The flow of data over the Internet creates privacy concerns in strange situations. For instance, when Pandora, the music streaming service, integrated its subscribers’ profile pages with their Facebook accounts, Pandora apparently made music preferences and listening choices available to the subscribers’ friends. The result was a suit alleging a violation of a Michigan statute that forbids the disclosure of personal information related to the renting or borrowing of movies and sound recordings.[1] Ultimately, the lawsuit was thrown out because the judge found that the technology employed by Pandora did not put its business within the scope of the Michigan law. Similar suits have been brought against other purveyors of streamed content.
One case that resulted in a financial settlement in favor of plaintiffs was against Netflix.[2] In the Netflix litigation, plaintiffs alleged, among other claims, violations of the federal Video Privacy Protection Act (VPPA). The VPPA was passed in the wake of the disclosure during the confirmation hearings on Supreme Court nominee Robert Bork’s video rental records in a newspaper. The complaint charged that Netflix unlawfully retained and disclosed personally identifiable information and rental history for former members. Netflix’s practice allegedly violated the VPPA because Netflix failed to destroy personally identifiable information as soon as practicable and disclosed the information for marketing and advertising purposes without members’ informed, written consent, or an opportunity to prohibit such disclosures. Netflix agreed to settle the claim by agreeing to decouple identification data from rental histories of former members and to pay $9 million dollars into a common settlement fund.
A second case, against Hulu, has been before the court for 3½ years over the issue of whether disclosure to Facebook violated the VPPA. Other cases brought under the VPPA related to disclosure to metrics companies have been dismissed.
The trend of increasing privacy lawsuits – see our December post on the subject here – indicates that plaintiff’s lawyers are scrutinizing company practices regarding consumer information and disclosure of that information in all its forms using whatever legislative avenues are arguably available. Companies should pay close attention to the ways in which they collect and disseminate personal information and ensure that their data retention policies meet the requirements imposed by federal and state regulations.
[1] Deacon v. Pandora Media, Inc., 901 F. Supp. 2d 1166 (N.D. Cal. 2012).
[2] In re Netflix Privacy Litig., No. 5:11-cv-00379, (N.D. Cal. filed Sept. 12, 2011).