The 9th Circuit Adopts the “Ordinary Person” Standard for “Personally Identifiable Information” Under The Video Privacy Protection Act of 1988

Key Points

• The 9th Circuit affirmed the dismissal of a putative class action alleging that ESPN disclosed “personally identifiable information” in violation of the Video Privacy Protection Act of 1988 (VPPA) by knowingly disclosing to a third party the plaintiffs’ Roku device serial number and the identity of the videos that he watched.
• Adopting the 3rd Circuit’s “ordinary person” standard, the 9th Circuit held that “personally identifiable information” under the VPPA “means only that information that would ‘readily permit an ordinary person to identify a specific individual’s video-watching behavior.’” In adopting this standard from In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3rd Cir. 2016), the 9th Circuit declined to apply the standard set forth in the 1st Circuit’s decision in Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482 (1st Cir. 2016).
• The 9th Circuit also rejected ESPN’s argument that the plaintiff lacked Article III standing for failure to allege a concrete harm as required by the Supreme Court’s decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).

  ---

On November 29, 2017, in Eichenberger v. ESPN, Inc., the 9th Circuit affirmed the dismissal of a putative class action which alleged that ESPN had disclosed “personally identifiable information” in violation of the Video Privacy Protection Act of 1988 (VPPA). Adopting the 3rd Circuit’s “ordinary person” standard, the 9th Circuit held that “personally identifiable information” under the VPPA “means only that information that would ‘readily permit an ordinary person to identify a specific individual’s video-watching behavior.’” The 9th Circuit also held that the plaintiff had Article III standing.

Background

Plaintiff Chad Eichenberger filed a putative class action in the Western District of Washington alleging that ESPN violated the VPPA by disclosing his “unique Roku device serial number” and the identity of the videos he watched through the WatchESPN Channel on his Roku device to a third party, Adobe Analytics (Adobe), without his consent. The plaintiff alleged that Adobe then connected this information with existing data in Adobe’s possession, such as “email addresses, account information, or Facebook profile information,” to provide ESPN with aggregated information that could then be provided to advertisers about its users’ demographics.

The district court dismissed the plaintiff’s complaint under Federal Rule of Civil Procedure 12(b)(6) on the ground that it failed to state a claim that the information disclosed was “personally identifiable information” within the meaning of the VPPA. The plaintiff appealed the decision to the 9th Circuit. On appeal, ESPN argued that the plaintiff lacked Article III standing for failure to allege a concrete harm as required by the Supreme Court’s decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).

The 9th Circuit’s Opinion

The 9th Circuit affirmed the lower court’s ruling and rejected ESPN’s argument that the plaintiff lacked Article III standing.

First, the 9th Circuit held that the plaintiff had alleged a “concrete injury” sufficient to establish Article III standing. The 9th Circuit reasoned that, unlike the procedural violation at issue in Spokeo, the VPPA “identifies a substantive right to privacy that suffers any time a video service provider discloses otherwise private information.”

Second, the 9th Circuit affirmed the district court’s dismissal on the ground that the plaintiff failed to adequately allege that ESPN disclosed his “personally identifiable information” under the VPPA. Adopting the 3rd Circuit’s “ordinary person” standard from In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3rd Cir. 2016), the court held that “personally identifiable information” under the VPPA “means only that information that would ‘readily permit an ordinary person to identify a specific individual’s video-watching behavior.’” The court reasoned that the VPPA “looks to what information a video service provider discloses, not to what the recipient of that information decides to do with it,” and consequently “‘personally identifiable information’ must have the same meaning without regard to its recipient’s capabilities.” In so ruling, the 9th Circuit declined to adopt the standard for “personally identifiable information” articulated by the 1st Circuit in Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482 (1st Cir. 2016).

Applying the “ordinary person” standard, the court found that the plaintiff’s allegations were insufficient to state a claim under the VPPA because the information that ESPN disclosed to Adobe “cannot identify an individual unless it is combined with other data in Adobe’s possession—data that ESPN never disclosed and apparently never even possessed.”

Takeaways

The 9th Circuit’s decision in Eichenberger clarifies the meaning of “personally identifiable information” under the VPPA, which was enacted long before the advent of today’s video streaming technology, and demonstrates the court’s skepticism that “the 1988 Congress intended for the VPPA to cover circumstances so different from the ones that motivated its passage.”

Contact Information

If you have any questions concerning this alert, please contact: