In the latest attempt to apply the Video Privacy Protection Act (VPPA) to 21st-century technology, the U.S. Court of Appeals, Ninth Circuit affirmed dismissal of Chad Eichenberger’s lawsuit against ESPN Inc.
Eichenberger, who used the ESPN app on his smartphone to watch the sports channel’s videos, claimed that when the defendant shared his Roku device identifier with Adobe for purposes of data analytics, the company violated the VPPA’s prohibition on transmitting personally identifiable information (PII) and viewing history.
ESPN moved to dismiss the putative class action, and a district court judge granted the motion, finding the Roku device identifier was not PII for purposes of the statute.
The federal appellate panel agreed. PII “must include more information than that which, by itself, identifies an individual as having watched certain videos,” the court said. “Instead, ‘personally identifiable information’ covers some information that can be used to identify an individual.”
To determine if the Roku device identifier met this standard, the panel imported a test from the Third Circuit as to whether the information would “readily permit an ordinary person to identify a [particular individual as having watched certain videos].” This test informs video service providers of their obligations under the VPPA, the panel wrote, and “looks to what information a video service provider discloses, not to what the recipient of that information decides to do with it.”
Applying the “ordinary person” test, the Ninth Circuit found the Roku device identifier created a sizable pool of possible viewers but would not “readily permit an ordinary person to identify a specific individual’s video-watching behavior.”
“It is true that today’s technology may allow Adobe to identify an individual from the large pool by using other information—as Plaintiff alleges,” the panel wrote. “But the advent of the Internet did not change the disclosing-party focus of the statute. And we are not persuaded that the 1988 Congress intended for the VPPA to cover circumstances so different from the ones that motivated its passage.”
However, because simply disclosing Eichenberger’s device serial number and the names of the videos he watched was not enough to specifically identify him as the viewer, the plaintiff failed to state a claim under the statute.
In a victory for the plaintiff, the panel did determine the plaintiff had standing to bring suit. As distinct from the procedural obligations outlined by the Fair Credit Reporting Act provisions relied upon by the plaintiff in Spokeo, Inc. v. Robins, the VPPA codified a context-specific extension of the substantive right to privacy, the Ninth Circuit said.
Eichenberger alleged a violation of Section 2710(b)(1): “A video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumers of such provider shall be liable to the aggrieved person.”
“That provision does not describe a procedure that video service providers must follow,” the court said. “Rather, it protects generally a consumer’s substantive privacy interest in his or her video-viewing history. Accordingly, every disclosure of an individual’s ‘personally identifiable information’ and video-viewing history offends the interests that the statute protects.”
To read the opinion in Eichenberger v. ESPN, Inc., click here.
Why it matters: The Ninth Circuit’s decision featured language that both sides of the bar will like. Video service providers have clarity in the use of the “ordinary person” standard, while consumers will be cheered by the court’s finding that Eichenberger had standing to sue under the statute. Left for another day: whether the plaintiff satisfied the requirement of a “consumer” under the VPPA and what types of information (a name and a birthday? GPS coordinates?) will enable an “ordinary person” to identify an individual.