Monday, November 09, 2015

The Video Privacy Protection Act, Disney Online and Personal Identifying Information

This post examines an opinion a U.S. District Court Judge who sits in the U.S. District Court for the Southern District of New York recently issued in a civil case:  Robinson v. Disney Online, 2015 WL 6161284 (2015).  The judge begins her opinion by explaining what the suit involves and how it arose:
Plaintiff James Robinson brings this class action against Defendant Disney Online (`Disney’), alleging violations of the Video Privacy Protection Act (the `VPPA’), 18 U.S. Code § 2710. He claims that Disney unlawfully disclosed personally identifiable information (`PII’)—the encrypted serial number of the digital device he used to access Disney video content, as well as his viewing history—to Adobe, a third-party data analytics company.

Adobe purportedly combined these disclosures with additional information gathered from other sources, and used this composite data to identify Robinson and attribute his viewing history to him. Before the Court is Disney's motion to dismiss Robinson's Amended Complaint pursuant to Federal Rule of Civil Procedure 12(b)(6). For the reasons that follow, Disney's motion is granted.
Robinson v. Disney Online, supra.
As Wikipedia explains, a Rule 12(b)(6) motion is how civil suits with
insufficient legal theories underlying their cause of action are dismissed from court. For example, assault requires intent, so if the plaintiff has failed to plead intent, the defense can seek dismissal by filing a 12(b)(6) motion. `While a complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiff's obligation to provide the grounds of his entitlement to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do. Factual allegations must be enough to raise a right to relief above the speculative level, on the assumption that all the allegations in the complaint are true (even if doubtful in fact).’ Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007) (citations, internal quotation marks and footnote omitted). 
In other words, a Rule 12(b)(6) motion does not argue that a lawsuit is defective because there is some deficiency or other problem with the facts in the case. As Wikipedia notes, disputed issues of fact are decided at a trial, either by a judge or a jury.
Getting back to the Robinson case, the next issue the District Court Judge addresses is the facts that led to the suit:
Robinson's Amended Complaint concerns videos he purportedly viewed using a Roku, a `digital media-streaming device that delivers videos, news, games, and other content to consumers' televisions via the Internet.’ Amended Complaint. . . . Through the Roku Channel Store—an `online digital media platform’—Robinson downloaded the Disney Channel application, which, once installed on his Roku, allowed him to view Disney's proprietary video content. . . .
 `Unbeknownst to its users,’ Robinson claims, `each time they use the Disney Channel to watch videos or television shows, Disney discloses their personally identifiable information—including a record of every video clip viewed by the user . . . to unrelated third parties.’ Amended Complaint. He further claims that this record is `sent each time that a user views a video clip,’ and is accompanied by the `hashed serial number associated with the user's Roku device.’ Amended Complaint. This hashed-or anonymized-serial number is `unique to a . . . device and remain[s] constant for the lifetime of that device.’  Amended Complaint.

Disney, according to Robinson, programmed its Roku channel to send this information to Adobe, a third-party data analytics company. See Amended Complaint. Adobe, and companies like it, purportedly maintain `massive digital dossiers on consumers’ by aggregating consumer data collected from an array of sources, including applications like the Disney Channel. See Amended Complaint. Robinson claims that `Adobe has the capability to use’ this aggregated data to `personally identify . . .  users and associate their video viewing selections with a personalized profile in its databases.’ Amended Complaint.

Robinson `downloaded and began using the Disney Channel on his Roku’ device beginning in December 2013. Amended Complaint. He claims Disney disclosed the hashed serial number of his device and his viewing history to Adobe without his consent, Amended Complaint, and that this information constitutes PII `in this context because it allows Adobe to identify users . . .  and to attribute their video viewing records to their existing profiles.’ Amended Complaint. He further alleges that Adobe actually identified him and `attribute[d] his viewing choices to his profile’ using the information disclosed by Disney. Amended Complaint. Robinson argues that these disclosures amounted to violations of the VPPA. Amended Complaint. Disney argues otherwise, and seeks dismissal of Robinson's Amended Complaint. . . . The Court heard oral argument from the parties on October 5, 2015.
Robinson v. Disney Online, supra.
The judge then begins her analysis of the issues raised by the Rule 12(b)(6) motion to dismiss the Amendment Complaint.  Robinson v. Disney Online, supra.  She begins by outlining the standard that applies when a defendant has filed a Rule 12(b)(6) motion to dismiss a Complaint:
To survive a motion to dismiss under Rule 12(b)(6), a pleading must contain `a short and plain statement of the claim showing that the pleader is entitled to relief,’ Rule 8(a)(2) of the Federal Rules of Civil Procedure, and be `plausible on its face,’ Bell Atlantic Corporation v. Twombly, 550 U.S. 544 (2007). `A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.’ Ashcroft v. Iqbal, 556 U.S. 662 (2009).
Robinson v. Disney Online, supra.
She then applies the law outlined above, along with other relevant legal standards, to the issues in this case.  She begins with the VPPA, explaining that it
prohibits a `video tape service provider’ from `knowingly disclos[ing], to any person, personally identifiable information concerning any consumer of such provider.’ 18 U.S. Code § 2710(b)(1). Its impetus was the publication in `a weekly newspaper in Washington’ of a “profile of Judge Robert H. Bork based on the titles of 146 films his family had rented from a video store.’ Senate Report 100–599, at 5 (1988).

As defined in the VPPA, a `video tape service provider’ is `any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials,’ 18 U.S. Code § 2710(a)(4); a `consumer’ is `any renter, purchaser, or subscriber of goods or services from a video tape service provider,’18 U.S. Code § 2710(a)(1); and `personally identifiable information’ (`PII’) `includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider,’ 18 U.S. Code  § 2710(a)(3). Disney contends that Robinson's VPPA claim is statutorily precluded, both because he was not a consumer and because the information Disney transmitted to Adobe was not PII. . . . The Court declines to address the former argument, as it concludes that the information Disney disclosed did not amount to PII.
Robinson v. Disney Online, supra.
The judge goes on to explain why she arrived at that conclusion, noting, first, that the
precise scope of PII under the VPPA is difficult to discern from the face of the statute-whether read in isolation or in its broader statutory context. As defined in Section 2710(a)(3), PII `includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.’

This language suggests that the information disclosed by a video tape service provider must, at the very least, identify a particular person—not just an anonymous individual—and connect this particular person with his or her viewing history. See In re Hulu Privacy Litigation, 2014 WL 1724344 (U.S. District Court for the Northern District of California 2014) (defining PII as, in part, `information that identifies a specific person and ties that person to particular videos that the person watched’). This construction is consistent with the ordinary meaning of `a person,’ as well as the plain meaning of the definition's final element, the requirement that the disclosed information identify “a person as having requested or obtained specific video materials.’ 18 U.S. Code §2710(a)(3). It is also consistent with the VPPA's legislative history. As explained in the Senate Report issued in advance of the statute's enactment, `personally identifiable information is intended to be transaction oriented. It is information that identifies a particular person as having engaged in a specific transaction with a video tape service provider.’ Senate Report 100–599, supra at 12 (emphasis added). The use of `includes’ in the statutory definition is not to the contrary. . . .

Less clear is the scope of information encompassed by PII, and how, precisely, this information must identify a person. Importantly, Robinson does not argue that the information disclosed by Disney—a `record of [his viewing] activities . . . along with the hashed serial number associated with [his] Roku device,’ Amended Complaint ¶¶ 13, 42—constitutes PII in its own right. Instead, he argues that the information constitutes PII because Adobe, the recipient of Disney's disclosures, can identify him by `link[ing]’ these disclosures with “existing personal information” obtained elsewhere.  See Amended Complaint 27, 29. . .  Indeed, the Court assumes, for the purposes of this motion, that Adobe has actually identified him in this manner. . . .

 Disney responds that the VPPA is not targeted at what non-defendant third parties might do with disclosures by video tape service providers, as PII is solely limited to information which, in and of itself, identifies a person. . . .  Because the anonymized disclosures here do not themselves identify a specific person, Disney contends, they are not prohibited. . . .
Robinson v. Disney Online, supra.
The judge went on to explain that Robinson’s theory of liability was
not without support in the existing case law. Indeed, Yershov v. Gannett Satellite Info. Network, Inc., 2015 WL 2340752 (U.S. District Court for the District of Massachusetts 2015), expressly rejects the view of PII urged by Disney. There, the District of Massachusetts concluded that the disclosures at issue-the transmission of viewing records of the USA Today application on an Android device, in addition to the `user's GPS coordinates and the . . . device's unique identification number’ -- constituted PII despite requiring additional information before Plaintiff was linked to his video history. . . . 

The majority of courts to address this issue, however, have adopted a narrower definition of PII. See In re Nickelodeon Consumer Privacy Litigation, 2014 WL 3012873 (U.S. District Court for the District of New Jersey 2014) (`[PII is] information which must, without more, itself link an actual person to actual video materials’); Ellis v. Cartoon Network, Inc., 2014 WL 5023535 (U.S. District Court for the Northern District of Georgia 2014) . . . (PII not disclosed where the third party to whom an Android ID and viewing history were provided had to `collect information from other sources’ to identify the plaintiff); Locklear v. Dow Jones & Co., 2015 WL 1730068 (U.S.District Court for the Northern District of Georgia 2015), . . . (`[A] Roku serial number, without more, is not akin to identifying a particular person, and therefore, is not PII). . . . The Court finds this latter, majority view, more persuasive.
Robinson v. Disney Online, supra.
She then pointed out that, in resolving this issue, a
discussion of Yershov is . . . instructive. The district court there began its analysis with the premise, rooted in the statutory text, that `a consumer's name and address are both PII, and . . . that the universe of PII is greater than the consumer's name and address. Yershov v. Gannett Satellite Info. Network, Inc., supra. . . . The Court agrees with the Yershov court that names and addresses are PII for the purposes of the VPPA, and that PII, in this statutory context, includes more than just names and addresses; it would be difficult to read the language of the statute otherwise. Neither party disputes this premise.
Robinson v. Disney Online, supra.
The judge therefore found that the
question for the Court is whether this premise necessarily leads to the Yershov court's conclusion that information can amount to PII even when it does not, on its own, identify a specific person. As a practical matter, it is surely right -- or at least often so-that addresses and even names `cannot be linked to a specific person without access to certain additional information.’ Yershov v. Gannett Satellite Info. Network, Inc., supra. Which John Smith, or which Main Street, among thousands? 

And there is, undoubtedly, an intuitive appeal to the Yershov court's conclusion that it would thus be `unrealistic to refer to PII as information which must, without more, itself link an actual person to actual video materials.’ Yershov v. Gannett Satellite Info. Network, Inc., supra. As that court stated, defining PII so narrowly would `preclude a finding that home addresses . . . are PII,' and thus conflict with the VPPA's plain statutory language. Yershov v. Gannett Satellite Info. Network, Inc., supra.

But in the end, this conclusion is at odds with the VPPA's particularized definition of PII and is overly expansive. If nearly any piece of information can, with enough effort on behalf of the recipient, be combined with other information so as to identify a person, then the scope of PII would be limitless. . . . 

Whatever the impact of modern digital technologies on the manner in which personal information is shared, stored, and understood by third parties like Adobe, the Court cannot ascribe such an expansive intent to Congress in enacting the VPPA. It would render meaningless the requirement that the information identify a specific person as having rented or watched specific videos, as all information would, with some work, be identifying, and would transmute a statute focused on disclosure of specific information to one principally concerned with what third parties might conceivably be able to do with far more limited disclosures.
Robinson v. Disney Online, supra.
She therefore concluded that the
most natural reading of PII suggests that it is the information actually `disclos[ed]’ by a `video tape service provider,’ 18 U.S. Code § 2710(b)(1), which must itself do the identifying that is relevant for purposes of the VPPA (literally, `information which identifies’)—not information disclosed by a provider, plus other pieces of information collected elsewhere by non-defendant third parties. This is the argument urged by Disney, and it is the definition of PII that this Court now adopts. PII is information which itself identifies a particular person as having accessed specific video materials.

That names and addresses are expressly included within the definition of PII, as is clear from the face of the VPPA, see 18 U.S. Code § 2710(b)(2)(D), does not foreclose this construction, even recognizing that names and addresses may, as the Yershov court noted, require additional information before they identify specific people. Instead, the inclusion of names and addresses as examples of PII in the VPPA suggests that Congress considered names and addresses to be sufficiently identifying without more. That is, a stronger reading of the VPPA suggests that these pieces of information are per se identifying such that their knowing disclosure amounts to a violation of the statute.
Robinson v. Disney Online, supra.
She then applied the analysis, and conclusions, above to this case:
The definition of PII the Court hereby adopts readily distinguishes between names and addresses, on the one hand, and an anonymized device serial number, on the other. If PII is information which must itself identify a particular person as having viewed specific video materials, the primary question for the reviewing court is whether the challenged disclosure similarly identifies a person. Whereas names and addresses, as a statutory matter, do identify a specific person, the anonymized Roku serial number at issue here does not; it identifies a specific device, and nothing more. In light of the Court's conclusion regarding the definition and scope of PII, Disney's liability turns only on whether the information it disclosed itself identified a specific person. It did not. Thus, Adobe's ability to identify Robinson by linking this disclosure with other information is of little significance.

Finally, Robinson has not alleged that the hashed serial number of his Roku device amounts to a geographic identifier. See Amended Complaint ¶ 13. It is thus unlike a home address, which ties a specific person to a specific place. Nor is the information disclosed by Disney equivalent to a Facebook ID. A `Facebook user-even one using a nickname—generally is an identified person on a social network platform.’ See In re Hulu Privacy Litigation, supra.

A Facebook ID, as the Hulu court found, is thus equivalent to a name-it stands in for a specific person, unlike a device identifier. . . . Disney has also not disclosed a `correlated look-up table’ that would enable Adobe to link the hashed serial number of Robinson's Roku device and his viewing choices to his identity. Instead, as Robinson himself alleges, it is Adobe, not Disney, which has purportedly assembled the equivalent of a `look-up table’—with information obtained from third-party sources, including Roku. . . . This is insufficient to constitute a violation of the VPPA.
Robinson v. Disney Online, supra.
The judge concluded the opinion with these comments:
In dismissing this action, the Court is sensitive to the policy implications posed by the increasing ubiquity of digital technologies, which, as Robinson ably alleges, have dramatically expanded the depth, range, and availability of detailed, highly personal consumer information. There is no doubt that the world of Roku devices, streaming video, and data analytics is a very different one from that of the physical video stores and tape rentals in which the VPPA was originally passed, and that, as the Yershov court noted, deciding VPPA cases today is thus akin to placing `a square peg . . .  into a round hole.’ . . .  

But while the Court recognizes the frustration of an individual such as Robinson—who seeks to keep his information private—whether it is personally identifying or not, the VPPA as written, and even as amended in 2013, does not afford him, or those similarly situated, a remedy.
Robinson v. Disney Online, supra. The judge therefore granted Disney’s motion to dismiss, which “terminate[d]” the suit. Robinson v. Disney Online, supra.
You can, if you are interested, read more about the case in the news stories you can find here, here and here.


No comments: