Earlier this month, the Eighth Circuit expanded standing to bring privacy policy violations claims but limited the definition of personal information in affirming the dismissal of a class action complaint in Carlsen v. GameStop, Inc., No. 15-2453 (8th Cir. Aug. 16, 2016).
GameStop published Game Informer Magazine, which provides news, reviews, and commentary about the video game industry. Subscribers could access digital versions of Game Informer Magazine and additional enhanced content online on the Game Informer website. They could also log in to the website using their Facebook accounts and utilize certain Facebook functions, such as “Like,” “Share,” and “Comment,” through the website. Matthew Carlsen purchased a one-year subscription to Game Informer Magazine and its enhanced online content for $14.99. The terms of service for the subscription incorporated Game Informer’s privacy policy, which provided that, with certain exception, “Game Informer does not share personal information with anyone.”
Carlsen filed a class action suit alleging that GameStop shared personal information with Facebook through the Game Informer website in violation of its privacy policy. Specifically, Carlsen alleged that the Game Informer website transmitted a user’s Facebook ID and Game Informer browsing history to Facebook if the user previously had opted to stay logged in to Facebook. Carlsen alleged that, had he known about the sharing of information, he either would not have paid as much for his subscription or would have refrained from accessing the online content on the Game Informer website for which he paid.
Carlsen’s class action complaint asserted various claims, including breach of contract, and unjust enrichment. The district court dismissed the complaint for lack of subject matter jurisdiction, holding that Carlsen lacked standing to bring his claims because he had failed to establish that he suffered a cognizable injury. The district court found that there was no injury because Carlsen failed to allege that he paid any specific amount for the privacy policy or that he had bargained for any additional privacy protection over that received by nonpaying visitors to the Game Informer website. In particular, the district court noted that the Game Informer privacy policy applied equally to both paid and non-paid Game Informer website users.
In Carlsen v. GameStop, Inc., No. 15-2453 (8th Cir. Aug. 16, 2016), the Eighth Circuit affirmed the dismissal of Carlsen’s complaint, not for lack of standing, but for failing to state a claim. The Court found that Carlsen’s allegation that he suffered damages “in the form of devaluation of his Game Informer subscription in an amount equal to the difference between the value of the subscription that he paid for and the value of the subscription that he received, i.e., a subscription with compromised privacy protection,” constituted an “actual” injury. Carlsen, at *7. In addition, the Court also found that “Carlsen’s allegation that he did not receive data protection set forth in GameStop’s policies” was sufficient to establish standing for his unjust enrichment claim. Id.
However, the Eighth Circuit held that Carlsen failed to state a claim for breach of contract, finding that a user’s Facebook ID and browsing history did not constitute personal information under Game Informer’s privacy policy and, therefore, the policy did not obligate GameStop to refrain from sharing that information. See id. at *9–10. The Court noted that the Game Informer privacy policy referenced that personal information might “include: your name, home address and zip code, telephone number, e-mail address and… credit card or checking account information including billing and shipping addresses and zip codes.” Id. at *10. The Court also noted that the policy stated that the Game Informer website might ask a user to provide personal information in connection with one of its features or services. Id. Because a user’s Facebook ID and browsing history were not on the list of what personal information might include and were neither solicited nor voluntarily provided by a user in response to such a solicitation, the Eighth Circuit found that the privacy policy did not apply to, or protect, this information.1Id. In addition, the Court held that Carlsen had similarly failed to state a claim for unjust enrichment because he had failed to allege “that any specific portion of his subscriber fee went toward data protection and that GameStop agreed to provide additional protection to paid subscribers” different than what it also provided to non-paying users. Id. at *11.
The significance of the Carlsen decision is twofold. First, Carlsen lowers the Article III standing bar in the Eighth Circuit for privacy claims where a consumer has purchased a product or subscription to a service. Under Carlsen, it may be sufficient for plaintiffs simply to allege that they would have paid less for a product or service if the purported violation of the privacy policy had not occurred to satisfy the injury requirement necessary for standing. Second, Carlsen limits the definition of personal information (at least in the Eighth Circuit) to how it is defined in a company’s or organization’s privacy policy. Under Carlsen, information that is not otherwise listed or referenced in a privacy policy is not covered by that policy. Companies and organizations may be able to limit their potential liability and increase the available options for what they can do with the data that they collect by defining personal information in their privacy policies much more narrowly.
1The Eighth Circuit further noted that the Game Informer privacy policy did not contain a specific promise to refrain from sharing a user’s Facebook ID and browsing history. Carlsen, at *10. Nor did the policy state that its protections extended to other websites maintained by other companies to which the Game Informer website linked. Id.