May 12, 2014
Video content provider, Hulu, is the defendant in a federal court case testing the scope of the Video Privacy Protection Act (VPPA). The case is likely to clarify the extent to which personal consumer information previously deemed to be anonymous may in fact be identifiable when combined with other available data, and thus subject to privacy requirements associated with personally identifiable information.
Enacted in 1988, the VPPA provides privacy protection for certain information associated with the video viewing activities of individuals. The VPPA prohibits the disclosure of information regarding specific videos or video services that are obtained by individual consumers.
Currently, a class action lawsuit is in progress in the federal district court in the Northern District of California. A group of consumers allege that information reportedly shared by Hulu with the social media service, Facebook, violates the privacy requirements of the VPPA.
Hulu placed a Facebook “like” button on its website. Allegedly, when Hulu users click on the like button, Hulu shares certain information regarding that consumer with Facebook. Plaintiffs claim that the information shared by Hulu with Facebook includes personal information such as the title of videos accessed, the IP address of the user, and “cookies” placed by Hulu on the user’s computer.
The plaintiffs claim that although Hulu does not share the names of the specific consumers, the set of information provided enables Facebook to identify the specific individuals and their video viewing activities. They allege that this violates the privacy provisions of the VPPA.
Hulu requested summary judgment in the case. The court denied the Hulu request. The case is now on track to move to trial.
This case will help to define the extent to which the privacy terms of the VPPA apply to online video distribution and distributors. As online video services become more active and popular, clarification of VPPA applicability is useful.
Perhaps more significant, however, is the potential impact of this case on the issue of anonymous data. Traditionally, collectors, distributors, and users of anonymous personal data have focused their attention on individual data points that they access. They have developed policies, practices, and procedures designed to preserve the anonymity of specific data.
The claims in the Hulu case suggest that information previously viewed to be anonymous may not, in fact, be anonymous to the extent that parties can connect that information with other available data points and identify the individual people involved. This case could result in additional privacy obligations for parties who handle or use anonymous consumer data. Such a result could have a significant impact on the large and lucrative commercial market that has developed for personal information associated with consumers.
In the current environment dominated by “Big Data” technologies, very large-scale data brokers, and massive data harvesting and monitoring by governments, issues associated with anonymous data are significant. In many cases apparently anonymous data may, in fact, not be anonymous. We may have reached the point where certain privacy requirements may need to be applied to anonymous data to the extent that such data can be combined with other available data to identify the identity of individual consumers.