## Facts

- After the September 11, 2001 attacks, NASA requested system-wide passenger data from Northwest Airlines for a three-month period for airline security research.
- Northwest provided NASA, without customers’ knowledge, passenger names, addresses, credit card numbers, and travel itineraries for individuals who flew between July and December 2001.
- Public disclosure of the transfer led to multiple putative class actions in other federal courts.
- Plaintiffs, Northwest passengers, filed a putative class action alleging the disclosure was unauthorized and contrary to federal privacy law and Northwest’s online privacy statements.

## Issues

1. Whether Northwest could be liable under the Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2702(a)(3), for disclosing passenger information to a federal agency as a “provider” of electronic communication service or remote computing service.
2. Whether Northwest’s online privacy policy created an enforceable contract with passengers, and whether plaintiffs adequately pleaded assent, consideration, and damages for breach.

## Decision

- The court granted defendants’ Rule 12(b)(6) motion and dismissed all claims for failure to state a claim.
- The ECPA claim was dismissed because Northwest was not a “provider” covered by § 2702(a)(3).
- The breach of contract claim was dismissed because the online privacy policy did not form a binding contract and plaintiffs did not adequately allege necessary elements, including damages.
- Because the case was dismissed on the pleadings, the court did not decide the alternative requests to transfer venue or stay proceedings.

## Legal Principles

- ECPA liability under 18 U.S.C. § 2702(a)(3) depends on whether the defendant is a statutorily defined provider of electronic communication service or remote computing service.
- A company that merely uses the internet to sell goods or services, without providing network access or similar communications services, is not an ECPA “provider” for purposes of § 2702.
- A website privacy policy, standing alone, is generally treated as a nonbinding policy statement absent pleaded facts showing offer, acceptance/assent (such as notice and agreement), and consideration.
- A breach of contract claim based on alleged data disclosure requires plausible allegations of cognizable damages flowing from the asserted breach.

## Conclusion

The court dismissed passengers’ claims arising from Northwest’s disclosure of personal travel data to NASA, holding the ECPA did not apply because Northwest was not a covered communications-services provider and that Northwest’s online privacy policy did not constitute an enforceable contract with adequately pleaded damages.


Dyer v. Nw. Airlines Corp., 334 F. Supp. 2d 1196 (D.N.D. 2004)