Blockbuster and Netflix will both amend their privacy policies following preliminary approval of settlement agreements on July 3, 2012 and July 5, 2012, respectively, in actions brought by subscribers alleging that the companies violated consumer privacy laws. In two very similar actions, the video rental companies were accused of violating the Video Privacy Protection Act of 1988 (VPPA) by storing consumers’ personal information such as the name, address, credit card information as well as a video-viewing history in company databases long after consumers ended their subscriptions, and continuing to profit from it. Online and traditional video services should audit their own data practices and policies in light of these law suits and consumer privacy concerns.
The VPPA, 18 U.S.C. § 2710 (2006) at http://www.law.cornell.edu/uscode/text/18/2710, requires video service providers to delete all “personally identifiable information” as soon as is feasible, or no longer than one year “from the date the information is no longer necessary for the purpose for which it was collected” and if there are no legally cognizable pending requests for it. Plaintiffs in both cases pointed to the companies’ privacy policies which indicated that they were collecting consumers’ personal information and monitoring their viewing choices during the course of the subscription to improve services provided and enhance customer satisfaction. The privacy policies also suggested that the companies benefited by using customers’ personal information for internal company analysis and sharing it with third parties such as business partners. Plaintiffs argued that because these companies retained consumers’ private information long after customers cancelled their subscriptions, and also continued to benefit from it, they were in violation of the VPPA.
Worth noting is that Blockbuster goes further in its settlement agreement than is required under the VPPA. While the VPPA allows a video tape service provider to keep such personally identifiable information for up to a year, Blockbuster agreed to keep such information only for a 90-day period after the customer requests that it be deleted, with the possibility of an extension in case of outstanding transactions. This, combined with the company’s agreement to promptly decouple information identifying a customer’s viewing content from other personal identification information upon request, goes further than is required by the law to promote consumer privacy.
With regard to the financial aspect of the settlement, Blockbuster agreed to pay no more than $140,000.00 to class counsel in fees, costs and expenses, and no more than a $750 incentive award to the class representative for time and effort. In a much more substantial cash settlement, Netflix agreed to pay $9,000,000 into a settlement fund, 25% of which will be paid to class counsel’s attorneys’ fees and an extra $25,000.00 to reimburse class counsel for out of pocket costs. Of the remainder, $30,000 will go to the six named plaintiffs, with each receiving $5,000 and the rest to non-profit organizations or institutions approved by the court.
Notably, the Netflix and Blockbuster actions do not answer questions about the scope and extent of the VPPA’s coverage as to online streaming providers. The Act’s description of a “video tape service provider,” covers companies that rent, sell or deliver “prerecorded video cassette tapes or similar audio visual materials.” It, therefore, seemingly applies to Netflix and Blockbuster whose services include renting, selling, or delivering physical rental videos in addition to digital versions. Nonetheless, it is not so clear that this description encompasses companies like Hulu, which do not provide physical rental videos, and sell instead online video services. Given the VPPA was passed in 1988 in the wake of the Robert Bork Supreme Court nomination hearings, Congress could not have foreseen the digital streaming or downloading business. However, regardless of the method of distribution, the privacy principles remain the same. Streaming companies have to determine whether the online video materials they provide are “audio visual materials” within the meaning of the VPPA, and whether they expose themselves to liability by not complying with the Act. Clearly, the safest approach would be to treat the VPPA as applying and to take guidance from these settlements.
The settlement orders are Missaghi v. Blockbuster LLC, No. 0:11-cv-02559-JRT-JSM (D. Minn. (July 5, 2012) (Order granting Mo) at https://ecf.mnd.uscourts.gov/doc1/10104239705; In re: Netflix Privacy Litigation, No. 11-00379-EJD (N.D. Cal. July 5, 2012) (Order granting motion for preliminary approval of settlement agreement) at https://ecf.cand.uscourts.gov/doc1/03519527650.