Reproduced with permission from Privacy & Security Law Report, 15 PVLR 1467, 7/18/16. Copyright 姝2016 by
The Bureau of National Affairs, Inc. (800-372-1033) http://www.bna.com
Video Privacy Protection Act
This article explores how personally identifiable information has been defined in leading
Video Privacy Protection Act actions and looks at how concerns over the potential sensitiv-
ity of geolocation information may alter how courts handle PII. Companies must pay close
attention to exactly what information they transmit to third parties—especially when that
information relates to a consumer’s precise geolocation, the authors write.
The VPPA and PII: Is Geolocation Another Anonymous Identifier?
BYD. REED FREEMAN AND JOSEPH JEROME
Although litigation under the Video Privacy Protec-
tion Act (VPPA) has exploded in recent years,
plaintiff’s attorneys have had limited success on
the merits, typically because courts have shown re-
straint in applying the law to modern online streaming
technologies. Moreover, courts have generally taken a
narrow view with respect to what constitutes personally
identifiable information (PII) under the statute.
A recent decision by the U.S. Circuit Court of Appeals
for the First Circuit, however, not only throws into
question how PII may be understood, but also threatens
to create a circuit split should any other circuit court
tackle whether the definition of PII includes anonymous
identifiers, geolocation data and elements of data that
are sometimes passed from a streaming service to third
parties, such as analytics providers. This article ex-
plores how PII has been defined in leading VPPA ac-
tions and looks at how concerns over the potential sen-
sitivity of geolocation information may alter how courts
interpret PII under the VPPA in the future.
With limited exceptions, the VPPA imposes liability—
and statutory damages of $2,500 per violation—on any
‘‘video tape service provider’’ (VTSP) that knowingly
discloses PII about a consumer without the consumer’s
consent. 18 U.S.C. § 2710(b). Online streaming services
such as Netflix Inc., Hulu Inc., and others have come to
be considered VTSPs, and as digital data has entered
the fray, a key question has been what, if any, of the in-
formation they pass to third parties is PII under the
VPPA. Unfortunately, the statute defines PII only as
‘‘information which identifies a person as having re-
quested or obtained specific video materials or services
from a video tape service provider.’’ 18 U.S.C.
§ 2710(a)(3). As the First Circuit recently noted, this
definition is both awkward and unclear Yershov v. Gan-
nett Satellite Info. Network, No. 15-1719, 2016 BL
136751 (1st Cir. Apr. 29, 2016 ) (15 PVLR 954, 5/9/16).
Courts have repeatedly struggled to understand the
scope of information encompassed by PII and how pre-
cisely this information must identify a person. E.g. Rob-
inson v. Disney Online, No. 14-CV-04146-RA, 2015 BL
D. Reed Freeman is a partner at WilmerHale
LLP in Washington and co-chair of the Cyber-
security, Privacy and Communications prac-
tice.
Joseph Jerome is an associate at WilmerHale
in Washington and a member of the Cyber-
security, Privacy and Communications prac-
tice.
COPYRIGHT 姝2016 BY THE BUREAU OF NATIONAL AFFAIRS, INC. ISSN 1538-3423
Privacy and Security
Law Report®
