Last week Hearst Communications Inc. agreed to pay $50 million to settle an alleged violation of the Michigan Video Rental Privacy Act, reports Law360. In a 2015 case in which plaintiff Josephine James Edwards sought class action status, Hearst was accused of selling its magazine customers’ subscription information including magazine subscription histories, reading habits, age, race, religion, charitable donations, political affiliations, income range, shopping habits and other personal data to third parties including data-mining companies without consent.

The video privacy act makes it illegal for anyone in the business of selling, renting or lending books or other written materials, audio or video recordings to share personally-identifiable information. As part of the settlement, Hearst will not admit to any wrongdoing.

The settlement, which was reached after mediation last month, is more than three times the biggest previous settlement in such a case. The largest settlement to date was $16.38 million by Consumer Reports who was sued by a class of readers who also believed their subscription data had been sold without their consent. That case was settled in April.

Edwards was a Good Housekeeping subscriber who said she received harassing phone calls and junk mail as a result of her personal data being sold to third parties. In addition to Good Housekeeping, Hearst titles Cosmopolitan, Country Living, Elle, Esquire, Food Network Magazine, Harper’s Bazaar, O, the Oprah Magazine, Redbook and Seventeen allegedly sold customer subscription data to third parties.

Variety reports that the settlement agreement would pay approximately $155 each to Michigan residents who were Hearst magazine subscribers prior to July 30, 2018. There are approximately 1.9 subscribers eligible class members who could qualify for the settlement upon completion of a one-page claim form.

Insider Take:

The proliferation of ad blockers, lawsuits like this one and the passage and implementation of GDPR should make it clear to publishers and other businesses that consumers want to control their personal data. They do not want it to be sold without their consent.

Businesses should take great care with their customer data and protect it as if it were their own. GDPR may apply only to businesses with customers in the European Union, but with growing privacy concerns and data breaches like the Facebook-Cambridge Analytica scandal, it won’t be long before GDPR-style regulation comes to the U.S. Companies who aren’t already following best practices for data privacy protection better get started before the government regulates that they do so, or face hefty fines.