PHILADELPHIA – When the U.S. Court of Appeals for the Third Circuit ruled in a class action lawsuit against Google and Viacom that alleged the companies had violated users’ privacy, there were several issues that the judges had to consider.
When it came to accusations that the companies violated state and federal laws, including the Video Privacy Protection Act (VPPA), attorney Drew Crawford told the Pennsylvania Record that the judges didn’t really put the privacy issue to rest in the June 27 decision. Crawford is an associate with King and Spaulding in Washington, D.C.
Drew Crawford
| Courtesy of King and Spaulding
“Judges are always cautious, and they try not to issue sweeping decisions. I was surprised that they went to such great lengths to interpret the (VPPA) and its history,” Crawford said.
“They open it up in the last paragraph and suggest that this is a very specific ruling, but in the meantime, companies that offer digital streaming should think closely about consent.”
The question in this case boils down to: What exactly is personally identifiable information?
In their lawsuit, the plaintiffs said that Viacom was getting information from users at Nick.com and the company was then sharing the information with Google.
With Viacom’s information, they alleged, Google could then piece information together, with the user’s video-watching history, to find out who specific users were. The judges of the Third Circuit said that the information in question was not considered personally identifiable information.
“They said VPPA was passed to give private citizens a right of action when their video rental history was disclosed. They said that ‘based on the way (the VPPA) is written, we can’t say it is analogous enough to constitute personally identifiable information,’” Crawford said.
“The VPPA can’t be read broadly enough to apply to this new situation.”
The ruling sets a precedent, as the Third Circuit is the first circuit court to address these issues, Crawford said.
“Internet service providers have a lot of information here and there, like IP addresses. With enough detective work, someone could likely figure things out. But, just because a company’s website collects cookies, that doesn’t give the general public a cause of action,” Crawford said.
“It’s probably very likely that in the future there will be a new piece of information that may cause a judge to say ‘That’s enough, you just crossed a line.'"
Ultimately, judges Franklin S. Van Antwerpen, Patty Schwartz and Julio Fuentes upheld the U.S. District Court for the District of New Jersey’s dismissal of the allegations against Google, including claims that the company violated users’ privacy by allegedly tracking the sites that young children were viewing.
The decision notes that claims under several legal acts, including the Wiretap Act, the Stored Communications Act and the California Invasion of Privacy Act, as well as the New Jersey Computer Related Offenses Act, do not stand up to scrutiny. The judges sent the decision regarding claims against Viacom back to the lower court for reconsideration.
In the decision, judges wrote that the law permits plaintiffs to sue only a person who disclosed the information, not a person who received it.
They also noted that the restriction against divulging personally identifiable information applies only when an ordinary person would be able to identify a specific person’s watching behaviors. Digital identifiers like IP addresses, they wrote, are not covered under the VPPA.
Attorneys Douglas A. Campbell and Frederick D. Rapone of Campbell and Levine LLC in Pittsburgh were involved in the defense of this case. Attorneys from Kansas, Missouri, New Jersey, Illinois and Texas were also involved in the defense.