Video Privacy Protection Act

The past few years have witnessed a series of attempts by plaintiffs to apply the Video Privacy Protection Act (“VPPA”) — a statute passed in 1988 to protect against certain disclosures of video rental records — to the video distribution technologies of today.  For example, in Sterk v. Redbox Automated Retail, plaintiffs sued the video kiosk operator for violating the VPPA’s prohibitions against disclosure of video rental data and prolonged retention of such data.  (The Seventh Circuit threw out the retention claim after an interlocutory appeal of the district court ruling, but the disclosure claim is still pending.) 

Mollett v. Netflix, a suit filed under the VPPA (and an analogous California statute, Cal. Civ. Code. § 1799.3) involved yet another attempt at applying the statute in a way that its drafters could not have envisioned.  Noting this and several other infirmities in the complaint, Judge Davila of the Northern District of California dismissed the suit earlier this week. 

Continue Reading Court Dismisses VPPA Suit Against Netflix

According to court documents filed last week, Netflix has agreed to change its data storage practices and pay about $9 million to settle allegations that it unlawfully retained and disclosed customers’ video-viewing histories.  Specifically, Netflix agreed to decouple viewing history from identification information once users have been inactive for a year; to pay $30,000 to the class representatives; to pay up to $2.25 million to class counsel; and to give the remaining funds to nonprofit organizations that provide privacy-related education.  The proposed settlement agreement has been submitted to the court for preliminary approval. 

The injunctive remedies, cy pres relief, and sizable award to class counsel in In re Netflix Privacy Litigation are consistent with settlements reached in earlier privacy-related lawsuits.  For example:Continue Reading Netflix to Settle Video Privacy Suit

A judge in the Northern District of California recently agreed with the Seventh Circuit that the Video Privacy Protection Act (“VPPA”) does not provide a private right of action premised solely on an allegedly unauthorized retention of information. 

Plaintiffs sued Sony Computer Entertainment America LLC (“SCEA”) and Sony Network Entertainment International LLC…

Continue Reading Court Dismisses Video Privacy Suit Against Sony

The Seventh Circuit held yesterday, in a decision written by Judge Posner, that damages are not available under the Video Privacy Protection Act (“VPPA”) for violations of the statute’s data deletion requirement, only for unlawful disclosures of video-viewing information. 

Subsection (b) of the VPPA prohibits knowing disclosure of personally identifiable…

Continue Reading Seventh Circuit Strikes VPPA Claim for Retention Damages

Two of the country’s largest video rental services, Netflix and Redbox, have been sued for allegedly violating the federal Video Privacy Protection Act (“VPPA”).  The plaintiffs in both suits contend that the rental services stored information about their rental histories for long after that information had ceased being “necessary” to provide the services for which customers had signed up, in violation of the VPPA.  The Netflix complaint also alleges that the company unlawfully maintained the information even after customers had cancelled subscriptions to the service.

One central issue in both cases will be the question of the point at which information collected by a company is “no longer necessary for the purpose for which it was collected” — specifically, with respect to Netflix, whether it was reasonable for it to retain subscriber information after cancellation of the service.  

The answer to this question about the substantive requirements of the VPPA may also have ramifications beyond the law of video privacy.  As we have previously detailed, the FTC’s recent staff report on consumer privacy recommended that businesses do more to incorporate substantive privacy protections at every stage of a product’s lifecycle.  The FTC, which characterized this approach as “privacy by design,” stressed the importance of limited data retention.Continue Reading Netflix, Redbox Sued for Allegedly Violating Renters’ Privacy