The Michigan attorney general intervened November 22 in a suit brought under a Michigan privacy law, making it one of the first times a state attorney general has weighed in on a case involving data use.
Michigan AG Bill Schuette defended the constitutionality of the Michigan Preservation of Personal Privacy Act, otherwise known as the Video Rental Privacy Act, citing the rights of Michigan residents to privacy in the video, audio, and reading materials they borrow or purchase. A Michigan resident had brought suit against Consumers Union of United States, alleging that the company had disclosed information, including his address and the names of magazines to which he subscribed, to “data mining” companies and other third parties, without obtaining his consent or providing him notice of the disclosure.
The Michigan law prohibits the release of information on customer’s purchase, rental, or borrowing of videos, books, and sound recordings that identify the customer unless the customer consents or unless the release is for the exclusive purpose of marketing directly to the customer, as long as the customer is given written notice and an opportunity to have their name removed, among other exceptions.
Significantly, the law was amended in July 2016 to stipulate that only a customer who suffers actual damages may sue. The law no longer allows for statutory damages of $5,000 per plaintiff. The question of what harm qualifies for standing in privacy cases is a key issue in privacy litigation today. Absent the amendment, this law was poised to be used repeatedly by plaintiffs seeking sizeable monetary damages with limited showing of harm.
In Ruppel v. Consumers Union, brought in the Southern District of New York, Consumers Union argued that the law unconstitutionally violated its right to free speech. AG Schuette contended that the law permissibly regulates commercial speech and withstands intermediate scrutiny.
While many state attorneys general have been involved in data breach cases that affect residents of their states, few have weighed in on laws governing data use. AG Schuette’s intervention in this case signals that more state AGs will likely become involved in substantive privacy legal issues beyond breach in the future.