Advisories
Former Subscriber Has No Right to Damages for Video Provider’s Failure to Destroy Personally Identifiable Information
Federal Court Holds that PII Retention after Cancellation of Service Causes No Harm
By John D. Seiver
08.05.13
In Padilla v. DISH Network L.L.C., a former subscriber alleged DISH failed to destroy his personally identifiable information (PII) upon cancellation of service, and failed to continue sending annual privacy notices while retaining his PII. A Chicago federal district judge dismissed claims for damages under the satellite subscriber privacy provisions (identical to cable’s), holding that the subscriber was not “aggrieved” because indefinite PII retention caused no actual damage, despite being contrary to the statute. While favorable to cable and satellite providers, the decision furthers the split among federal courts as to whether to allow cases to move forward based solely on alleged violations of federal statutes with statutory damage provisions. The court did allow the claim for injunctive relief to proceed, at which time Padilla will have to prove that DISH’s retention of his PII was “no longer necessary for the purpose for which it was collected” or was not being held for some other lawful reason.
Padilla, a DISH subscriber for over six years who cancelled service in 2011, sued under 47 U.S.C. §§ 338(i)(6) and 338(i)(1), which govern the collection, use, disclosure, and destruction of subscribers’ PII. Under § 338(i)(6), satellite providers must destroy subscriber PII when no longer necessary for the purpose for which it was collected (and there are no pending requests by the subscriber to access the PII, or pending court orders for disclosure). Section 338(i)(1) requires satellite providers, upon signing up a subscriber and at least yearly thereafter, to give written notice of the provider’s PII collection, use, disclosure, and retention practices, of the subscriber’s right to access the PII, and that these statutory rights exist and are enforceable by the subscriber. Identical requirements apply to cable operators under 47 U.S.C. §§ 551(e) and 551(a)(1). The statute provides a remedy for violations by allowing civil suits for actual damages or statutory damages of up to $1,000, punitive damages, injunctive relief, and attorneys’ fees and costs.
Padilla claimed that although DISH’s Privacy Policy stated it would retain former subscribers’ PII only as long as “necessary for the purposes for which it is collected or to satisfy legal requirements,” DISH in practice retained PII indefinitely. He also claimed that, once he was no longer a subscriber, DISH stop providing him annual privacy notices despite retaining his PII. Padilla additionally brought statutory and common law claims under state law. Padilla sought damages, an injunction, and fees.
The court dismissed Padilla’s damages claim because he lacked a cognizable injury necessary to have standing to sue even for statutory damages. The court held that retention alone (without any unauthorized disclosure) caused no actual damage. However, the court did find sufficient injury to allow the claim for injunctive relief to proceed.
The court also dismissed Padilla’s annual-notice claim on grounds that the statutory notice duty applies only to current subscribers. Reading “subscribers” in the notice provision to include former subscribers, the court held, would require retaining PII and/or collecting additional PII (such as new addresses, especially given that cancellations of service often attend a move of household). That would, in the court’s view, turn “a law intended to limit the retention of [PII] into a de-facto requirement that additional personal information be collected and retained.”
The court went on to dismiss Padilla’s Illinois Cable and Video Consumer Protection Law claim on grounds the statute applicable to satellite providers governs only disclosure, as well as his last contract claim (based on the earlier privacy notices) for essentially the same lack-of-damages reason.
The decision is significant in that it establishes that under the satellite privacy rules—and presumably the corresponding cable privacy rules—retention of PII, without disclosure, does not cause injury sufficient for standing to sue, notwithstanding the Act’s allowance for statutory damages. The decision accordingly reduces exposure to possible class claims as well. And while consistent with other federal cases that have ruled that a plaintiff must prove actual damages to recover statutory awards, it contributes to the growing split among federal courts as to whether these types of alleged statutory violations, especially where violations of consumer privacy have been alleged, should be allowed to move forward where there is no actual injury. So while this is beneficial, direct precedent for retention claims under the cable and satellite privacy laws (47 U.S.C. § 551 and §338, respectively), the risk remains that some courts will permit such actions to move forward based solely on an alleged violation of a statute with no harm.
Padilla, a DISH subscriber for over six years who cancelled service in 2011, sued under 47 U.S.C. §§ 338(i)(6) and 338(i)(1), which govern the collection, use, disclosure, and destruction of subscribers’ PII. Under § 338(i)(6), satellite providers must destroy subscriber PII when no longer necessary for the purpose for which it was collected (and there are no pending requests by the subscriber to access the PII, or pending court orders for disclosure). Section 338(i)(1) requires satellite providers, upon signing up a subscriber and at least yearly thereafter, to give written notice of the provider’s PII collection, use, disclosure, and retention practices, of the subscriber’s right to access the PII, and that these statutory rights exist and are enforceable by the subscriber. Identical requirements apply to cable operators under 47 U.S.C. §§ 551(e) and 551(a)(1). The statute provides a remedy for violations by allowing civil suits for actual damages or statutory damages of up to $1,000, punitive damages, injunctive relief, and attorneys’ fees and costs.
Padilla claimed that although DISH’s Privacy Policy stated it would retain former subscribers’ PII only as long as “necessary for the purposes for which it is collected or to satisfy legal requirements,” DISH in practice retained PII indefinitely. He also claimed that, once he was no longer a subscriber, DISH stop providing him annual privacy notices despite retaining his PII. Padilla additionally brought statutory and common law claims under state law. Padilla sought damages, an injunction, and fees.
The court dismissed Padilla’s damages claim because he lacked a cognizable injury necessary to have standing to sue even for statutory damages. The court held that retention alone (without any unauthorized disclosure) caused no actual damage. However, the court did find sufficient injury to allow the claim for injunctive relief to proceed.
The court also dismissed Padilla’s annual-notice claim on grounds that the statutory notice duty applies only to current subscribers. Reading “subscribers” in the notice provision to include former subscribers, the court held, would require retaining PII and/or collecting additional PII (such as new addresses, especially given that cancellations of service often attend a move of household). That would, in the court’s view, turn “a law intended to limit the retention of [PII] into a de-facto requirement that additional personal information be collected and retained.”
The court went on to dismiss Padilla’s Illinois Cable and Video Consumer Protection Law claim on grounds the statute applicable to satellite providers governs only disclosure, as well as his last contract claim (based on the earlier privacy notices) for essentially the same lack-of-damages reason.
The decision is significant in that it establishes that under the satellite privacy rules—and presumably the corresponding cable privacy rules—retention of PII, without disclosure, does not cause injury sufficient for standing to sue, notwithstanding the Act’s allowance for statutory damages. The decision accordingly reduces exposure to possible class claims as well. And while consistent with other federal cases that have ruled that a plaintiff must prove actual damages to recover statutory awards, it contributes to the growing split among federal courts as to whether these types of alleged statutory violations, especially where violations of consumer privacy have been alleged, should be allowed to move forward where there is no actual injury. So while this is beneficial, direct precedent for retention claims under the cable and satellite privacy laws (47 U.S.C. § 551 and §338, respectively), the risk remains that some courts will permit such actions to move forward based solely on an alleged violation of a statute with no harm.