The significance and extent of the right to maintain the privacy of a consumer's private information has long been a fertile ground in litigation, especially in New York state and federal courts. The law has become increasingly protective of individuals' privacy rights, particularly with the ever-increasing online acquisition and exchange of sensitive consumer information. Indeed, “[t]he right to privacy, part of the Due Process Clause of the Fourteenth Amendment, protects an individual's interest in avoiding disclosure of information about personal matters.” Pirozzi v. City of New York, 950 F. Supp. 90, 94 (S.D.N.Y. 1996).

This article discusses the federal Video Privacy Protection Act (VPPA), a statute that seeks to protect the knowing unauthorized disclosure of “personally identifiable information,” related to a consumer's video rental and sale records. This article analyzes how federal courts have defined “personally identifiable information” under prevailing law. Further, this article discusses the future of the VPPA in New York and potential considerations for counsel to New York businesses that are seeking to be compliant with the VPPA (such as the option of seeking consumer consent). Lastly, this article touches on the Video Consumer Privacy Act, the New York state law's parallel to the VPPA.

Background of the VPPA

The VPPA is one of the strongest federal safeguards of consumer information. Passed in 1988, the law was enacted in response to a newspaper's disclosure of the video rental records of the then Supreme Court nominee, Robert Bork. The law was seldom invoked for a period of years, but has become a major litigation topic over the last several years due to the increase in streaming and video-on-demand services. Many major companies that conduct a significant portion of their business online have been sued under the VPPA.

The VPPA explicitly outlaws a “video service provider” from knowingly disclosing a consumer's “personally identifiable information” (PII). 18 U.S.C. §2710(b)(1). The Act defines PII as “includ[ing] information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider[.]” 18 U.S.C. §2710(a)(3).

The VPPA allows for damages of $2,500 per violation, punitive damages, reasonable attorney fees and “reasonably incurred” litigation costs. 18 U.S.C. §2710(c)(2). Therefore, if companies handle PII improperly, the law subjects them to the possibility of substantial monetary damages.

Over the last several years, federal courts have addressed varying issues surrounding the VPPA, including what constitutes a “consumer” and a “video service provider.” Most recently, however, courts have been wrestling with the specific scope and definition of PII.

Federal Circuit Courts' Interpretation of PII

The Second Circuit has not ruled on the scope of PII yet, but three federal circuit courts have: the First, Third, and Ninth Circuits. At least one New York district court has referenced two of these holdings so far. See Bernardino v. Barnes & Noble Booksellers, 2017 WL 3727230 (S.D.N.Y. Aug. 11, 2017).

The U.S. Court of Appeals for the First Circuit has held that information is PII when it is “reasonably and foreseeably likely to reveal which … videos [a consumer] has obtained.” Yershov v. Gannett Satellite Information Network, 820 F.3d 482, 486 (1st Cir. 2016). In Yershov, the plaintiff sued the defendant for disclosing his information to a third party. The defendant sent the third party titles of videos that plaintiff viewed, the device's GPS coordinates when plaintiff watched them, and certain device identifiers (such as an Android ID). The First Circuit held this data was PII, stating that “while there is certainly a point at which the linkage of information to identity becomes too uncertain … here the linkage, as plausibly alleged, is both firm and readily foreseeable to [Defendant].” Id.

The Third Circuit has construed the definition of PII slightly differently, holding that PII “means the kind of information that would readily permit an ordinary person to identify a specific individual's video-watching behavior.” In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262, 290 (3d Cir. 2016) (emphasis added). In Nickelodeon, plaintiffs brought a class action alleging that the defendant disclosed users' PII to a third party including an IP address, user operating settings and a device's “unique device identifier.” Id. at 281-82. The Third Circuit held this information was not PII, stating that “[s]ome disclosures predicated on new technology, such as the dissemination of precise GPS coordinates or customer ID numbers, may suffice. But others … are simply too far afield from the circumstances that motivated the Act's passage to trigger liability.” Id. at 290. The Third Circuit's definition of PII was, arguably, narrower than the First Circuit's.

Most recently, the Ninth Circuit adopted the Third Circuit's approach in holding that “[PII] means only that information that would 'readily permit an ordinary person to identify a specific individual's video-watching behavior.'” Eichenberger v. ESPN, 876 F.3d 979, 985 (9th Cir. 2017) (quoting Nickelodeon, 827 F.3d at 267). In Eichenberger, Plaintiff alleged that the defendant disclosed his Roku serial number and the titles of videos he watched to a third party. The Ninth Circuit held the information was not PII because “an ordinary person could not use the information that Defendant allegedly disclosed to identify an individual.” 876 F.3d at 986.

PII in New York's Federal Courts

The Southern District of New York is the only New York court that has substantively addressed the scope of PII, thus far. In Robinson v. Disney Online, plaintiff filed a class action alleging that the defendant disclosed his Roku serial number and viewing history to a third party. 152 F. Supp. 3d 176, 178 (S.D.N.Y. 2015). The court held that the data was not PII. Construing PII narrowly, the court stated that: “[Defendant's] liability turns only on whether the information it disclosed itself identified a specific person … [a third party's] ability to identify [plaintiff] by linking this disclosure with other information is of little significance.” Id. at 184 (emphasis added). The Southern District arguably embraces a narrow interpretation of PII, similar to the Third Circuit.

PII Under New York's Video Consumer Privacy Act (VCPA)

The VCPA is New York state's parallel to the VPPA. This law similarly seeks to protect consumer's video rental and sale records. The law's definition of PII is almost identical to the VPPA's. N.Y. GBL §672. To date, there are no reported decisions addressing the definition of PII under this law. While the VCPA is invoked incredibly rarely, familiarity with it is important because it may become more relevant as the VPPA's influence grows.

Now What? Be Familiar With the Law and Seek Consent

Federal case law interpreting the definition of PII under the VPPA leaves the waters murky, at best. Once counsel factors in the collection of district court cases that have also addressed the issue, any concrete answer as to the scope and definition of PII becomes even more unknown. In addition, companies must also wrestle with other complicated issues, such as the definitions of “consumer” and “video service provider” under the VPAA.

To defend VPPA lawsuits filed in New York, it is obviously imperative to understand the scope of PII as laid out by the Southern District in Robinson. However, it is also important to be familiar with other holdings throughout the country. Much like the district court did in Robinson, New York's federal courts may look to other jurisdictions' treatment of the issue for guidance and clarity. Further, New York companies seeking to be compliant with the law cannot rely on the fact that a plaintiff will sue in a New York federal court. Large companies may be subject to the jurisdiction of the district court a Plaintiff chooses to sue in, such as the jurisdiction where they reside.

Due to the inherent difficulties in confirming the precise scope of PII, a safer and presumably easier alternative is to seek consumer consent to disclose their information. The VPPA allows companies to share a consumer's PII with their “informed, written consent.” 18 U.S.C. §2710(b)(2)(B). The sought consent must be “distinct and separate from any form setting forth other legal or financial obligations of the consumer,” and the consumer can grant consent for up to two years in advance of the sought disclosure. Id.

Conclusion

Based on the law's current landscape, it is difficult for companies to confirm without doubt whether a specific kind of information is PII, especially with respect to types of consumer data that have not yet been at issue in a litigation. Having a full understanding of the laws (both the VPPA and VCPA) and receiving advanced consumer consent to disclose PII can help limit companies' exposure.

As the Third Circuit aptly put it, there are “some unanswered questions about what kinds of disclosures violate the [VPPA]. Such uncertainty is ultimately a consequence of our common-law system of adjudication and the rapid evolution of contemporary technology … Whether other kinds of disclosure will trigger liability under the Act is another question for another day.” 827 F.3d at 290.

Daniel A. Schnapp is a partner with Fox Rothschild. Philip Langer, a law clerk awaiting admission to the New York Bar, assisted in the preparation of this article.