Overview
This morning, Judge Abrams dismissed a purported class action against Disney Interactive for alleged violations of the Video Privacy Protection Act ("VPPA"), a 1988 privacy law that was passed after Supreme Court nominee Robert Bork's video rental history became public. According to the plaintiff, Disney had disclosed "personally identifiable information" to a third party data analytics firm (Adobe, a non-party), who was then able to use the information to identify specific users and the Disney Channel videos they watched on a Roku device.
Judge Abrams rejected this claim, noting that Disney had only disclosed an anonymous device serial number and the associated viewing history. Only by using information obtained elsewhere was Adobe then able to identify particular users and the videos they had watched. In order to have a viable claim under the VPPA, the "personally identifiable information" must link an actual person to actual videos they have watched:
But in the end, [plaintiff's] conclusion is at odds with the VPPA's particularized definition of PII [personally identifiable information] and is overly expansive. If nearly any piece of information can, with enough effort on behalf of the recipient, be combined with other information so as to identify a person, then the scope of PII would be limitless. Whatever the impact of modern digital technologies on the manner in which personal information is shared, stored, and understood by third parties like Adobe, the Court cannot ascribe such an expansive intent to Congress in enacting the VPPA. It would render meaningless the requirement that the information identify a specific person as having rented or watched specific videos, as all information would, with some work, be identifying, and would transmute a statute focused on disclosure of specific information to one principally concerned with what third parties might conceivably be able to do with far more limited disclosures.Judge Abrams expressed her sympathy for the plaintiff's privacy concerns, but noted that the VPPA as written afforded him no relief:
In dismissing this action, the Court is sensitive to the policy implications posed by the increasing ubiquity of digital technologies, which, as [the plaintiff] ably alleges, have dramatically expanded the depth, range, and availability of detailed, highly personal consumer information. There is no doubt that the world of Roku devices, streaming video, and data analytics is a very different one from that of the physical video stores and tape rentals in which the VPPA was originally passed, and that, as the Yershov court noted, deciding VPPA cases today is thus akin to placing "a square peg ... into a round hole." But while the Court recognizes the frustration of an individual such as [the plaintiff] -- who seeks to keep his information private, whether it is personally identifying or not -- the VPPA as written, and even as amended in 2013, does not afford him, or those similarly situated, a remedy.