Lugo v. Amazon.com Services LLC

Opinion

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON ANGELA LUGO and ANDREW CASE NO. 2:22-cv-01230-TL BRYNILDSON, individually and on behalf of all others similarly situated, ORDER ON MOTION TO DISMISS Plaintiffs, v. AMAZON.COM, INC., Defendant.

This is a proposed class action for statutory damages under New York and Minnesota state law for alleged unlawful retention of personally identifiable information. This matter is before the Court on Defendant Amazon.com, Inc.’s Rule 12(b)(6) and 12(b)(1) Motion to Dismiss (Dkt. No. 18). Having reviewed Plaintiffs Angela Lugo and Andrew Brynildson’s response (Dkt. No. 22), Defendant’s reply (Dkt. No. 24), and the relevant record, and finding oral argument unnecessary, see LCR 7(b)(4), the Court finds that Plaintiffs lack Article III standing and thus GRANTS the motion. Defendant is a Delaware corporation with its headquarters in Seattle, Washington. Dkt. No. 1 ¶ 20. Defendant is a leading technology company that, as relevant to this case, rents videos for streaming to consumers through its Prime Video platform. Id. ¶ 2.

To rent videos, consumers must first create an account with Defendant, which requires them to input their name, date of birth, email address, billing address, and credit card information. Id. ¶ 41. Renting a video is a four-step process: (1) The customer logs onto Defendant’s website by entering a username and password. Id. ¶ 42. (2) The customer searches Defendant’s selections by using its interface. Id.

(3) After the customer identifies a video that they wish to rent, the customer clicks on that video. Id. (4) The page for the video presents the option to rent or buy the video. Id. If the customer clicks the “rent” button, Defendant will charge the credit card on file with the customer’s account, and the video will be available for streaming for a limited period of time. Id. The customer must watch the video within 30 days of the rental and has 48 hours from first viewing the video to complete it. Id. ¶ 43. After 30 days of the rental or 48 hours from first viewing the video, whichever comes earlier, the video is no longer accessible to the customer. Id. ¶ 44. At no time does Defendant obtain the consent of its customers to retain their personally identifiable information beyond any period permitted by law.1 Id. ¶ 45. With every rental transaction, Defendant collects, stores, and maintains its customers’ name, credit and debit card information, billing address, and video rental history for an indefinite period of time. Id. ¶ 49. 1 Defendant disputes this allegation, arguing that Plaintiffs did consent to the retention of their rental histories. See Dkt. No. 18 at 23–25. Because the Court finds that Plaintiffs lack Article III standing, the Court need not resolve this dispute. Plaintiff Lugo is domiciled in Rochester, New York. Id. ¶ 10. She has an account with Defendant and has rented videos through that account. Id. ¶ 11. In January 2020, she rented movies from Defendant. Id. ¶ 12. In connection with these rentals, Defendant collected her name, address, and credit card information. Id. ¶ 13. As of at least June 28, 2022, Plaintiff Lugo’s

account history still displayed the titles of the videos she rented, as well as the date she rented them and the price she paid for them. Id. ¶ 14. Plaintiff Brynildson is domiciled in Minneapolis, Minnesota. Id. ¶ 15. He has an account with Defendant and has rented videos through that account. Id. ¶ 16. In March 2021, he rented movies from Defendant. Id. ¶ 17. In connection with these rentals, Defendant collected his name, address, and credit card information. Id. ¶ 18. As of at least June 22, 2022, Plaintiff Brynildson’s account history still displayed the titles of the videos he rented, as well as the date he rented them and the price he paid for them. Id. ¶ 19. Plaintiffs allege that Defendant unlawfully retains their personally identifiable information, including their names, addresses, credit card information, and video rental history,

in violation of New York and Minnesota state law. Id. ¶ 1; see N.Y. Gen. Bus. Law §§ 670–675; Minn. Stat. § 325I.01–03. Specifically, New York and Minnesota require certain parties to “destroy personally identifiable information as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected . . . .” Dkt. No. 1 ¶¶ 31, 36; N.Y. Gen. Bus. Law § 673(5); Minn. Stat. § 325I.02(6). Plaintiffs bring this action on behalf of themselves and two separate classes of all people in New York and Minnesota whose personally identifiable information and video histories were retained by Defendant. Dkt. No. 1 ¶ 9.

A motion to dismiss may be brought where subject matter jurisdiction is lacking. See Fed. R. Civ. P. 12(b)(1). The Court must dismiss a case if it determines that it lacks subject matter jurisdiction “at any time.” Fed. R. Civ. P. 12(h)(3). A motion to dismiss for lack of subject

matter jurisdiction may be either a facial attack (challenging the sufficiency of the pleadings) or a factual attack (presenting evidence contesting the truth of the allegations in the pleadings). See Wolfe v. Strankman, 392 F.3d 358, 362 (9th Cir. 2004). “When reviewing a [facial] dismissal pursuant to Rule 12(b)(1) . . . , ‘we accept as true all facts alleged in the complaint and construe them in the light most favorable to plaintiff[ ], the non-moving party.’” DaVinci Aircraft, Inc. v. United States, 926 F.3d 1117, 1122 (9th Cir. 2019) (second alteration in original) (quoting Snyder & Assocs. Acquisitions LLC v. United States, 859 F.3d 1152, 1156–57 (9th Cir. 2017)). “[T]hose who seek to invoke the jurisdiction of the federal courts must satisfy the threshold requirement imposed by Article III of the Constitution by alleging an actual case or controversy.” Phillips v. U.S. Customs & Border Prot., 74 F.4th 986, 991 (9th Cir. 2023)

(quoting City of Los Angeles v. Lyons, 461 U.S. 95, 101 (1983)). “To establish Article III standing, an injury must be concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling.” Martin v. City of Boise, 920 F.3d 584, 608 (9th Cir. 2019) (quoting Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013)). “An injury is concrete for purposes of standing if it ‘actually exist[s],’ meaning it is ‘real, and not abstract’—but not necessarily ‘tangible.’” Campbell v. Facebook, Inc., 951 F.3d 1106, 1116 (9th Cir. 2020) (alteration in original) (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 340 (2016)). “[A]n intangible injury may be concrete if it presents a material risk of tangible harm or ‘has a close relationship to a harm that has traditionally been regarded as providing a basis for a

lawsuit in English or American courts,’ like common law torts or constitutional violations.” Phillips, 74 F.4th at 991 (emphasis in original) (quoting Spokeo, 578 U.S. at 340–41, and citing TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2204 (2021)). The “close relationship” inquiry “asks whether plaintiffs have identified a close historical or common-law analogue for their asserted injury.” TransUnion, 141 S. Ct. at 2204. The inquiry does not require plaintiffs to

identify “an exact duplicate in American history and tradition,” but it is “not an open-ended invitation for federal courts to loosen Article III based on contemporary, evolving beliefs about what kinds of suits should be heard in federal courts.” Id. When courts are faced with “an intangible harm that is linked to a statutory violation,” they “are guided in determining concreteness by both history and the judgment of Congress, or the legislature that enacted the statute.” Campbell, 951 F.3d at 1116 (internal quotation marks omitted). “When a legislature has enacted a ‘bare procedural’ protection, a plaintiff ‘cannot satisfy the demands of Article III’ by pointing only to a violation of that provision, but must also linked it to a concrete harm.” Id. at 1117 (emphasis in original) (quoting Spokeo, 578 U.S. at 342). “Where, however, a statutory provision identifies a substantive right that is infringed any

time it is violated, a plaintiff bringing a claim under that provision ‘need not allege any further harm to have standing.’” Id. (emphasis in original) (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983–94 (9th Cir. 2017)). Defendant moves to dismiss under Rule 12(b)(1) for lack of Article III standing, as well as Rule 12(b)(6) for lack of a private right of action and failure to state a claim. See Dkt. No. 18; see also Dkt. No. 22 (Plaintiffs’ response), 24 (Defendant’s reply). As the Court finds Plaintiffs lack Article III standing and dismisses this case for the reasons discussed below, the Court does not reach the remaining grounds for dismissal.

In its motion, Defendant argues that Plaintiffs lack Article III standing because they “have not alleged any actual harm resulting from retention of their rental histories.” Dkt. No. 18 at 21. It argues that Plaintiffs have not alleged harm from the mere retention of information, nor have they alleged disclosure of that information to a third party or an increase in the likelihood of

disclosure. Id. In opposition, Plaintiffs argue that “their injury bears a close relationship to invasion of privacy.” Dkt. No. 22 at 10. They argue that Defendant has collected sensitive information and retained that information for an indefinite period, thus making a “highly offensive intrusion” and engaging in “a pattern of highly offensive conduct.” Id. at 11. Here, the Court finds that Plaintiffs have not alleged a concrete injury and thus do not have Article III standing to sue. The United States Supreme Court stated as much in TransUnion when it quoted and cited with approval two Courts of Appeals: “[T]he ‘retention of information lawfully obtained, without further disclosure, traditionally has not provided the basis for a lawsuit in American courts’ . . . .”2 141 S. Ct. at 2209 (quoting Braitberg v. Charter Commc’ns, Inc., 836 F.3d 925, 930 (8th Cir. 2016) and citing Gubala v. Time Warner Cable, Inc., 846 F.3d

909, 912 (7th Cir. 2017)). Since the completion of briefing in this case, the Ninth Circuit— applying TransUnion—has held that “the retention of the illegally obtained records at issue, without more, does not give rise to a concrete injury necessary for standing.” Phillips, 74 F.4th at 988. Here, Plaintiffs voluntarily provided their personally identifiable information to Defendant in order to make use of Defendant’s video rental services. Dkt. No. 1 ¶¶ 12–13, 17–18. They do not allege that the information was unlawfully obtained or disclosed to a third party. Therefore,

2 In TransUnion, a portion of the proposed class alleged that their credit files contained inaccurate information but did not allege that the information had been shared with anyone. 141 S. Ct. at 2209. The Supreme Court held that those class members did not have Article III standing under the Fair Credit Reporting Act (“FCRA”) because their analogy to the common-law tort of defamation required publication of the information. Id. at 2210. Plaintiffs here offer a different common-law analogue: invasion of privacy. But contrary to Plaintiffs’ assertion (Dkt. No. 22 at 12– 13), the Supreme Court’s analysis still sheds light on the instant matter. without more, the allegations in Plaintiffs’ Complaint amount to a bare procedural violation and cannot establish an injury in fact. See Phillips, 74 F.4th at 988 (affirming grant of summary judgment to defendant where “plaintiffs have not shown that the retention gives rise to any other sort of harm that constitutes a concrete injury”).3

Braitberg and Gubala provide additional support that Plaintiffs’ allegations are procedural violations that do not establish an injury in fact. Braitberg is similar to this case and thus instructive. There, the plaintiff signed up for cable services from Charter Communications and provided various items of personally identifiable information to do so. 836 F.3d at 927. Three years after canceling his cable services, the plaintiff called the defendant and confirmed that all of his personally identifiable information had been retained. Id. The plaintiff sued under the Cable Communications Policy Act, which requires cable operators (in language strikingly similar to the statutes at issue here) to “destroy personally identifiable information if the information is no longer necessary for the purpose for which it was collected and there are no pending requests or orders for access to such information [by the subscriber] or pursuant to a

court order.” 47 U.S.C. § 551(e). The Eighth Circuit held that the plaintiff had not alleged an injury in fact, but rather “a bare procedural violation, divorced from any concrete harm.” Braitberg, 836 F.3d at 930 (quoting Spokeo, 578 U.S. at 341). The court explained: Braitberg alleges only that Charter violated a duty to destroy personally identifiable information by retaining certain information longer than the company should have kept it. He does not allege that Charter has disclosed the information to a third party, that any outside party has access the data, or that Charter has used the information in any way during the disputed period. He identifies no material risk of harm from the retention; a speculative or hypothetical risk is insufficient. Although there is a common law tradition of lawsuits for invasion of privacy, the retention of information lawfully obtained, 3 Although Phillips concerned a motion for summary judgment, the Ninth Circuit’s analysis of “concrete” injury still informs the Court. without further disclosure, traditionally has not provided the basis for a lawsuit in American courts. Id. (citing Restatement (Second) of Torts § 652A (Am. Law Inst. 1977) and Spokeo, 578 U.S. at 340–42). Gubala is similarly instructive. There, the plaintiff confirmed that the defendant had retained his personal information eight years after he canceled his cable services. 846 F.3d at 910. The plaintiff sought damages and injunctive relief under the Cable Communications Policy Act, 47 U.S.C. § 551(e). 846 F.3d at 910. The Seventh Circuit noted that the plaintiff did not allege that the defendant “has ever given away or leaked or lost any of his personal information or intends to give it away or is at risk of having the information stolen from it.” Id. Similarly, the court rejected the plaintiff’s argument that a violation of § 551(e) is a violation of “a right of privacy”: “[T]here is no indication that [the defendant] has released, or allowed anyone to disseminate, any of the plaintiff’s personal information in the company’s possession,” nor did the plaintiff “even argue that there is a risk of such leakage.” Id. at 912 (emphasis in original). The court concluded that “the absence of allegation let alone evidence of any concrete injury inflicted or likely to be inflicted on the plaintiff as a consequence of [the defendant’s] continued retention of his personal information precludes the relief sought.” Id. at 913. Like the plaintiffs in Braitberg and Gubala, Plaintiffs here allege only that Defendant has retained their personally identifiable information in violation of a statutory duty. This type of statutory violation, without more, is not enough to establish a concrete injury. See, e.g., Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 783 (9th Cir. 2018) (holding no concrete injury under FCRA where plaintiff’s information was only disclosed to himself). Plaintiffs’ authorities are distinguishable. In Fox v. Dakkota Integrated Systems, the Seventh Circuit was confronted with the question of Article III standing for a plaintiff under the Illinois Biometric Information Privacy Act (“BIPA”). 980 F.3d 1146 (7th Cir. 2020). BIPA requires, among other things, that a company in possession of “biometric identifiers” develop a written policy establishing a data retention policy and then comply with that policy. Id. at 1150. The court concluded that the “unlawful retention of biometric data” was a concrete injury because it “inflicts a privacy injury in the same sense that an unlawful collection does.” Id. at

1154. But the court distinguished Gubala for two reasons, both applicable here. First, “keeping a former cable customer’s account information on file . . . is not analogous to a tortious invasion of his right to privacy.” Id. at 1155. In contrast, the instant matter was about “biometric identifiers, which are meaningfully different because there are immutable, and once compromised, are compromised forever.” Id. Even the plaintiff’s date of birth, while “obviously unchangeable,” was “far less identifying” than biometric data. Id. at 1155 n.2. Second, the court observed that the plaintiff’s allegations included “unlawful sharing of her data with a third-party database administrator with unknown security practices,” while Gubala included no similar allegation. Id. at 1155. So too here, Plaintiffs allege retention of information that is mutable or far less identifying than biometric data but do not allege that the information was disclosed.

Similarly, in Patel v. Facebook, Inc., the Ninth Circuit held that a BIPA plaintiff alleged a concrete injury. 932 F.3d 1264, 1267 (9th Cir. 2019). The court concluded, in light of “historical background” and “the Supreme Court’s views regarding enhanced technological intrusions on the right to privacy,” that “an invasion of an individual’s biometric privacy rights” bore a close relationship to a traditionally recognized harm. Id. at 1273. Because BIPA was enacted to protect “the right not to be subject to the collection and use of such biometric data,” the defendant’s alleged violation of BIPA “would necessarily violate the plaintiff’s substantive privacy interests.” Id. at 1274. Here, however, Plaintiffs do not allege similar unlawful collection or use, nor do they allege the retention of biometric data. Moreover, the Ninth Circuit later

framed Patel as addressing a prohibition on “the collection, use, and storage of a person’s biometric identifiers from photographs” and declared that Patel, among other cases, did not hold that plaintiffs had standing “due to the retention of records alone.” Phillips, 74 F.4th at 994. In re Vizio, Inc., Consumer Private Litigation is also distinguishable. 238 F. Supp. 3d 1204 (C.D. Cal. 2017). There, the plaintiffs alleged that the defendants’ “Smart TVs” collected

and reported the plaintiffs’ viewing histories without their knowledge or consent and further sold that data to third parties, in violation of multiple federal and state laws. Id. at 1212. The court held that the plaintiffs had standing to sue under the federal Video Privacy Protection Act (“VPPA”) and Wiretap Act because the collection and disclosure of the plaintiffs’ data bore a close relationship to the tort of invasion of privacy, a finding confirmed by Congress’s judgment. Id. at 1216–17. Here again, Plaintiffs do not allege that their information was unlawfully collected or disclosed but merely that their information was retained. Finally, Plaintiffs point to the judgment of the New York and Minnesota legislatures: “By enacting these statutes, the legislatures ‘identified a concrete interest deserving of protection,’ thereby reinforcing the conclusion that Plaintiffs suffered a concrete harm.” Dkt. No. 22 at 11

(quoting Tailford v. Experian Info. Sols., Inc., 26 F.4th 1092, 1100 (9th Cir. 2022)); see also Spokeo, 578 U.S. at 341 (“[The legislature’s] judgment is also instructive and important.”). The Court “affords due respect” to the decisions of these state legislatures to enact these prohibitions. TransUnion, 141 S. Ct. at 2204. Still, a legislature “may not simply enact an injury into existence, using its lawmaking power to transform something that is not remotely harmful into something that is.” Id. at 2205 (quoting Hagy v. Demers & Adams, 882 F.3d 616, 622 (6th Cir. 2018)). The enactment of a law “does not relieve courts of their responsibility to independently decide whether a plaintiff has suffered a concrete harm under Article III.” Id. On the facts alleged in the current Complaint, Plaintiffs have not demonstrated a concrete

harm necessary for an injury in fact. Therefore, the Court finds that Plaintiffs do not have Article III standing. However, Plaintiffs will be given an opportunity to amend their Complaint. See Fed. R. Civ. P. 15(a)(2). Accordingly, the Court GRANTS Defendant’s Rule 12(b)(6) and 12(b)(1) Motion to

Dismiss (Dkt. No. 18) with leave to amend. Should Plaintiffs choose to amend, their amended complaint must be filed within thirty (30) days of this Order. Dated this 26th day of September 2023. A Tana Lin United States District Judge