The US has unusually strict privacy protections to video rental records. This can be traced back to the confirmation hearings of Supreme Court nominee Robert Bork, during which a reporter obtained copies of Bork’s video rental records. Though the rentals were innocuous, the incident frightened Congress enough to pass the 1988 Video Privacy Protection Act (VPPA), which requires written consent from consumers before video rental records could be shared.
What is the VPPA?
The Video Privacy Protection Act of 1988 (Public Law 100-618) limits the disclosure of personally identifiable information regarding video rentals. It represents one of the strongest consumer privacy protections in federal law – even stronger than those for health records under HIPAA.
The VPPA defines “personally identifiable information” as that which “identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” A “video tape service provider” is “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale or delivery of prerecorded video cassette tapes or similar audiovisual materials.”
Video tape service providers may disclose personally identifiable information only:
- To the consumer himself/herself
- To any other person, with the written consent of the consumer
- To any other person, if this disclosure is simply of names and addresses and:
- The consumer has been provided with an opportunity to opt-out and
- The disclosure does not identify title, description or subject matter (though subject matter may be disclosed “for the exclusive use of marketing goods and services to the consumer”)
- To any other person, if in the ordinary course of business
- To a law enforcement agency, pursuant to a federal or state warrant, a grand jury subpoena, or a court order, provided that:
- The consumer is provided with prior notice and
- There is a showing of probable cause to believe that the records are relevant to a legitimate law enforcement enquiry
- Pursuant to a court order in a civil proceeding, upon showing of a compelling need, provided
- The consumer is given reasonable notice and
- Afforded the opportunity to contest the request
Responses to the Act
It’s important to note that the VPPA is very rarely applied; however, it represents one of the strongest protections of consumer privacy against a specific form of data collection. In general, it prevents disclosure of personally identifiable rental records of video cassette tapes or similar audio visual material, but beyond that it has several important provisions, including:
- A general ban on the disclosure of personally identifiable rental information unless the consumer consents specifically and in writing.
- Disclosure to police officers only with a valid warrant or court order.
- Disclosure of “genre preferences” along with names and addresses for marketing, but allowing customers to opt out.
- Exclusion of evidence acquired in violation of the VPPA.
- Civil remedies, including possible punitive damages and attorneys’ fees, not less than $2500.
- A requirement that video stores destroy rental records no longer than one year after an account is terminated.
- The VPPA does not preempt state law. This means that states are free to enact broader protections for individuals’ records.
Updates to allow online sharing
In December 2011, the House of Representatives passed legislation updating the VPPA in order to facilitate online rental services – such as Netflix – to share information about customers’ viewing habits with user consent. Previously, the law required written consent to share video records, however the new law allows companies to obtain consent over the web.
Specifically, it would amend the VPPA’s consent provision to allow the disclosure of video rental records:
to any person with the informed, written consent (including through an electronic means using the Internet) in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer given at one or both of the following times –
i. the time the disclosure is sought; and
ii. in advance for a set period of time or until consent is withdrawn by such consumer.
The legislation was sponsored by Rep. Bob Goodlatte (R-VA) and updates the VPPA to allow users to consent to video sharing over the web. It also allows users to consent once to all future sharing. These adjustments were criticized by Marc Rotenberg, president of the Electronic Privacy Information Center (EPIC).
This article takes a look at the Video Privacy Protection Act of 1988 (VPPA), which limits the disclosure of personally identifiable information regarding video rentals. It represents one of the strongest consumer privacy protections in federal law and was passed as a response to the disclosure of Supreme Court nominee Robert Bork’s video rental records during his confirmation hearings.
CIPP Exam Preparation
In preparation for the Certified Information Privacy Professional/United States (CIPP/US) exam, a privacy professional should be comfortable with topics related to this post, including:
- Video Privacy Protection Act of 1988 (II.E.f.)