Congress V. Consumers: Who Should Control Data-Sharing Choices?
Lawmakers, Stakeholders Discuss Amendment to the Video Privacy Protection Act
By Angelique Carson, CIPP/US
Should consumers have the power to choose whether to share their personal information, or should Congress legislate when they have that right?
That question was up for debate at yesterday’s hearing on the proposed amendment to the Video Privacy Protection Act (VPPA), during which lawmakers and witnesses discussed consumer rights, the viability of easily accessible opt-out mechanisms and how to adequately update a consumer privacy law sure to soon again fall behind the forward march of technology.
Witnesses at “The Video Privacy Protection Act: Protecting Viewer Privacy in the 21st Century” hearing, held by the Senate Judiciary Committee’s Subcommittee on Privacy, Technology and the Law, agreed the VPPA needs updating, but to what extent and how didn’t always draw consensus.
House Resolution 2471—which passed the House of Representatives in December 2011--would amend the VPPA to allow consumers to give one-time, blanket consent for their viewing preferences to be shared by a “video tape service provider,” and for that consent to be obtained via the Internet.
The VPPA was passed in 1988—years before online video streaming and data sharing were prolific—after a Supreme Court nominee’s video rental history was published in a newspaper. The law forbids the disclosure of video renters’ personal information without the consumer’s informed, written consent at the time of disclosure. Disclosure is permitted under certain circumstances–such as for law enforcement under a court order or warrant, or if the consumer provides written consent–provided a video’s title, description or subject matter isn’t disclosed.
EPIC’s Marc Rotenberg said the VPPA aimed to provide a higher level of protection against companies disclosing data under opt-out provisions that would reveal significant details about a person’s personal interests and likes.
Rep. Melvin Watt (D-NC) noted that a video subscriber’s data “exposes a member’s personal interest and struggles with various highly personal issues including sexuality, mental illness, recovery from alcoholism and victimization from incest, physical abuse, domestic violence and rape.”
Internet subscription service Netflix says consumers should ultimately control what information they share, not Congress. Ambiguities under the VPPA recently halted Netflix’s plans to integrate its video streaming services with Facebook in the U.S. Though the service is available in 44 countries, the VPPA prevents such disclosures, even if customers have opted in, said Netflix General Counsel David Hyman.
The proposed amendment “leaves the opt-in standard on VPPA undisturbed,” Hyman said, but clarifies users’ abilities to share. “Netflix supports opt-in standards and believes this approach is workable. We hope the Senate will see the value of clarifying the right of consumers to opt-in to ongoing sharing and quickly approve HR 2471.”
Christopher Wolf of the Future of Privacy Forum agrees with Hyman in his support of HR 2471, saying the choice should remain in the consumers’ hands.
“A law that takes away that choice ignores that there are people who want to (share everything on Facebook),” Wolf said. “I don’t see how it’s the business of Congress to dictate how and when people share.”
But Watt testified that it was a mistake that HR 2471 moved through the House so quickly and without a hearing. The bill would have unintended negative consequences for consumers as well as affected businesses because it fails to specify what constitutes a “video service provider”; leaves a consumer’s private information vulnerable to third parties; fails to appropriately update the law on consumer-oriented provisions, and fails to consider the impact it would have on state laws, Watt said.
Rotenberg said he believes the members of the House who voted for the bill may not have understood its consequences, and the bill would not only allow video renters’ Facebook friends to see their viewing preferences but also Netflix’s business partners and potentially law enforcement agents.
“What Netflix is asking users to do is provide blanket consent that gives them the opportunity to disclose specific movie viewing data to any party in any circumstance that Netflix wants. This knocks out the cornerstone of the act,” he said. “Obviously I don’t think this is going to support online privacy, and frankly, I don’t think Netflix users want these provisions. But I do think changes can be made to the act to update and improve it.”
Although Wolf disagreed that the bill would offend users or undermine the VPPA’s fundamental purpose, he agreed that as a privacy best-practice, opt-in should be the default for sharing and should be presented prominently, separately and distinctly from general privacy policies.
“For many people, automatic sharing and social media is how they shape online identities and how they share ideas,” he said. “When it comes to sharing online video preferences, the law gets in the way.”
Subcommittee Chairman Sen. Al Franken (D-MN) closed the hearing by saying that he doesn’t believe the amendment is comprehensive and that it should include a broader definition on “video tape service provider” to ensure the law applies to online video streaming.
In the end, said Wolf, “Privacy is and all along has been about giving people the choice to share their information and who sees it and how it’s disclosed.”