Considering the case for a second time, the Seventh U.S. Circuit Court of Appeals affirmed summary judgment for Redbox in a class action suit alleging that the company violated the Video Privacy Protection Act (VPPA).

Customer service is part of a video rental company’s “ordinary course of business” whether the business is a brick-and-mortar store or a rental kiosk operated by software, the federal appellate panel concluded.

Kevin Sterk originally filed suit against Redbox seeking damages based on claims that the company violated the VPPA by keeping users’ rental histories longer than the time period allowed by the statute. A panel of the Seventh Circuit determined that violations of that provision allowed for injunctive relief only and not monetary damages.

The case remained alive on Sterk’s allegations that Redbox illegally shared user information, including viewing history, with Stream Global Services, a third party that handles customer service operations for Redbox. When a user encounters technical problems at a Redbox self-service kiosk, Stream provides a live person to help.

To perform such functions, Redbox has granted Stream access to the database in which Redbox stores its customer information.

While the VPPA prohibits the disclosure of personally identifiable information, the unanimous panel looked to an exception in the statute for disclosures incident to the video tape service provider’s ordinary course of business activities, which are limited to “debt collection activities, order fulfillment, request processing, and the transfer of ownership.”

In rejecting the plaintiff’s attempt to carve out customer service from a video rental company’s ordinary course of business, the court said that Stream’s customer service activities fell neatly within the category of “request processing.”

When Congress enacted the VPPA in 1988 – before the advent of automated kiosks – the “ordinary course of business” at a brick-and-mortar video rental store would have included a clerk accessing an individual customer’s rental history and other personal information during the check-out process if the customer experienced technical problems with a VHS when he returned home, the panel noted.

“All of these interactions, occurring within the store’s ordinary course of business, constitute that customer’s ‘request processing’ and ‘order fulfillment,’ if ordinary meaning is assigned to those terms,” the court said. “[W]hen the VPPA was enacted, we can safely assume that Congress contemplated customer service as part and parcel of the ordinary rental experience. That Redbox has replaced most live customer service interactions with a computer interface does not change this.”

The panel found no problem with the fact that Redbox preemptively disclosed its entire customer database to Stream rather than waiting until an individual customer called with a problem. The plaintiff’s attempt to distinguish proactive disclosure from reactive disclosure was “meaningless because the permissibility of disclosure under the VPPA turns on the underlying purpose for which Redbox provides the information to a third party. And whether proactive or reactive, Redbox’s purpose for disclosing the information to Stream is the same.”

Affirming summary judgment for Redbox, the panel did agree with the plaintiff that he established standing under the statute by alleging that his personally identifiable information was disclosed.

To read the opinion in Sterk v. Redbox Automated Retail, click here.

Why it matters: Consumers have tried in a myriad of ways to apply the VPPA to 21st century technology with mixed results. Sterk has now lost twice on theories against Redbox, while plaintiffs have had some success with allegations against a magazine publisher under a state analogue to the statute.