Data privacy practices and related class action litigation continue to be super-hot topics that require close attention. Brand damage, governance shakeups, and congressional inquiries because of data practices should provide sufficient motivation to stay up-to-the minute in these critical areas.
The most recent news involves allegations that ordinary video hosting and social media engagement permit the disclosure of personally identifiable information in violation of federal video privacy law. In the wake of the comScore class certification and recent settlement, a California federal district court has denied certification of a class of Hulu video service users. The plaintiff users claimed that Hulu disclosed their video viewing selections and personal identification information to Facebook simply by enabling the “Like” button functionality on Hulu’s website. The court held that it could not certify the proposed class both because the class was not sufficiently ascertainable and because individual issues regarding actual transmission of private information (injury) predominated over common issues.
The Hulu class action provides a fascinating example of the intersection of class action defenses and strategies, substantive privacy law, and a technical evidentiary record. To defeat this type of case, a company’s affirmative story—both on the merits and for class—must take complex technical concepts and distill them into a simple, yet compelling narrative. A coordinated (and potentially simultaneous) strategy to limit the size and scope of the class through both merits and class arguments will be needed. On the merits, a defendant must explain to the court the specific conduct or actions that are illegal under the Video Privacy Protection Act (VPPA) and demonstrate why its actions do not run afoul of the statute. A technical tutorial for the court in advance of substantive motions is all but necessary and recommended.
This understanding of the technical issues, the elements of the cause of action, and the proof necessary to establish those elements and the defenses thereto is directly relevant to class certification arguments. On the class issues, a company must demonstrate that a class action cannot be manageably tried without depriving the company of its due process rights and/or devolving into a series of mini-trials on liability-determinative issues, and trying the case of the class representatives will not establish a right of recovery for any other member of the class. While many courts have experience applying rigorous analysis to consumer protection, warranty, and antitrust class theories and the Rule 23 principles are the same, the VPPA class and other data privacy theories are new and open to interpretation.
From a class litigation perspective, Hulu did a good job at using summary judgment practice to eliminate an additional class whose data was communicated to a different company (comScore). Summary judgment motions are part of a triple-threat strategy that can be a powerful tool in defeating class actions: oppose class certification, move for summary judgment, and utilize defense class experts while filing targeted strategic Rule 702 motions to exclude important portions of plaintiffs’ Rule 23 evidence.
The text of Hulu’s opposition relied primarily on the plaintiffs’ lack of evidence to support the Rule 23 factors. Companies facing similar litigation can strengthen their opposition to class certification by presenting affirmative evidence—such as their own expert testimony and declarations from absent class members not associated with the named plaintiffs. Companies can also take full advantage of the Ninth Circuit requirement that plaintiffs submit a trial plan. A defendant’s response to a trial plan is a great way to highlight and bring to life due process and constitutional arguments—which the class trial plaintiffs propose here violates the United States Supreme Court’s rejection of “trial by formula,” in Walmart v. Dukes. (The California Supreme Court has recently articulated the importance of trial plans at the certification stage in Duran v. U.S. Bank Nat. Assoc.)
The greatest insight from the Hulu decision is the need for companies to highlight problems with ascertainability, an increasingly important Rule 23 issue on which the Hulu court asked for special briefing. The court ultimately ruled that the proposed class was not ascertainable because the plaintiffs “offered no way to identify individual class members other than broad notice and a self-reporting affidavit,” which was not sufficient given the relatively high dollar value of each claim ($2,500) and the difficulty in establishing and verifying claims.
Significantly, while Hulu succeeded in defeating the class on ascertainability and predominance grounds, the court left open the possibility for plaintiffs to re-file their motion for class certification and re-define the class and utilize Rule 23(c) subclasses to present a class capable of certification. The denial of the plaintiffs’ motion was without prejudice, and the court rejected Hulu’s arguments regarding commonality, typicality, and adequacy. The court focused on the record currently before it and left open the possibility that, with a different record, a different result may lie.
Accordingly, from a class action perspective, the Hulu decision demonstrates, once again, the importance of developing a factual and expert record that is credible, persuasive and robust. In addition to more refined class definitions, defendants should anticipate plaintiffs’ use of sub-classing, expert reports that will attempt to nullify predominance defenses, their own consumer survey data and reports, and creative trial plans focusing on what they will describe as the single, central issue of liability. Plaintiffs’ counsel will double-down on their continued public policy attacks against the ascertainability defense—i.e., it will spell the demise of consumer class actions and insulate corporate wrongdoing—and in the short term, will attempt to identify jurisdictions hostile to ascertainability arguments and target companies whose records may support self-reporting by members of the class.
From a privacy and data best practices perspective, this case highlights the need for companies to consider whether it is necessary to include specific video titles in the URLs where their videos are posted. The Hulu plaintiffs’ claims centered around the capture of the watch-page URL (which contained video titles) into web beacons and cookies shared with third parties. The VPPA prohibits the disclosure of personal information – a disclosure identifying a person as having requested or obtained specific video viewing materials. The plaintiffs’ proposed class definition (covering the April 2010 to June 7, 2012, period) ended on the precise date when Hulu removed specific video titles from its URL referrer headers. If companies choose to keep video titles in their watch pages, they should strongly consider seeking informed written consent to ensure compliance with the VPPA.
Finally, companies will want to pay special attention to the type of records they maintain regarding individual users. The Hulu court specifically distinguished the comScore case, in which the Northern District of Illinois certified the proposed plaintiff class, holding that, unlike comScore, identification of email addresses alone is insufficient to determine whether a user deployed ad blockers or cleared cookies so that the Facebook cookie could not obtain the user’s video viewing data. Had Hulu kept more detailed records (as was the case in comScore), the outcome of this case could have been different.
For more background on the Hulu case and further recommendations for privacy best practices, please see Alston & Bird’s series of client alerts on the action: Privacy & Security Advisory: Northern District Court Grants Summary Judgment in Favor of Hulu as to the comScore Claims but Denies Summary Judgment as to the Facebook Claims ( April 28, 2014); Northern District of California to Decide in the In re Hulu Privacy Litigation Whether Disclosing Anonymized Data to a Web Analytics Company and Use of the Facebook “Like” Button Violate the Video Privacy Protection Act (February 27, 2014); and 2013 Ends with a Bang – Northern District of California Denies Hulu’s Motion for Summary Judgment in Video Tracking Case (January 7, 2014).
Alston & Bird prides itself on its expertise in both class action litigation and substantive privacy and data management. We welcome the opportunity to share that expertise with our clients.
This advisory is published by Alston & Bird LLP’s Privacy & Data Security practice area to provide a summary of significant developments to our clients and friends. It is intended to be informational and does not constitute legal advice regarding any specific situation. This material may also be considered attorney advertising under court rules of certain jurisdictions.