Nate Wunderli ’22
Staff Editor
Hushed, tense whispers echoed throughout the courtroom (aka Caplin Pavilion). “All rise. Oyez, Oyez, Oyez.” The crowd went silent. I tried to stand and partially tripped over my backpack, but recovered in time to give each judge a slight head nod that hopefully will win me a clerkship in a couple of years. The tension was palpable, as the competitors mentally readied themselves for what would be the culmination of years of hard work and preparation leading up to this moment.
The background of the case at issue are as follows: Plaintiff Yasmin Suri brought a class action lawsuit against a social media video service, JusticeConnect. JusticeConnect had developed an application, PrideParent, that was “an advice-oriented community for same-sex parents,” through which they posted content including advice regarding adoption, IVF, and surrogacy. Suri decided to purchase premium content on the app, which required entering her name, email address, phone number, home address, and credit card information. Nine months before the district court judgment, Suri received an email from JusticeConnect notifying her that all of PrideParent’s premium content subscribers were victims of a data breach.
While JusticeConnect claimed there was no reason to believe any sensitive information had been misused, the company urged its customers to take protective measures. Upon further investigation, Suri also learned that JusticeConnect maintained consumer preference data through PrideParent, which includes unique device identifier information, the user’s location when the app is open, and all specific content the user views. JusticeConnect sold this data to an advertising agency, the Chloe Company, which aggregates the data it receives from several applications and uses it to target advertisements to individual users.
Suri was alarmed and decided to bring action against JusticeConnect, alleging (1) that JusticeConnect acted negligently in connection with the data breach, and (2) that JusticeConnect violated the Video Privacy Protection Act (VPPA) by knowingly disclosing consumer preference data to the Chloe Company.[1] The District Court for the District of Lile granted Suri’s motion for summary judgment. JusticeConnect then appealed, setting the stage for these advocates to shine.
After opening remarks by the judges—Judge Jeffrey Howard from the U.S. Court of Appeals for the First Circuit, Judge Alison Nathan for the U.S. District Court for the Southern District of New York, and Judge Andrew Oldham for the U.S. Court of Appeals for the Fifth Circuit—Henry Dickman ’20 calmly took the stage to argue for the appellant, JusticeConnect, on the issue of whether a data breach can confer injury in fact. Dickman argued that the bar to standing is high where there is only a threat to harm, not actual harm. The harm must be “certainly impending” and pose a “substantial risk” to the plaintiff in order to demonstrate injury in fact.
In this case, the harm does not meet either of these criteria, Dickman argued. It has been nine months since the breach, and the plaintiffs have not alleged any actual harm or that harm is imminent. There has been plenty of time following the breach to take the necessary steps to counter identity theft (i.e. freezing credit cards and obtaining new ones), so there is little risk of identity theft in the future. Studies show only about 1 in 5 data breaches lead to identity theft. On top of that, Dickman pled with the court to consider the chain of intervening causes between a data breach and identity theft, arguing that there are too many steps in between to consider a data breach “certainly impending harm.”
Throughout his argument, the judges did not hold back as they peppered Dickman with questions, admitting after the argument that one reason for their questioning was to “throw him off.” They seemed especially concerned with the fact that a 1 in 5 chance of having your identity stolen can very well be seen as a substantial risk, and barring all victims of a data breach from recovery unless they experience actual harm can under-deter companies from this kind of negligence. They also argued that having to freeze a credit card and take related preventive measures following a data breach can be seen as harm in itself, but Dickman countered that the plaintiffs never alleged any harm pertaining to this.
The judges were also concerned about future applications of this case and where the line should be drawn to determine what constitutes a “substantial risk” or “certainly impending harm” with regards to data breaches in general. Although Dickman admitted that some data breaches without actual harm could be considered injury in fact, he refused to draw a bright line rule, instead advocating for a more case-by-case approach. In this case, even if the worst thing that could have happened occurred (identify theft, followed by credit card fraud), the credit card companies do not hold the customers liable for these charges so no damage would have been incurred regardless.
Following Dickman’s fantastic performance, Katherine Whisenhunt ’20 took the spotlight for the appellee plaintiff, Suri, who represented the class of plaintiffs affected by the data breach. A former college soccer player turned oral advocate,[2] Whisenhunt showed a command of the case law that impressed the panel of seasoned judges. Citing Clapper, Whisenhunt argued that creating a substantial risk is sufficient to establish a breach and that a data breach where credit card information, names, addresses, and other personal information is stolen is the substantial risk in which the harm of identity theft arises.
In fact, the very purpose of hacking is to misuse the information, so the harm is a clear and obvious result of the risk presented. Countering Dickman, Whisenhunt argued that the attenuating circumstances between a data breach and identity theft is not as long and complicated as the appellants contended, but certain, direct, and in line with what the Clapper court would consider to be a substantial risk. The hackers had everything they needed to steal the identity of the plaintiffs.
The bench did not fire questions at Whisenhunt at the same speed that they did with Dickman, but their questions tried to derail her from her main points. However, Whisenhunt stayed focused on the arguments she needed to present in her limited time and didn’t allow the questioning to keep her from presenting a strong case for her client.
Megan Mers ’20 was next up to the plate, arguing for JusticeConnect on the second issue of whether PrideParent’s selling of device identification codes to the Chloe Company for use in advertising is in violation of the VPPA Act. Mers argued that since an ordinary person cannot trace the Personally Identifiable Information (P.I.I.) back to the actual person, PrideParent’s practice should not violate the statute. Although conceding that the statute was created at a time when the technology at issue could not have been anticipated, Mers argued that the legislative intent of the statute is still important in its application to this case.
Mers argued that the point of the statute was to prevent video service providers from releasing potentially embarrassing customer information to third parties. The information released to the Chloe Company was for its eventual use in targeted advertising, not for any kind of public embarrassment. Congress has had opportunities to revise the statute to clarify some of the points relating it to today, but they have yet to do so, so it would be unwise to infer what Congress could have clarified but chose not to.
The judges’ main concern about Mers’s argument was that the company the data was released to was not an ordinary person, but an organization with the ability to trace back the information to the individuals. Why should the recipient of the information not matter but the ordinary person standard apply, when PrideParent knew full well, or at least should have known, the capacity of the company it was sending the information to?
Mers answered that making this kind of information P.I.I. is essentially rendering almost all information P.I.I. just because somebody can trace it back to you. Her example was that Apple can trace a zip code and the movie Legally Blonde back to individuals, but clearly that is not P.I.I. protected under the statute. Thus, the ordinary person standard is the only standard that makes sense in this case, and basing it on the recipient or another standard would be overly broad and render too much information P.I.I., contrary to the intentions of the legislature.
Last of all to argue for the appellee was the 2019 Lile Moot Court Oral Advocacy champion Abbey Thornhill ’20. Contrary to Mers, Thornhill thought the court should construe the meaning of the VPPA broadly and look at what the statute is trying to prevent generally. The purpose of the VPPA, she contends, is to prevent companies from releasing information that can later be traced back to an individual. It does not matter what an ordinary person can or cannot do with the information, but what the recipient of the information can do with it. Chloe’s very business model is to take this kind of information, aggregate it, and use it to target individuals for advertisement. JusticeConnect knew full well how Chloe used this information and that Chloe has the capability to trace it back to their customers. In addition, JusticeConnect could have asked for consent from its customers to sell their information, which is a policy many current companies implement, but they did not.
Thornhill argued that although the VPPA does not explicitly mention the type of information relevant to this case since it was enacted before this sort of technology existed, the legislature made the statute to protect personal customer information from being released, which is exactly what happened here. Notwithstanding the facts and circumstances that lead to the adoption of the statute were different than the case at issue, the main purpose of the statute remains the same: Protect individuals from companies misusing their personal information.
After the main arguments were presented and Mers gave a concise, yet passionate rebuttal for the appellant, the judges exited to deliberate the facts and decide the outcome. Relief washed over both teams, as they finally let themselves relax and take in years of hard work, oral arguments, and lengthy briefs. The teams embraced each other and shook hands with the opposing counsel. The hard part was over, but the result had yet to be determined.
“All rise.” I don’t know why that phrase gives me the chills every time. The judges reentered the room, this time to a much more relaxed audience. The judges praised the oral advocacy skills of all the competitors, also complimenting their legal briefs and how well they handled the tough questions the judges posed. After the judges each gave a short speech congratulating the competitors, they announced the winners: Megan Mers and Henry Dickman on behalf of the appellants won the argument on both counts, and Abbey Thornhill won the award for best oral advocate. The teams once again embraced, and the crowd offered its congratulations and appreciation for what was a remarkable competition.
Thornhill, talking to the Law Weekly about the competition, said: “The results of the finals were obviously disappointing, but I can honestly say that the decision to compete in Lile, and the decision to compete with Katherine, were the best two decisions I have made in all of law school. I had the opportunity to improve and test my skills as an advocate, but I also got to do it with my best friend. It took a lot of stress-eating chocolate from the snack room, but it was an experience I would not trade for the world.” Whisenhunt echoed her partner, telling the Law Weekly that “[p]articipating in a competition that spans more than a year takes a tremendous amount of work, but it was worth the effort. I learned a lot about appellate advocacy throughout the process. We competed against excellent teams in every round. I am grateful to the organizers of the competition, the judges who volunteered their time, and the students who helped us with practice moots. I am particularly thankful for Abbey, who not only is an incredible moot court partner, but also one of my best friends.”
Henry Dickman also thanked those who helped along the way, saying “One of my favorite aspects of this competition was the chance to build great friendships with the many people who prepared us for the real event. We're really grateful to those people for volunteering so much of their time; we certainly wouldn't have been ready for the judges without them." Mers commented, “I learned so much from Lile, primarily from our mooters and from Henry. The competition was incredibly rewarding—in no small part because of the amazing friends who helped us prepare day after day.” The court of Lile is now adjourned until next year, and the Law Weekly can’t wait to see what is to come.
---
nw7cz@virginia.edu
[1] This information has been adapted from the problem written by Hanaa Khan ’20.
[2] To date I’ve never lost a pickup game with Katherine on my team.
