## Facts

- Redbox operated self-service kiosks for renting DVDs and Blu-ray discs using payment cards.
- Redbox outsourced customer service to Stream Global Services, which handled customer calls through a call center.
- To resolve customer-service problems, Redbox provided Stream access to Redbox’s customer database, including information identifying customers and their rental histories.
- Stream representatives sometimes reviewed a caller’s rental history to address issues such as being charged without receiving a disc.
- Stream used customer records in training exercises to teach employees how to access the database and respond to customer inquiries.
- Customers Kevin Sterk and Jiah Chung sued Redbox under the Video Privacy Protection Act (VPPA), alleging the database access constituted unlawful disclosure of personally identifiable information and viewing histories to a third party.

## Issues

1. Whether Redbox’s disclosure of customer information and rental histories to an outsourced customer-service vendor fell within the VPPA exception for disclosures “incident to the ordinary course of business,” including “request processing.”
2. Whether the district court abused its discretion by denying plaintiffs’ Rule 56(d) request for additional discovery before ruling on summary judgment.

## Decision

- The Seventh Circuit affirmed summary judgment for Redbox.
- The court held that disclosures to Stream were “incident to the ordinary course of business,” specifically “request processing,” and therefore permitted under the VPPA.
- The court held the district court did not abuse its discretion in denying additional discovery under Rule 56(d) given the extensive discovery already completed.

## Legal Principles

- Under the VPPA, a video service provider may disclose personally identifiable information when the disclosure is “incident to the ordinary course of business” as statutorily defined, including “request processing.”
- Customer-service interactions seeking help with a rental qualify as “requests,” and access to customer records needed to resolve those requests falls within “request processing.”
- Use of customer records to train customer-service personnel may be treated as incident to request processing when tied to the same customer-service function.
- A court may deny Rule 56(d) discovery when the nonmovant has already had ample discovery and further discovery would not create a genuine dispute of material fact on the dispositive legal question.

## Conclusion

The Seventh Circuit held that providing an outsourced call center access to customer identifying information and rental histories to handle customer-service problems, including related training uses, is a disclosure incident to “request processing” and thus exempt from VPPA liability, and it upheld the denial of additional discovery before summary judgment.


Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618 (7th Cir. 2014)