Dyer v. Northwest Airlines Corporations
334 F. Supp. 2d 1196, 2004 U.S. Dist. LEXIS 18010, 2004 WL 2009397 (2004)
Premium Feature
Subscribe to Lexplug to listen to the Case Podcast.
Rule of Law:
An entity that sells traditional goods or services online, such as an airline, is not an "electronic communication service" under the Electronic Communications Privacy Act (ECPA) and is not liable under the act for disclosing customer data. Additionally, a website's privacy policy does not form a binding contract unless a plaintiff can demonstrate they read and relied upon it and suffered actual damages from its breach.
Facts:
- Following the September 11, 2001 terrorist attacks, the National Aeronautical and Space Administration (NASA) requested system-wide passenger data from Northwest Airlines for airline security research.
- Northwest Airlines complied with the request and provided NASA with customer information.
- The disclosed data included the names, addresses, credit card numbers, and travel itineraries of persons who had flown on Northwest Airlines between July and December 2001.
- Northwest Airlines made this disclosure without the knowledge or consent of its customers.
- At the time, Northwest Airlines had a privacy policy posted on its website.
Procedural Posture:
- The Plaintiffs initiated a class-action lawsuit against Northwest Airlines in a North Dakota state court.
- The complaint alleged violations of the Electronic Communications Privacy Act (ECPA) and breach of contract.
- Northwest Airlines removed the action from state court to the United States District Court for the District of North Dakota.
- Northwest Airlines filed a Motion to Transfer Venue, to Stay, or in the Alternative, to Dismiss Proceedings Under Rule 12(b)(6).
- The Plaintiffs filed a motion to stay proceedings, which the court denied.
Premium Content
Subscribe to Lexplug to view the complete brief
You're viewing a preview with Rule of Law, Facts, and Procedural Posture
Issue:
Does an airline's disclosure of passenger data to a government entity violate the Electronic Communications Privacy Act (ECPA) or constitute a breach of contract based on its website's privacy policy?
Opinions:
Majority - Hovland, Chief Judge
No. Northwest Airlines' disclosure did not violate the ECPA because the airline is not an electronic communication service provider as contemplated by the statute, nor did it breach a contract because a website privacy policy does not automatically create a contract and the plaintiffs failed to allege reliance or damages. The ECPA applies to entities that provide access to the internet, such as Internet Service Providers (ISPs), not to businesses that simply use the internet to sell their traditional products and services. The court distinguished Northwest Airlines, which sells airline tickets online, from an ISP whose primary business is providing electronic communication services. Therefore, Northwest falls outside the scope of § 2702(a)(3). Regarding the contract claim, the court found it deficient for three reasons: 1) broad statements of company policy generally do not create contractual rights; 2) the plaintiffs did not allege that they had ever read, understood, or relied upon the privacy policy; and 3) the plaintiffs failed to allege any specific contractual damages resulting from the alleged breach.
Analysis:
This decision significantly narrows the applicability of the Electronic Communications Privacy Act, establishing a key distinction between internet service providers and online vendors of traditional goods and services. By classifying Northwest Airlines as the latter, the court limited the ECPA's reach to the infrastructure of electronic communications rather than the commerce conducted upon it. This ruling makes it more difficult for plaintiffs to hold companies liable for sharing business records under the ECPA. Furthermore, it sets a high bar for treating website privacy policies as enforceable contracts, requiring plaintiffs to prove specific knowledge, reliance, and damages, which presents a significant hurdle in privacy litigation.
