Appeals Court Says Netflix Doesn't Violate Privacy By Displaying Viewing History To Anyone Using That Account

Privacy

from the because-duh dept

The Ninth Circuit Appeals Court has upheld a win for Netflix in yet another privacy class-action lawsuit arising from the publication of then-Supreme Court nominee Robert Bork’s rental history oh so many years ago. The Video Privacy Protection Act sprang into being in 1988 and was used to extract a settlement from Netflix over 20 years later.

The lawsuit Netflix settled featured one key difference: in that case, rental information — in the form of “anonymized data” — was released to third parties working on better suggestion algorithms in hopes of winning $1 million. In this case, no information was released in any form to third parties… at least not in this sense.

At the center of this lawsuit were complaints that Netflix exposed viewing history to certain third parties, i.e., anyone who used the same login as the account holder. This would include family, friends and guests at a person’s residence. Since Netflix allows any number of devices to be allowed to access the account simultaneously (depending on how much you want to pay per month), one person’s viewing history could theoretically be accessed by a great many people.

So, while there may be a privacy concern, it isn’t a logical one. The information “exposed” to third parties is done so willingly by the account holder by sharing login info/logged-in devices with other viewers. Certainly the original account holder would like immediate access to recently viewed content. But this convenience also allows anyone using that login to see what’s been viewed by that account. The plaintiffs claimed this convenient feature was actually a violation of the 27-year-old Video Privacy Protection Act.

The complaint alleges that upon setting up a Netflix account, personally identifiable information, by default, is only disclosed to a Netflix subscriber through her password-protected account. Under those circumstances, a subscriber’s queue or recommendation lists are only viewable by the subscriber. Netflix subscribers can then elect to display on their televisions what would otherwise be password-protected information by registering Netflix-ready devices in their accounts. Thereafter, Netflix automatically displays on a television what it displays on a subscriber’s computer: streamed instant videos, the subscriber’s queue, and video recommendations. This is plainly a disclosure “to the consumer” as contemplated by the VPPA. When Netflix displays a subscriber’s queue, viewing history, or recommendation lists in her online account, that is a disclosure directly to the consumer. The nature of that disclosure does not change when subscribers choose to display the same content on their television screens. The subscriber’s choice to do so does not trigger some new statutory duty on the part of Netflix.

Furthermore, the law (logically) does not demand that Netflix prevent things it can’t possibly control.

The fact that a subscriber may permit third parties to access her account, thereby allowing third parties to view Netflix’s disclosures, does not alter the legal status of those disclosures. No matter the particular circumstances at a subscriber’s residence, Netflix’s actions remain the same: it transmits information automatically to the device that a subscriber connected to her Netflix account. The lawfulness of this disclosure cannot depend on circumstances outside of Netflix’s control.

The lawsuit also used California’s civil code as a fallback option in case the VPPA claims failed, but the court finds the wording in that statute doesn’t open Netflix up to any additional culpability.

While phrased in slightly different language than the VPPA, the California Civil Code plainly excludes liability for disclosures to a subscriber who is the subject of a record. Netflix’s disclosure of personal information was made to its subscribers and therefore it is not liable under section 1799.3.

That this case made it as far as the appeals court is simply the judicial system functioning as it should, rather than indicative of the lawsuit’s strengths. Exhausting every available remedy is something the system grants to plaintiffs, even if the arguments made are incredibly weak.

The simple fact is that if someone don’t want anyone but Netflix knowing what they watch, they should’t let anyone but Netflix have access to the account. Additionally, the company now allows the account holder to remove recently-viewed titles at any point in time (exception: children’s accounts). Granted, this feature didn’t go into effect until after the lawsuit was filed, but its nonexistence at the point of filing (2011) didn’t make the lawsuit any less misguided. Information pertinent and relevant to the account holder will obviously be displayed to any person using any device that is logged on to that account. Why anyone should expect anything else when they “log in” is baffling.

Filed Under: privacy, video rentals, videos, vppa
Companies: netflix