Robinson v. The Walt Disney Company, A delaware corporation
Filing
40
OPINION & ORDER re: 30 MOTION to Dismiss First Amended Complaint. filed by Disney Online. As alleged, the disclosures at issue here indicate only that a specific device somewhere was used by someone to watch specific videos. Id. Parag raph 13. An unrelated third party equipped with the information purportedly disclosed by Disney, and nothing more, could not identify Robinson. The third party would not know his name, his age, his gender, his social security number, his home address or any other information tantamount to a physical location, or any similar details that would enable it to identify Robinson as the specific person accessing specific videos on his specific Roku device. The somewhere and someone remain unknown until Adobe purportedly combines Disney's disclosure with other information collected from elsewhere. See Am. Compl. Paragraphs 27, 29, 55-57. Thus, Robinson's allegations, as measured against the definition of personally identifiable informatio n adopted by the Court, fail to show that he is entitled to relief. Accordingly, Robinson cannot make out a viable claim under the VPP A, and his Amended Complaint must be dismissed. In dismissing this action, the Court is sensitive to the policy imp lications posed by the increasing ubiquity of digital technologies, which, as Robinson ably alleges, have dramatically expanded the depth, range, and availability of detailed, highly personal consumer information. There is no doubt that the world of Roku devices, streaming video, and data analytics is a very different one from that of the physical video stores and tape rentals in which the VPP A was originally passed, and that, as the Yershov court noted, deciding VPPA cases today is thus akin t o placing "a square peg... into a round hole." 2015 WL 2340752, at *4. But while the Court recognizes the frustration of an individual such as Robinson-who seeks to keep his information private-whether it is personally identifying or not, t he VPP A as written, and even as amended in 2013, does not afford him, or those similarly situated, a remedy. For the reasons stated above, Disney's motion to dismiss is granted. The Clerk of Court is requested to terminate the motion pending at Dkt. 30 and close the case. SO ORDERED. (As further set forth within this Opinion.) (Signed by Judge Ronnie Abrams on 10/20/2015) (ajs)
UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF NEW YORK
USDC-SDNY
DOCUMENT
ELECTRO NI CALLY FILED
DOC#:
DATE FILED: 10/20/15
JAMES ROBINSON, individually and on
behalf of others similarly situated,
Plaintiff,
No. 14-CV-4146 (RA)
v.
OPINION & ORDER
DISNEY ONLINE D/B/A DISNEY
INTERACTIVE,
Defendant.
RONNIE ABRAMS, United States District Judge:
Plaintiff James Robinson brings this class action against Defendant Disney Online
("Disney"), alleging violations of the Video Privacy Protection Act (the "VPPA"), 18 U.S.C. §
2710. He claims that Disney unlawfully disclosed personally identifiable information ("PII")-the
encrypted serial number of the digital device he used to access Disney video content, as well as
his viewing history-to Adobe, a third-party data analytics company. Adobe purportedly
combined these disclosures with additional information gathered from other sources, and used this
composite data to identify Robinson and attribute his viewing history to him. Before the Court is
Disney's motion to dismiss Robinson's Amended Complaint pursuant to Fed. R. Civ. P. 12(b)(6).
For the reasons that follow, Disney's motion is granted.
BACKGROUND
Robinson's Amended Complaint concerns videos he purportedly viewed using a Roku, a
"digital media-streaming device that delivers videos, news, games, and other content to
consumers' televisions via the Internet." Am. Compl. (Dkt. 20) ~ 1 n.1. Through the Roku Channel
Store-an "online digital media platform"-Robinson downloaded the Disney Channel
application, which, once installed on his Roku, allowed him to view Disney's proprietary video
content. Id. ,-r,-r 9-10.
"Unbeknownst to its users," Robinson claims, "each time they use the Disney Channel to
watch videos or television shows, Disney discloses their personally identifiable informationincluding a record of every video clip viewed by the user ... to unrelated third parties." Id. ,-r 2;
see also id. ,-r 13. He further claims that this record is "sent each time that a user views a video
clip," and is accompanied by the "hashed serial number associated with the user's Roku device."
Id. ,-r 13. This hashed-or anonymized-serial number is "unique to a ... device and remain[ s]
constant for the lifetime of that device." Id. ,-r 18.
Disney, according to Robinson, programmed its Roku channel to send this information to
Adobe, a third-party data analytics company. See id. ,-r,-r 3, 13. Adobe, and companies like it,
purportedly maintain "massive digital dossiers on consumers" by aggregating consumer data
collected from an array of sources, including applications like the Disney Channel. See id. ,-r,-r 2229. Robinson claims that "Adobe has the capability to use" this aggregated data to "personally
identify ... users and associate their video viewing selections with a personalized profile in its
databases." Id. ,-r 29.
Robinson "downloaded and began using the Disney Channel on his Roku" device
beginning in December 2013. Id. ,-r 39. He claims that Disney disclosed the hashed serial number
of his device and his viewing history to Adobe without his consent, id. ,-r 40, and that this
information constitutes PII "in this context because it allows Adobe to identify users ... and to
attribute their video viewing records to their existing profiles,'' id. ,-r 56. He further alleges that
Adobe actually identified him and "attribute[d] his viewing choices to his profile" using the
2
information disclosed by Disney. Id. ~ 57. 1 Robinson argues that these disclosures amounted to
violations of the VPP A. Id. ~ 59. Disney argues otherwise, and seeks dismissal of Robinson's
Amended Complaint in its entirety. See Dkt. 30. The Court heard oral argument from the parties
on October 5, 2015.
LEGAL STANDARD
To survive a motion to dismiss under Fed. R. Civ. P. 12(b)(6), a pleading must contain "a
short and plain statement of the claim showing that the pleader is entitled to relief," Fed. R. Civ.
P. 8(a)(2), and be "plausible on its face," Bell At!. Corp v. Twombly, 550 U.S. 544, 570 (2007).
"A claim has facial plausibility when the plaintiff pleads factual content that allows the court to
draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcrofi v.
Iqbal, 556 U.S. 662, 678 (2009).
DISCUSSION
The VPPA prohibits a "video tape service provider" from "knowingly disclos[ing], to any
person, personally identifiable information concerning any consumer of such provider." 18 U.S.C.
§ 2710(b)(l). Its impetus was the publication in "a weekly newspaper in Washington" of a "profile
of Judge Robert H. Bork based on the titles of 146 films his family had rented from a video store."
Sen. Rep. 100-599, at 5 (1988).
As defined in the VPP A, a "video tape service provider" is "any person, engaged in the
business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded
1
The parties disagree about whether Robinson has adequately alleged that Adobe actually identified him.
Disney argues that this allegation-to the extent it is even made in the Amended Complaint-is conclusory and thus
insufficient to satisfy the pleading requirements of Fed. R. Civ. P. 8, while Robinson contends that in light of the
informational asymmetries in this case, as well as the publicly available information about Adobe's identification
capabilities documented in his Amended Complaint, he has sufficiently alleged actual identification. Even ifthe Court
were to resolve this dispute in Robinson's favor, however, his allegations would not be sufficient, as a matter of law,
to survive Disney's motion to dismiss. The Court thus assumes, for the purpose of deciding this motion, that Adobe
did actually identify Robinson.
3
video cassette tapes or similar audio visual materials," 18 U.S.C. § 2710(a)(4); a "consumer" is
"any renter, purchaser, or subscriber of goods or services from a video tape service provider,'' 18
U.S.C. § 2710(a)(l); and "personally identifiable information" ("PII") "includes information
which identifies a person as having requested or obtained specific video materials or services from
a video tape service provider,'' 18 U.S.C. § 271 O(a)(3). Disney contends that Robinson's VPPA
claim is statutorily precluded, both because he was not a consumer and because the information
Disney transmitted to Adobe was not PII. See Mem. (Dkt. 31) 7-10, 16-17. The Court declines to
address the former argument, as it concludes that the information Disney disclosed did not amount
to PII.
The precise scope of PII under the VPP A is difficult to discern from the face of the
statute-whether read in isolation or in its broader statutory context. As defined in Section
2710(a)(3), PII "includes information which identifies a person as having requested or obtained
specific video materials or services from a video tape service provider."
This language suggests that the information disclosed by a video tape service provider
must, at the very least, identify a particular person-not just an anonymous individual-and
connect this particular person with his or her viewing history. See In re Hulu Privacy Litig., 2014
WL 1724344, at *7 (N.D. Cal. Apr. 28, 2014) (defining PII as, in part, "information that identifies
a specific person and ties that person to particular videos that the person watched"). This
construction is consistent with the ordinary meaning of "a person," as well as the plain meaning
of the definition's final element, the requirement that the disclosed information identify "a person
as having requested or obtained specific video materials." 18 U.S.C. § 2710(a)(3). It is also
consistent with the VPPA's legislative history. As explained in the Senate Report issued in advance
of the statute's enactment, "personally identifiable information is intended to be transaction-
4
oriented. It is information that identifies a particular person as having engaged in a specific
transaction with a video tape service provider." Sen. Rep. 100-599, at 12 (emphasis added). The
use of "includes" in the statutory definition is not to the contrary. See id. ("[PII] is information ..
. .")(emphasis added)).
Less clear is the scope of information encompassed by PII, and how, precisely, this
information must identify a person. Importantly, Robinson does not argue that the information
disclosed by Disney-a "record of [his viewing] activities ... along with the hashed serial number
associated with [his] Roku device," Am. Compl.
~~
13, 42-constitutes PII in its own right.
Instead, he argues that the information constitutes PII because Adobe, the recipient of Disney's
disclosures, can identify him by "link[ing]" these disclosures with "existing personal information"
obtained elsewhere. See Am. Compl.
~~
27, 29; Opp. 8-10. Indeed, the Court assumes, for the
purposes of this motion, that Adobe has actually identified him in this manner. See infra note 1.
Disney responds that the VPP A is not targeted at what non-defendant third parties might do with
disclosures by video tape service providers, as PII is solely limited to information which, in and
of itself, identifies a person. See Mem. 7-10. Because the anonymized disclosures here do not
themselves identify a specific person, Disney contends, they are not prohibited. See id.
Robinson's theory of liability is not without support in the existing case law. Indeed,
Yershov v. Gannett Satellite Info. Network, Inc.,_ F. Supp. 3d _, 2015 WL 2340752 (D. Mass.
May 15, 2015), expressly rejects the view of PII urged by Disney. There, the District of
Massachusetts concluded that the disclosures at issue-the transmission of viewing records of the
USA Today application on an Android device, in addition to the "user's GPS coordinates and the
. . . device's unique identification number"-constituted PII despite requiring additional
information before Plaintiff was linked to his video history. Id. at *2, *6, *8. The majority of courts
5
to address this issue, however, have adopted a narrower definition of PII. See In re Nickelodeon
Consumer Privacy Litig., 2014 WL 3012873, at *10 (D.N.J. July 2, 2014) ("[PII is] information
which must, without more, itself link an actual person to actual video materials.); Ellis v. Cartoon
Network, Inc., 2014 WL 5023535, at *3 (N.D. Ga. Oct. 8, 2014), aff'd on other grounds, 2015 WL
5904760 (11th Cir. Oct. 9, 2015), (PII not disclosed where the third party to whom an Android ID
and viewing history were provided had to "collect information from other sources" to identify the
plaintiff); Locklear v Dow Jones & Co.,_ F. Supp. 3d _, 2015 WL 1730068, at *6 (N.D. Ga.
2015), abrogated on other grounds, 2015 WL 5904760 (11th Cir. Oct. 9, 2015), ("[A] Roku serial
number, without more, is not akin to identifying a particular person, and therefore, is not PII."
(quotations omitted)); Eichenberger v. ESPN, Inc., C14-463 (W.D. Wash. May 7, 2015)
(allegation that Adobe "used information gathered from other sources to link plaintiff's Roku
device serial number and the record of what videos were watched to plaintiff's identity" failed to
state a claim for disclosure of PII under the VPPA). The Court finds this latter, majority view,
more persuasive.
A discussion of Yershov is nevertheless instructive. The district court there began its
analysis with the premise, rooted in the statutory text, that "a consumer's name and address are
both PII, and ... that the universe of PII is greater than the consumer's name and address." 2015
WL 2340752, at *4 (analyzing Section 2710(b)(2)(D)'s exception to the general prohibition on the
disclosure of PII, pursuant to which such disclosures are permissible insofar as they consist "solely
of the names and addresses of consumers," among other requirements); accord Nickelodeon, 2014
WL 3012873, at *9 ("[N]ames and addresses are but a subset of PII."); Hulu, 2014 WL 1724344,
at * 11 ("The statute does not require a name."); Locklear, 2015 WL 1730068, at *4 ("[A] person
can be identified by more than just their name and address."). The Court agrees with the Yershov
6
court that names and addresses are PII for the purposes of the VPP A, and that PII, in this statutory
context, includes more than just names and addresses; it would be difficult to read the language of
the statute otherwise. Neither party disputes this premise.
The question for the Court is whether this premise necessarily leads to the Yershov court's
conclusion that information can amount to PII even when it does not, on its own, identify a specific
person. As a practical matter, it is surely right-or at least often so-that addresses and even names
"cannot be linked to a specific person without access to certain additional information." 2015 WL
2340752, at *6. Which John Smith, or which Main Street, among thousands? And there is,
undoubtedly, an intuitive appeal to the Yershov court's conclusion that it would thus be "unrealistic
to refer to PII as information which must, without more, itself link an actual person to actual video
materials." Id. at *8. As that court stated, defining PII so narrowly would "preclude a finding that
home addresses ... are PII," and thus conflict with the VPPA's plain statutory language. Id. at *6.
But in the end, this conclusion is at odds with the VPPA's particularized definition of PII
and is overly expansive. If nearly any piece of information can, with enough effort on behalf of
the recipient, be combined with other information so as to identify a person, then the scope of PII
would be limitless. Accord Nickelodeon, 2014 WL 3012873, at
* 11
("Certainly, this type of
information might one day serve as the basis of personal identification after some effort on the part
of the recipient, but the same could be said for nearly any type of personal information.").
Whatever the impact of modern digital technologies on the manner in which personal information
is shared, stored, and understood by third parties like Adobe, the Court cannot ascribe such an
expansive intent to Congress in enacting the VPP A. It would render meaningless the requirement
that the information identify a specific person as having rented or watched specific videos, as all
information would, with some work, be identifying, and would transmute a statute focused on
7
disclosure of specific information to one principally concerned with what third parties might
conceivably be able to do with far more limited disclosures. 2
It is true, of course, that liability would not be imposed on providers like Disney unless
they also knew that the information disclosed was personally identifying, see 18 U.S.C. §
2710(a)(3), but this knowledge requirement would not operate as any real limitation on liability;
if virtually all information can, in the end, be identifying, it is hard to conceive of a case in which
a disclosure would not be considered knowing. Other limiting principles might plausibly be read
into the VPPA to address the concern of overbreadth. For instance, information might constitute
PII only if the third-party recipient has the ability, at the moment of disclosure (and not just
theoretically), to combine it with other information and identify the underlying consumer. But such
a principle would necessarily either read into the VPP A a requirement that providers not only know
the nature of the information actually disclosed by them, but also know the informational
capabilities of any third-party recipient, or, to the extent "knowing" is limited to knowledge of
disclosure, hold providers liable even where the ability of third-party recipients to compile
identifying information was unknown to them. Both constructions are unsupported by the statutory
text.
Indeed, the most natural reading of PII suggests that it is the information actually
"disclos[ed]" by a "video tape service provider," 18 U.S.C. § 2710(b)(l), which must itself do the
identifying that is relevant for purposes of the VPP A (literally, "information which identifies")not information disclosed by a provider, plus other pieces of information collected elsewhere by
2
Plaintiffs contention, at oral argument, that hashed serial numbers are, like names or social security
numbers, just randomized strings of numbers and/or letters, similarly goes too far. Plaintiffs argument merely
demonstrates what should already be obvious: Much of human language is symbolic, communicated through systems
ofletters and numbers. But such a generalized principle is not particularly useful in determining what PII-a statutorily
defined term-means in this context.
8
non-defendant third parties. This is the argument urged by Disney, and it is the definition of PII
that this Court now adopts. PII is information which itself identifies a particular person as having
accessed specific video materials.
That names and addresses are expressly included within the definition of PII, as is clear
from the face of the VPPA, see 28 U.S.C. § 2710(b)(2)(D), does not foreclose this construction,
even recognizing that names and addresses may, as the Yershov court noted, require additional
information before they identify specific people. Instead, the inclusion of names and addresses as
examples of PII in the VPP A suggests that Congress considered names and addresses to be
sufficiently identifying without more. That is, a stronger reading of the VPP A suggests that these
pieces of information are per se identifying such that their knowing disclosure amounts to a
violation of the statute.
Nor is the Court's reading foreclosed by the VPPA's use of the word "includes" in the
statutory definition of PII. The Senate Report accompanying the VPP A, which notes that
"paragraph (a)(3) uses the word 'includes' to establish a minimum, but not exclusive, definition of
personally identifiable information," makes clear that "includes" is used not to suggest that PII
encompasses more than "information which identifies a person as having requested ... specific
video materials," but instead to signal that PII must, at the very least, "identif[y] a particular person
as having engaged in a specific transaction." Sen. Rep. 100-599, at 11-12. To be PII, information
must identify a specific person and must tie this person to specific video materials; it can do no
less, but the scope of what constitutes PII is not otherwise limited.
None of which is to say that context is irrelevant. Context may matter, for instance, to the
extent other information disclosed by the provider permits a "mutual understanding that there has
been a disclosure" of PII. In re Hulu Privacy Litig., 86 F. Supp. 3d 1090, 1097 (N.D. Cal. 2015).
9
Thus, as the Hulu court concluded, although "a unique anonymized ID alone is not PII ... context
could render it not anonymous and the equivalent of the identification of a specific person";"[ o ]ne
could not skirt liability under the VPPA ... by disclosing a unique identifier and a correlated lookup table." 2014 WL 172344, at *11. 3 Disney could not disclose the information at issue here, along
with a code that enabled Adobe to decrypt the hashed serial number and other information
necessary to determine the specific device's user, and still evade liability. But recognizing that
context matters-and that a third-party recipient needs to know the import or nature of the
information it receives for that information to have meaning-is not the same as concluding that
information which is not otherwise PII can somehow become PII because of the potential, however
remote, of a third party to "reverse engineer" a disclosure using data gathered from other sources.
Pruitt v. Comcast Cable Holdings, LLC, 100 F. App'x 713 (10th Cir. 2004), on which
Robinson relies, see Opp. 17, does not suggest otherwise. In Pruitt, current and former Comcast
cable subscribers alleged that Comcast had violated the 1984 Cable Communications Privacy Act
("Cable Act"), 47 U.S.C. § 551, et. seq., by retaining personally identifiable information in its
cable boxes, namely, unique anonymous IDs. See 100 F. App'x at 715-17. They also argued that
Comcast could "identify a customer's viewing habits by connecting the coded information with its
billing or management system." Id. at 716. The district court rejected the first theory of liability,
as did the Tenth Circuit on appeal, holding that "[ w ]ithout the information in the billing or
management system one cannot connect the unit address with a specific customer; without the
3
The Hutu court's discussion of"context" is consistent with the agency regulations implementing The Family
Educational Rights and Privacy Act of 1974 (FERPA), which bars, in part, the disclosure of PII in educational records.
Pursuant to these regulations, PII includes a range of so-called "personal identifiers," such as a student's social security
number or biometric record, as well as "other information that, alone or in combination, is linked or linkable to a
specific student that would allow a reasonable person in the school community, who does not have personal knowledge
of the relevant circumstances, to identify the student with reasonable certainty." 34 C.F.R. § 99.3. Thus, the regulations
are only concerned with the content of disclosures actually made by the educational provider-and are concerned with
context only to the extent that multiple pieces of information disclosed by a provider, none of which themselves
amount to PII, could, when combined with one another, prove identifying.
10
billing information, even Comcast would be unable to identify which individual household was
associated with the raw data in the converter box." Id. And because plaintiffs had not alleged "that
the retention of data in the billing or management systems violates the Cable Act," the Circuit
declined to reach the second theory-that on which Robinson relies-altogether. Id. at 717.
Even assuming the Tenth Circuit had endorsed this second theory, however, Pruitt does
not stand for the proposition that unique, anonymous IDs, when disclosed to third-parties, become
PII. It merely reaffirms the Hulu court's suggestion, discussed above, that "[o]ne could not skirt
liability under the VPPA, for example, by disclosing a unique identifier and a correlated look-up
table." 2014 WL 1724 344, at * 11. In Pruitt, Comcast controlled both the information stored in the
cable boxes and the correlated information in its billing system. See 100 F. App'x at 715. Because
the Cable Act prohibits storage of PII, and Comcast possessed within its internal systems both a
unique identifier and a look-up table, it may well have been liable had plaintiffs properly alleged
that theory. But the VPP A, as noted, is concerned with disclosure, and while Disney did disclose
encrypted device serial numbers, it did not disclose a correlated decryption table or other
identifying information.
The definition of PII the Court hereby adopts readily distinguishes between names and
addresses, on the one hand, and an anonymized device serial number, on the other. If PII is
information which must itself identify a particular person as having viewed specific video
materials, the primary question for the reviewing court is whether the challenged disclosure
similarly identifies a person. Whereas names and addresses, as a statutory matter, do identify a
specific person, the anonymized Roku serial number at issue here does not; it identifies a specific
device, and nothing more. In light of the Court's conclusion regarding the definition and scope of
PII, Disney's liability turns only on whether the information it disclosed itself identified a specific
11
person. It did not. Thus, Adobe's ability to identify Robinson by linking this disclosure with other
information is of little significance.
Finally, Robinson has not alleged that the hashed serial number of his Roku device amounts
to a geographic identifier. See Am. Com pl.
~
13. It is thus unlike a home address, which ties a
specific person to a specific place. Nor is the information disclosed by Disney equivalent to a
Facebook ID. A "Facebook user-even one using a nickname-generally is an identified person
on a social network platform." Hulu, 2014 WL 1724344, at* 14. A Facebook ID, as the Hulu court
found, is thus equivalent to a name-it stands in for a specific person, unlike a device identifier.
See id. Disney has also not disclosed a "correlated look-up table" that would enable Adobe to link
the hashed serial number of Robinson's Roku device and his viewing choices to his identity.
Instead, as Robinson himself alleges, it is Adobe, not Disney, which has purportedly assembled
the equivalent of a "look-up table"-with information obtained from third-party sources, including
Roku. See Am. Compl.
~~
22-29. This is insufficient to constitute a violation of the VPP A.
CONCLUSION
As alleged, the disclosures at issue here indicate only that a specific device somewhere was
used by someone to watch specific videos. Id.
~
13. An unrelated third party equipped with the
information purportedly disclosed by Disney, and nothing more, could not identify Robinson. The
third party would not know his name, his age, his gender, his social security number, his home
address or any other information tantamount to a physical location, or any similar details that
would enable it to identify Robinson as the specific person accessing specific videos on his specific
Roku device. The somewhere and someone remain unknown until Adobe purportedly combines
Disney's disclosure with other information collected from elsewhere. See Am. Compl.
~~
27, 29,
55-57. Thus, Robinson's allegations, as measured against the definition of personally identifiable
12
information adopted by the Court, fail to show that he is entitled to relief. Accordingly, Robinson
cannot make out a viable claim under the VPP A, and his Amended Complaint must be dismissed.
In dismissing this action, the Court is sensitive to the policy implications posed by the
increasing ubiquity of digital technologies, which, as Robinson ably alleges, have dramatically
expanded the depth, range, and availability of detailed, highly personal consumer information.
There is no doubt that the world of Roku devices, streaming video, and data analytics is a very
different one from that of the physical video stores and tape rentals in which the VPP A was
originally passed, and that, as the Yershov court noted, deciding VPPA cases today is thus akin to
placing "a square peg ... into a round hole." 2015 WL 2340752, at *4. But while the Court
recognizes the frustration of an individual such as Robinson-who seeks to keep his information
private-whether it is personally identifying or not, the VPP A as written, and even as amended in
2013, does not afford him, or those similarly situated, a remedy.
For the reasons stated above, Disney's motion to dismiss is granted. The Clerk of Court is
requested to terminate the motion pending at Dkt. 30 and close the case.
SO ORDERED.
Dated:
October 20, 2015
New York, New York
United States District Judge
13
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?