This post examines an opinion a U.S. District Court Judge
who sits in the U.S. District Court for the Southern District of New York
recently issued in a civil case: Robinson v. Disney Online, 2015 WL
6161284 (2015). The judge begins her
opinion by explaining what the suit involves and how it arose:
Plaintiff James Robinson brings this
class action against Defendant Disney Online (`Disney’), alleging violations of
the Video Privacy Protection Act (the `VPPA’), 18 U.S. Code § 2710. He
claims that Disney unlawfully disclosed personally identifiable information
(`PII’)—the encrypted serial number of the digital device he used to access
Disney video content, as well as his viewing history—to Adobe, a third-party
data analytics company.
Adobe purportedly combined these
disclosures with additional information gathered from other sources, and used
this composite data to identify Robinson and attribute his viewing history to
him. Before the Court is Disney's motion to dismiss Robinson's Amended Complaint pursuant to Federal Rule of Civil Procedure 12(b)(6). For the
reasons that follow, Disney's motion is granted.
Robinson v. Disney
Online, supra.
As Wikipedia explains, a Rule 12(b)(6) motion is how civil
suits with
insufficient legal theories underlying
their cause of action are dismissed from court. For example, assault requires intent,
so if the plaintiff has failed to plead intent, the defense can seek dismissal
by filing a 12(b)(6) motion. `While a complaint attacked by a Rule 12(b)(6)
motion to dismiss does not need detailed factual allegations, a plaintiff's
obligation to provide the grounds of his entitlement to relief requires more
than labels and conclusions, and a formulaic recitation of the elements of a
cause of action will not do. Factual allegations must be enough to raise a
right to relief above the speculative level, on the assumption that all the
allegations in the complaint are true (even if doubtful in fact).’ Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007) (citations, internal
quotation marks and footnote omitted).
In other words, a Rule 12(b)(6) motion does not argue that a lawsuit is defective because there is some deficiency or other problem with the facts in the case. As Wikipedia notes, disputed issues of fact are decided at a trial, either by a judge or a jury.
Getting back to the Robinson
case, the next issue the District Court Judge addresses is the
facts that led to the suit:
Robinson's Amended Complaint concerns
videos he purportedly viewed using a Roku, a `digital media-streaming device
that delivers videos, news, games, and other content to consumers' televisions
via the Internet.’ Amended Complaint. . . . Through the Roku Channel Store—an
`online digital media platform’—Robinson downloaded the Disney Channel
application, which, once installed on his Roku, allowed him to view Disney's
proprietary video content. . . .
Disney, according to Robinson,
programmed its Roku channel to send this information to Adobe, a third-party
data analytics company. See Amended Complaint. Adobe, and companies
like it, purportedly maintain `massive digital dossiers on consumers’ by
aggregating consumer data collected from an array of sources, including applications
like the Disney Channel. See Amended Complaint. Robinson claims
that `Adobe has the capability to use’ this aggregated data to `personally
identify . . . users and associate their
video viewing selections with a personalized profile in its databases.’ Amended
Complaint.
Robinson `downloaded and began using
the Disney Channel on his Roku’ device beginning in December 2013. Amended
Complaint. He claims Disney disclosed the hashed serial number of his device
and his viewing history to Adobe without his consent, Amended Complaint, and
that this information constitutes PII `in this context because it allows Adobe
to identify users . . . and to attribute
their video viewing records to their existing profiles.’ Amended Complaint. He
further alleges that Adobe actually identified him and `attribute[d] his
viewing choices to his profile’ using the information disclosed by
Disney. Amended Complaint. Robinson argues that these disclosures amounted
to violations of the VPPA. Amended Complaint. Disney argues otherwise, and
seeks dismissal of Robinson's Amended Complaint. . . . The Court heard oral argument from the parties on October 5, 2015.
Robinson v. Disney
Online, supra.
The judge then begins her analysis of the issues raised by
the Rule 12(b)(6) motion to dismiss the Amendment Complaint. Robinson
v. Disney Online, supra. She begins
by outlining the standard that applies when a defendant has filed a Rule
12(b)(6) motion to dismiss a Complaint:
To survive a motion
to dismiss under Rule
12(b)(6), a pleading must contain `a short and
plain statement of the claim showing that the pleader is entitled to relief,’
Rule 8(a)(2) of the Federal Rules of Civil Procedure, and be `plausible on its
face,’ Bell Atlantic Corporation v.
Twombly, 550
U.S. 544 (2007). `A claim has facial plausibility
when the plaintiff pleads factual content that allows the court to draw the
reasonable inference that the defendant is liable for the misconduct alleged.’ Ashcroft v. Iqbal, 556 U.S. 662 (2009).
Robinson v. Disney
Online, supra.
She then applies the law outlined above, along with other
relevant legal standards, to the issues in this case. She begins with the VPPA, explaining that it
prohibits a `video tape service
provider’ from `knowingly disclos[ing], to any person, personally identifiable
information concerning any consumer of such provider.’ 18 U.S. Code § 2710(b)(1). Its impetus was the publication in `a weekly newspaper in
Washington’ of a “profile of Judge Robert H. Bork based on the titles of 146
films his family had rented from a video store.’ Senate Report 100–599, at 5 (1988).
As defined in the VPPA, a `video tape
service provider’ is `any person, engaged in the business, in or affecting
interstate or foreign commerce, of rental, sale, or delivery of prerecorded
video cassette tapes or similar audio visual materials,’ 18 U.S. Code § 2710(a)(4); a `consumer’ is `any renter, purchaser, or subscriber of goods or
services from a video tape service provider,’18 U.S. Code § 2710(a)(1); and `personally
identifiable information’ (`PII’) `includes information which identifies a
person as having requested or obtained specific video materials or services
from a video tape service provider,’ 18 U.S. Code § 2710(a)(3). Disney contends
that Robinson's VPPA claim is statutorily precluded, both because he was not a
consumer and because the information Disney transmitted to Adobe was not
PII. . . . The Court declines to address the former argument, as it
concludes that the information Disney disclosed did not amount to PII.
Robinson v. Disney
Online, supra.
The judge goes on to explain why she arrived at that
conclusion, noting, first, that the
precise scope of PII under the VPPA is
difficult to discern from the face of the statute-whether read in isolation or
in its broader statutory context. As defined in Section 2710(a)(3), PII `includes
information which identifies a person as having requested or obtained specific
video materials or services from a video tape service provider.’
This language suggests that the information
disclosed by a video tape service provider must, at the very least, identify
a particular person—not just an anonymous individual—and
connect this particular person with his or her viewing history. See In
re Hulu Privacy Litigation, 2014 WL 1724344 (U.S. District Court for the Northern District of California 2014) (defining PII as, in part, `information
that identifies a specific person and ties that person to particular videos
that the person watched’). This construction is consistent with the ordinary
meaning of `a person,’ as well as the plain meaning of the definition's final
element, the requirement that the disclosed information identify “a person as
having requested or obtained specific video materials.’ 18 U.S. Code §2710(a)(3). It is also consistent with the VPPA's legislative history. As
explained in the Senate Report issued in advance of the statute's enactment, `personally
identifiable information is intended to be transaction oriented. It is
information that identifies a particular person as having
engaged in a specific transaction with a video tape service provider.’ Senate Report 100–599, supra at 12 (emphasis
added). The use of `includes’ in the statutory definition is not to the
contrary. . . .
Less clear is the scope of information
encompassed by PII, and how, precisely, this information must identify a
person. Importantly, Robinson does not argue that the information disclosed by Disney—a
`record of [his viewing] activities . . . along with the hashed serial number
associated with [his] Roku device,’ Amended Complaint ¶¶ 13, 42—constitutes PII
in its own right. Instead, he argues that the information constitutes PII
because Adobe, the recipient of Disney's disclosures, can identify him by
`link[ing]’ these disclosures with “existing personal information” obtained elsewhere. See
Amended Complaint 27, 29. . . Indeed, the Court assumes, for the
purposes of this motion, that Adobe has actually identified him in this
manner. . . .
Disney responds that the VPPA is not targeted at
what non-defendant third parties might do with disclosures by video tape
service providers, as PII is solely limited to information which, in and of
itself, identifies a person. . . . Because the anonymized disclosures here do not
themselves identify a specific person, Disney contends, they are not
prohibited. . . .
Robinson v. Disney
Online, supra.
The judge went on to explain that Robinson’s theory of
liability was
not without support in the existing
case law. Indeed, Yershov v. Gannett Satellite Info. Network, Inc.,
2015 WL 2340752 (U.S. District Court for the District of Massachusetts 2015),
expressly rejects the view of PII urged by Disney. There, the District of
Massachusetts concluded that the disclosures at issue-the transmission of
viewing records of the USA Today application on an Android device, in addition
to the `user's GPS coordinates and the . . . device's unique identification
number’ -- constituted PII despite requiring additional information before
Plaintiff was linked to his video history. . . .
The majority of
courts to address this issue, however, have adopted a narrower definition of
PII. See In re Nickelodeon Consumer Privacy Litigation, 2014
WL 3012873 (U.S. District Court for the District of New Jersey 2014) (`[PII is]
information which must, without more, itself link an actual person to actual
video materials’); Ellis v. Cartoon Network, Inc., 2014 WL
5023535 (U.S. District Court for the Northern District of Georgia 2014) . . . (PII
not disclosed where the third party to whom an Android ID and viewing history
were provided had to `collect information from other sources’ to identify the
plaintiff); Locklear v. Dow Jones & Co., 2015 WL 1730068 (U.S.District Court for the Northern District of Georgia 2015), . . . (`[A] Roku
serial number, without more, is not akin to identifying a particular person,
and therefore, is not PII). . . . The Court finds this latter, majority view,
more persuasive.
Robinson v. Disney
Online, supra.
She then pointed out that, in resolving this issue, a
discussion of Yershov is
. . . instructive. The district court there began its analysis with the
premise, rooted in the statutory text, that `a consumer's name and address are
both PII, and . . . that the universe of PII is greater than the consumer's
name and address. Yershov v. Gannett Satellite Info. Network, Inc., supra. .
. . The Court agrees with the Yershov court that names and
addresses are PII for the purposes of the VPPA, and that PII, in this statutory
context, includes more than just names and addresses; it would be difficult to
read the language of the statute otherwise. Neither party disputes this
premise.
Robinson v. Disney
Online, supra.
The judge therefore found that the
question for the Court is whether this
premise necessarily leads to the Yershov court's conclusion
that information can amount to PII even when it does not, on its own, identify
a specific person. As a practical matter, it is surely right -- or at least
often so-that addresses and even names `cannot be linked to a specific person
without access to certain additional information.’ Yershov v. Gannett
Satellite Info. Network, Inc., supra. Which John Smith, or which Main
Street, among thousands?
And there is, undoubtedly, an intuitive appeal to
the Yershov court's conclusion that it would thus be `unrealistic
to refer to PII as information which must, without more, itself link an actual
person to actual video materials.’ Yershov v. Gannett Satellite Info.
Network, Inc., supra. As that court stated, defining PII so narrowly
would `preclude a finding that home addresses . . . are PII,' and thus
conflict with the VPPA's plain statutory language. Yershov v. Gannett
Satellite Info. Network, Inc., supra.
But in the end, this conclusion is at
odds with the VPPA's particularized definition of PII and is overly expansive.
If nearly any piece of information can, with enough effort on behalf of the
recipient, be combined with other information so as to identify a person, then
the scope of PII would be limitless. . . .
Whatever the impact of
modern digital technologies on the manner in which personal information is
shared, stored, and understood by third parties like Adobe, the Court cannot
ascribe such an expansive intent to Congress in enacting the VPPA. It would
render meaningless the requirement that the information identify a specific
person as having rented or watched specific videos, as all information would,
with some work, be identifying, and would transmute a statute focused on
disclosure of specific information to one principally concerned with what third
parties might conceivably be able to do with far more limited disclosures.
Robinson v. Disney
Online, supra.
She therefore concluded that the
most natural reading of PII suggests
that it is the information actually `disclos[ed]’ by a `video tape service
provider,’ 18 U.S. Code § 2710(b)(1), which must itself do the identifying
that is relevant for purposes of the VPPA (literally, `information which
identifies’)—not information disclosed by a provider, plus other pieces of
information collected elsewhere by non-defendant third parties. This is the
argument urged by Disney, and it is the definition of PII that this Court now
adopts. PII is information which itself identifies a particular person as having
accessed specific video materials.
That names and addresses are expressly
included within the definition of PII, as is clear from the face of the VPPA, see
18 U.S. Code § 2710(b)(2)(D), does not foreclose this construction, even
recognizing that names and addresses may, as the Yershov court
noted, require additional information before they identify specific
people. Instead, the inclusion of names and addresses as examples of PII
in the VPPA suggests that Congress considered names and addresses to be sufficiently
identifying without more. That is, a stronger reading of the VPPA suggests that
these pieces of information are per se identifying such that
their knowing disclosure amounts to a violation of the statute.
Robinson v. Disney
Online, supra.
She then applied the analysis, and conclusions, above to
this case:
The definition of PII the Court hereby
adopts readily distinguishes between names and addresses, on the one hand, and
an anonymized device serial number, on the other. If PII is information which
must itself identify a particular person as having viewed
specific video materials, the primary question for the reviewing court is
whether the challenged disclosure similarly identifies a person. Whereas names
and addresses, as a statutory matter, do identify a specific person, the
anonymized Roku serial number at issue here does not; it identifies a specific
device, and nothing more. In light of the Court's conclusion regarding the
definition and scope of PII, Disney's liability turns only on whether the
information it disclosed itself identified a specific person. It did not. Thus,
Adobe's ability to identify Robinson by linking this disclosure with other
information is of little significance.
Finally, Robinson has not alleged that
the hashed serial number of his Roku device amounts to a geographic
identifier. See Amended Complaint ¶ 13. It is thus unlike a
home address, which ties a specific person to a specific place. Nor is the
information disclosed by Disney equivalent to a Facebook ID. A `Facebook
user-even one using a nickname—generally is an identified person on a social network
platform.’ See In re Hulu Privacy Litigation, supra.
A Facebook ID, as the Hulu court
found, is thus equivalent to a name-it stands in for a specific person, unlike
a device identifier. . . . Disney has also not disclosed a
`correlated look-up table’ that would enable Adobe to link the hashed serial
number of Robinson's Roku device and his viewing choices to his identity.
Instead, as Robinson himself alleges, it is Adobe, not Disney, which has
purportedly assembled the equivalent of a `look-up table’—with information
obtained from third-party sources, including Roku. . . . This is insufficient
to constitute a violation of the VPPA.
Robinson v. Disney
Online, supra.
The judge concluded the opinion with these comments:
In dismissing this action, the Court is
sensitive to the policy implications posed by the increasing ubiquity of
digital technologies, which, as Robinson ably alleges, have dramatically
expanded the depth, range, and availability of detailed, highly personal
consumer information. There is no doubt that the world of Roku devices,
streaming video, and data analytics is a very different one from that of the
physical video stores and tape rentals in which the VPPA was originally passed,
and that, as the Yershov court noted,
deciding VPPA cases today is thus akin to placing `a square peg . . . into a round hole.’ . . .
But while the Court recognizes the
frustration of an individual such as Robinson—who seeks to keep his information
private—whether it is personally identifying or not, the VPPA as written, and
even as amended in 2013, does not afford him, or those similarly situated, a
remedy.
Robinson v. Disney
Online, supra. The judge therefore granted Disney’s motion to dismiss,
which “terminate[d]” the suit. Robinson
v. Disney Online, supra.
You can, if you are interested, read more about the case in
the news stories you can find here, here and here.
No comments:
Post a Comment