In this holding, the First Circuit interpreted the meaning of personally identifiable information (PII) under the VPAA broadly to include GPS coordinates and unique device identifiers. At the same time, the First Circuit acknowledged that it remained to be determined whether the plaintiff could ultimately show that Adobe foreseeably could identify him. The Circuit explained that discovery would "enable a more refined, and possibly different, conclusion on the ultimate question of whether Gannett has violated the VPPA." (Read more about the 2016 First Circuit decision in our earlier Privacy and Information Governance Alert, available here).
Gannett's filings just weeks before the parties entered into the joint stipulation for dismissal, and the text of the stipulation itself, suggest that the named plaintiff could not establish a VPPA violation and thus was not a suitable class representative. Gannett informed the court that the named plaintiff had recently disclosed that he had performed a factory reset on his device several months before the lawsuit was filed. According to Gannett's filings, that reset erased all of the data on the plaintiff's device and reset the device's Android ID. Gannett further reported that, in response to a third-party subpoena, Adobe found no matches in its records to the plaintiff's Android ID. With this backdrop, the parties filed a joint stipulation for dismissal in which the plaintiff acknowledged that he lacked "sufficient evidence to support his allegation" that Gannett violated the VPPA when it disclosed the "titles of the videos he watched," "his unique Android ID," and his "GPS coordinates" to third party Adobe. Importantly, though the lawsuit dismisses all claims with respect to this particular plaintiff, it left open the possibility of bringing a new lawsuit against Gannett with a different plaintiff.
Whether this lawsuit is renewed or not, the landscape of what constitutes PII under the VPPA will continue to evolve without guidance from the Supreme Court, which recently declined to weigh in on this issue. And, in contrast to the First Circuit's view that PII includes GPS coordinates, in 2016 the Third Circuit in In re Nickelodeon Consumer Privacy Litigation took a more narrow approach holding that "static digital identifiers" such as IP addresses were not PII. In reaching its decision, the Third Circuit reasoned that it did not create a circuit split because GPS coordinates are more linked to a person's location than an IP address. In 2015, a district court in the Second Circuit also adopted more narrow interpretation in Robinson v. Disney Online, holding that disclosing an "encrypted [or anonymized] serial number of [a Roku] digital media-streaming device and consumer's viewing history" to a third party did not violate the VPPA.
In light of the various interpretations of PII and the diverse information potentially collected and shared, distributors of video content should continue to monitor legal developments and have systems in place which permit them to document and audit any data collected and shared with third parties. Consideration should also be given to, where necessary, implementing consent protocols. Similarly,
third-party recipients of video viewing information should determine whether the VPPA may be invoked by the type of information that they receive together with consumer video viewing records.
Mary Ellen Callahan
email@example.com | Download V-Card
Julie Ann Shepard
firstname.lastname@example.org | Download V-Card
email@example.com | Download V-Card
Unsubscribe | Manage Preferences Copyright 2017 Jenner & Block LLP, 353 North Clark Street, Chicago, IL 60654, 312 222-9350. Jenner & Block is an Illinois Limited Liability Partnership including professional corporations. Under professional rules, this communication may be considered advertising material. The material contained in this document has been authored or gathered by Jenner & Block for informational purposes only. It is not intended to be and is not considered to be legal advice. Transmission is not intended to create and receipt does not establish an attorney-client relationship. Legal advice of any nature should be sought from legal counsel.