Two of the country’s largest video rental services, Netflix and Redbox, have been sued for allegedly violating the federal Video Privacy Protection Act (“VPPA”). The plaintiffs in both suits contend that the rental services stored information about their rental histories for long after that information had ceased being “necessary” to provide the services for which customers had signed up, in violation of the VPPA. The Netflix complaint also alleges that the company unlawfully maintained the information even after customers had cancelled subscriptions to the service.
One central issue in both cases will be the question of the point at which information collected by a company is “no longer necessary for the purpose for which it was collected” — specifically, with respect to Netflix, whether it was reasonable for it to retain subscriber information after cancellation of the service.
The answer to this question about the substantive requirements of the VPPA may also have ramifications beyond the law of video privacy. As we have previously detailed, the FTC’s recent staff report on consumer privacy recommended that businesses do more to incorporate substantive privacy protections at every stage of a product’s lifecycle. The FTC, which characterized this approach as “privacy by design,” stressed the importance of limited data retention.
The FTC suggested that companies only should retain data for as long as there is a “specific and legitimate need to do so.” Numerous commenters objected to this standard, with some noting that limits on retention may impede businesses’ ability to use consumer information to provide innovative new services. Depending on how far the suits against Netflix and Redbox progress, we may soon have judicial decisions that provide clarity on (or further complicate) this increasingly important issue.
Sometimes referred to as the “Bork Bill,” the VPPA was enacted after Supreme Court nominee Robert Bork’s video rental history was obtained and published by a small newspaper during his confirmation hearings. The main provisions of the Act generally prohibit “video tape service providers” (“VTSPs”) from disclosing information that “identifies a person as having requested or obtained specific video materials or services.” The Act also requires video tape service providers to “destroy personally identifiable information as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected.” The Netflix [PDF] and Redbox [PDF] lawsuits are based on the latter provision.
Although Netflix and Redbox do not provide “video tapes,” the plaintiffs have argued that the defendants are “video tape service providers.” The VPPA defines that term broadly to include “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” The court will also have to look at whether the italicized language is broad enough to cover the DVD rental operations of Netflix and Redbox and their delivery of online streaming video.