in the suit would redress,” the court said.

… but Disclosure Is Permissible

The court then rejected the plaintiff's argument that Redbox's disclosure of customer data to Stream didn't fit within the VPPA's ordinary course of business exception. The statute defines “ordinary course of business” as “only debt collection activities, order fulfillment, request processing, and the transfer of ownership.”

In combination with the VPPA's definition of PII—“information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider”—the plaintiffs argued that “request processing” refers only to requests for “specific video materials” and thus doesn't include the customer service that Stream provides.

The court disagreed, finding that the plaintiffs overlooked part of the statutory language. “Restoration of ‘or services' to the definition of PII, however, forecloses plaintiffs' strained reading altogether, since it is difficult to fathom ‘a request for service' in the video rental context that does not implicate the customer service that Stream provides for Redbox,” the court said.

It found that the disclosure of the information fell within the VPPA's ordinary course of business exception. At the time the statute was enacted, “we can safely assume that Congress contemplated customer service as part and parcel of the ordinary rental experience,” the court said. “That Redbox has replaced most live customer service interactions with a computer interface does not change this.”

The court also ruled that the plaintiffs failed to sufficiently raise the issue of Redbox's alleged disclosure of customer PII to information storage company Iron Mountain Inc. at summary judgment.

Judges Daniel A. Manion and Michael S. Kanne also served on the appellate panel.

Edelson PC represented the plaintiffs. Dentons US LLP represented Redbox.

To contact the reporter on this story: Katie W. Johnson in Washington at

To contact the editor responsible for this story: Barbara Yuill at

Full text of the court's opinion is available at