Appeals Court Says Netflix Doesn't Violate Privacy By Displaying Viewing History To Anyone Using That Account
from the because-duh dept
The Ninth Circuit Appeals Court has upheld a win for Netflix in yet another privacy class-action lawsuit arising from the publication of then-Supreme Court nominee Robert Bork's rental history oh so many years ago. The Video Privacy Protection Act sprang into being in 1988 and was used to extract a settlement from Netflix over 20 years later.
The lawsuit Netflix settled featured one key difference: in that case, rental information -- in the form of "anonymized data" -- was released to third parties working on better suggestion algorithms in hopes of winning $1 million. In this case, no information was released in any form to third parties… at least not in this sense.
At the center of this lawsuit were complaints that Netflix exposed viewing history to certain third parties, i.e., anyone who used the same login as the account holder. This would include family, friends and guests at a person's residence. Since Netflix allows any number of devices to be allowed to access the account simultaneously (depending on how much you want to pay per month), one person's viewing history could theoretically be accessed by a great many people.
So, while there may be a privacy concern, it isn't a logical one. The information "exposed" to third parties is done so willingly by the account holder by sharing login info/logged-in devices with other viewers. Certainly the original account holder would like immediate access to recently viewed content. But this convenience also allows anyone using that login to see what's been viewed by that account. The plaintiffs claimed this convenient feature was actually a violation of the 27-year-old Video Privacy Protection Act.
The complaint alleges that upon setting up a Netflix account, personally identifiable information, by default, is only disclosed to a Netflix subscriber through her password-protected account. Under those circumstances, a subscriber’s queue or recommendation lists are only viewable by the subscriber. Netflix subscribers can then elect to display on their televisions what would otherwise be password-protected information by registering Netflix-ready devices in their accounts. Thereafter, Netflix automatically displays on a television what it displays on a subscriber’s computer: streamed instant videos, the subscriber’s queue, and video recommendations. This is plainly a disclosure “to the consumer” as contemplated by the VPPA. When Netflix displays a subscriber’s queue, viewing history, or recommendation lists in her online account, that is a disclosure directly to the consumer. The nature of that disclosure does not change when subscribers choose to display the same content on their television screens. The subscriber’s choice to do so does not trigger some new statutory duty on the part of Netflix.Furthermore, the law (logically) does not demand that Netflix prevent things it can't possibly control.
The fact that a subscriber may permit third parties to access her account, thereby allowing third parties to view Netflix’s disclosures, does not alter the legal status of those disclosures. No matter the particular circumstances at a subscriber’s residence, Netflix’s actions remain the same: it transmits information automatically to the device that a subscriber connected to her Netflix account. The lawfulness of this disclosure cannot depend on circumstances outside of Netflix’s control.The lawsuit also used California's civil code as a fallback option in case the VPPA claims failed, but the court finds the wording in that statute doesn't open Netflix up to any additional culpability.
While phrased in slightly different language than the VPPA, the California Civil Code plainly excludes liability for disclosures to a subscriber who is the subject of a record. Netflix’s disclosure of personal information was made to its subscribers and therefore it is not liable under section 1799.3.That this case made it as far as the appeals court is simply the judicial system functioning as it should, rather than indicative of the lawsuit's strengths. Exhausting every available remedy is something the system grants to plaintiffs, even if the arguments made are incredibly weak.
The simple fact is that if someone don't want anyone but Netflix knowing what they watch, they should't let anyone but Netflix have access to the account. Additionally, the company now allows the account holder to remove recently-viewed titles at any point in time (exception: children's accounts). Granted, this feature didn't go into effect until after the lawsuit was filed, but its nonexistence at the point of filing (2011) didn't make the lawsuit any less misguided. Information pertinent and relevant to the account holder will obviously be displayed to any person using any device that is logged on to that account. Why anyone should expect anything else when they "log in" is baffling.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: privacy, video rentals, videos, vppa
Companies: netflix
Reader Comments
Subscribe: RSS
View by: Time | Thread
[ link to this | view in chronology ]
Re:
You want to sue those kids on your lawn... we can do that
You want to sue that cloud where all your data is... we can do that
You want to sue mother nature for raining on your parade... we can do that
Lawyers are willing to do just about anything to rack up the billable hours... want to jump the shark, they can do that
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
The law is no good unless you actually use it...
Like many things in the law, the solution is already there. You just have to bother using it rather than attempting to create new (an possibly more bothersome) measures.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Speaking of which....
[ link to this | view in chronology ]
Re: Speaking of which....
[ link to this | view in chronology ]
I still have that data...
Huh. I actually participated in that contest. Did fairly well, I had ~82% accuracy on the test set. Not bad for a college kid at the time, though of course the winner was some big lab. My biggest problem was a lack of compute power. Had to rewrite my algorithm to use aggressive disk caching, 'cause the 6gb of RAM on my server wasn't nearly enough. Slowed the whole thing to a crawl, so that even the smaller training set took like 12 hours to process. This was, of course, before SSDs were economically feasible.
I'm pretty sure that I still have a copy of that data lying around.
[ link to this | view in chronology ]
Re: I still have that data...
"The lead attorney on the new suit, Joseph Malley, recently reached a multimillion-dollar settlement with Facebook over its failed Beacon program, which drew fire in part for sharing users’ Blockbuster rentals with their friends."
Interesting. Were you ever contacted to return the data?
[ link to this | view in chronology ]
What? Did they expect Netflix to support multiple profiles per account with face recognition now !?
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Is this for real?
If you don't want your wife to know that you watch midget porn then don't watch midget porn with the family Netflix account.
[ link to this | view in chronology ]
Re:
Of course not all the machines in the house have the ability to use the sub second profile soooo my profile is full of little girl cartoons and the kids can see a list of every movie the wife and I have watched.
[ link to this | view in chronology ]