9th Circuit Finds Consumer Standing under Privacy Law

The U.S. Court of Appeals for the Ninth Circuit recently held that disclosure of a consumer’s “personally identifiable information” and video-viewing history on a streaming device was sufficient to establish standing under the Video Privacy Protection Act (VPPA).  However, the Ninth Circuit upheld the district court’s dismissal of the plaintiff’s claim on the grounds that the serial number of a movie streaming device is not “personally identifiable information” under the VPPA.

The VPPA bars a “video tape service provider” from knowingly disclosing “personally identifiable information concerning any consumer of such provider.”  The statute defines “personally identifiable information” as “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”

In the case at issue, the plaintiff alleged that a television network violated the VPPA and knowingly disclosed his personally identifiable information by sharing his Roku streaming device serial number and video-viewing history on the network’s Roku application with a third party.  The plaintiff did not consent to have this information shared with a third party.  The third party allegedly combined this information with additional information from sources other than the network to identify the plaintiff, which the network then used to provide its advertisers with aggregated information about the demographics of its users.  The plaintiff alleged that the network disclosed his “personally identifiable information” by giving the third party his Roku device serial number and identifying the videos that he watched, because the network knew that the third party could and would use that information to identify him.

With respect to the standing issue, the Ninth Circuit held that allegations that the VPPA was violated are sufficient to establish standing.  The court held that every disclosure of an individual’s “personally identifiable information” and video-viewing history offends the interests that the statute protects, and that the plaintiff need not allege any further harm to have standing.

The court ultimately held, however, that “personally identifiable information” under the VPPA means only that information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.  Applying that definition to the facts at issue, the court concluded that an ordinary person could not use the information that the network allegedly disclosed to identify an individual.  Indeed, the court held that the allegedly disclosed information cannot identify an individual unless it is combined with other data in the third party’s possession, which the network never disclosed and that the third party never even possessed.

The case is Eichenberger v. ESPN.