Whether consumers can sue for violations of the Cable Communications Policy Act
Gubala v. Time Warner Cable, Inc., No. 16-2613, currently pending before the U.S. Court of Appeals for the Seventh Circuit, concerns whether consumers have standing to sue companies for violating the Cable Communications Policy Act (“CCPA”). The CCPA requires cable operators to destroy personally identifiable information (“PII”) of consumers if the “information is no longer necessary for the purpose for which it was collected.” 47 U.S.C. § 551(e). Gubala alleges that even though he cancelled his Time Warner Cable service in 2006, TWC still retaines his personal information, including his name, address, Social Security Number, phone numbers, and credit card information. The lower court dismissed Gubala’s claim for lack of standing and for failure to state a claim.
Does the plaintiff have standing to sue Time Warner Cable for violating the Cable Communications Policy Act?
Factual & Procedural Background
The lead plaintiff, Derek Gubala, signed up for cable services from Time Warner Cable (“TWC”) in December 2004. When registering, TWC “required Plaintiff to provide TWC with various forms of PII, including his date of birth, address, home, and work telephone numbers, social security, and credit card information.” He cancelled his service in September 2006. Gubala learned that all of his personally identifiable information (“PII”) remained in TWC’s billing records when he called TWC in 2014. Upon learning this, he filed this putative class action suit on September 3, 2015.
The first complaint sought injunctive relief, attorneys’ fees, costs, and damages—actual, liquidated, and punitive. TWC sought enforcement of the binding arbitration clause in the Residential Services Subscriber Agreement, which Gubala agreed to when signing with TWC. To avoid binding arbitration, Gubala subsequently amended the complaint—twice—to remove any prayer for damages.
Gubala alleges TWC violated his rights conferred to him by the Cable Communications Policy Act of 1984, 47 U.S.C. §§ 521-573. Specifically, Gubala alleges TWC violated 47 U.S.C. § 551(e), which requires a cable operator to destroy “personally identifiable information if the information is no longer necessary for the purpose for which it was collected and there are no pending requests or orders for access to such information under subsection (d) of this section or pursuant to a court order.” Gubala argues that TWC’s failure to destroy [his] PII, as required [by] 47 U.S.C. § 551, constitutes injury in the form of a direct invasion of their federally protected privacy rights.”
TWC moved the court to dismiss the complaint for failure to state a claim upon which relief can be granted. Specifically, TWC claimed “the plaintiff had failed to plead the elements of a claim for injunctive relief, and because the request for injunctive relief was allegedly vague.” The District Court heard oral arguments on this motion the same day Spokeo v. Robins, 136 S. Ct. 1540 (2016), was decided. Following the Supreme Court’s opinion in Spokeo, the District Court granted the parties’ request to brief on whether Spokeo had any impact on this case.
Lower Court Opinion
The District Court granted TWC’s motion to dismiss on two grounds: lack of standing to invoke federal court jurisdiction and failure to state a claim.
First, Judge Pamela Pepper agreed with TWC that Gubala “cannot prove the ‘concrete harm’” supposedly required by the Supreme Court in Spokeo v. Robins. The court found that Gubala alleged a set of facts similar to those alleged by Robins in Spokeo:
[T]he plaintiff alleges that Congress has identified and elevated an intangible harm—the risk to subscribers’ privacy created by the fact that cable providers have an enormous capacity to collect and store personally identifiable data about each cable subscriber. He has identified the statutory protection Congress has provided—the requirement in the CCPA that cable providers destroy personally identifiable information when it is no longer required for the purposes which it was collected.
The court concluded that although these allegations satisfy the particularity prong of standing, they fail to satisfy the concreteness prong. In conducting the concreteness analysis, the court looks entirely at harms: Gubala did not allege that TWC disclosed the PII to a third party; even if TWC did disclose the data, Gubala hadn’t alleged that disclosure caused harm, such as being contacted by marketers or being the victim of fraud or identity theft. The court found the that allegations in Spokeo were slightly more concrete than those made by Gubala, because Gubala has failed to allege that TWC was retaining and publishing inaccurate records.
The court also found that Gubala had failed to state a claim. To receive injunctive relief, a plaintiff must not have an “adequate remedy at law” and will “suffer irreparable harm if the court does not grant the injunctive relief.” The court distinguished Sterk v. Redbox Automated Retail, LLC, which found that the Video Privacy Protection Act did not create a private right of action for damages against a company that failed to timely destroy PII. Instead, the court found that “[u]nlike it did with the VPPA, Congress provided a damages remedy for violation of the information destruction requirement in the CCPA.” As a result, Gubala was not seeking monetary damages only to avoid the arbitration clause, not because the CCPA barred a damages claim. In other words, “it is not that the plaintiff does not have a remedy at law; it is that he does not want to avail himself of that remedy at law, because to do so, he would have to eschew federal court and submit himself to a binding arbitration award.”
The lower court granted TWC’s motion to dismiss. Gubala filed a timely appeal in the U.S. Court of Appeals for the Seventh Circuit on June 22, 2016. Judge Richard Posner authored a panel opinion affirming the lower court decision on January 20, 2017.
Article III of the U.S. Constitution grants the federal courts judicial power over “cases” and “controversies.” In order to show standing, plaintiffs must establish that they have (1) suffered an injury-in-fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) is likely to be redressed by a favorable judicial decision. Injury-in-fact itself requires the plaintiff suffer an invasion of a legally protected interest that is (1) concrete, (2) particularized, and (3) actual or imminent, not conjectural or hypothetical.
EPIC has a long history of advocating for consumer privacy.
In August 2016, EPIC filed an amicus brief in Cahen v. Toyota Motor Corp, warning the Ninth Circuit that connected cars pose serious risks to consumer safety and privacy. EPIC also argued that the lower court misapplied the Article III standing test, focusing incorrectly on consequential harm. In July 2016, EPIC filed an amicus brief in Perry v. CNN, arguing that the privacy protections in the Video Privacy Protection Act apply to mobile apps that provide video service. Earlier that month, EPIC also filed an amicus in In re SuperValu Customer Data Security Breach Litigation, defending the rights of consumers to sue companies that mishandle personal consumer information. In April 2016, EPIC filed an amicus brief in the Third Circuit case Storm v. Paytime, Inc., which involved a very similar question as In Re SuperValu. EPIC argued that consumers are facing unprecedented threat from data breaches and subsequent misuse of their personal data. Accordingly, now is not the time to be limiting consumers’ options for recourse. EPIC also argued that consequential, downstream harms such as identity theft and financial fraud are irrelevant to whether data breach victims have standing to sue breached companies.
In January 2016, EPIC launched Data Protection 2016, a nonpartisan campaign to make data protection an issue in the 2016 election. The campaign advocates for reduced identity theft and financial fraud and for investigations of the misuse of personal data.
In September 2015, EPIC filed an amicus brief in the Supreme Court case Spokeo v. Robins, which concerns whether courts have jurisdiction to review cases brought based on violations of federal statutory rights. Plaintiff Robins sued Spokeo for violating the Fair Credit Reporting Act by disclosing inaccurate information about him. EPIC filed an amicus brief, advising the Court that now is not the time “to limit the ability of individuals to seek redress for violations of privacy rights set out by Congress.” EPIC highlighted the need for robust privacy and consumer protection laws by demonstrating that “Americans consumers today face an epidemic of privacy harms, including data breaches, identity theft, and financial fraud.” In 2015 alone, data breaches have “exposed more than one hundred and forty million records of personally identifiable information.” And according to the most recent Department of Justice report, “identity theft cost American consumers more than twenty-four billion dollars” in 2012. In May 2016, the Supreme Court concluded that the U.S. Court of Appeals for the Ninth Circuit had failed to analyze whether Robins’s allegations were “concrete,” and remanded the case to the lower court.
In April 2014, EPIC submitted comments to the White House Office of Science and Technology Policy’s review of Big Data and the Future of Privacy. In its comments, EPIC warned the OSTP about the risks Americans face from the current big data environment, urged the swift enactment of the Consumer Privacy Bill of Rights, and highlighted the need for stronger privacy safeguards.
EPIC has also repeatedly advised legislators about the need to provide strong protections for consumer data. In October 2015, EPIC testified before the Senate Committee on Aging about protecting senior citizens from identity theft. EPIC warned about the growing risk of SSN-related identity theft, a risk magnified by the inclusion of SSNs on Medicare cards. EPIC had previously warned Congress and state legislators about the risks of using SSNs on identity documents. In June 2011, EPIC testified before the House Committee on Energy and Commerce about the SAFE Data Act, a bill intended to protect consumers’ personal information. EPIC emphasized the growing problem of data breaches and the likelihood that problems would get worse as more user data moves to cloud-based services. EPIC criticized the bill for preempting stronger state laws and for not adequately protecting personal information. The bill was not enacted. And in May 2009, EPIC testified before the House Committee on Energy and Commerce about H.R. 2221, the Data Accountability and Trust Act, and H.R. 1319, the Informed P2P User Act. EPIC opposed the preemption of state laws, recommended the use of text messages for breach notices, and suggested that personally identifiable information be broadly defined to include any information that identifies or could identify a particular person. Both bills died in committee.
U.S. Court of Appeals for the Seventh Circuit, No. 16-2613