A federal court in the Northern District of California recently ruled
a person whose personally identifying information was released by Hulu in violation of the Video Privacy Protection Act is “aggrieved.” According to the court, the statute’s plain language compels the result. And if that means the ruling is intuitively obvious, it is nonetheless good news for victims of privacy violations.
The VPPA is a targeted statute that prohibits the release of movie rental information. Congress passed it in 1988
in the wake of the disclosure of Robert Bork’s
video rental records (just kidding on that first link
– but the resemblance is remarkable). On the one hand, it begs the question “didn’t Congress have more important things to do?” But on the other, it means that only I will know how many times I rented “Dirty Dancing” (kidding). So on balance, I suppose it’s a good thing.
As you might have guessed, the VPPA doesn’t merely prohibit the release of information – it provides a remedy in the form of a civil action. A party “aggrieved” by a violation can recover actual damages not less than “liquidated damages” of $2500, punitive damages and attorney fees (probably more than $2500 in virtually every case).
According to the complaint (which seeks certification as a class action) Hulu released to personally identifiable information to comScore and Facebook, in violation of the VPPA. In a summary judgment motion, Hulu argued the plaintiffs weren’t “aggrieved” because they provided no evidence of any damage other than the release of the information itself. Hulu argued a plaintiff seeking damages has to show some harm resulting
from the disclosure. The disclosure itself is not sufficient.
The court apparently was not a believer in the time tested playground concept of “no harm no foul.” It found that the plain language of the statute establishes the party is “aggrieved” the minute the information is disclosed – there is no need to show any additional harm. In the court’s view, section (b)(1) of the statute, which states: “a video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person for the relief provided” settles the issue. And that analysis makes sense I think. The statute gives me the right to assume that my information is private. If that information is released, it seems to me I’m “aggrieved” by virtue of having that expectation dashed. I may not be entitled to a lot, but the law’s the law.
And while the stakes may not seem that high I can see why Hulu made the argument. 2,500 bucks starts to sound like a big deal when it gets multiplied by thousands of class members. And once the door gets cracked even a little, it potentially allows for the big hit of punitive damages and attorney fees. I suspect this one will get appealed.