A putative class of some 500,000 Netflix subscribers filed a complaint against Netflix in the Northern District of California alleging that Netflix failed to live up to privacy protection promises it made in its posted privacy policy, as well as violating the federal Video Privacy Protection Act, 18 U.S.C. § 2710, and California consumer protection statutes,. According to the complaint, Netflix gave researchers customer video rental and rating data for 480,000 subscribers as part of a contest for researchers. The researchers were offered the chance to win up to $1 million if they could create new algorithms to improve Netflix’s ability to provide rental recommendations. Although Netflix did not list subscribers by name, and used other anonymization techniques, the complaint alleged that these steps could be easily circumvented to mine the data sets to identify individuals. The complaint also alleged that even after Netflix became aware that the data could be de-anonymized, including through a research paper published by one of the researchers only 16 days after Netflix launched the contest, Netflix announced its intention to run a second contest with similar data.

TIP: Companies should use caution when releasing customer information to third parties, especially when doing so as part of a publicly promoted program.