On Wednesday, the 9th Circuit Court of Appeals decided not to revive a lawsuit against ESPN over the way the sports network was allegedly disclosing who was watching what on its WatchESPN application. Nevertheless, the opinion may ultimately be seen as a small victory for those concerned about privacy.
Chad Eichenberger, the plaintiff, attempted to bring a claim under the Video Privacy Protection Act, a law enacted in the 1980s by Congress in response to a video store that gave The Washington Post a list of videos that Supreme Court then-nominee Robert Bork had rented. The statute has struggled to find relevance in a digital age where many people are watching stuff online with data being collected and shared with advertisers. In this instance, Eichenberger alleged that ESPN had disclosed the videos he was watching by sharing the serial number of his Roku device with the analytics firm, Adobe.
In response to the lawsuit, ESPN argued that Eichenberger lacked standing because he had not alleged a concrete harm.
The subject of standing in privacy cases is one that courts throughout the nation have been grappling with in recent years. Twice this decade, the Supreme Court attempted to weigh in on the controversy in a case — Spokeo v. Robins — covering the privacy of an individual’s credit reports. The high court ruled that Article III of the U.S. Constitution “requires a concrete injury even in the context of a statutory violation” and that a “bare procedural violation, divorced from any concrete harm” is not enough.
But confusion still exists about the application of this, especially in disputes beyond the Fair Credit Reporting Act.
Last week, for instance, the 2nd Circuit ruled that NBA 2K video game players lacked standing to sue Take-Two Interactive over biometric collection because the plaintiffs had failed to show injuries or at least a real risk of harm.
On Wednesday, in contrast, the 9th Circuit concludes Eichenberger does have standing.
In coming to the conclusion, Circuit Judge Susan Graber writes how the VPPA is a “substantive provision that protects concrete interests,” and that the VPPA “does not protect only against harms such as embarrassment and harassment — as Defendant argues. Rather, the statute also protects privacy interests more generally by ensuring that consumers retain control over their personal information.”
“Privacy torts do not always require additional consequences to be actionable,” Graber adds while attempting to distinguish Eichenberger’s case from Spokeo. The judge says the cases that went up to the Supreme Court concerned procedural violations of the Fair Credit Reporting Act, whereas the VPPA codifies a substantive right to privacy.
Graber says the opinion is consistent with a couple of other recent ones in sister circuits (e.g. see this 3rd Circuit opinion in a recently settled VPPA case over videos watched on Nick.com), although other circuits have come to other conclusions as shown by the NBA 2K dispute.
The Supreme Court may ultimately have to weigh in on the topic of standing again, but perhaps not in Eichenberger’s case because ESPN emerges the winner on different grounds.
Graber tackles whether ESPN disclosed Eichenberger’s personal information, and in doing so, asks, “Under the VPPA, what information did Congress intend to cover as ‘capable of’ identifying an individual?”
That’s a tough question as well, as seen by a 2016 decision by the 11th Circuit allowing a lawsuit from a man who downloaded USA Today‘s app. In that case, the appeals court held a user could be identified by the sharing of viewed videos, his Android ID and the GPS coordinates of the device at the time videos were watched. Other cases didn’t necessarily apply different reasoning, but have nevertheless resulted in different outcomes including Eichenberger’s. The test being applied is: Would an “ordinary person” be able to identify a specific individual’s video-watching behavior from the information provided?
In accepting this test, Graber writes it “fits most neatly with the regime that the VPPA’s enacting Congress likely had in mind.”
“In 1988, the Internet had not yet transformed the way that individuals and companies use consumer data — at least not to the extent that it has today,” the judge adds. “Then, the VPPA’s instructions were clear. The manager of a video rental store in Los Angeles understood that if he or she disclosed the name and address of a customer — along with a list of the videos that the customer had viewed — the recipient of that information could identify the customer. By contrast, it was clear that, if the disclosure were that ‘a local high school teacher’ had rented a particular movie, the manager would not have violated the statute. That was so even if one recipient of the information happened to be a resourceful private investigator who could, with great effort, figure out which of the hundreds of teachers had rented the video.”
Applying the analogy to the current dispute, Graber says that “Plaintiff’s Roku device serial number is like the information in the latter scenario. It creates a sizable ‘pool’ of possible viewers — here, Roku users — just as the information in the latter example does — there, high school teachers.”
The judge offers more analysis.
“It is true that today’s technology may allow Adobe to identify an individual from the large pool by using other information — as Plaintiff alleges,” Graber writes. “But the advent of the internet did not change the disclosing-party focus of the statute. And we are not persuaded that the 1988 Congress intended for the VPPA to cover circumstances so different from the ones that motivated its passage.”
Ultimately, the opinion (read in full here) affirms the dismissal of the lawsuit against ESPN because while Adobe may have other data in its possession to identify Eichenberger, ESPN never gave such data to Adobe. The 9th Circuit concludes “that an ordinary person could not use the information that [ESPN] allegedly disclosed to identify an individual. Plaintiff has therefore failed to state a claim … .”