TMCnet News
Senate Judiciary Subcommittee on Privacy, Technology and the Law HearingFeb 01, 2012 (Congressional Documents and Publications/ContentWorks via COMTEX) -- Chairman Franken, Ranking Member Coburn and Members of the Subcommittee, I appreciate this opportunity to address the Subcommittee about the proposed amendment of the Video Privacy Protection Act ("the VPPA") and consumer privacy in this rapidly evolving digital age. It is particularly timely that the Subcommittee holds this hearing today. Online privacy has been at the forefront of intense discussion for the past few years. Business leaders, consumer advocates, state and local elected representatives and officials from each branch of federal government have all weighed in with a variety of concerns and proposed solutions to address the absence of a uniform framework or approach to safeguard individual information in the thriving online environment. Attention has appropriately intensified as two of the Internet's giants--Facebook and Google--have come under scrutiny for their personal data usage policies and practices. Both Facebook and Google are currently subject to 20 year periodic audits of their privacy policies pursuant to separate settlements with the Federal Trade Commission (FTC) entered into late last year.n1 Yet, just last week, Google announced sweeping changes to its privacy policy that users will not be allowed to "opt-out" of. The announcement has already raised the eyebrows of privacy advocates and could revive FTC probes into Google's practices. n2 In the coming weeks, both the FTC n3 and the Department of Commerce n4 are expected to issue long anticipated final reports on online privacy policy based on a series of roundtable discussions with relevant stakeholders and following up on their initial studies in 2010. n5 Senators Kerry and McCain, in the Senate, n6 and Representative Cliff Stearns, n7 in the House, last year introduced comprehensive legislation designed to prescribe standards for the collection, storage, use, retention and dissemination of users' personally identifiable information. These bills also generated debate more generally in the Halls of Congress. This Subcommittee also held hearings to address the security of sensitive health records and personal privacy on mobile devices. And, last week, in deciding whether GPS tracking violates a criminal defendant's Fourth Amendment right against unreasonable search and seizure n8, a majority of the Justices of the Supreme Court acknowledged the challenges we confront as a society in determining the "new normal" for privacy expectations in the digital age. In separate concurrences Justice Sotomayor, writing for herself, and Justice Alito, joined by Justices Ginsburg, Breyer and Kagan, pondered whether "[d]ramatic technological change may lead to periods in which popular expectations [of privacy] are in flux" and require the Court to rethink expectations of privacy where information is shared so freely. n9 Although the Justices were deliberating expectations of privacy that give rise to a constitutional claim under the Fourth Amendment, that debate is not without significance in the context of this hearing today. Because of the inevitable disclosure of a wealth of personal information to third parties as a condition of using modern technologies, the intersection between commercial and constitutional privacy is palpable. n10 I believe that any legislative initiative in this realm must balance the right of individuals to privacy and control over their personal information, the interests of online commercial businesses in innovation and global competitiveness and legitimate law enforcement considerations. Against this backdrop, I will direct the remainder of my comments to H.R. 2471, which passed in the House last session by a split vote of 303-116 under suspension of the rules. While I may not always avail myself of the new and revolutionary tools and services available over the Internet, let me say at the outset that I fully appreciate and applaud the explosion of technological advances that has transformed forever the way we communicate and transact business. While I support innovation on the web, however, I cannot do so at the expense of individual privacy. Given the gravity of the issues involved, I believe it was a mistake for this bill to move through the House relatively under the radar and without the benefit of a single hearing. But let me be clear: this is not just a process issue. I believe H.R. 2471 as passed will have unintended negative consequences for consumers and affected businesses, which will undoubtedly lose the confidence of their subscribers with the first privacy violation or data breach. The history of the Video Privacy Protection Act, which is widely considered to be the strongest consumer privacy law in the United States, is well-known. The law was passed in 1988 following bipartisan outrage over the disclosure and publication of the video rental records of Supreme Court nominee Judge Robert Bork. Proponents of H.R. 2471argue that the VPPA is outdated and that changes in the commercial video distribution landscape justify modernization. Although the commercial distribution landscape has changed, the underlying concerns that inspired passage of the VPPA are timeless. Technology and privacy are not incompatible. We can and should promote technological innovation. But we must simultaneously prevent the unwarranted, uninformed disclosure of personal information for purposes over which the consumer invariably will lose control. Unfortunately, the amendment to the VPPA proposed in by H.R. 2471 chip away at those protections by equating technological expediency with consumer preferences. Consumer desire to have access to the next cool tool should not, however, be mistaken as the voluntary surrender of fundamental privacy interests. The proliferation of privacy lawsuits and complaints against corporate giants like Google, Facebook, Apple and Netflix should make that imminently clear. In addition to the lack of thoughtful process in the House, I believe there are at least four substantive problems with H.R. 2471. First, the bill leaves unaddressed the question of who the bill applies to, which I believe creates collateral, but important, intellectual property enforcement concerns. Second, although the debate on H.R. 2471 myopically centered on the online experience of consumers with social media like Facebook, the bill as passed applies to physical and online video tape service providers alike, and disclosures are authorized "to any person," not only "friends" on Facebook. Third, despite claims that the VPPA is "outdated," only a single provision of the statute was "updated," leaving consumer-oriented provisions that also should have been reviewed and strengthened unaltered. Fourth and finally, no consideration was given to the effect of the changes to the VPPA on state laws that afford similar and sometimes broader protections to consumers. Each of these concerns is discussed in greater detail below. I. The definition of "video tape service provider" is left ambiguous by H.R. 2471 As Ranking Member of the Subcommittee on Intellectual Property, Competition, and the Internet of the House Judiciary Committee, I am concerned that in purportedly updating a statute to address new distribution models, H.R. 2471 failed to clarify who is covered by the Act. Under the VPPA, a "video tape service provider" is defined as "any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials." n11 When the VPPA was enacted, the primary method for the consumption of feature-length films by individual consumers was through the sale or rental of video cassette tapes. Today, consumers can assess video programming over a variety of platforms including Internet Protocol Television, cable, or online streaming video-on-demand services. In September 2011, Netflix n12 launched a public campaign in support of H.R. 2471, urging its subscribers to contact Congress to help bring Facebook sharing to Netflix USA. n13 Although Netflix is a legitimate and reputable company that provides a valuable service to its customers, its business model consists of a dual delivery method for movies and television which, I believe, complicates the application of the VPPA as narrowly amended to its distribution scheme. The company provides a mail order service for physical copies of DVDs and a streaming video-on-demand service to watch movies directly over the Internet. There is little doubt that Netflix's DVD by mail service is considered a videotape service provider under the statute. But neither the judiciary, regulatory body, nor Congress has concluded that Internet streaming services are covered by the statute. The only court that has considered the issue summarily and without analysis rejected the argument that an online streaming service was prohibited (in an action alleging copyright infringement against the service), from producing its users' video history in discovery to enable the rights holder to determine whether the content was infringing. n14 Left unresolved is whether companies with dual distribution platforms (like Netflix) should be considered video tape service providers covered by the VPPA for social networking purposes and appropriately fall beyond the statutes' reach for IP enforcement purposes or, alternatively whether streaming services will use the passage of H.R. 2471 to assert that Congress intended that the VPPA applies to both physical and virtual distribution methods. If the latter, I fear that online service providers will be able to have their cake and eat it too. In short, while enjoying the financial benefits of sharing its users' viewing history across platforms, a service provider could avoid or delay access to those same records in a meritorious copyright infringement dispute. By failing to address this fundamental issue, passage of H.R. 2471will add confusion rather than clarifying the law. II. H.R. 2471 applies to all "video tape service providers" as defined by VPPA and disclosures are authorized to "any person." In addition to failing to clarify what constitutes a "video tape service provider," H.R. 2471 leaves open the possibility that the very scenario that prompted passage of the VPPA could again expose consumers to unwanted disclosure and publication of their viewing histories. n15 Because H.R. 2471 focuses exclusively on a single disclosure requirement and does not address the VPPA as a whole, by its own terms the bill would apply to new and old distribution methods alike. There is nothing in the bill that would prevent a newspaper reporter from obtaining the rental or viewing history of a consumer who opts-in to the enduring, universal consent whether online or with a brick-and-mortar video store. In other words, nothing in the bill mandates that the disclosure be limited to social media integration. The bill simply gives carte blanche to video tape service providers, whether online or not, to disclose to "any person" a consumer's viewer history provided they have obtained the "informed" consent of the consumer in a conspicuous manner. My concerns are not eased, and indeed are exacerbated, when consent is sought in the online environment. At a time when the broader privacy debate is trending towards establishing some baseline privacy protections for consumers online, I believe this bill moves in the opposite direction. Although consumers can withdraw their consent at any time, I do not believe that option adequately reflects the realities of the instant, permanent, widespread dissemination and consumption of users' content. Facebook--the largest social media network -boasts 800 million users, with the average user having 120 "friends." But because Facebook, and most social platforms, are dynamic with a user's roster of friends constantly in flux, a consumer's consent today to allow perpetual access to their viewing history is clearly not informed by who will be their "friend" tomorrow. Today when the online bullying of teen and young adults can lead to depression or even suicide and online predators can learn otherwise confidential, private information about their prey, I believe the selective, piecemeal "modernization" of the VPPA is simply irresponsible. "[M]ovie and rating data contains information of a more highly personal and sensitive nature. The member's movie data exposes a ...member's personal interest and/or struggles with various highly personal issues, including sexuality, mental illness, recovery from alcoholism, and victimization from incest, physical abuse, domestic violence, adultery, and rape." n16 The VPPA established robust protections for precisely this type of information. Passage of H.R. 2471 would seriously compromise those robust protections. III. Consumer oriented provisions of the VPPA are not "updated" by H.R. 2471. In the inexplicable rush to pass this bill, I believe important consumer protection issues were overlooked. The VPPA was enacted to protect consumer interests in personally identifiable records. Yet H.R. 2471 focuses singularly on facilitating disclosure, not preventing, limiting, or protecting that interest. The bill's exclusive aim is to provide a safe haven for wide-scale disclosures made possible by technological innovation. In the process, the goal of insulating personal information from unwanted disclosure is completely neglected. In fact, none of the consumer-oriented provisions of the underlying Act are amended to reflect modern day circumstances. For example, the VPPA requires destruction of records "as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected." Record retention and destruction plans reinforce policies designed to deter the abuse or misuse of personally identifiable material. They generally set forth guidelines to those with access to an individuals' personal information that prohibit storing documents beyond their usefulness or discarding them prematurely. The rationale embodied in the provision in the VPPA that requires the destruction of video records no later than a year after the record was established was clearly driven by the desire to prevent stockpiling of old and outdated data on any person. True modernization of the VPPA should also have considered the feasibility and desirability of applying that same provision in the online environment. Some internet companies have been found to track, retain, market and mine information on their customers at an alarmingly high rate. n17 Conventional wisdom teaches that once information is posted on or over the Internet, it remains stored or cached there forever. Thus, while record destruction in the physical world is more easily effected and verified, that is not the case in the virtual world. The question arises whether additional safeguards should be enacted to ensure that the policy objectives underlying the requirement in the VPPA to destroy old records are transferrable to the online environment. n18 Additionally, while easing the restrictions on video service providers to disclose its users' video histories, H.R. 2471 ignores the damages provision for consumers harmed by violations of the VPPA. In 1988 when the VPPA was passed, Congress calculated that a minimum of $2,500 in actual damages was an adequate deterrent to discourage violations of the Act. Certainly that figure, although a floor, is outdated today where revenues earned by companies online can exceed billions of dollars and permanent disclosure of a consumer's intimate information can extend to much larger audiences. IV. No consideration was given to the effect of the changes to the VPPA on state laws that afford similar protections to consumers. According to the Electronic Privacy Information Center (EPIC), many states have laws that extend greater protections to consumers and their video records than does the VPPA. Among the states that have adopted comparable or stronger measures are: Connecticut, Maryland, California, Delaware, Iowa, Louisiana, New York, Rhode Island and Michigan. Michigan's law actually applies to book purchases, rental and borrowing records, as well as to video records. And California recently passed a law updating its reader privacy laws to apply to Electronic books. n19 The House did not evaluate what practical impact H.R. 2471 would have on those states laws. The VPPA expressly preserves state law that establishes more robust safeguards for consumers in their relationships with video rental services. The VPPA, however, preempts state law that requires disclosures otherwise banned by the VPPA. Conclusion During consideration of H.R. 2471 before the House Judiciary Committee I offered two amendments, both designed to give Internet businesses the necessary flexibility to obtain electronic consent from consumers, while simultaneously safeguarding privacy rights. While there may be other more precise and effective means to balance these objectives, I believe that H.R. 2471 is clearly not that alternative. Mr. Chairman, this past Saturday was "Data Privacy Day." n20 Data Privacy Day recognizes the importance of educating consumers on how to preserve the security and privacy of their personal and potentially sensitive information shared over the Internet. While Internet users have a responsibility to self-censor and restrict the information they share about themselves, the reality is that many online users have a false sense of privacy due to a lack of understanding of lengthy and complex privacy policies to which they are compelled to agree in order to use the service. As a result, online users have a tendency to share a lot of personal information unknowingly and with unintended audiences. I do not believe that the unsuspecting, unsophisticated or casual Internet user should be deemed to relinquish his right to a basic level of privacy. As Justice Marshall wrote years ago, "Privacy is not a discrete commodity, possessed absolutely or not at all." n21 The trick is to strike an appropriate balance to develop meaningful protections for consumers while promoting a healthy online economy. I support a comprehensive online privacy plan that will address and mitigate the unintended consequences of third party sharing. In that regard, I believe Justice Alito got it right: "In circumstances involving dramatic technological change, the best solution to privacy concerns may be legislative. A legislative body is well situated to gauge changing public attitudes, to draw detailed lines, and to balance privacy and public safety in a comprehensive way." n22 This hearing is a responsible beginning to that effort and even more critically important because the House failed to give the matters the kind of attention required. I thank the Chairman for this opportunity and look forward to working across the Capitol moving forward. n1 News Release, "Facebook Settles FTC Charges That It Deceived Consumers By Failing To Keep Privacy Promises," available at http://www.ftc.gov/opa/2011/11/privacysettlement.shtm; News Release, "FTC Gives Final Approval to Settlement with Google over Buzz Rollout," available at http://www.ftc.gov/opa/2011/10/buzz.shtm. n2 Cecilia Kang, "Google announces privacy changes across products; users can't opt out," Jan. 24, 2012, Washington Post, available at http://www.washingtonpost.com/business/economy/google-tracks-consumers-across-products-users-cant-opt-out/2012/01/24/gIQArgJHOQ_story.html n3 The FTC issued a preliminary staff report titled, "Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework For Business And Policymakers" in December 2010 following a series of stakeholder meetings. The report solicited comments and expected to issue a final report in 2011. The report is available here http://business.ftc.gov/privacy-and-security/consumer-privacy n4 The Department of Commerce also issued a "green paper" in December 2010--"Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework." n5 See Abby Johnson, "Online Privacy Debate Heats Up With FTC And Commerce Dept. Reports Coming Soon," January 17, 2012 available at http://www.webpronews.com/online-privacy-debate-heats-up-with-ftc-and-commerce-dept-reports-coming-soon-2012-01. n6 S.799, the Commercial Privacy Bill of Rights Act of 2011. n7 H.R. 1528, the Consumer Privacy Protection Act of 2011. n8 U.S. v. Jones, 565 U.S. ___ (2012) (slip opinion). n9 Id., (Alito, J., concurring in judgment), slip op. at 10. n10 Justice Sotomayor observed that "it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties. This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks...Perhaps, as JUSTICE ALITO notes, some people may find the "tradeoff" [online] of privacy for convenience 'worthwhile,' or come to accept this 'diminution of privacy' as 'inevitable,' and perhaps not." Id., (Sotomayor, J., concurring), slip op. at 5 (citations omitted). n11 See 18 U.S.C. [Sec.]2710 (a) (4) (2011). n12 Founded in 1997, Netflix is the world's leading Internet subscription service. It provides movies and television shows through mail order DVD and online streaming services. With 900 employees, Netflix has 25 million subscribers worldwide. Netflix Company Facts, available at https://account.netflix.com/MediaCenter/Facts . n13 Netflix has integrated user accounts in Canada and Latin America with Facebook, but advised its American customers that the VPPA "creates some confusion over our ability to let U.S. members automatically share the television shows and movies they watch with their friends on Facebook." Posting of Michael Drobac to The Netflix Blog, "Help us Bring Facebook Sharing to Netflix USA," (Sept. 22, 2011), http://blog.netflix.com/2011/09/help-us-bring-facebook-sharing-to.html. n14 Viacom International, Inc. v. YouTube, Inc., No. 07 Civ. 2103 (S.D.N.Y., June 23, 2010). n15 Much has been made about the presumed disparity in treatment of video history as opposed to a consumer's reading lists or musical consumption habits. At the time the VPPA was enacted there were no comparable commercial music or book rental entities. The Committee Report did note, however, that the Senate subcommittee considered and "reported a restriction on the disclosure of library borrower records... [but] was unable to resolve questions regarding the application of such a provision for law enforcement." S. Rep. No. 100-599 (1988), at 8. n16 Ryan Singed, "Netflix Spilled Your Brokeback Mountain Secret, Lawsuit Claims," WIRED, December 17, 2009, available at: http://www.wired.com/threatlevel/2009/12/netflix-privacy-lawsuit. n17 See "The Web's New Gold Mine: Your Secrets," WSJ Julia Angwin (July 30, 2010). n18 Netflix is currently in class action litigation over claims that the company's practice of keeping the rental history and ratings "long after subscribers cancel their Netflix subscription," violates the VPPA. http://www.huntonprivacyblog.com/2011/03/articles/netflix-sued-for-allegedly-violating-movie-renters-privacy/. n19 See http://www.aclu-sc.org/releases/view/802934. n20 Data Protection Day began in Europe in 2007. The following year, the United States and Canada initiated "Data Privacy Day" which is celebrated annually in late January/early February with participants from the U.S., Canada and over 40 countries in the Council of Europe. Events associated with Data Privacy Day are designed to reach and involve consumers and consumer advocates, businesses and government officials to promote awareness about developments in the intersection between data collection and privacy protection. See http://www.staysafeonline.org/dpd/about. n21 Smith v. Maryland, 442 U.S. 735, 749 (1979). n22 Jones, 565 U.S. ___, (Alito, J., concurring in judgment), slip op. at 5. Read this original document at: http://judiciary.senate.gov/pdf/12-1-31WattTestimony.pdf |