Kevin Sterk v. Redbox Automated Retail, LLC

Redbox Automated Retail, LLC outsources its customer service operations to Stream Global Services, which fields Red-box customer inquiries through a customer service call center. To enable Stream to perform this function, Redbox provides Stream with access to its customer database, the disclosure of which Kevin Sterk and Jiah Chung allege violates the Video Privacy Protection Act, 18 U.S.C. § 2710. The district court granted summary judgment in Redbox’s favor, concluding that Redbox’s actions fall within the statutory exception for disclosures in the ordinary course of business — more precisely, disclosures incident to “request processing.” We agree, and therefore affirm the district court’s decision.

I. Background

Redbox operates automated self-service kiosks — typically located at grocery stores, *621 convenience stores, or drug stores — at which customers rent DVDs and Blu-ray discs with a debit or credit card for a daily rental fee. Although Redbox owns and operates the machines, the company outsources certain “back office” functions to various service providers, including Stream. Stream provides customer service to Redbox users when, for example, a customer encounters technical problems at a kiosk and requires help from a live person. In such an event, the Redbox customer can call the phone number listed on the machine to speak to a customer service representative to troubleshoot the issue. If resolution of the customer’s issue requires accessing that customer’s video rental history — for instance, if a Redbox kiosk charges the customer’s credit card, but fails to dispense the selected movie— that call center representative (a Stream employee) will do so.

So that Stream can perform Redbox’s customer service functions, Redbox has granted Stream access to the database in which Redbox stores relevant customer information. To enable customer service representatives to perform their jobs capably, Stream trains its employees on how to use the database to access the information necessary to respond to customer inquiries. Plaintiffs object both to Stream’s ability to access customer rental histories when prompted by a customer call and Stream’s use of customer records during the course of employee training exercises. In plaintiffs’ view, Redbox’s disclosure of customer information to Stream for these purposes violates the Video Privacy Protection Act (“VPPA”).

Enacted in 1988 in response to the Washington City Paper’s publication of then-Supreme Court nominee Robert Bork’s video rental history (a DC-area video store provided it to a reporter), S.Rep. No. 100-599, at 5 (1988), reprinted in 1988 U.S.C.C.A.N, 4342, the VPPA prohibits “video tape service provider[s]” like Red-box from “disclosing], to any person, personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). Personally identifiable information (“PII”) “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” Id. § 2710(a)(3). But the VPPA provides several exceptions to the disclosure prohibition, allowing disclosure of a consumer’s video rental history when the consumer has provided written consent, when the party seeking disclosure has obtained a warrant or court order, or (relevant to this case) when the disclosure is incident to the video tape service provider’s ordinary course of business. Id. § 2710(b)(2). The statute instructs that “ ‘ordinary course of business’ means only debt collection activities, order fulfillment, request processing, and the transfer of ownership.” Id. § 2710(a)(2).

Plaintiffs Kevin Sterk and Jiah Chung are Redbox users who contend that Red-box’s disclosure of their PII to Stream is not incident to Redbox’s ordinary course of business. Initially, Sterk filed this lawsuit without Chung, alleging in his original complaint only that Redbox violated the VPPA’s “destruction of old records” provision, which requires video tape service providers to destroy PII “as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected and there are no pending requests or orders for access to such information.” 18 U.S.C. § 2710(e). After Sterk’s case was consolidated with a similar suit, Redbox moved to dismiss Sterk’s complaint, arguing that the VPPA does not provide a private right of action for mere “information retention.” Sterk then filed an amended complaint, which Chung *622 joined, adding the unlawful disclosure claim at issue here. Redbox again moved to dismiss. The district court denied the motion but certified for interlocutory appeal the issue of whether the VPPA’s private right of action extended to improper retention claims. We took up the issue and reversed the district court, holding that the VPPA does not provide a damages remedy for a retention claim, and so plaintiffs could only seek injunctive relief from Redbox for its alleged failure to timely destroy their information. See Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535, 538-39 (7th Cir.2012).

While the interlocutory appeal on the retention issue was pending, discovery regarding the disclosure claims proceeded. Fact discovery commenced on December 21, 2011, and originally was set to close on April 6, 2012. Over Redbox’s opposition, plaintiffs moved to extend discovery by a month, and the district court obliged. During this discovery period, we issued our opinion on the retention issue, and the district court granted plaintiffs leave to file another amended complaint. After denying in part and granting in part Redbox’s renewed motion to dismiss the retention claims, the district court reopened discovery as to both the disclosure and retention claims for an additional period of time. During discovery, Redbox produced over a thousand pages of documents in response to forty-eight document requests; responded to forty-two interrogatories; and produced witnesses for three depositions, including two Rule 30(b)(6) witnesses. In the end, Redbox produced information concerning every vendor to which Redbox discloses customer information — including the precise information shared to each — and plaintiffs successfully obtained third-party discovery from Stream. Against that backdrop, Redbox moved for summary judgment.

Plaintiffs objected to Redbox’s summary judgment motion as premature, arguing (pursuant to Federal Rule of Civil Procedure 56(d)) that they needed more discovery in order to adequately respond to Redbox’s arguments. Despite their contention, plaintiffs pointed to just two issues concerning which they desired more discovery: (1) information regarding the “technical” method by which “Stream queries Redbox’s database,” and (2) information relating to whether Stream accesses all, or just a portion, of Redbox’s customer records. The district court denied plaintiffs’ request for additional discovery and granted summary judgment as to all counts in Redbox’s favor. As to plaintiffs’ improper disclosure claim (the only claim at issue in this appeal), the district court concluded that Redbox’s disclosure of its customers’ PII to Stream constitutes “requést processing” and thus falls within the VPPA’s “ordinary course of business” exception. Plaintiffs appeal the summary judgment decision, as well as the district court’s refusal to permit additional discovery before ruling. Plaintiffs also complain that the district court overlooked a footnote in their opposition brief concerning Iron Mountain, a vendor with which Red-box stores backup tapes of its data. Though victorious below, Redbox takes issue with the district court’s standing analysis.

II. Discussion

We review the issue of standing de novo. Sierra Club v. Franklin Cnty. Power of III, LLC, 546 F.3d 918, 925 (7th Cir.2008). We also review the district court’s summary judgment ruling de novo, construing all facts and drawing all reasonable inferences in the light most favorable to plaintiffs (the non-moving party). Mullin v. Temco Mach., Inc., 732 F.3d 772, 776 (7th Cir.2013). The district court’s denial of plaintiffs’ Rule 56(d) motion for addi *623 tional discovery is reviewed for an abuse of discretion. Davis v. G.N. Mortg. Corp., 396 F.3d 869, 885 (7th Cir.2005).

A. Standing

Redbox argues that plaintiffs lack standing because they did not suffer an injury in fact when Redbox disclosed their PII to Stream. “[T]he irreducible constitutional minimum of standing contains three elements.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). First, a plaintiff must have suffered an injury in fact — that is, “an invasion of a legally protected interest which is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical.” Id. (internal citations and quotation marks omitted). Next, that injury must be fairly traceable to the challenged action of the defendant — ie., there must be a causal connection between the injury and the conduct. Id. Finally, it must be likely that the injury will be redressed by a favorable decision. Id. at 561, 112 S.Ct. 2130. Here, there is no doubt that plaintiffs have alleged an “invasion of a legally protected interest,” which this suit would remedy if successful. See Hays v. City of Urbana, III., 104 F.3d 102, 103 (7th Cir.1997) (“What is necessary for standing is a concrete injury, redressable by success in the litigation.”). Plaintiffs have demonstrated that Redbox, in fact, disclosed their PII to Stream and argue that such disclosure violates the VPPA.

Redbox characterizes plaintiffs’ claim as an allegation that Redbox committed a “mere technical violation” of the statute, which Redbox argues is insufficient to establish standing. But “technical” violations of the statute (i.e., impermissible disclosures of one’s sensitive, personal information) are precisely what Congress sought to illegalize by enacting the VPPA. As we have said, Congress “may not lower the threshold for standing below the minimum requirements imposed by the Constitution,” but Congress does have the power to “enact statutes creating legal rights, the invasion of which creates standing, even though no injury would exist without the statute.” Kyles v. J.K Guardian Sec. Servs., Inc., 222 F.3d 289, 294 (7th Cir.2000) (internal quotation marks omitted). Accordingly, Redbox appears to confuse the separate issue of whether plaintiffs have suffered financial harm as a result of the disclosure with Article Ill’s injury-in-fact requirement for purposes of constitutional standing to bring suit in the first place. 1 By alleging that Redbox disclosed their personal information in violation of the VPPA, Sterk and Chung have met their burden of demonstrating that they suffered an injury in fact that success in this suit would redress.

B. Redbox’s Disclosures to Stream

In opposing Redbox’s motion for summary judgment, plaintiffs focused on a 1988 Senate Judiciary Report that purportedly speaks to the type of disclosure that Congress intended to permit under the VPPA. The Senate Report reads:

This subsection takes into account that video tape service providers may use third parties in their business operations. For example, debt collection is often conducted by third parties, with disclosure of credit histories made to third party credit bureaus. Debt collection is subject to other Federal laws: *624 disclosures for that purpose continue to be governed by those laws.

This subsection also allows disclosure to permit video tape service providers to use mailing houses, warehouses, computer services, and similar companies for marketing to their customers. These practices are called “order fulfillment” and “request processing.”

S.Rep. No. 100-599, at 14 (1988), reprinted in 1988 U.S.C.C.A.N 4342. Seizing on this last paragraph, plaintiffs argued to the district court that the Senate Judiciary Committee intended to group disclosures incident to “order fulfillment” and “request processing” (two of the four disclosure exceptions) together and define them as disclosures only to “mailing houses, warehouses, computer services, and similar companies for marketing to their customers.” Based on that self-serving interpretation of Congress’s intent, plaintiffs contended that the VPPA permits disclosure only to third-parties engaged in (1) debt collection, (2) transfer of ownership, and (3) marketing — effectively reducing the number of statutory disclosure exceptions from four to three. The district court was not persuaded.

Highlighting the Supreme Court’s stance that “[ejxtrinsic materials have a role in statutory interpretation only to the extent that they shed a reliable light on the enacting Legislature’s understanding of otherwise ambiguous terms,” and the Court’s recognition that committee reports can “give unrepresentative committee members ... both the power and the incentive to attempt strategic manipulations of legislative history to secure results they were unable to achieve through the statutory text,” the district court saw no persuasive reason to effectively rewrite a federal statute based on an ambiguous committee report. Sterk v. Redbox Automated Retail, LLC, 2013 WL 4451223, at *4-5 (N.D.I11. Aug. 16, 2013) (quoting Exxon Mobil Corp. v. Allapattah Servs., Inc., 545 U.S. 546, 568, 125 S.Ct. 2611, 162 L.Ed.2d 502 (2005)). In the district court’s view: “[i]t is undisputed that the only functions Stream performs for Red-box are customer support services and that Stream performs these services only in response to customers’ requests for information. It is difficult to imagine a more obvious illustration of ‘request processing’ given the ordinary meaning of thát term.” Id. at *4.

■ On appeal, plaintiffs abandon their contention that “order fulfillment” and “request processing” are synonymous with marketing activities. Instead, they argue that Congress intended to limit “request processing” to the processing of requests for specific video materials. The VPPA defines four terms, in the following order: (1) “consumer,” (2) “ordinary course of business,” (3) “personally identifiable information,” and (4) “video tape service provider.” 18 U.S.C. § 2710(a). As discussed, “ordinary course of business” means “debt collection activities, order fulfillment, request processing, and the transfer of ownership.” Id. § 2710(a)(2). “Personally identifiable information,” the next defined term, “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” Id. § 2710(a)(3) (emphasis added). Plaintiffs urge us to read the former definition as modifying the latter and conclude that “request processing” refers only to requests for “specific video materials.” As plaintiffs see it, a customer makes a request for specific video materials when he selects a particular movie to rent while standing at a Redbox kiosk. By plaintiffs’ logic, therefore, Redbox kiosks process all customer “requests” (as they narrowly construct that term), and so any inquiries made by a consumer who calls Redbox’s *625 customer service line (operated by Stream) necessarily occur outside of the ordinary course of Redbox’s business.

There are several problems with plaintiffs’ reasoning. First, we are unconvinced that just because PII includes information that identifies a person as having “requested” materials, the phrase “request processing” — which appears earlier in the statute — is necessarily limited to that type of request. But even assuming that the phrase is constrained in that way, plaintiffs mischaracterize the VPPA’s definition of “personally identifiable information,” overlooking a critical piece of the statutory language. Again, PII is defined as inclusive of “information which identifies a person as having requested or obtained specific video materials or services from a video tape service -provider.” 18 U.S.C. § 2710(a)(3) (emphasis added). Only by ignoring the words “or services” are plaintiffs able to craft a reading of the statute that excludes customer service requests from “request processing” with at least some degree of plausibility. Restoration of “or services” to the definition of PII, however, forecloses plaintiffs’ strained reading altogether, since it is difficult to fathom “a request for service” in the video rental context that does not implicate the customer service that Stream provides for Redbox.

Moreover, common sense counsels against plaintiffs’ statutory construction. Plaintiffs argue that “request processing” refers only to a Redbox kiosk’s computerized response when a consumer selects a movie using the kiosk’s touchscreen, while “order fulfillment” describes the kiosk’s dispensing of the selected movie after processing the customer’s request. But Congress enacted the VPPA in 1988, before the advent of automated kiosks (or internet-based rental companies or streaming services). Thus, when the law was passed, Congress assuredly had a brick-and-mortar video rental store in mind. The “ordinary course” of that rental store’s business would have included typical interactions between a customer and the store clerk, who in many cases would have accessed an individual customer’s rental history, address, and other personal information during the checkout process. And if that customer experienced technical problems with his rented VHS upon his return home from the store, he would have called the store to complain or seek a refund. He also would have called to complain if the store overcharged his credit card. All of these interactions, occurring within the store’s ordinary course of business, constitute that customer’s “request processing” and “order fulfillment,” if ordinary meaning is assigned to those terms. Accordingly, plaintiffs’ attempt to carve out customer service from a video rental company’s “ordinary course of business” is unpersuasive. Congress, of course, did not draft the VPPA only with automated video rental kiosks in mind, and so it defies logic to construe the statute’s terms as if it had. Besides, though a typical visit to a Redbox kiosk may not necessitate an interaction between a customer and a live service representative, some do — which is precisely why Redbox provides its customers with the phone number for its call center. And when the VPPA was enacted, we can safely . assume that Congress contemplated customer service as part and parcel of the ordinary rental experience. That Redbox has replaced most live customer service interactions with a computer interface does not change this.

Plaintiffs argue that even if responding to customer service requests is incident to Redbox’s ordinary course of business, Red-box violates the VPPA by preemptively disclosing its entire customer database to Stream, rather than waiting until Stream receives a call from a Redbox user and *626 disclosing to Stream just the PII for that customer. In other words, plaintiffs draw a distinction between disclosure of customer PII that is proactive (in anticipation of customer requests) and disclosure that is reactive (in response to an individual customer’s call). We find' that distinction meaningless, because the permissibility of disclosure under the VPPA turns on the underlying purpose for which Redbox provides the information to a third party. And whether proactive or reactive, Red-box’s purpose for disclosing the information to Stream is the same.

Our decision in Graczyk v. West Publ’g Co., 660 F.3d 275 (7th Cir.2011), underscores our conclusion. Graczyk involved a similar challenge under the Driver’s Privacy Protection Act (“DPPA”). There, the plaintiffs alleged- that defendant West Publishing acquired their personal information from motor vehicle records for resale in violation of the DPPA. Id. at 276-77. The DPPA prohibits state DMVs from disclosing personal information about individuals that the DMV obtained in connection with a motor vehicle record, and it prohibits private individuals from knowingly obtaining or disclosing such information. Id. at 277. But like the VPPA, the DPPA includes several disclosure exceptions. Id. The Graczyk plaintiffs alleged that West Publishing obtained personal information from state DMVs, stored it in a database, and then sold the information to others. Id. at 279. The plaintiffs, however, did not challenge the lawfulness of West Publishing’s disclosures; instead, the plaintiffs argued that the act of storing the information in a database (prior to a lawful disclosure) was illegal under the DPPA. Id. We disagreed, noting that “[tjhere is no meaningful difference in terms of West Publishing’s purpose between the practice the plaintiffs approve — obtaining the records each time West- Publishing receives a valid request — -and the practice they object to — compiling the records first and then disclosing them in response to a valid request. In both cases, West Publishing’s ‘purpose’ for obtaining the records” is the same. Id. at 279-80. .

That reasoning applies with equal force here. If it is permissible to disclose PII to Stream in order to respond to a customer’s call, there is nothing objectionable about Redbox’s wholesale disclosure of information pertaining to all customers, for use in the event of such a call. Likewise, plaintiffs take issue with Stream’s use of customer PII during training exercises in advance of such calls, but — again—the purpose underlying Redbox’s disclosure of the PII is proper. Disclosure of customer information for training purposes may not be incident to a specific customer service request, but it is, of course, incident to the request processing function that Stream serves.

C. Redbox’s Disclosures to Iron Mountain

Plaintiffs also complain on appeal that the district court’s summary judgment ruling ignored Redbox’s disclosure of customer PII to Iron Mountain, the vendor with which Redbox apparently stores backup tapes containing company records. In their brief in opposition to Redbox’s motion for summary judgment, plaintiffs included a single reference to Iron Mountain, complaining in a footnote that Red-box’s summary judgment motion “inexplicably ignore[d]” the fact that Redbox stores backup tapes containing company data with the storage vendor (a fact revealed by a Rule 30(b)(6) deponent during the course of discovery). PL Opp. to MSJ p. 4 n. 1 [194]. In conclusory fashion, plaintiffs represented in their opposition brief that Redbox does not store these backup tapes in the ordinary course of business, but, nonetheless, announced that *627 their brief would focus solely on Redbox’s disclosures to Stream. Plaintiffs, therefore, did not sufficiently raise this issue at summary judgment and, thus, failed to preserve it for appeal. See Puffer v. Allstate Ins. Co., 675 F.3d 709, 718 (7th Cir. 2012) (“[Arguments that have been raised may still be waived on appeal if they are underdeveloped, conclusory, or unsupported by law.”); APS Sports Collectibles, Inc. v. Sports Time, Inc., 299 F.3d 624, 631 (7th Cir.2002) (“It is not this court’s responsibility to research and construct the parties’ arguments, and conclusory analysis will be construed as waiver.”) (internal citation and quotation marks omitted); United States v. Dunkel, 927 F.2d 955, 956 (7th Cir.1991) (“A skeletal ‘argument,’ really nothing more than an assertion, does not preserve a claim.”).

Moreover, plaintiffs seem to misunderstand the burden of proof at summary judgment. We have been clear that “Federal Rule of Civil Procedure 56 imposes an initial burden of production on the party moving for summary judgment to inform the district court why a trial is not necessary.” Modrowski v. Pigatto, 712 F.3d 1166, 1168 (7th Cir.2013) (citing Celotex Corp. v. Catrett, 477 U.S. 317, 325, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986)). That burden “may be discharged by showing ... that there is an absence of evidence to support the nonmoving party’s case.” Id. (internal quotation marks omitted). Upon such a showing, the non-movant (here, plaintiffs) then must “make a showing sufficient to establish the existence of an element essential to that party’s case.” Id. Put another way, the nonmovant must “go beyond the pleadings (e.g., produce affidavits, depositions, answers to interrogatories, or admissions on file) to demonstrate that there is evidence ‘upon which a jury could properly proceed to find a verdict’ in [their] favor.” Id. at 1169 (quoting Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 251, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986)). Plaintiffs not only failed to make this showing at summary judgment, they expressly renounced their opportunity to do so.

In their reply brief on appeal, plaintiffs argue that “Redbox had the burden of establishing that the undisputed facts showed that it did not disclose Plaintiffs’ personally identifiable [sic] to anyone in violation of the VPPA.” Reply Br. 19. Yet summary judgment is proper against “a party who fails to make a showing sufficient to establish the existence of an element essential to that party’s case and on which that party will bear the burden of proof at trial.” Celotex, 477 U.S. at 322, 106 S.Ct. 2548. Thus, it was plaintiffs’ burden at summary judgment to point to evidence that — taken as true and drawing all reasonable inferences in their favor-established a violation of the VPPA, not Redbox’s burden to disprove one.

Based on evidence in the record — which reveals simply that Redbox stores backup data with Iron Mountain — a factfinder would have no idea what information Red-box disclosed to Iron Mountain, let alone why or when Rédbox disclosed it. Therefore, even if plaintiffs had properly raised the issue to the district court at summary judgment, no reasonable factfinder could conclude (on such minimal evidence) that Redbox disclosed customer PII to Iron Mountain in violation of the VPPA.

D. Plaintiffs’ Motion for Additional Discovery

For similar reasons, the district court did not abuse its discretion by denying plaintiffs’ motion for more discovery pursuant to Federal Rule of Civil Procedure 56(d). Rule 56 permits a district court to delay consideration of a summary judgment motion and order additional dis *628 covery before ruling if the non-movant demonstrates that “it cannot present facts essential to justify its opposition.” Fed. R.Civ.P. 56(d). The Rule places the burden on the non-movant that believes additional discovery is required to “state the reasons why the party cannot adequately respond to the summary judgment motion without further discovery.” Deere & Co. v. Ohio Gear, 462 F.3d 701, 706 (7th Cir. 2006).

Plaintiffs identified two discrete areas of discovery that they allegedly needed to further explore in order to respond to Redbox’s summary judgment motion as it pertained to Stream: (1) information regarding the “technical” method by which Stream “queries Redbox’s database,” and (2) information that would shed more light on whether Stream had accessed all, or just some, of Redbox’s customer records. Neither of these topics were material to the district court’s summary judgment ruling. How Stream accesses Redbox’s information is irrelevant to whether disclosures to Stream fall within the VPPA’s “ordinary course of business” exception, and the district court made clear in its opinion that it would reach the same conclusion (one which we endorse on appeal) regardless of whether Stream had access to all customer records or just some of them. Plaintiffs therefore fell far short of meeting their burden to identify material facts needed to oppose summary judgment. Accordingly, the district court did not abuse its discretion in denying plaintiffs additional discovery before ruling on Redbox’s motion. 2

III. Conclusion

For the foregoing reasons, we AFFIRM the judgment of the district court.