Neil Richards writes:
The House of Representatives recently passed an amendment to a fairly obscure a law known as the Video Privacy Protection Act. This law protects the privacy of our video rental records.
[…]
Industry groups are fond of saying that good privacy practices require consumer notice and consumer choice. The current Video Privacy Act is one of the few laws that does give consumers meaningful choice about protecting their sensitive personal information. Now is not the time to cut back on the VPPA’s protections. Now is the time to extend its protections to the whole range of intellectual records – the books we buy, our internet search histories, and ISP logs of what we read on the Internet. As a first step, we should reject this attempt to eviscerate our intellectual privacy.
Read his full commentary on Concurring Opinions.
While I agree with Neil that we need to extend protections in the ways he describes, I’m not sure that we should be preventing sharing for those who don’t want such protections. What do we say to someone who says, “Hell yeah, I want to share everything I rent from Netflix with all my friends on Facebook.” Why not allow them to read a notice that explains what that means, who might see it, and how it might be retained and archived, and then let them choose to share automatically if they want to? Does amending VPPA weaken the protections for those of us who are more privacy protective? If not, what skin is it off our teeth to let others share?
The current law reads, in part:
(b) Video Tape Rental and Sale Records.—
(1) A video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person for the relief provided in subsection (d).
(2) A video tape service provider may disclose personally identifiable information concerning any consumer—
(A) to the consumer;
(B) to any person with the informed, written consent of the consumer given at the time the disclosure is sought;
The bill passed by the House and sent to the Senate would replace (B) with:
(B) to any person with the informed, written consent (including through an electronic means using the Internet) in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer given at one or both of the following times–
(i) the time the disclosure is sought; and
(ii) in advance for a set period of time or until consent is withdrawn by such consumer; .
Are there risks that people might misunderstand any consent notice and wind up sharing information they didn’t intend to share? Yes.
Are there risks that a glitch in a platform like Facebook might suddenly make the information more widely available than the individual consented to? Yes.
Does such sharing make it easy for the government to gather information about you for possible prosecution or as part of any investigation? Yes.
Are there other risks of possible embarrassment to individuals or consequences if potential employers check their publicly available information? Yes.
But is it Congress’s job to protect individuals from their own decisions on this? I don’t think so.
As long as the law doesn’t weaken my protections for intellectual privacy, I’m fine with letting others decide whether they want to routinely share information. I think some may regret any such decision, but I am not my brother’s video rentals keeper. As long as the default is “no sharing” and there is clear and separate notice and consent required in plain language, this is not an amendment that I think really needs to be fought.
If Neil thinks that amending the law actually weakens protections for those of who are privacy protective, I hope he’ll expand on his thoughts and explain what risk he sees.