On Friday September 2, the United States District Court for the District of Massachusetts ruled against Gannett Company, Inc. (“Gannett”) in a case where Gannett allegedly violated the Video Privacy Protection Act (“VPPA”) by collecting app users’ video viewing data and sharing such data with another company. U.S. District Judge F. Dennis Saylor IV denied Gannett’s motion to dismiss the suit for lack of standing by the plaintiff, Alexander Yershov, stating that “the intangible harm allegedly suffered by Yershov from Gannett’s alleged disclosure of his [personally identifiable information] is a concrete injury in fact.” This Article III standing decision, which analyzes the “injury in fact” prong of the standing requirements established in the recent Spokeo v. Robins U.S. Supreme Court decision in the context of alleged VPPA violations, held that statutory VPPA violations themselves can result in legally cognizable injuries, even if the plaintiff suffers no additional harm.

When faced with an Article III standing issue in the context of an alleged Fair Credit Reporting Act (“FCRA”) violation in Spokeo, the Court reiterated that “to establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete or particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” However, in the context of privacy law violations, the requirement that a plaintiff show a “concrete” injury can pose problems when attempting to establish standing. When privacy violations do not directly result in monetary harm, it raises the question as to whether the mere violation of the plaintiff’s privacy is concrete enough of a harm to establish that the plaintiff has suffered an injury in fact. The Spokeo Court approached this question by starting with the axiom that “[i]n determining whether an intangible harm constitutes an injury in fact, both history and the judgment of Congress play important roles.” Nevertheless, the Spokeo Court determined that, due to the particular history and intent of Congress in enacting the FCRA, the plaintiff in that case “cannot satisfy the demands of Article III by alleging a bare procedural violation [of the FCRA].”

In the wake of Spokeo, the U.S. Court of Appeals for the Third Circuit addressed this “concrete harm” issue in the case of In re: Nickelodeon Consumer Privacy Litigation, wherein children under the age of thirteen brought a putative class action lawsuit against an Internet search engine operator alleging that the operator unlawfully collected their personal information in violation of the VPPA, amongst other privacy laws. The Third Circuit in that case held that the factual allegations were sufficient to establish that the plaintiffs suffered an injury in fact because the plaintiffs’ information was disclosed to a third party. The U.S. Court of Appeals for the Seventh Circuit reached a similar conclusion when faced with this issue in the case of Sterk v. Redbox Automated Retail, LLC, stating that “[b]y alleging that [the defendant] disclosed their personal information in violation of the VPPA, [the plaintiffs] have met their burden of demonstrating that they suffered an injury in fact that success in this suit would redress.” In both In re: Nickelodeon and Sterk, the courts cited to the history of the VPPA and intent of Congress in enacting that statute to support those courts’ determinations that the plaintiffs in each case had shown they suffered a sufficiently concrete harm simply by alleging the defendants had violated the VPPA.

Here, Gannett’s motion to dismiss hinged primarily on an interpretation of the Spokeo decision that Yershov would have to show more than that his information was transmitted from one company to another to establish that he suffered an injury in fact.  Instead, according to Gannett, he would have to show he incurred some actual harm as a result of such transmission. Like the Third and Seventh Circuits, Judge Saylor disagreed with this interpretation, stating in his decision that “by enacting the VPPA, [Congress] elevated an otherwise nonactionable invasion of privacy into a concrete, legally cognizable injury.” Thus, in Judge Saylor’s determination, the congressional history of the VPPA was sufficiently distinguished from that of the FCRA to allow plaintiffs to establish Article III standing for an alleged violation of the VPPA, without a showing of actual harm, even though the Spokeo Court held that a bare procedural violation of the FCRA would not satisfy the requirements for Article III standing.

While Judge Saylor’s decision did not determine the outcome of the case, it shows a trend for how the injury in fact prong of an Article III standing analysis may be determined by courts with respect to alleged violations of the VPPA. Under this interpretation of Spokeo, plaintiffs need only show that a violation of the VPPA occurred to satisfy the standard for establishing injury in fact. Plaintiffs suing under the VPPA would still have to show that the injury in fact is fairly traceable to the challenged conduct of the defendant and that the injury is likely to be redressed by a favorable judicial decision in order to satisfy the constitutional requirements under Article III for standing; however, these additional standing elements were not contested by Gannett. This serves as notice for service providers that handle the personally identifiable information of its users and customers in the context of videos and similar audio visual mediums that  noncompliance with the VPPA could open the door to more litigation for violations of the statute. Whether mere violations of the VPPA are sufficient to impose liability upon a company which violates that statute, or what else must be shown by the plaintiff for him or her to win damages, is yet to be clearly determined. Judge Saylor’s decision, however, provides further arguments for plaintiffs’ counsel that a plaintiff’s lack of showing of any additional harm on top of the VPPA statutory violations is not sufficient grounds for a defendant to dismiss a VPPA case.