Updates on Developments in Data Privacy and Cybersecurity
On Thursday, the Senate Judiciary Committee reportedly will vote on Sen. Patrick Leahy’s bill that would amend the Electronic Communications Privacy Act (ECPA) and the Video Privacy Protection Act (VPPA). The bill would amend the VPPA by clarifying that a consumer may consent to the disclosure of her video viewing…
Continue Reading Committee Vote on ECPA, VPPA Amendment Scheduled for Thursday
Last Friday, Rep. Zoe Lofgren (D-CA) introduced the ECPA 2.0 Act, H.R. 6529, which would strengthen the legal standards for law enforcement to gain access to electronic communications and location information. The Electronic Communications Privacy Act (ECPA) is more than 25 years old and is widely seen as needing modernization to address changes in digital storage, the cloud, and location-based services. As we’ve previously noted, government access to location information is an ongoing issue for legislators, courts, and government officials. Continue Reading Rep. Lofgren Introduces Legislation to Update ECPA
According to a number of media outlets, the Senate Judiciary Committee will consider proposed amendments to the Video Privacy Protection Act (“VPPA”) and to Title II of the Electronic Communications Privacy Act, better known as the Stored Communications Act (“SCA”). The amendments reportedly will be offered by Judiciary Chairman Patrick…
Continue Reading Judiciary Committee May Consider Amendments to VPPA, ECPA
According to court documents filed last week, Netflix has agreed to change its data storage practices and pay about $9 million to settle allegations that it unlawfully retained and disclosed customers’ video-viewing histories. Specifically, Netflix agreed to decouple viewing history from identification information once users have been inactive for a year; to pay $30,000 to the class representatives; to pay up to $2.25 million to class counsel; and to give the remaining funds to nonprofit organizations that provide privacy-related education. The proposed settlement agreement has been submitted to the court for preliminary approval.
The injunctive remedies, cy pres relief, and sizable award to class counsel in In re Netflix Privacy Litigation are consistent with settlements reached in earlier privacy-related lawsuits. For example:Continue Reading Netflix to Settle Video Privacy Suit
A judge in the Northern District of California recently agreed with the Seventh Circuit that the Video Privacy Protection Act (“VPPA”) does not provide a private right of action premised solely on an allegedly unauthorized retention of information.
Plaintiffs sued Sony Computer Entertainment America LLC (“SCEA”) and Sony Network Entertainment International LLC…
Continue Reading Court Dismisses Video Privacy Suit Against Sony
The Seventh Circuit held yesterday, in a decision written by Judge Posner, that damages are not available under the Video Privacy Protection Act (“VPPA”) for violations of the statute’s data deletion requirement, only for unlawful disclosures of video-viewing information.
Subsection (b) of the VPPA prohibits knowing disclosure of personally identifiable…
Continue Reading Seventh Circuit Strikes VPPA Claim for Retention Damages
As we previously reported, the Video Privacy Protection Act reform bill sponsored by Rep. Bob Goodlatte (R-VA) passed the House. And now the Senate Judiciary Committee’s Subcommittee on Privacy, Technology and the Law has scheduled a hearing on video privacy, to be held next Tuesday, January 31.
The…
Continue Reading Senate Privacy Subcommittee Schedules Video Privacy Hearing
Earlier today, the House of Representatives approved an amendment to the Video Privacy Protection Act (VPPA) (H.R. 2471) that would clarify certain ambiguities in the 1988 law in light of technological changes in the marketplace. In his remarks on the House floor, Rep. Bob Goodlatte (R-VA) – the primary author of H.R. 2471– explained that the amendment will facilitate the sharing of video usage information on social media networks.
During a debate on the legislation, Rep. Melvin Watt (D-NC) opposed the bill as he did in the committee markup, expressing concern about the adequacy of one-time consent to the sharing of information on dynamic social media sites. He emphasized the sensitivity of video usage information and expressed concerns about whether Congress has given sufficient thought to the impact of H.R. 2471 on state video privacy laws. Rep. Watt also questioned the propriety of Congress acting in light of a number of pending private law suits under the VPPA. Rep. John Conyers, Jr. (D-MI) lent his support to H.R. 2471, but stated that he would have preferred the bill require consumers to renew their consent periodically.
Under the VPPA, which was passed long before the Internet was widely available, “video tape service providers” generally are not permitted to share a consumer’s video usage information without “the informed, written consent of the consumer given at the time the disclosure is sought.” If enacted into law, H.R. 2471 would clarify this limitation in the context of online distribution in the following ways:Continue Reading House Approves VPPA Amendment
Following up on a meeting last week, today the House Judiciary Committee held a hearing on Rep. Bob Goodlatte’s proposed amendment to the Video Privacy Protection Act (VPPA). The Committee favorably reported (i.e., approved) a modified version of Rep. Goodlatte’s bill, H.R. 2471, which would permit consent to be given to sharing video usage information electronically (1) on a one-time basis or (2) in advance of the disclosure for a set period of time or until consent is withdrawn by the consumer. The modified version approved by the Committee includes an amendment, introduced by Rep. Jerry Nadler and supported by Goodlatte, requiring the consent to be obtained distinctly and separate from any other legal or financial terms presented.
Congress passed the VPPA, which protects the privacy of certain video records, in 1988 in the wake of a scandal concerning the release of videotape rentals for then-Supreme Court nominee Robert Bork. The VPPA, which has not been amended since passage, currently permits sharing of protected information with consent only if the consent is in “writ[ing]” and obtained “at the time the disclosure is sought.”Continue Reading Video Privacy Protection Act Consent Bill Passes House Committee
Two of the country’s largest video rental services, Netflix and Redbox, have been sued for allegedly violating the federal Video Privacy Protection Act (“VPPA”). The plaintiffs in both suits contend that the rental services stored information about their rental histories for long after that information had ceased being “necessary” to provide the services for which customers had signed up, in violation of the VPPA. The Netflix complaint also alleges that the company unlawfully maintained the information even after customers had cancelled subscriptions to the service.
One central issue in both cases will be the question of the point at which information collected by a company is “no longer necessary for the purpose for which it was collected” — specifically, with respect to Netflix, whether it was reasonable for it to retain subscriber information after cancellation of the service.
The answer to this question about the substantive requirements of the VPPA may also have ramifications beyond the law of video privacy. As we have previously detailed, the FTC’s recent staff report on consumer privacy recommended that businesses do more to incorporate substantive privacy protections at every stage of a product’s lifecycle. The FTC, which characterized this approach as “privacy by design,” stressed the importance of limited data retention.Continue Reading Netflix, Redbox Sued for Allegedly Violating Renters’ Privacy
