Key Points

• Over the last several years, the class action bar has targeted companies in a wave of putative class actions under state “right of publicity” statutes. Although they vary some around the edges, these statutes generally seek to codify the common law right of publicity—the right to prevent the unauthorized use of one’s identity for commercial gain—and have been used to sue companies that sell personally identifiable information to third-party marketers, data aggregators and brokers. Like many other state statutes seeking to codify established common law privacy rights, these statutes bring with them the specter of business-crippling statutory damages.
• California, where statutory damages of $750 per person, full profits disgorgement, punitive damages and attorney’s fees are available under Civil Code Section 3344, and Illinois, where businesses may be liable to the tune of $1,000 per class member under the IRPA as well as full profits disgorgement, punitive damages and attorney’s fees, have been hotbeds for this litigation.
• The right of publicity doesn’t lend itself naturally to representative litigation claims because the right is distinctly personal. For this reason, class actions brought under these laws have tended to target conduct well outside the realm traditionally thought to be prohibited by the common law right of publicity. Perhaps chief among these cases have been actions seeking to aggregate the claims of consumers included on mailing lists sold in the direct mail marketplace, on the theory that those on the mailing list have suffered a common injury protected by the statutory right of publicity.
• The 7th Circuit in Huston v. Hearst Communications, Inc. just issued a published decision in a putative IRPA class action laying these claims to rest. Applying straightforward principles of statutory construction and federal rules of pleading, the court soundly rejected a liability theory that has been repeatedly pursued to assert claims against companies that sell personally identifiable information to third parties.

Background

The Illinois Right of Publicity Act (IRPA) prohibits the nonconsensual use of another individual’s identity for a “commercial purpose,” defined by the statute as “the public use or holding out of an individual’s identity (i) on or in connection with the offering for sale or sale of a product, merchandise, goods, or services; (ii) for purposes of advertising or promoting products, merchandise, goods, or services; or (iii) for the purpose of fundraising.” Under each of IRPA’s three disjunctive prongs defining a “commercial purpose,” consumers may sue for the greater of actual damages, profits derived from the unauthorized use of the person’s identity, or statutory damages of $1,000. Punitive damages, injunctive relief and attorney’s fees are all also available.

Cases under IRPA generally fall into two categories. In the first category are those aptly described by the court in Huston as “background report” cases. Those actions challenge companies in the business of selling consumer background reports and the like. Prospective purchasers are shown previews and advertisements that include limited information about particular individuals, with an offer to sell more information about these or other individuals on demand.

In the second category are cases involving the much more ubiquitous practice of selling customer mailing or subscriber lists typically enriched with other personal information, either to third-party marketers or data aggregators. This ubiquity dramatically expands the field of potential defendants, as well as class members. As a result, the number of putative class actions challenging these practices has dramatically increased. Huston is such a case.

The Huston Decision

At issue in Huston was the defendant magazine publisher’s alleged sale to “data miners, aggregators, and brokers” of lists that identified subscribers of the company’s magazines. Those mailing lists, plaintiff alleged, included personally identifiable information of the company’s subscribers, including “name, address, gender, age, ethnicity, income, political party, religion, and charitable donation history, among other personal attributes.” As in other IRPA actions, plaintiff alleged that the defendant’s sale of this customer information violated both the first and second prongs of the statute—the “holding out” of customers’ personal information (i) in connection with the offering for sale or sale of a product, merchandise, goods or services; and (ii) for purposes of advertising or promoting merchandise, goods or services. Plaintiff alleged that defendant sold her and millions of other class members’ personal information without their consent, and she sought statutory damages of $1,000 per class member.

The district court granted defendant’s motion to dismiss, holding, as other district courts in the 7th Circuit had held, that “IRPA liability is limited to instances where a person’s identity is used or held out to sell a separate product, and the mailing lists are not separate from Huston’s identity.” The 7th Circuit affirmed on separate grounds.

Addressing IRPA’s first prong, the court found “outcome determinative . . . that [plaintiff] did not allege that [defendant] solicited mailing list purchasers by publicizing her information.” There was no allegation that prospective purchasers of the personally identifiable information “were able to see her or any other subscribers’ information, in whole or part, prior to their purchase.” Nor was there any contention that plaintiff’s name or other personal information was itself “used to sell or promote the mailing lists themselves.” Instead, plaintiff’s theory of liability turned on her claim that “her identity was included as part of the product sold.” Applying the plain text of the statute, the court held that this theory was “a nonstarter.”

To begin, the court explained that plaintiff’s argument “ignores the timing requirement implicit in IRPA’s construction.” On its face, IRPA requires that a person’s identifying information be used or held out “to offer to sell or sell a product, piece of merchandise, good, or service.” In other words, a person’s identifying information has to “either accompany an offer to sell or precede the sale”—“it cannot follow the sale.” If a person’s identity is “only revealed after the sale is completed,” then no claim for relief exists under IRPA.

Ultimately, because plaintiff’s personal information was disclosed only after the sale of the mailing list was completed, and it was not itself used to sell the list, the court held that her claim was “outside IRPA’s ambit.”

Plaintiff’s theory under IRPA’s second prong fared no better. Armed with the text of the statute and plain good sense, the court reasoned that the prong two argument foundered on the requirement that plaintiff’s identity must have been held out to promote defendant’s goods or services, which it quite clearly was not. For obvious reasons, plaintiff was unable to credibly allege factual allegations that would “plausibly suggest that [defendant]’s commercial goal in holding out its customer mailing lists is to promote its own magazines.” Because plaintiff’s complaint included no such allegations, she could not clear the threshold hurdle of pleading, and her claim failed.

Looking Ahead

Huston should mark the rightful end of dubious claims under IRPA, and it should prove to be useful guidance in jurisdictions where similarly suspect claims are still being pursued. This decision, and those like it, are welcome at a time when so-called “privacy” class actions—leveraging the aggregate litigation device and emerging state privacy statutes—are increasingly being used to challenge routine business practices well outside the intended reach of these newly codified laws.

At the same time, there are at least a couple of things to bear in mind moving forward. First, remember that in Huston there was no personal information that was disclosed prior to or in connection with the sale of the underlying subscriber data. If your business practices involve such pre-sale disclosures, Huston provides no shield to liability.

Second, we would not be surprised to see attempts to state a prong two promotion claim under IRPA in complaints that purport to supply the factual allegations the 7th Circuit found lacking in Huston. To be sure, we think such allegations would be facially implausible in most circumstances and independently subject to dismissal based on the text of the statute, but the bottom line is that Huston may not be the end to this wave of cases.