Lugo v. Amazon.com Services LLC

• Court: District Court, W.D. Washington
• Decided: September 26, 2023
• Docket: 2:22-cv-01230
• Status: Unknown

Opinion

1 2 3 4

5 6 7 8 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON 9 AT SEATTLE 10 11 ANGELA LUGO and ANDREW CASE NO. 2:22-cv-01230-TL BRYNILDSON, individually and on behalf 12 of all others similarly situated, ORDER ON MOTION TO DISMISS 13 Plaintiffs, v. 14 AMAZON.COM, INC., 15 Defendant. 16

17 18 This is a proposed class action for statutory damages under New York and Minnesota 19 state law for alleged unlawful retention of personally identifiable information. This matter is 20 before the Court on Defendant Amazon.com, Inc.’s Rule 12(b)(6) and 12(b)(1) Motion to 21 Dismiss (Dkt. No. 18). Having reviewed Plaintiffs Angela Lugo and Andrew Brynildson’s 22 response (Dkt. No. 22), Defendant’s reply (Dkt. No. 24), and the relevant record, and finding 23 oral argument unnecessary, see LCR 7(b)(4), the Court finds that Plaintiffs lack Article III 24 standing and thus GRANTS the motion. 1 I. BACKGROUND 2 Defendant is a Delaware corporation with its headquarters in Seattle, Washington. Dkt. 3 No. 1 ¶ 20. Defendant is a leading technology company that, as relevant to this case, rents videos 4 for streaming to consumers through its Prime Video platform. Id. ¶ 2.

5 To rent videos, consumers must first create an account with Defendant, which requires 6 them to input their name, date of birth, email address, billing address, and credit card 7 information. Id. ¶ 41. Renting a video is a four-step process: 8 (1) The customer logs onto Defendant’s website by entering a username and password. Id. ¶ 42. 9 (2) The customer searches Defendant’s selections by using its 10 interface. Id.

11 (3) After the customer identifies a video that they wish to rent, the customer clicks on that video. Id. 12 (4) The page for the video presents the option to rent or buy the 13 video. Id. 14 If the customer clicks the “rent” button, Defendant will charge the credit card on file with the 15 customer’s account, and the video will be available for streaming for a limited period of time. Id. 16 The customer must watch the video within 30 days of the rental and has 48 hours from first 17 viewing the video to complete it. Id. ¶ 43. After 30 days of the rental or 48 hours from first 18 viewing the video, whichever comes earlier, the video is no longer accessible to the customer. Id. 19 ¶ 44. At no time does Defendant obtain the consent of its customers to retain their personally 20 identifiable information beyond any period permitted by law.1 Id. ¶ 45. With every rental 21 transaction, Defendant collects, stores, and maintains its customers’ name, credit and debit card 22 information, billing address, and video rental history for an indefinite period of time. Id. ¶ 49. 23 1 Defendant disputes this allegation, arguing that Plaintiffs did consent to the retention of their rental histories. See Dkt. 24 No. 18 at 23–25. Because the Court finds that Plaintiffs lack Article III standing, the Court need not resolve this dispute. 1 Plaintiff Lugo is domiciled in Rochester, New York. Id. ¶ 10. She has an account with 2 Defendant and has rented videos through that account. Id. ¶ 11. In January 2020, she rented 3 movies from Defendant. Id. ¶ 12. In connection with these rentals, Defendant collected her name, 4 address, and credit card information. Id. ¶ 13. As of at least June 28, 2022, Plaintiff Lugo’s

5 account history still displayed the titles of the videos she rented, as well as the date she rented 6 them and the price she paid for them. Id. ¶ 14. 7 Plaintiff Brynildson is domiciled in Minneapolis, Minnesota. Id. ¶ 15. He has an account 8 with Defendant and has rented videos through that account. Id. ¶ 16. In March 2021, he rented 9 movies from Defendant. Id. ¶ 17. In connection with these rentals, Defendant collected his name, 10 address, and credit card information. Id. ¶ 18. As of at least June 22, 2022, Plaintiff Brynildson’s 11 account history still displayed the titles of the videos he rented, as well as the date he rented them 12 and the price he paid for them. Id. ¶ 19. 13 Plaintiffs allege that Defendant unlawfully retains their personally identifiable 14 information, including their names, addresses, credit card information, and video rental history,

15 in violation of New York and Minnesota state law. Id. ¶ 1; see N.Y. Gen. Bus. Law §§ 670–675; 16 Minn. Stat. § 325I.01–03. Specifically, New York and Minnesota require certain parties to 17 “destroy personally identifiable information as soon as practicable, but no later than one year 18 from the date the information is no longer necessary for the purpose for which it was 19 collected . . . .” Dkt. No. 1 ¶¶ 31, 36; N.Y. Gen. Bus. Law § 673(5); Minn. Stat. § 325I.02(6). 20 Plaintiffs bring this action on behalf of themselves and two separate classes of all people in New 21 York and Minnesota whose personally identifiable information and video histories were retained 22 by Defendant. Dkt. No. 1 ¶ 9. 23

24 1 II. LEGAL STANDARD 2 A motion to dismiss may be brought where subject matter jurisdiction is lacking. See Fed. 3 R. Civ. P. 12(b)(1). The Court must dismiss a case if it determines that it lacks subject matter 4 jurisdiction “at any time.” Fed. R. Civ. P. 12(h)(3). A motion to dismiss for lack of subject

5 matter jurisdiction may be either a facial attack (challenging the sufficiency of the pleadings) or 6 a factual attack (presenting evidence contesting the truth of the allegations in the pleadings). See 7 Wolfe v. Strankman, 392 F.3d 358, 362 (9th Cir. 2004). “When reviewing a [facial] dismissal 8 pursuant to Rule 12(b)(1) . . . , ‘we accept as true all facts alleged in the complaint and construe 9 them in the light most favorable to plaintiff[ ], the non-moving party.’” DaVinci Aircraft, Inc. v. 10 United States, 926 F.3d 1117, 1122 (9th Cir. 2019) (second alteration in original) (quoting 11 Snyder & Assocs. Acquisitions LLC v. United States, 859 F.3d 1152, 1156–57 (9th Cir. 2017)). 12 “[T]hose who seek to invoke the jurisdiction of the federal courts must satisfy the 13 threshold requirement imposed by Article III of the Constitution by alleging an actual case or 14 controversy.” Phillips v. U.S. Customs & Border Prot., 74 F.4th 986, 991 (9th Cir. 2023)

15 (quoting City of Los Angeles v. Lyons, 461 U.S. 95, 101 (1983)). “To establish Article III 16 standing, an injury must be concrete, particularized, and actual or imminent; fairly traceable to 17 the challenged action; and redressable by a favorable ruling.” Martin v. City of Boise, 920 F.3d 18 584, 608 (9th Cir. 2019) (quoting Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013)). 19 “An injury is concrete for purposes of standing if it ‘actually exist[s],’ meaning it is ‘real, 20 and not abstract’—but not necessarily ‘tangible.’” Campbell v. Facebook, Inc., 951 F.3d 1106, 21 1116 (9th Cir. 2020) (alteration in original) (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 340 22 (2016)). “[A]n intangible injury may be concrete if it presents a material risk of tangible harm or 23 ‘has a close relationship to a harm that has traditionally been regarded as providing a basis for a

24 lawsuit in English or American courts,’ like common law torts or constitutional violations.” 1 Phillips, 74 F.4th at 991 (emphasis in original) (quoting Spokeo, 578 U.S. at 340–41, and citing 2 TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2204 (2021)). The “close relationship” inquiry 3 “asks whether plaintiffs have identified a close historical or common-law analogue for their 4 asserted injury.” TransUnion, 141 S. Ct. at 2204. The inquiry does not require plaintiffs to

5 identify “an exact duplicate in American history and tradition,” but it is “not an open-ended 6 invitation for federal courts to loosen Article III based on contemporary, evolving beliefs about 7 what kinds of suits should be heard in federal courts.” Id. 8 When courts are faced with “an intangible harm that is linked to a statutory violation,” 9 they “are guided in determining concreteness by both history and the judgment of Congress, or 10 the legislature that enacted the statute.” Campbell, 951 F.3d at 1116 (internal quotation marks 11 omitted). “When a legislature has enacted a ‘bare procedural’ protection, a plaintiff ‘cannot 12 satisfy the demands of Article III’ by pointing only to a violation of that provision, but must also 13 linked it to a concrete harm.” Id. at 1117 (emphasis in original) (quoting Spokeo, 578 U.S. at 14 342). “Where, however, a statutory provision identifies a substantive right that is infringed any

15 time it is violated, a plaintiff bringing a claim under that provision ‘need not allege any further 16 harm to have standing.’” Id. (emphasis in original) (quoting Eichenberger v. ESPN, Inc., 876 17 F.3d 979, 983–94 (9th Cir. 2017)). 18 III. DISCUSSION 19 Defendant moves to dismiss under Rule 12(b)(1) for lack of Article III standing, as well 20 as Rule 12(b)(6) for lack of a private right of action and failure to state a claim. See Dkt. No. 18; 21 see also Dkt. No. 22 (Plaintiffs’ response), 24 (Defendant’s reply). As the Court finds Plaintiffs 22 lack Article III standing and dismisses this case for the reasons discussed below, the Court does 23 not reach the remaining grounds for dismissal.

24 1 In its motion, Defendant argues that Plaintiffs lack Article III standing because they 2 “have not alleged any actual harm resulting from retention of their rental histories.” Dkt. No. 18 3 at 21. It argues that Plaintiffs have not alleged harm from the mere retention of information, nor 4 have they alleged disclosure of that information to a third party or an increase in the likelihood of

5 disclosure. Id. In opposition, Plaintiffs argue that “their injury bears a close relationship to 6 invasion of privacy.” Dkt. No. 22 at 10. They argue that Defendant has collected sensitive 7 information and retained that information for an indefinite period, thus making a “highly 8 offensive intrusion” and engaging in “a pattern of highly offensive conduct.” Id. at 11. 9 Here, the Court finds that Plaintiffs have not alleged a concrete injury and thus do not 10 have Article III standing to sue. The United States Supreme Court stated as much in TransUnion 11 when it quoted and cited with approval two Courts of Appeals: “[T]he ‘retention of information 12 lawfully obtained, without further disclosure, traditionally has not provided the basis for a 13 lawsuit in American courts’ . . . .”2 141 S. Ct. at 2209 (quoting Braitberg v. Charter Commc’ns, 14 Inc., 836 F.3d 925, 930 (8th Cir. 2016) and citing Gubala v. Time Warner Cable, Inc., 846 F.3d

15 909, 912 (7th Cir. 2017)). Since the completion of briefing in this case, the Ninth Circuit— 16 applying TransUnion—has held that “the retention of the illegally obtained records at issue, 17 without more, does not give rise to a concrete injury necessary for standing.” Phillips, 74 F.4th at 18 988. Here, Plaintiffs voluntarily provided their personally identifiable information to Defendant 19 in order to make use of Defendant’s video rental services. Dkt. No. 1 ¶¶ 12–13, 17–18. They do 20 not allege that the information was unlawfully obtained or disclosed to a third party. Therefore, 21

22 2 In TransUnion, a portion of the proposed class alleged that their credit files contained inaccurate information but did not allege that the information had been shared with anyone. 141 S. Ct. at 2209. The Supreme Court held that those class members did not have Article III standing under the Fair Credit Reporting Act (“FCRA”) because their 23 analogy to the common-law tort of defamation required publication of the information. Id. at 2210. Plaintiffs here offer a different common-law analogue: invasion of privacy. But contrary to Plaintiffs’ assertion (Dkt. No. 22 at 12– 24 13), the Supreme Court’s analysis still sheds light on the instant matter. 1 without more, the allegations in Plaintiffs’ Complaint amount to a bare procedural violation and 2 cannot establish an injury in fact. See Phillips, 74 F.4th at 988 (affirming grant of summary 3 judgment to defendant where “plaintiffs have not shown that the retention gives rise to any other 4 sort of harm that constitutes a concrete injury”).3

5 Braitberg and Gubala provide additional support that Plaintiffs’ allegations are 6 procedural violations that do not establish an injury in fact. Braitberg is similar to this case and 7 thus instructive. There, the plaintiff signed up for cable services from Charter Communications 8 and provided various items of personally identifiable information to do so. 836 F.3d at 927. 9 Three years after canceling his cable services, the plaintiff called the defendant and confirmed 10 that all of his personally identifiable information had been retained. Id. The plaintiff sued under 11 the Cable Communications Policy Act, which requires cable operators (in language strikingly 12 similar to the statutes at issue here) to “destroy personally identifiable information if the 13 information is no longer necessary for the purpose for which it was collected and there are no 14 pending requests or orders for access to such information [by the subscriber] or pursuant to a

15 court order.” 47 U.S.C. § 551(e). The Eighth Circuit held that the plaintiff had not alleged an 16 injury in fact, but rather “a bare procedural violation, divorced from any concrete harm.” 17 Braitberg, 836 F.3d at 930 (quoting Spokeo, 578 U.S. at 341). The court explained: 18 Braitberg alleges only that Charter violated a duty to destroy personally identifiable information by retaining certain information 19 longer than the company should have kept it. He does not allege that Charter has disclosed the information to a third party, that any outside 20 party has access the data, or that Charter has used the information in any way during the disputed period. He identifies no material risk of 21 harm from the retention; a speculative or hypothetical risk is insufficient. Although there is a common law tradition of lawsuits for 22 invasion of privacy, the retention of information lawfully obtained, 23 3 Although Phillips concerned a motion for summary judgment, the Ninth Circuit’s analysis of “concrete” injury still 24 informs the Court. 1 without further disclosure, traditionally has not provided the basis for a lawsuit in American courts. 2 Id. (citing Restatement (Second) of Torts § 652A (Am. Law Inst. 1977) and Spokeo, 578 U.S. at 340–42). 3 Gubala is similarly instructive. There, the plaintiff confirmed that the defendant had 4 retained his personal information eight years after he canceled his cable services. 846 F.3d at 5 910. The plaintiff sought damages and injunctive relief under the Cable Communications Policy 6 Act, 47 U.S.C. § 551(e). 846 F.3d at 910. The Seventh Circuit noted that the plaintiff did not 7 allege that the defendant “has ever given away or leaked or lost any of his personal information 8 or intends to give it away or is at risk of having the information stolen from it.” Id. Similarly, the 9 court rejected the plaintiff’s argument that a violation of § 551(e) is a violation of “a right of 10 privacy”: “[T]here is no indication that [the defendant] has released, or allowed anyone to 11 disseminate, any of the plaintiff’s personal information in the company’s possession,” nor did the 12 plaintiff “even argue that there is a risk of such leakage.” Id. at 912 (emphasis in original). The 13 court concluded that “the absence of allegation let alone evidence of any concrete injury inflicted 14 or likely to be inflicted on the plaintiff as a consequence of [the defendant’s] continued retention 15 of his personal information precludes the relief sought.” Id. at 913. 16 Like the plaintiffs in Braitberg and Gubala, Plaintiffs here allege only that Defendant has 17 retained their personally identifiable information in violation of a statutory duty. This type of 18 statutory violation, without more, is not enough to establish a concrete injury. See, e.g., Bassett v. 19 ABM Parking Servs., Inc., 883 F.3d 776, 783 (9th Cir. 2018) (holding no concrete injury under 20 FCRA where plaintiff’s information was only disclosed to himself). 21 Plaintiffs’ authorities are distinguishable. In Fox v. Dakkota Integrated Systems, the 22 Seventh Circuit was confronted with the question of Article III standing for a plaintiff under the 23 Illinois Biometric Information Privacy Act (“BIPA”). 980 F.3d 1146 (7th Cir. 2020). BIPA 24 1 requires, among other things, that a company in possession of “biometric identifiers” develop a 2 written policy establishing a data retention policy and then comply with that policy. Id. at 1150. 3 The court concluded that the “unlawful retention of biometric data” was a concrete injury 4 because it “inflicts a privacy injury in the same sense that an unlawful collection does.” Id. at

5 1154. But the court distinguished Gubala for two reasons, both applicable here. First, “keeping a 6 former cable customer’s account information on file . . . is not analogous to a tortious invasion of 7 his right to privacy.” Id. at 1155. In contrast, the instant matter was about “biometric identifiers, 8 which are meaningfully different because there are immutable, and once compromised, are 9 compromised forever.” Id. Even the plaintiff’s date of birth, while “obviously unchangeable,” 10 was “far less identifying” than biometric data. Id. at 1155 n.2. Second, the court observed that 11 the plaintiff’s allegations included “unlawful sharing of her data with a third-party database 12 administrator with unknown security practices,” while Gubala included no similar allegation. Id. 13 at 1155. So too here, Plaintiffs allege retention of information that is mutable or far less 14 identifying than biometric data but do not allege that the information was disclosed.

15 Similarly, in Patel v. Facebook, Inc., the Ninth Circuit held that a BIPA plaintiff alleged 16 a concrete injury. 932 F.3d 1264, 1267 (9th Cir. 2019). The court concluded, in light of 17 “historical background” and “the Supreme Court’s views regarding enhanced technological 18 intrusions on the right to privacy,” that “an invasion of an individual’s biometric privacy rights” 19 bore a close relationship to a traditionally recognized harm. Id. at 1273. Because BIPA was 20 enacted to protect “the right not to be subject to the collection and use of such biometric data,” 21 the defendant’s alleged violation of BIPA “would necessarily violate the plaintiff’s substantive 22 privacy interests.” Id. at 1274. Here, however, Plaintiffs do not allege similar unlawful collection 23 or use, nor do they allege the retention of biometric data. Moreover, the Ninth Circuit later

24 framed Patel as addressing a prohibition on “the collection, use, and storage of a person’s 1 biometric identifiers from photographs” and declared that Patel, among other cases, did not hold 2 that plaintiffs had standing “due to the retention of records alone.” Phillips, 74 F.4th at 994. 3 In re Vizio, Inc., Consumer Private Litigation is also distinguishable. 238 F. Supp. 3d 4 1204 (C.D. Cal. 2017). There, the plaintiffs alleged that the defendants’ “Smart TVs” collected

5 and reported the plaintiffs’ viewing histories without their knowledge or consent and further sold 6 that data to third parties, in violation of multiple federal and state laws. Id. at 1212. The court 7 held that the plaintiffs had standing to sue under the federal Video Privacy Protection Act 8 (“VPPA”) and Wiretap Act because the collection and disclosure of the plaintiffs’ data bore a 9 close relationship to the tort of invasion of privacy, a finding confirmed by Congress’s judgment. 10 Id. at 1216–17. Here again, Plaintiffs do not allege that their information was unlawfully 11 collected or disclosed but merely that their information was retained. 12 Finally, Plaintiffs point to the judgment of the New York and Minnesota legislatures: “By 13 enacting these statutes, the legislatures ‘identified a concrete interest deserving of protection,’ 14 thereby reinforcing the conclusion that Plaintiffs suffered a concrete harm.” Dkt. No. 22 at 11

15 (quoting Tailford v. Experian Info. Sols., Inc., 26 F.4th 1092, 1100 (9th Cir. 2022)); see also 16 Spokeo, 578 U.S. at 341 (“[The legislature’s] judgment is also instructive and important.”). The 17 Court “affords due respect” to the decisions of these state legislatures to enact these prohibitions. 18 TransUnion, 141 S. Ct. at 2204. Still, a legislature “may not simply enact an injury into 19 existence, using its lawmaking power to transform something that is not remotely harmful into 20 something that is.” Id. at 2205 (quoting Hagy v. Demers & Adams, 882 F.3d 616, 622 (6th Cir. 21 2018)). The enactment of a law “does not relieve courts of their responsibility to independently 22 decide whether a plaintiff has suffered a concrete harm under Article III.” Id. 23 On the facts alleged in the current Complaint, Plaintiffs have not demonstrated a concrete

24 harm necessary for an injury in fact. Therefore, the Court finds that Plaintiffs do not have Article 1 III standing. However, Plaintiffs will be given an opportunity to amend their Complaint. See Fed. 2 R. Civ. P. 15(a)(2). 3 IV. CONCLUSION 4 Accordingly, the Court GRANTS Defendant’s Rule 12(b)(6) and 12(b)(1) Motion to

5 Dismiss (Dkt. No. 18) with leave to amend. Should Plaintiffs choose to amend, their amended 6 complaint must be filed within thirty (30) days of this Order. 7 Dated this 26th day of September 2023. 8 A 9 Tana Lin United States District Judge 10

11 12 13 14 15 16 17 18 19 20 21 22 23 24