In Eichenberger-v.-ESPN., Case No. 15-35499 (Nov. 29, 2017), the United States Court of Appeals for the Ninth Circuit affirmed the district court judgment holding that the serial numbers on a consumer’s video streaming device and the titles of the videos an individual watches do not constitute personally identifiable information (PII) under the Video Privacy Protection Act of 1988 (VPPA)—even if a third party has additional information that when coupled with the shared information can identify the individual.

Background

The plaintiff sued ESPN for violation of the VPPA after he learned that every time he watched an ESPN produced sport-related news video on his Roku digital streaming device, ESPN disclosed his Roku device serial number and the titles of the videos he watched to Adobe Analytics.  Adobe would then use the information obtained from ESPN to identify specific consumers by connecting that information with other data in Adobe’s possess that was obtained from other sources (such as email addresses, account information, or Facebook profile information, including photos and usernames).

Plaintiff argued that his Roku device serial number and the titles of the videos were personally identifiable information because Adobe would use them to identify him and as such ESPN violated the VPPA by disclosing such information. The district court rejected the argument finding such information did not constitute personally identifiable information within the meaning of the VPPA.  The VPPA was passed in  1988 in response to a newspaper article leaking Supreme Court nominee Robert Bork’s video rental records. The VPPA was enacted to permit “consumers to maintain control over personal information divulged and generated in exchange for receiving services from video tape service providers.”

No Additional Showing Of Harm Required For Article III Standing Under The VPPA

The Court of Appeals first addresses the Article III standing issue.  Recognizing that unlike the Fair Credit Report Act analyzed in Spokeo, Inc. v. Robins, 136 S.Ct. 1540 (2016), the VPPA, specifically 18 U.S.C. sec. 2710(b)(1), codifies a substantive right to privacy in one’s video-viewing history, the Court of Appeals finds that the mere disclosure of such information is sufficient to confer standing under the VPPA.

Ordinary Person Standard Applies And Knowing Disclosure Required

Turning to the information disclosed, the Court of Appeals, citing In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262 (3d Cir. 2016), concludes that under the VPPA,  PII is only information that “readily permits an ordinary person” to identify a particular individual as having watched a certain video.  Since the disclosure of the device’s serial number and titles of videos creates a large pool of possible individuals and does not identify a particular individual, the Court of Appeals holds that such information does not constitute PII in this context.  Furthermore, the Ninth Circuit notes that the VPPA seeks to prevent services providers from “knowingly disclosing” a user’s information, and does not require the provider to consider how the recipient intends to use it.  Consequently, even though Adobe could identify plaintiff by combining the data provided by ESPN with other data already in its possession, its ability to do so did not change the information shared by ESPN into PII under the VPPA.

Although in this decision, like various other Circuits, the Ninth Circuit recognizes the disclosure of PII in violation of the VPPA is—even without a showing of additional harm—a concrete injury that can establish Article III standing, the Court’s narrow reading of the VPPA’s intent and what constitutes PII may deter plaintiffs from relying on the VPPA in the future unless technology further evolves such that the anonymous data of today becomes  PII in the future.  While that remains uncertain, one thing is certain—there will be more litigation on the meaning of PII under in the VPPA in the future.