A recent court decision signifies that compliance with
state privacy laws cannot always be achieved by looking to the
residency of data subjects.
On January 16, 2020, a federal judge held that Michigan's
Personal Privacy Protection Act applies to nonresidents who are
located outside the state. The decision, Lin v. Crain
Communications, No. 19-11889 (E.D. Mich. January 16, 2020),
has important implications for the extraterritorial application of
state privacy laws and more generally signifies that compliance
with these laws cannot always be achieved by simply looking to the
residency of data subjects.
Gary Lin, a resident of Virginia, sued Crain Communications
under the Michigan Personal Privacy Protection Act, M.C.L. §
445.1712 ("PPPA") for allegedly disclosing information
about Lin's magazine subscriptions to various data mining
companies. Crain moved to dismiss the lawsuit, arguing that Lin, as
a resident of Virginia, lacked standing under the PPPA. The
