A VHS-era privacy law in the Digital Age

As demonstrated by the overwhelming bipartisan support to overhaul the Electronic Communications Privacy Act, privacy laws passed in the 1980s are difficult to apply to today’s technology.

Nowhere is this difficulty more evident than in cases dealing with the Video Privacy Protection Act. A VPPA case decided in late April by the federal appellate court in New England illustrates the weaknesses in this anachronistic law. Congress passed the VPPA in 1988 in response to the Washington City Paper’s publication of a list of videos that Supreme Court nominee Robert Bork rented at his local video store.

The VPPA prohibits “video tape service providers” from disclosing “personally identifiable information” about their consumers’ requests or purchases of “specific video materials” without the consumers’ written consent. Although the average person would believe that “video tape service providers” are virtually extinct, courts have held that online video services are subject to the statute.

And there is good reason for online video service providers to be concerned. The VPPA allows plaintiffs to bring class action lawsuits for $2,500 per violation, regardless of the actual amount of harm caused to a customer. In recent years, as website and app operators increasingly offer video content, some have faced large VPPA class actions.

On April 29, the illogical and unclear nature of the VPPA became crystal clear when the U.S. Court of Appeals for the First Circuit allowed a VPPA claim to proceed against Gannett. The plaintiff claimed that USA Today’s mobile app did not obtain adequate consent before providing Adobe with information including the title of the video viewed on the app, the device’s GPS coordinates and unique device identifiers.

The question for the First Circuit was whether this information constitutes “personally identifiable information.” Unfortunately, the text of the VPPA is not very much help. The law’s “definitions” section states only that personally identifiable information “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” As the First Circuit recognized, this definition is “awkward and unclear.”

Courts generally have been skeptical of any VPPA claims that do not involve the transfer of information that explicitly reveals an individual’s name. For instance, earlier in the week, an Atlanta federal judge dismissed a lawsuit against CNN that arose from the alleged disclosure of video logs and MAC addresses. Relying on the reasoning in four other recent VPPA cases, the judge held that the plaintiff did not plead any facts “to establish that the video history and MAC address were tied to an actual person and disclosed by Defendants.”

Granted, the First Circuit’s case involved more than just a unique device identification number; the plaintiffs also alleged that Adobe received GPS location information.

But the First Circuit did not cite any VPPA opinions in its analysis of the “personally identifiable information” definition. It instead relied on a 1963 case involving a public contracting dispute between the federal government and a coal company to conclude that if Congress had intended for the VPPA to only apply when an individual’s name is explicitly disclosed, “it would have had no reason to fashion the more abstract formulation contained in the statute.”

The First Circuit used a string of analogies to justify its conclusion that the USA Today app disclosed personally identifiable information. The court likened the allegations in the USA Today complaint to disclosing an individual’s Social Security number to the government, or a football referee announcing “a violation by No. 12 on the offense.”

These comparisons are inapplicable because only one individual can have a Social Security number or a football jersey number for a given team. Although GPS coordinates might, in many cases, be used to identify an individual, there often are multiple people in a single location (think apartment buildings or large office complexes). The First Circuit acknowledged that although “there is certainly a point at which the linkage of information to identity becomes too uncertain, or too dependent on too much yet-to-be-done, or unforeseeable detective work,” the lawsuit’s claims involving the USA Today app allege a linkage that “is both firm and readily foreseeable to Gannett.”

Gannett also had argued that the VPPA does not apply because the app was free, and therefore the plaintiff is not a “consumer” who is covered by the statute. The statute merely defines “consumer” as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” The plaintiff argued that even though he did not pay for the app, he was a “subscriber.”

Last year, the U.S. Court of Appeals for the Eleventh Circuit affirmed the dismissal of a VPPA claim against the Cartoon Network for its free online app, reasoning that the term “subscriber” involves “some type of commitment, relationship, or association (financial or otherwise) between a person and an entity.” The First Circuit attempted to distinguish the USA Today case, reasoning that although the plaintiff did not pay for the app, the plaintiff provided Gannett with information and “established a relationship” with Gannett.

The Court then attempted to bolster its reasoning by presenting a bizarre hypothetical: “Imagine that Gannett had installed a hotline at Yershov’s home, for free, allowing him to call Gannett and receive instant delivery of videos in exchange for his name and address, and he then used the hotline over the course of many months to order videos.”  The Court reasoned that Congress would not have intended for a company to share such “hotline” information.

Huh? The idea of a “hotline” is about as outdated as the VHS/Betamax wars, and it has little resemblance to a free mobile app. In addition to being a completely unrealistic scenario, this hypothetical fails to provide any support for the conclusion that a person who downloads a free app is a “consumer” who is entitled to the full privacy protections of the VPPA. That’s because the text of the VPPA simply does not contemplate such a scenario, and cannot provide a satisfactory answer in this dispute.

The First Circuit’s struggles to define “personally identifiable information” and “consumer” demonstrate the difficulty of applying the VPPA to the digital age. Even in the Gannett case, it’s impossible to say which side is right or wrong because the VPPA is so woefully outdated.

In five or 10 years, the technologies used to deliver video likely will be quite different than today’s apps. Yet companies still may be forced to apply the VPPA’s ambiguous wording and scattered court precedents — including the First Circuit’s opinion in the USA Today case.

Just as ECPA is receiving much-needed scrutiny, we must carefully examine whether the VPPA continues to serve the purposes intended when Congress passed it nearly 30 years ago. Congress made some amendments to the statute in 2012, but many of the definitions remain unchanged, despite the rapidly changing landscape of video delivery.

We also should question why video viewing information receives special protection under the law, when other types of information receive little to no privacy protection. Does the VPPA still serve a useful purpose, or does it merely impose regulations that fail to help consumers? Indeed, as the late Judge Robert Bork noted in a 1983 essay, we “all know of extensive regulatory programs that have added enormous costs without securing any discernible benefits or that have created graver problems than they solved.”