You are viewing an archived webpage. The information on this page may be out of date. Learn about EPIC's recent work at epic.org.

Video Privacy Protection Act

Introduction

The Video Privacy Protection Act of 1988 (codified at 18 U.S.C. § 2710 (2002)) was passed in reaction to the disclosure of Supreme Court nominee Robert Bork's video rental records in a newspaper. The Act is not often invoked, but stands as one of the strongest protections of consumer privacy against a specific form of data collection. Generally, it prevents disclosure of personally identifiable rental records of "prerecorded video cassette tapes or similar audio visual material." The Act has several important provisions, including:

  • A general ban on the disclosure of personally identifiable rental information unless the consumer consents specifically and in writing.
  • Disclosure to police officers only with a valid warrant or court order.
  • Disclosure of "genre preferences" along with names and addresses for marketing, but allowing customers to opt out.
  • Exclusion of evidence acquired in violation of the Act
  • Civil remedies, including possible punitive damages and attorneys fees, not less than $2500.
  • A requirement that video stores destroy rental records no longer than one year after an account is terminated.
  • The VPPA does not preempt state law. That is, states are free to enact broader protections for individuals' records.

Issues remain about the applicability of the Act to other rental records, including DVDs and video games, which are commonly rented by the same stores that rent video cassettes. The plain language of the Act would indicate that it applies broadly to all such records, but no cases have, at this point, interpreted the language.

Also at issue is the interaction of the VPPA with the recent Patriot Act, which expanded law enforcement powers to procure information such as library records and individual purchasing records "in the course of an ongoing investigation" (a lower standard than the traditional warrant). So far, no cases or stories have surfaced about use of the Patriot Act to investigate video rental records, but it seems likely that federal authorities would assert their power to do so.

Many states have enacted laws providing greater protections than the federal VPPA. Video rentals in Connecticut and Maryland, for example, are considered confidential, and cannot be sold. California, Delaware, Iowa, Louisiana, New York, and Rhode Island have also enacted video privacy laws. Michigan's video privacy law goes beyond the VPPA, and protects records of book purchases, rentals, and borrowing as well.

History

The origin of the VPPA was the ill-fated nomination hearings for Judge Robert Bork in 1988. Bork's Washington, DC-area video store gave Bork's rental records to a reporter for the Washington City Paper, a local newspaper. The paper published the records likely in an attempt to embarrass Bork, but succeeded more in scaring Congress into enacting protective legislation. The bill was drafted by Senator Leahy, who noted during the floor debate that new privacy protections are necessary in "an era of interactive television cables, the growth of computer checking and check-out counters, of security systems and telephones, all lodged together in computers...." S. Rep. No. 100-599, 100th Cong., 2d Sess. at 6 (1988).

According to congressional sources, the language of the bill changed somewhat during debate due to pressure from marketers and other groups. For instance, the original bill included personally identifiable magazine subscription information, but this provision was struck by lobbying from direct marketers and law enforcement groups.

2011 Netflix-Backed Amendment

In 2011, Representative Robert Goodlatte (R-VA) introduced H.R. 2471, which would amend the VPPA’s consent provision to allow the disclosure of video rental records:

to any person with the informed, written consent (including through an electronic means using the Internet) in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer given at one or both of the following times--

(i) the time the disclosure is sought; and

(ii) in advance for a set period of time or until consent is withdrawn by such consumer.

The Amendment was heavily supported by entertainment companies such as Netflix. On, December 6, 2011, H.R. 2471 passed the House of Representatives 330-116 without any opportunity for public debate or discussion.

Previously, the VPPA’s consent provision allowed disclosure “to any person with the informed, written consent of the consumer given at the time the disclosure is sought.” H.R. 2471weakens the consent provision of the VPPA by diminishing the ability of users to control the use and disclosure of their personal information. Under the Amendment, companies like Netflix would be able to obtain one-time, blanket consent from a user and then continuously disclose on Facebook all of the movies watched by that user. Netflix would automatically post this viewing information regardless of whether users would choose to post such information themselves.

In addition to transferring control over the user’s information from the user to the company, the Amendment’s blanket-disclosure provision allows companies to profit from the association between users and products. Currently, users of social networking services such as Facebook must take some affirmative action, such as liking or sharing, in order to associate themselves with the product. Thus, users are able to decide on a case-by-case basis which associations they want Facebook to disclose to their friends. By automatically disclosing everything a user watches, the Amendment would make simply watching a movie the equivalent of “liking” it.

The benefit to companies from this blanket disclosure comes not just from the advertisements that appear in the Facebook ticker whenever a user watches a movie or uses a product, but also from the association between a user and the product itself. Facebook repeatedly emphasizes the benefits to a company of associating that company’s brand and products with users. For example, Facebook’s Best Practices marketing guide explains that

[Facebook Ads and Sponsored Stories] offer the benefits of earned at the scale and predictability of paid. That’s because they are shown with stories about friends who have already engaged with your business on Facebook. This is the new word of mouth and it’s twice as effective at driving awareness.

. . .

On Facebook, people discover your brand through trusted referrals from their friends. Then drive preference by interacting with and rewarding your fans.

. . .

Facebook turns purchasing into a social decision by enabling people to show what they like and have purchased, both online and in the physical world . . . This combination of word of mouth and your ability to deepen engagement with your customers at the point of purchase (either on your website or in store) is incredibly powerful at driving traffic and sales.

Thus, by allowing the automatic association of users with movies, the Amendment increases the ability of companies to exploit the behavior of Facebook users.

Similar issues arose in a California lawsuit over Facebook's sponsored advertisements, which use the images of users to help sell products. The lawsuit alleges that sponsored stories violate California's Right of Publicity Statute, which prohibits the misappropriation of a person's name, photograph, likeness, and identity for use in paid advertisements without obtaining that person's consent. Recently, the judge rejected Facebook's motion to dismiss the lawsuit, allowing the plaintiffs to pursue their claims.

Cases

Dirkes v. Borough of Runnemede, 936 F. Supp. 235 (D.N.J. 1996).

In the process of an internal affairs investigation of Officer Dirkes, the investigator asked for and received the list of the Plaintiff's video rental records from a clerk at the local video store. The investigating officer failed to get a warrant, subpoena, or court order, and the employee did not question the request. Dirkes sued for violation of his rights under the VPPA.

The court identified the purpose of the law as protecting privacy in an era of new technology. According to the law, the court noted, Dirkes could sue either the video store for unauthorized release of his information, or the city for using the video information as part of the internal investigation. The court's broad reading of the statute established that any party using video records wrongly obtained is subject to liability under the VPPA.

Camfield v. City of Oklahoma City, 248 F.3d 1214 (10th Cir. 2001) (the Tin Drum case).

In 1997, an Oklahoma citizen complained that the academy award-winning German movie The Tin Drum contained child pornography and therefore violated Oklahoma law. The police took the film to a local judge, who informally viewed it and agreed that it was probably child porn. The police subsequently went to neighborhood video stores and removed all copies of The Tin Drum, and obtained, without a warrant, the names of those who were currently renting it. One copy had been rented by a local ACLU employee who got wind of the impending seizure and wanted to see if the movie was really objectionable. Police came to Mr. Camfield's house and asked for the cassette, which he handed over after some discussion of "the artistic merits of the movie."

The court found that the city violated Camfield's rights under the VPPA by obtaining his rental records without a court order or warrant. He was awarded the statutory minimum of $2500 and a victory for civil liberties.

Comstock v. Netflix; Milans v. Netflix

In 2011, Peter Comstock and Jeff Milans filed separate class action lawsuits against Netflix for violations of the VPPA. The Act requires video rental companies to destroy personally identifiable information as soon as practicable, but no later than one year after the information is no longer necessary for its collected purpose. The complaints allege that Netflix violated this provision by tracking the viewing habits of its users and maintaining the information long after the users had canceled their accounts.

Resources

http://epic.org/privacy/vppa/Fraley%20v.%20Facebook%20%28appropriation%20case%29%20Order%2012-16.pdf

Share this page:

Defend Privacy. Support EPIC.
US Needs a Data Protection Agency
2020 Election Security