    [Senate Hearing 112-869]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 112-869

    THE VIDEO PRIVACY PROTECTION ACT: PROTECTING VIEWER PRIVACY IN THE 21ST
                                    CENTURY

    =======================================================================

                                    HEARING

                                   before the

                            SUBCOMMITTEE ON PRIVACY,
                             TECHNOLOGY AND THE LAW

                                     of the

                           COMMITTEE ON THE JUDICIARY
                              UNITED STATES SENATE

                          ONE HUNDRED TWELFTH CONGRESS

                                 SECOND SESSION

                                   __________

                                JANUARY 31, 2012

                                   __________

                              Serial No. J-112-59

                                   __________

             Printed for the use of the Committee on the Judiciary

                      U.S. GOVERNMENT PRINTING OFFICE
    87-342                    WASHINGTON : 2012
    -----------------------------------------------------------------------
    For sale by the Superintendent of Documents, U.S. Government Printing Office,
    http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, U.S. Government Printing Office. Phone 202�09512�091800, or 866�09512�091800 (toll-free). E-mail, gpo@custhelp.com.

                           COMMITTEE ON THE JUDICIARY

                      PATRICK J. LEAHY, Vermont, Chairman
    HERB KOHL, Wisconsin                 CHUCK GRASSLEY, Iowa
    DIANNE FEINSTEIN, California         ORRIN G. HATCH, Utah
    CHUCK SCHUMER, New York              JON KYL, Arizona
    DICK DURBIN, Illinois                JEFF SESSIONS, Alabama
    SHELDON WHITEHOUSE, Rhode Island     LINDSEY GRAHAM, South Carolina
    AMY KLOBUCHAR, Minnesota             JOHN CORNYN, Texas
    AL FRANKEN, Minnesota                MICHAEL S. LEE, Utah
    CHRISTOPHER A. COONS, Delaware       TOM COBURN, Oklahoma
    RICHARD BLUMENTHAL, Connecticut
                Bruce A. Cohen, Chief Counsel and Staff Director
            Kolan Davis, Republican Chief Counsel and Staff Director
                                     ------

                Subcommittee on Privacy, Technology and the Law

                        AL FRANKEN, Minnesota, Chairman
    CHUCK SCHUMER, New York              TOM COBURN, Oklahoma
    SHELDON WHITEHOUSE, Rhode Island     ORRIN G. HATCH, Utah
    RICHARD BLUMENTHAL, Connecticut      LINDSEY GRAHAM, South Carolina
                    Alvaro Bedoya, Democratic Chief Counsel
                    Elizabeth Hays, Republican Chief Counsel

                                C O N T E N T S

                                  ----------

                        STATEMENTS OF COMMITTEE MEMBERS

                                                                       Page

    Franken, Hon. Al, a U.S. Senator from the State of Minnesota.....     1
    Coburn, Hon. Tom, a U.S. Senator from the State of Oklahoma......     4
    Leahy, Hon. Patrick J., a U.S. Senator from the State of Vermont.     7
        prepared statement...........................................    28

                                   WITNESSES

    Watt, Melvin L., a Representative in Congress from the State of
      North Carolina.................................................     4
        prepared statement...........................................    30
    Hyman, David, General Counsel, Netflix, Inc., Los Gatos,
      California.....................................................    10
        prepared statement...........................................    42
    McGeveran, William, Professor, University of Minnesota Law
      School, Minneapolis, Minnesota.................................    11
        prepared statement...........................................    45
    Rotenberg, Marc, Executive Director, Electronic Privacy
      Information Center, Washington, DC.............................    13
        prepared statement...........................................    51
    Wolf, Christopher, Director, Privacy and Information Management
      Group, Hogan Lovells LLP, Washington, DC.......................    15
        prepared statement...........................................    63

                                   QUESTIONS

    Questions for William McGeveran submitted by Senator Al Franken..    68
    Questions for Marc Rotenberg submitted by Senator Al Franken.....    69
    Questions for David Hyman submitted by Senator Tom Coburn........    70
    Questions for Christopher Wolf submitted by Senator Tom Coburn...    72

                             QUESTIONS AND ANSWERS

    Statement of no response for William McGeveran and Marc Rotenberg    73
    Responses of David Hyman to questions submitted by Senator Coburn    74
    Responses of Christopher Wolf to questions submitted by Senator
      Coburn.........................................................    81

                           SUBMISSIONS FOR THE RECORD

    American Civil Liberties Union, Laura W. Murphy, Director,
      Washington Legislative Office and Christopher Calabrese,
      Legislative Counsel, Washington, DC, January 31, 2012, joint
      letter.........................................................    85
    Entertainment Merchants Association, Crossan R. Andersen,
      President & CEO, Encino, California, December 13, 2011, letter.    90

    THE VIDEO PRIVACY PROTECTION ACT: PROTECTING VIEWER PRIVACY IN THE 21ST
                                    CENTURY

                                  ----------

                           TUESDAY, JANUARY 31, 2012

                                           U.S. Senate,
              Subcommittee on Privacy, Technology, and the Law,
                                    Committee on the Judiciary,
                                                        Washington, DC.
        The Subcommittee met, pursuant to notice, at 10:02 a.m., in
    Room SD-226, Dirksen Senate Office Building, Hon. Al Franken,
    Chairman of the Subcommittee, presiding.
        Present: Senators Franken, Leahy, and Coburn.

     OPENING STATEMENT OF HON. AL FRANKEN, A U.S. SENATOR FROM THE
                           STATE OF MINNESOTA

        Senator Franken. This hearing will come to order. It is my
    pleasure to welcome all of you to the third hearing of the
    Senate Judiciary Subcommittee on Privacy, Technology, and the
    Law.
        Now, before we start, I just want to applaud the Supreme
    Court for its decision in the Jones case. It was, I believe,
    the right result, but it was also a call to action to Congress
    because, while law enforcement now needs a warrant to track
    your location, all of the companies that get your location
    information almost every day--your smartphone company, your in-
    car navigation company, and even the apps on your phone--are
    still in most cases free to give out your location to whomever
    they want, as long as it is not the Government. I have a bill
    to fix that, and I think we need to take action on it right
    away.
        But today's hearing will focus on the Video Privacy
    Protection Act, a powerful privacy law that was written and
    passed by Chairman Leahy and Ranking Member Grassley of the
    full Judiciary Committee. I want to use this hearing to make
    sure that everyone knows what the Video Privacy Protection Act
    is and how it protects our privacy and our civil liberties. I
    want to look at how we might update the Video Privacy
    Protection Act for the 21st century, and I want to look at a
    specific bill to amend the law that was just passed in the
    House.
        Twenty-five years ago, Judge Robert Bork was before the
    full Senate Judiciary Committee as a nominee to the Supreme
    Court. During that hearing, a local reporter asked Judge Bork's
    video store for a record of the movies he had watched. There
    was no law against it, so the video store gave him the records,
    and the reporter wrote a story about them. The Senate Judiciary
    Committee was split on Judge Bork's nomination, but it was
    unanimous in its outrage over what had happened. There was not
    anything particularly memorable about Judge Bork's movie
    rentals. In fact, they consisted primarily of mysteries and
    caper films. But that was not the point. The point was that the
    movies we choose to watch are our business and not anyone
    else's.
        Soon after this, Senator Leahy and Senator Grassley
    introduced the Video Privacy Protection Act. The bill was
    reported out of the Committee unanimously and passed through
    the Senate and the House on voice votes.
        There has been renewed interest in the Video Privacy
    Protection Act in recent months, and I think that is great. But
    I have seen a lot of people talking about the law like it was
    some kind of relic, something that is so outdated that it does
    not make any sense anymore. So I want to take a moment to
    explain in simple terms what this law does for consumers.
        Thanks to the Video Privacy Protection Act, your video
    company cannot tell other people what you are watching unless
    you give them permission to do that. Now, when Chairman Leahy
    and Senator Grassley wrote the law, they were really smart
    about it, if I might say. They did not just say that a video
    company has to at some point get you to sign some form that
    says, ``I am OK with you telling people what I watch.'' No.
    They said that every time a video company wants to tell people
    what you watch, they have to check with you first. And that is
    an important right, because you probably do not care if people
    know that you watched some summer blockbuster. But if you are
    suddenly having trouble with your marriage and you are trying
    to get help, you might not want your friends and relatives to
    find out that you have been watching videos about marriage
    counseling or divorce. I also think that parents of a young
    child may want to watch documentaries about autism or
    developmental disabilities without broadcasting that to the
    world.
        This can be really sensitive stuff, and that is why the
    Video Privacy Protection Act is so important. It gives you the
    right to tell your video company what can be shared and what
    cannot.
        The Video Privacy Protection Act also protects your private
    sector against the government. Under the law, if the government
    wants to get your viewing records, it has to get a warrant, a
    grand jury subpoena, or a court order. This came up in one
    famous case where a local police department thought that the
    1979 movie ``The Tin Drum'' was obscene. Now, mind you, this
    was a movie about what happened in Nazi Germany just before
    World War II. It won an Oscar for best foreign film. But the
    police department went out and seized a list of everyone who
    had the movie and then drove around confiscating every copy.
    And in that case, the ACLU chapter in the Ranking Member's
    State of Oklahoma used the Video Privacy Protection Act to stop
    that.
        And so, without objection, I will add to the record a
    letter from the American Civil Liberties Union that stresses
    that this is a civil liberties law, too, not just a consumer
    protection law.
        [The letter appears as a submission for the record.]
        Senator Franken. The Video Privacy Protection Act also
    makes sure that video companies do not keep information about
    what you have watched after that information is no longer
    needed. This protects that information from getting lost,
    stolen, or hacked.
        Finally, the law gives people the right to have their day
    in court to defend their rights if a video company or the
    government violates these rights.
        So the Video Privacy Protection Act is a really important
    law for consumer privacy and for civil liberties, but things do
    change in a quarter century, and I am calling this hearing to
    see if we can update the law so that it can protect our privacy
    for another 25 years.
        One way we need to update this law is to make sure that it
    is keeping up with technology. It used to be that if you wanted
    to watch a video, you had to go to the video store or then wait
    for it in the mail after that. Now you can stream it directly
    to your computer in seconds. Streaming is the future of video,
    but no judge has ever decided whether or not the Video Privacy
    Protection Act covers streaming video companies. I think it is
    clear that the law does cover new technologies like streaming
    because it does not just cover ``prerecorded video cassette
    tapes.'' It also covers ``similar audio-visual materials.''
        But I do think there is a real risk that a judge might look
    at this law and say it does not cover streaming, it just covers
    DVDs and VHS tapes and things like that. So I do not want to
    leave the future of video privacy up to a judge. So if we are
    updating the Video Privacy Protection Act, I think we need to
    confirm that it covers video streaming technology. I also know
    that the courts are split about whether or not people have the
    right to enforce the data retention provision. That might need
    to be clarified as well.
        Those are just two ideas. I am sure the witnesses will have
    other suggestions. My goal here is to lay the groundwork for a
    fair and comprehensive update of the entirety of this law.
        Before I close, I want to touch on H.R. 2471, a recently
    passed House bill that would modify one aspect of the Video
    Privacy Protection Act. H.R. 2471 lets a video company ask for
    your consent just once up front to disclose the videos you
    watch instead of asking for consent on a case-by-case basis.
    Netflix has strongly supported this bill and has explained that
    it will make it easier for them to integrate into social media
    sites like Facebook. I am pleased to report that Netflix is
    here with us today to talk about their support.
        I want to be honest. Based on what I have seen so far, I
    have some reservations about H.R. 2471. First, it looks like
    the bill will basically undo users' ability to give case-by-
    case permission to a video company on what it can tell people
    and what it cannot. And that worries me because case-by-case
    consent, I believe, is a really good thing. It is a really good
    thing that people can easily tell their video company, ``Sure,
    go ahead and tell people I watched `The Godfather,' but, no, do
    not tell them I watched `Yoga for Health, Depression, and
    Gastrointestinal Problems.' ''
        Senator Coburn. Is that one of----
        Senator Franken. Yes, for the record, that is a real title
    in the Netflix catalogue. And, by the way, it is an excellent
    film.
        [Laughter.]
        Senator Franken. So I am worried that H.R. 2471 will
    eliminate our ability to give case-by-case consent, but I am
    also worried that this bill will make these changes without
    confirming that streaming is covered or doing anything else to
    strengthen the law for consumers.
        Finally, I want to know how this bill will affect the Video
    Privacy Protection Act's protections against government
    snooping into our video records. But I am here to listen and to
    learn more about this, and this is a hearing on all proposals
    to update the Video Privacy Protection Act, not just H.R. 2471.
    And we have two great panels for that, but before I introduce
    them--do you want me to go to the Chairman first?
        Chairman Leahy. I tell you what. We have Senator Coburn
    here, and my----
        Senator Coburn. I am happy to yield to the Chairman.
        Chairman Leahy. No, no. I will yield to you and also to--I
    know Congressman Watt, who has been such a leader in this, has
    to get back to matters in the House, so I will wait until after
    he has testified and, of course, I will follow the rest of you.
        Senator Franken. We will go to the Ranking Member, Senator
    Coburn, for his remarks. Thank you, Senator.

    STATEMENT OF HON. TOM COBURN, A U.S. SENATOR FROM THE STATE OF
                                OKLAHOMA

        Senator Coburn. Mr. Chairman, thank you. I believe the
    Video Privacy Protection Act has become antiquated given all
    the new technology that is out there, and I would just note
    that you right now can share your music preferences through
    Spotify by setting up one time. You can share your book
    preferences by signing up one time. You can share your
    television programs through Hulu by signing up one time and
    news articles through Social Reader by signing up one time.
        I think the Chairman of the Subcommittee makes some good
    points, and I am anxious to hear Congressman Watt and his
    thoughts on this. I did have a chance to talk to your Ranking
    Member yesterday and hear his input in it, and I look forward
    to the input.
        Thank you, Mr. Chairman.
        Senator Franken. Thank you to the Ranking Member.
        I think we will go to our first witness. That is what the
    Chairman would like, and what the Chairman would like, the
    Chairman gets. Our first witness is Hon. Melvin L. Watt, the
    distinguished Representative for North Carolina's 12th
    District. He has represented the people of the 12th District
    since 1992. Representative Watt serves on the House Judiciary
    Committee where he is the Ranking Member on the Subcommittee on
    Intellectual Property, Competition, and the Internet. Prior to
    his election to the House of Representatives, Representative
    Watt practiced civil rights law for more than two decades. He
    received his J.D. from Yale School and his B.S. from the
    University of North Carolina.
        Representative Watt, welcome, and the floor is all yours.

    STATEMENT OF HON. MELVIN L. WATT, A REPRESENTATIVE IN CONGRESS
                    FROM THE STATE OF NORTH CAROLINA

        Representative Watt. Thank you, Chairman Franken, Ranking
    Member Coburn, Senator Leahy, and Members of the Subcommittee.
    I am truly honored to have this opportunity to address the
    Subcommittee about the amendments proposed in H.R. 2471 to the
    Video Privacy Protection Act and consumer privacy in this
    rapidly evolving Digital Age.
        While I am the Ranking Member of the House Judiciary
    Committee's Subcommittee on Intellectual Property, Competition,
    and the Internet, the views I express here today are my
    individual views, and I do not speak for the Committee or the
    Subcommittee.
        I believe there are countless reasons to oppose H.R. 2471,
    which relate both to what the bill does and what it does not do
    and how that fits into the broader debate about how best to
    protect individual privacy in the volatile online environment.
        It is particularly timely that the Subcommittee holds this
    hearing today. Although online privacy has been at the
    forefront of discussion for the past few years, there has been
    a recent flurry of more intense discussion that I believe makes
    your hearing timely. Business leaders, consumer advocates,
    State and local elected representatives, and officials from
    each branch of the Federal Government have all weighed in with
    a variety of concerns and proposed solutions to address the
    absence of a uniform framework or approach to safeguard
    individual information in the thriving online environment.
        Attention has appropriately intensified as two Internet
    giants, Facebook and Google, have come under scrutiny for their
    data uses, policies, and practices. Likewise, Netflix, the main
    proponent of this bill, has had more than its fair share of
    regulatory complaints and consumer lawsuits with regard to the
    handling of user information.
        In the coming weeks, both the FTC and the Department of
    Commerce are expected to issue long-anticipated final reports
    on online privacy policy based on a series of roundtable
    discussions with relevant stakeholders and following up on
    their initial studies in 2010.
        Senators Kerry and McCain in the Senate and Representative
    Cliff Stearns in the House last year introduced comprehensive
    legislation designed to prescribe standards for the collection,
    storage, use, retention, and dissemination of users' personally
    identifiable information, and these bills generated debate more
    generally in the halls of Congress.
        This Subcommittee also held hearings to address the
    security of sensitive health records and personal privacy on
    mobile devices, and last week, in deciding whether GPS tracking
    violates a criminal defendant's Fourth Amendment right against
    unreasonable search and seizure, a majority of the Justices of
    the Supreme Court acknowledged the challenges we confront as a
    society in determining the so-called new normal for privacy
    expectations in the Digital Age.
        Against this backdrop, I will direct the remainder of my
    comments to H.R. 2471, which passed the House under suspension
    of the rules. While I may not always avail myself of all the
    new technology and revolutionary tools and services available
    over the Internet, let me say at the outset that I applaud the
    explosion of technological advances that has transformed
    forever the way we communicate and transact business. While I
    support innovation on the Web, however, I cannot do so at the
    expense of individual privacy. Given the gravity of issues
    involved, I believe it was a mistake for this bill to move
    through the House under the radar and without the benefit of a
    single hearing. But my concerns are not just about process. I
    believe that H.R. 2471 would have unintended negative
    consequences for consumers as well as affected businesses that
    will undoubtedly lose the confidence of their subscribers with
    the first privacy violation or data breach. Consumer desire to
    have access to the next cool tool should not be mistaken for
    the voluntary surrender of fundamental privacy interests.
        In addition to the lack of thoughtful process in the House,
    I believe there are at least four substantive problems with
    H.R. 2471.
        First, the bill leaves unaddressed the question of who the
    bill applies to, which I believe creates collateral, but
    important, intellectual property enforcement concerns. By
    declining to define what constitutes a videotape service
    provider under the VPPA, H.R. 2471 leaves open the possibility
    that businesses that provide video on demand over the Internet
    or those with dual distribution platforms like Netflix can
    avoid or delay compliance with legitimate discovery requests in
    copyright infringement actions.
        Second, the debate on H.R. 2471 centered on the online
    experiences of consumers with social media like Facebook.
    However, the bill as passed applies to physical and online
    videotape service providers alike, and disclosures are
    authorized to any person, not on friends on Facebook.
    Consequently, a consumer's private information is vulnerable to
    release to third parties like the news reporter who published
    the video rental history of Judge Robert Bork that paved the
    way to enactment of the Video Privacy Protection Act.
        Third, despite claims that the Video Privacy Protection Act
    is outdated, only a single provision of the statute was
    updated, leaving consumer-oriented provisions that should have
    been reviewed and strengthened unaltered.
        Fourth, and finally, no consideration was given to the
    effect that changes in the Video Privacy Protection Act will
    have on State laws that afford similar and sometimes broader
    protections to consumers. This oversight is likely to invite
    thorny conflict of laws disputes given the borderless
    boundaries of the Internet.
        While Internet users have a responsibility to self-censor
    and restrict the information they share about themselves, the
    reality is that many online users have a false sense of privacy
    due to their lack of understanding of lengthy and complex
    privacy policies they are compelled to agree to in order to use
    the service. As a result, online users often share a lot of
    personal information unknowingly and to unintended audiences. I
    do not believe that unsuspecting, unsophisticated, or casual
    Internet users should be deemed to relinquish their right to a
    basic level of privacy. And my concerns are heightened even
    more when the user is a vulnerable teen or young adult whose
    ability to adequately assess risk has not fully matured.
        Third-party access to dynamic social platforms are
    constantly in flux. A consumer's consent today to allow
    perpetual access to their viewing history is clearly not
    informed by who will be their friend tomorrow. Today, when
    online bullying of teens and young adults can lead to
    depression or even suicide and online predators can learn
    otherwise confidential, private information about their prey, I
    believe the selective and piecemeal amendment of the Video
    Privacy Protection Act is irresponsible.
        As one commentator has written, movie and rating data
    contains information of a more highly personal and sensitive
    nature. The member's movie data exposes a member's personal
    interest and/or struggles with various highly personal issues,
    including sexuality, mental illness, recovery from alcoholism,
    and victimization from incest, physical abuse, domestic
    violence, adultery, and rape.
        Justice Marshall wrote years ago that ``Privacy is not a
    discrete commodity, possessed absolutely or not at all.'' The
    objective is to strike an appropriate balance to develop
    meaningful protections for consumers while promoting a healthy
    online economy. I do not believe that H.R. 2471 has found that
    appropriate balance. I support a comprehensive online privacy
    plan that will address and mitigate the unintended consequences
    of third-party sharing. In that regard, I believe Justice Alito
    got it right when he said: ``In circumstances involving
    dramatic technological change, the best solution to privacy
    concerns may be legislative. A legislative body is well
    situated to gauge changing public attitudes, to draw detailed
    lines, and to balance privacy and public safety in a
    comprehensive way.''
        This hearing is an important step toward finding the right
    balance, and it is more critically important because the House
    failed to give the matters the kind of attention they required.
        I thank the Chairman for this opportunity and look forward
    to working across the Capitol to move forward. Thank you so
    much.
        [The prepared statement of Representative Watt appears as a
    submission for the record.]
        Senator Franken. Thank you, Representative Watt, and the
    purpose of this is to give a hearing to all these matters and
    issues. Your complete written testimony will be made part of
    the record.
        We are fortunate to have with us Chairman Leahy, who is the
    author of the Video Privacy Protection Act, and I understand
    that I left out Alan Simpson's role when I touted----
        Chairman Leahy. Alan was very important in that.
        Senator Franken. OK, so I apologize for that. He is a good
    friend. Today this law, the Video Privacy Protection Act, is
    just one of several critical privacy laws that the Chairman has
    written and passed during his tenure in the Senate, so I turn
    it over to the Chairman.

      STATEMENT OF HON. PATRICK J. LEAHY, A U.S. SENATOR FROM THE
                            STATE OF VERMONT

        Chairman Leahy. I thank you very much, and it is good to
    see my friend Congressman Watt. We have worked together on so
    many things, from privacy issues to the Voting Rights Act, and
    I appreciate that collaboration.
        I should tell Chairman Franken--and I thank him for his
    responsible leadership he has done on this issue of privacy--we
    Vermonters come about it naturally. I see a smile from a friend
    of mine in the audience who probably has heard this story more
    than once, but one of the few things I have ever saved written
    about me in the press--and I actually framed it--was a sidebar
    to a New York Times profile.
        Now, to put this in perspective, you have to understand, my
    wife and I live in an old farmhouse in Vermont on a dirt road.
    We celebrated our--well, actually had part of our honeymoon
    there nearly 50 years ago, 50 years ago this summer. And
    hundreds of acres of land and fields that have been hayed and
    watched over by an adjoining farmer's family from the time I
    was a teenager, and they have known me since then.
        So the whole story goes like this: On a Saturday morning, a
    reporter in an out-of-State car sees this farmer sitting on the
    porch and asks, ``Does Senator Leahy live up this road?''
        He said, ``Are you a relative of his?''
        He said, ``No, I am not.''
        ``Are you a friend of his?''
        ``No, not really.''
        ``He expecting you?''
        ``No.''
        ``Never heard of him.''
        Now, we like our privacy in Vermont. In the Digital Age,
    ensuring the right to privacy is critical. But I think it
    becomes ever more difficult as our Government and businesses
    collect and store and mine and use our most sensitive personal
    information for their own purposes--not ours, but theirs.
    Whether it is sensitive medical records, private financial
    information, or personal thoughts and feelings, I have worked,
    as so many others on this Committee have, to ensure that
    Americans' privacy rights are respected.
        We talked about the Video Privacy Protection Act from 1988.
    When I introduced the bill, I said that it was intended to help
    make all of us a little freer to watch what we choose, without
    public scrutiny. More recently, I have worked at protections
    for library and book seller records in Section 215 of the USA
    PATRIOT Act.
        Now, it is true that technology has changed, as the
    Chairman mentioned that Justice Alito said, but I think we
    should all agree that we have to be faithful to our fundamental
    right to privacy and freedom. Today the social networking,
    video streaming, the cloud, mobile apps, and other new
    technologies have revolutionized the availability of Americans'
    information. But they are also outpacing our privacy laws. That
    is one of the things we have to think about.
        So I continue to push to enact the Personal Data Privacy
    and Security Act to create a nationwide data breach
    notification standard and better combat cyber crime. That is
    why I proposed a comprehensive review and update of the
    Electronic Communications Privacy Act.
        Recently some companies that dominate various aspects of
    cyberspace have announced that they want to simplify matters so
    that they can more easily track Americans' activities across
    the board, obviously to their own financial benefit. But I
    worry that sometimes what is simpler for corporate purposes is
    not better for consumers. It might be simpler for some if we
    had no privacy protections, if we had no antitrust protections,
    if we had no consumer protections. It would be simpler for
    some, but it certainly would not be better for Americans. And I
    worry about a loss of privacy because of the claimed benefit of
    simplicity.
        Privacy advocates and elected representatives from both
    sides of the aisle have serious concerns and serious questions.
    We are looking for information and answers. When dominant
    corporate interests entice a check-off in order to receive what
    may seem like a fun new app or service, they may not be
    presenting a realistic and informed choice to consumers. A one-
    time check-off that has the effect of an all-time surrender of
    privacy does not seem like the best course for consumers. I
    worry that the availability of vast stores of information via
    corporate data banks also makes this information readily
    available to the government, which has almost unfettered power
    to obtain information with an administrative subpoena and so-
    called national security letters. So I think we need to have
    comprehensive reform.
        Now, Representative Mel Watt is a thoughtful leader on
    these issues, and it is good that he is here, as well as those
    from corporate America. But I am hearing from many privacy
    advocates who have expressed concern about the privacy
    implications of the House-passed proposal. A key concern is
    that a one-time check-off of consent to disclose, mine, sell--
    sell, sell--and share information does not adequately protect
    the privacy of consumers. And the House's proposal updating the
    law does not cover streaming and cloud computing to the extent
    I would like. So we need to move forward with a comprehensive
    review and update of the Electronic Communications Privacy Act
    and also see how best to update to the Video Privacy Protection
    Act.
        I want to thank the Chairman for doing this, and I just
    want to stress again that this Vermonter likes his privacy. And
    I especially do not like it when somebody says, ``We are just
    going to make life simpler if we sell your privacy.''
        Senator Franken. Thank you, Mr. Chairman.
        We are now going to go to the second panel. Thank you
    again, Representative Watt. You were the first panel. Evidently
    a single person can be a panel.
        Senator Franken. If the panel would come forward, I would
    like to introduce our second panel of witnesses.
        David Hyman is the general counsel of Netflix. Mr. Hyman
    has served in this role for the past decade and has seen the
    company grow tremendously during that period. Prior to joining
    Netflix, Mr. Hyman was the general counsel of Webvan, an
    Internet-based grocery delivery service. He received both his
    J.D. and B.A. from the University of Virginia.
        Bill McGeveran is an associate professor of law at the
    University of Minnesota, where he specializes in information
    law, including digital identity and data privacy. Before
    joining the university, he was a resident fellow at Harvard's
    Berkman Center for Interest and Society and a litigator in
    Boston. Professor McGeveran received his J.D. from NYU and his
    B.A. from Carleton College in Minnesota. Finally, I should add
    that Professor McGeveran was once a staffer for Senator Schumer
    back in the days in the House of Representatives.
        Marc Rotenberg is the executive director of the Electronic
    Privacy Information Center, which he co-founded in 1994. He
    chairs the American Bar Association Committee on Privacy and
    Information Protection and has edited several privacy law
    textbooks. Prior to founding EPIC--that is, again, the
    Electronic Privacy Information Center, EPIC--Mr. Rotenberg was
    counsel to Senator Leahy, where he advised the Senator on the
    law that we are considering today, the Video Privacy Protection
    Act. He received his J.D. from Stanford Law School and his B.A.
    from Harvard College.
        Christopher Wolf is the director of the privacy and
    information management practice at Hogan Lovells here in
    Washington, and he is also the founder and co-chair of the
    Future of Privacy Forum. He was the editor and lead author of
    the Practicing Law Institute's first treatise on privacy law
    and has authored numerous publications on privacy. He received
    his J.D. from Washington and Lee University and his A.B. from
    Bowdoin College.
        I want to thank you all for being here today. We will start
    with Mr. Hyman.

     STATEMENT OF DAVID HYMAN, GENERAL COUNSEL, NETFLIX, INC., LOS
                           GATOS, CALIFORNIA

        Mr. Hyman. Chairman Franken, Ranking Member Coburn, thank
    you for the opportunity to testify today on the Video Privacy
    Protection Act. My name is David Hyman. I have served as the
    general counsel of Netflix since 2002: a time when streaming
    video over the Internet to a ``smart'' TV was more the stuff of
    a sci-fi miniseries than a topic of serious consideration in a
    board room, much less a Congressional hearing. How far we have
    come in such a short period of time. Today's hearing is a
    testimony to the incredibly dynamic and powerful innovation
    engine of our Internet economy.
        Netflix was founded in 1997 as a DVD-by-mail service. To
    many, the use of the Internet and the Netflix Web site was
    nothing more than a way to submit orders for physical disc
    delivery. But for Netflix, we saw an opportunity to use
    technology in a way that helped consumers discover movies and
    TV shows they would love, as well as provide business
    opportunities for content producers and distributors. The
    popularity of our DVD-by-mail service grew rapidly. But with
    innovation deeply rooted in our corporate DNA, we continued to
    research and try new and compelling consumer offerings. We were
    an early pioneer in the streaming of movies and TV shows over
    the Internet to personal computers. And in 2008, we began to
    deliver instant streaming video to televisions through the use
    of a handful of Internet-connected devices. Today, more than 21
    million consumers in the United States use the Netflix
    streaming service on more than 700 different types of Internet-
    connected devices, including game consoles, mobile phones, and
    tablets. And in the last three months of 2011, we delivered
    more than two billion hours of streaming movies and TV shows to
    those consumers.
        At the same time that the Netflix streaming service has
    seen such uptake by consumers, the world of social media has
    exploded in popularity. Embodied by the growth of Facebook, the
    social Internet offers tremendous opportunities for consumers
    and businesses. Netflix believes that social media offers a
    powerful new way for consumers to enjoy and discover movies and
    TV shows they will love. To this end, we have been offering our
    members outside the United States the opportunity to share and
    discover movies with their friends through the Facebook
    platform. While it is early in the innovation process, we have
    seen strong consumer interest in our social application, with
    more than half a million subscribers outside the United States
    connected with Facebook.
        Unfortunately, we have elected not to offer our Facebook
    application in the United States because of ambiguities in the
    Video Privacy Protection Act. Under this law, it is unclear
    whether consumers can give ongoing consent to allow Netflix to
    share the movies and TV shows they have instantly watched
    through our service. The VPPA is an unusual law; unlike most
    Federal privacy statutes, the VPPA could be read to prohibit
    consumers who have provided explicit opt-in consent from being
    able to authorize the disclosure on an ongoing basis of
    information they so desire to share. The friction that this
    ambiguity creates places a drag on social video innovation that
    is not present in any other medium, including music, books, and
    even news articles.
        Recognizing this, the House recently passed a bipartisan
    bill, H.R. 2471, that clarifies consumers' ability to elect to
    share movies and TV shows they have watched on an ongoing
    basis. H.R. 2471 leaves the opt-in standard for privacy within
    the VPPA undisturbed. Netflix supports the opt-in standard and
    believes that this approach is workable and consistent with our
    members' expectations and desires.
        The VPPA singles out one type of data sharing. Instead of
    trying to graft specific notions about video privacy from
    almost 25 years ago into the dynamic information age of today,
    we would encourage a measured and holistic review of privacy
    for the 21st century, one designed to foster continued
    innovation while balancing the desires and privacy expectations
    of consumers. Such a review will understandably take
    considerable time and effort, and we are ready to assist. In
    the interim, it is our hope that the Senate will see the value
    in clarifying the right of consumers to opt in to ongoing
    sharing under the VPPA and quickly approve H.R. 2471.
        Again, I thank you for the opportunity to be here today,
    and I look forward to your questions.
        [The prepared statement of Mr. Hyman appears as a
    submission for the record.]
        Senator Franken. Thank you, Mr. Hyman.
        By the way, your complete written testimony will be made
    part of the record.
        Professor McGeveran.

       STATEMENT OF WILLIAM MCGEVERAN, PROFESSOR, UNIVERSITY OF
              MINNESOTA LAW SCHOOL, MINNEAPOLIS, MINNESOTA

        Mr. McGeveran. Thank you. Chairman Franken, Ranking Member
    Coburn, and Members of the Subcommittee and staff, thank you
    for inviting me to testify here today.
        My name is William McGeveran. I am a law professor at the
    University of Minnesota. My teaching and research focus on
    Internet, privacy, and intellectual property law. In that
    context, I have written about the Video Privacy Protection Act,
    which I consider a model for privacy legislation more
    generally.
        Now, unquestionably, there are enormous benefits to the
    online recommendations we get from friends through sources like
    Facebook or Spotify, and I myself use social media and those
    recommendations heavily. But the potential problems are serious
    too, as others have noted. In one article, I argued that the
    key to getting that balance right is securing genuine consent.
    That means an individual sent a social message intentionally,
    not by mistake. If we have too many accidental disclosures, we
    undermine the privacy of personal matters and also the accuracy
    of the recommendations, the fact that our friend really wants
    us to see this movie rather than passively letting us know that
    he saw it and it turns out maybe he did not like it very much.
    The VPPA is designed to secure that sort of genuine consent.
        I want to emphasize three points: first, the important
    interests behind the VPPA; second, the fact that amendments are
    not necessary to keep up with technology; and, finally, the
    problems with H.R. 2471.
        First, the VPPA safeguards important interests, as others
    have noted. Why else did a newspaper reporter think Judge
    Bork's rental history might be interesting in the first place
    except that it would be revealing of something about him?
        In my view, the greatest flaw in the existing VPPA is its
    limitation to video, which arises from a historical accident
    around its enactment. Unintended disclosure of a user's choices
    of books, music, films, or Web sites can also constrain the
    capacity to experiment and explore ideas freely. If the
    Committee revisits this statute, I believe you should consider
    extending protection to reading and listening habits as well as
    viewing. That was part of the intent of the California Reader
    Protection Act, which took effect at the beginning of the
    month. In general, the law ought to protect private access to
    any work covered by copyright, not just movies.
        Second, the VPPA, in its current form, already allows video
    companies to implement social media strategies, including, if
    they wish, integration with Facebook. Now, it is true that the
    VPPA requires opt-in consent every time a viewer's movie
    choices get forwarded to a third party, and that includes
    friends in a social network. That is not an ambiguity. That is
    actually clearly what the law says.
        But it is actually easier to satisfy those requirements
    online than off. The statute's authors, after all, such as
    Senator Leahy, envisioned a video rental store getting the
    customer to sign a separate document with pen and paper every
    time in person. On the Internet, by comparison, each time users
    push the button to play a movie, they could be offered a ``play
    and share'' button right alongside it allowing them to both
    show the video and post that information in social networks.
        I think it would be quite radical to assert that an
    electronic format does not fulfill the requirement for written
    consent under the statute. That interpretation would undermine
    every clickwrap and ``I agree'' button that is on the Internet.
    It is contrary to the E-SIGN Act and to all the case law I have
    seen.
        I think the real objection here is not about technology. It
    is a disagreement with the VPPA's explicit policy choice to get
    case-by-case consent rather than a one-time authorization.
        Finally, I do want to note that H.R. 2471 has a lot of
    problems and misses some opportunities for reasonable
    compromise. I will just note a few.
        Changes to the statute apply to every disclosure, not just
    those in social networks. By rushing to address Netflix and
    Facebook, the bill reduces privacy in many other settings, from
    law enforcement to behavioral advertising. By specifically
    mentioning the Internet, I am concerned the bill may foreclose
    electronic consent through other technologies such as cable or
    satellite, and that is a real concern.
        The provision for withdrawing consent says nothing about
    how it is supposed to be done. That vagueness may, apparently,
    permit companies to comply by making it easy to give consent
    but very cumbersome to withdraw that consent.
        Most important, the bill passed by the House replaces a
    robust consent provision with a very weak alternative. There
    may be other ways to get genuine consent than what is offered
    in the VPPA. For example, what about general authorization with
    a short time limit, say one month, and granular, clear opt-out
    for individual postings? I urge the Committee and the bill's
    supporters to explore those sorts of creative compromises to
    streamline the VPPA for the 21st century without vitiating its
    important protection for individual privacy.
        Thank you, and I look forward to questions.
        [The prepared statement of Mr. McGeveran appears as a
    submission for the record.]
        Senator Franken. Thank you very much, Professor.
        Mr. Rotenberg.

      STATEMENT OF MARC ROTENBERG, EXECUTIVE DIRECTOR, ELECTRONIC
               PRIVACY INFORMATION CENTER, WASHINGTON, DC

        Mr. Rotenberg. Mr. Chairman, Senator Coburn, thank you very
    much for the opportunity to testify today.
        As you know, there are few issues of greater concern to
    Internet users than the protection of privacy. In fact,
    according to the Federal Trade Commission, over the past decade
    the top concern of American consumers has been privacy and
    identity theft, so the hearing that you are holding today is
    very important, very timely, and of great concern to a lot of
    people.
        I wanted to begin by talking about the purpose and passage
    of the Video Privacy Protection Act. As you suggested, Mr.
    Chairman, in many ways this was a smart and forward-looking
    piece of legislation. Among the various provisions that
    Congress enacted 25 years ago was one that said let us not keep
    personal information longer than is necessary. Today we have an
    enormous problem in this country with data breaches, identity
    theft, and companies keeping data on their customers and their
    clients for much longer than they should. Fortunately, in this
    area there are strong safeguards that have prevented and
    protected users of these new services from those types of
    problems.
        What the Video Privacy Protection Act sought to do was to
    deal with the new reality in video services. Prior to the mid-
    1980s, as you know, most people watched broadcast television or
    saw movies. There was very little collection of personal data
    about individuals' particular movie preferences. And so when
    the story broke about the access to Judge Bork's video rental
    records, Congress appropriately said we need to put in place
    some safeguards for that information that businesses were now
    able to collect.
        Now, the act establishes a strong presumption in favor of
    privacy, but it is not a prohibition against disclosure.
    Individuals always have the right to consent to disclosure. Law
    enforcement has the right under a court order to get access to
    records in the course of an interrogation. And even for
    marketing purposes, personal information can be disclosed, and
    this is the key provision that I would like to draw your
    attention to, because there was an important compromise that
    the Congress struck when they were considering the act. They
    said when it comes to the fact that someone may happen to be a
    customer of a video service, there really should be few
    restrictions on disclosing that fact, and the privacy
    protection was essentially an opt-out. Congress even said that
    if the company wanted to disclose the fact that a person was
    interested in science fiction movies or mystery movies or
    action adventure, companies in those circumstances as well
    could disclose those facts simply with the opt-out protection.
        But when it came to the actual titles of particular movies
    that would reveal so much about a person's personal interests
    and the likes, Congress said, well, there we need a higher
    level of protection. That should really be opt-in. And if a
    person chooses in a particular case to disclose that
    information, they should be free to do so, and the act allows
    for it.
        Now, I want to say very directly to Netflix that this
    argument that they are making that this law somehow stands in
    the way of integration with Facebook is simply not right. They
    have the freedom today under the law to note when Netflix users
    are using Netflix services. They can even go the next step and
    talk about the types of movies that their customers are
    viewing. What the law tries to do is establish a line at the
    point that the company wants to say, ``And here is the
    particular movie that one of our users is now viewing.'' That
    is where the law says, please, in those circumstances, get opt-
    in consent.
        Now, I want to make a further point here because I actually
    believe that many of the House members who voted for this bill
    do not fully understand the consequence of the amendment. It is
    not just the friends of that individual to whom the fact of the
    specific movie viewing will be disclosed. It is also to Netflix
    business partners, and it is also potentially to law
    enforcement, because what Netflix is asking users to do is to
    provide a blanket consent that gives them the opportunity to
    disclose specific movie viewing to any party under any
    circumstance that Netflix chooses to. This knocks out the
    cornerstone of the act. It takes away the key provision that
    was put in place to give users meaningful consent.
        Obviously, I do not think this is going to support online
    privacy and, frankly, I do not think Netflix users want this
    provision. But I do think changes could be made to the act to
    modernize it and to update it. I think it should be applied to
    all streaming services. I think that data destruction provision
    needs to be coupled to the private right of action. I would
    also like to see more transparency so that users of the service
    actually know how their personal information is being used, and
    I think companies should be required to routinely encrypt the
    data they collect. Those types of changes to the act actually
    would update it, would continue to promote a viable and useful
    service for many users, and I hope they will be considered by
    the Committee.
        Thank you.
        [The prepared statement of Mr. Rotenberg appears as a
    submission for the record.]
        Senator Franken. Thank you, Mr. Rotenberg.
        Mr. Wolf.

         STATEMENT OF CHRISTOPHER WOLF, DIRECTOR, PRIVACY AND
    INFORMATION MANAGEMENT GROUP, HOGAN LOVELLS LLP, WASHINGTON, DC

        Mr. Wolf. Thank you, Chairman Franken, Ranking Member
    Coburn, and Members of the Subcommittee. My name is Christopher
    Wolf, and I am a privacy lawyer at Hogan Lovells, where I lead
    that firm's global privacy practice. I am also a privacy
    advocate. As part of my pro bono work, I won a leading case
    against the government for violating the Electronic
    Communications Privacy Act. I am part of a group advising the
    OECD on its privacy guidelines. I am on the EPIC Advisory
    Board, and I founded and co-chair the Future of Privacy Forum,
    a think tank with advisory board members from business,
    consumer advocacy and academia, focused on practical ways to
    advance privacy. I am pleased that Professor McGeveran is a
    member of that advisory board.
        Fundamentally, privacy is about control. Indeed, a
    principal goal of privacy law is to put choices and decisions
    in the hands of informed consumers. With the advent of video
    streaming and social sharing, the Video Privacy Protection
    today stands in the way of consumers' exercising control and,
    thus, limits their choices and even limits free expression.
        The VPPA, enacted nearly a quarter of a century ago during
    the Betamax era, was designed to prevent prying into people's
    video rental history. The purpose of that law was not to stop
    people from sharing information about the videos they watched
    or to dictate how they share. Indeed, the law's laudable
    purpose was to give control and choice to consumers, to let the
    consumers decide whether and how to share their video-watching
    information.
        In 1988, when the VPPA was enacted, no one dreamed of
    streaming video and social sharing. So when that pre-Internet
    era law is applied to the world of online video and social
    media, it can be read to frustrate the choices of consumers to
    authorize the disclosure on an ongoing basis of the streaming
    movies they have watched online.
        For many people, automatic sharing in social media is how
    they shape their online identities and how they share ideas.
    Facebook users commonly utilize a one-time authorization, a
    durable sharing option, to share a wide range of information
    with their friends. But when it comes to sharing their online
    video experiences, the law gets in the way.
        Take a person who is an avid video watcher watching 100
    short videos per week. She wants to share every video she
    watches with her friends, just as she shares every song she
    listens to on the streaming music service Spotify and just as
    she shares every item she reads online on the Washington Post
    through a Facebook social sharing app. But current law suggests
    she is not fit to make the frictionless sharing decision with
    respect to videos she watches. Should this video file have to
    opt in 100 times per week? Does making her do so serve any
    purpose other than to annoy her and to take needless time? The
    constant, legally required interruption to her online
    experience harkens back to the day when pop-ups had to be
    clicked on to proceed online. Our frequent video viewers should
    be given the opt-in choice to share all of her viewing
    experience if that is what she wants.
        In contrast to the restrictions of the VPPA, there are no
    legal restrictions on her ability to socially share every e-
    book she reads. Through a durable sharing option, she easily
    can share the fact that she read the book entitled ``The
    Godfather,'' but the law stands in the way of her similarly
    sharing the fact that she watched the movie entitled ``The
    Godfather.'' That makes no sense.
        Of course, not everyone wants to share their viewing
    experiences with their friends online, and they do not have to
    share. And if someone prefers to share their video-watching
    experiences on a case-by-case basis, he or she can do so
    manually, just as people occasionally post news stories they
    read on the Washington Post on Facebook rather than choosing
    the automatic sharing option.
        Similarly, a person who chooses to share on a continuous
    basis can disable the share function before watching a
    streaming video that he or she wants to exclude from online
    post, such the ``Yoga for Health'' video that Senator Franken
    referenced.
        In order to clarify the uncertainty of the language in the
    VPPA on disclosures, I support an amendment such as H.R. 2471
    allowing durable sharing choice for consumers, which in turn
    will permit frictionless social sharing. I agree that as a
    privacy best practice, the durable choice option should be opt
    in and presented prominently, separate and distinct from the
    general privacy policy and the terms of use of an online
    service. That is genuine consent.
        I join the Center for Democracy and Technology in
    concluding that such an amendment will not undermine the
    fundamental purpose of the VPPA. Even though some Senators
    personally may feel that sharing all the movies one watches is,
    to use a phrase not heard much anymore, TMI, too much
    information, people should as a matter of free expression be
    able to share as they choose, and companies should not face
    legal penalties for providing them with that choice.
        As governments around the world, including our own,
    consider ways to improve their privacy frameworks, there are
    big decisions to be made, as Representative Watt pointed out in
    his presentation. Starting a legislative process in the name of
    privacy protection through which lawmakers decide case by case
    what information and by what means consumers can share online
    seems terribly ill-advised. In contrast, amendment of the VPPA
    to permit full user choice and control fits squarely within the
    preferred privacy framework, one that empowers consumers.
        Thank you for the opportunity to appear here today. I look
    forward to your questions.
        [The prepared statement of Mr. Wolf appears as a submission
    for the record.]
        Senator Franken. Thank you, Mr. Wolf, for your testimony.
        Let me start with Professor McGeveran because I want to
    make a few things clear about what this bill does and does not
    do. I talked a little in my opening statement--or about what
    the amendment does and does not do, about what the video--I
    talked about what the Video Privacy Protection Act does. I want
    to talk for a moment about what it does not do. A lot of people
    have been saying that the Video Privacy Protection Act actually
    prohibits people from sharing their viewing habits on social
    networking. In fact, one article said that, ``An antiquated
    1988 bill called the Video Privacy Protection Act forbids the
    disclosure of one's video rental information even if the renter
    is OK with the disclosure.''
        Is that right, Professor McGeveran? Does this law prevent--
    and I am talking about the VPPA--video companies from
    integrating into Facebook or other social networking sites even
    if the user wants them to?
        Mr. McGeveran. No, it is not right, Senator. The underlying
    existing statute, which I am concerned it is called
    ``antiquated'' since that is the year I graduated from high
    school. But the statute requires consent every time. But as I
    mentioned in my opening statement, that can be done simply by
    saying here is a button to press when you play the movie,
    because presumably you have to press a button to play the
    movie, and right next to it here is a button to both play and
    share. You can post. You just have to be asked every time you
    see a movie online. That seems relatively easy to effectuate.
        Senator Franken. So it would be easy to say I can share.
        Mr. McGeveran. That is right.
        Senator Franken. Mr. Wolf talked about it would be really
    easy to disable the sharing, but is there anything in the
    amendment that says how that would happen? Could an online
    video company, one less scrupulous than Netflix, just have it
    really hard--is there anything in the law that would prevent
    them from making it almost impossible to figure out how to
    disable it?
        Mr. McGeveran. In the House bill, the way it is set up now,
    it says that you could enable consent until you took it away,
    but there is nothing in the bill that gives any requirements
    about how that would be done.
        Mr. Wolf mentioned some best practices. You know, I think a
    scrupulous company would make it easy. But this law is not only
    going to apply to companies that we believe are going to do the
    right things, and it does not--the company could have no button
    or access anywhere on its Web site to do this. It could perhaps
    have no explanation on its Web site that you had the right to
    do this, and it would be up to the consumer to figure it out.
    And the House bill allows that kind of arrangement.
        Senator Franken. OK. I just want to make that kind of
    clear, that to opt in to sharing a video, what movie you are
    watching, would be no more burdensome than just watching the
    movie itself.
        Mr. McGeveran. Under current law.
        Senator Franken. So, in other words, press one button.
    However, disabling the overall consent to watch everything
    could be impossible to find, essentially.
        Mr. McGeveran. That is right. The House bill does not----
        Senator Franken. Mr. Rotenberg, do you agree with that?
        Mr. Rotenberg. I think this is a very important point,
    Senator, and also what Professor McGeveran has pointed out is
    that there are innovative ways to allow individuals to click,
    you know, ``play and share''. There is the integration, and
    there is the disclosure, or to simply click ``play,'' which is
    I just want to see a movie, I do not need to tell the world
    about it. But the point that you are making which is of
    particular concern to us is under the House approach, once you
    basically have ``play and share stuck,'' that button setting,
    it may be very difficult to unstick because there is nothing in
    the proposal that would make it easy to withdraw the consent.
        Senator Franken. OK, thank you.
        Mr. Hyman, there is no company that better exemplifies the
    promise of streaming than Netflix. Netflix introduced its
    streaming in 2008. Today 90 percent of Netflix's 24 million
    subscribers have streaming subscriptions; only 45 percent have
    DVD subscriptions, and that number is dropping. In fact, if you
    look at ``About Us,'' the ``About Us'' section on Netflix's Web
    site, the word ``DVD'' does not appear once. It is all about
    streaming, and for good reason, because that is the future of
    video.
        I mentioned in my opening statement that there may be some
    disagreement as to whether or not streaming video companies are
    covered by the Video Privacy Protection Act. Mr. Rotenberg
    suggested in his testimony that it would be helpful to change
    language in the Video Privacy Protection Act to confirm that it
    does, in fact, cover streaming video companies.
        Mr. Hyman, would Netflix support doing that?
        Mr. Hyman. Mr. Franken, Netflix would probably not--we
    would not support that. I think the issue for us is really one
    of what is video in the future and how do you think about that
    in the Internet age. Video embedded into news stories, does
    that become a news story or is that streaming video? Music
    videos, is that music or is that videos? Books. You know, I
    recently read a book called ``A Visit from the Good Squad,''
    which is a very good book. Interestingly, it uses in there
    texting. It has a PowerPoint presentation. You can imagine in
    the future that books will incorporate video. Does that now
    mean that that is covered by the VPPA?
        So I think we have a host of issues relative to what is
    video in the future, and so just extending the Video Privacy
    Protection Act into the Internet raises a host of issues, and I
    think there is a host of other players that need to be involved
    in that.
        So, again, as we mentioned in the testimony, a holistic
    approach and a comprehensive approach would be one that Netflix
    would support and be involved in, but merely taking the VPPA
    and saying it applies to streaming, I think, opens a whole host
    of issues that need to be carefully addressed.
        Senator Franken. Would anyone care to address that in terms
    of--because I do not think this amendment is comprehensive at
    all. And so I think you raise a lot of great issues about this,
    but it seems to me to say that since the VPPA applied to what
    we think of as movies, movies are going to be streamed.
        Mr. Hyman. They are.
        Senator Franken. They are going to be. So that this law, it
    seems like that you need to apply streaming to this, and I am
    troubled by your excluding, trying to exclude streaming at all.
        Does anyone have anything to say about that?
        Mr. Rotenberg. Well, Mr. Chairman, I think perhaps the
    advocates of that approach are drawing the wrong line. The
    Video Privacy Protection Act was not trying to regulate
    technology. It was not saying we will treat, you know, video
    rental cassettes in one way and other things in a different
    way. It actually says similar materials should be treated in a
    similar way.
        What the act is trying to do is regulate the collection and
    use of personally identifiable information, and the reason you
    need to do that in the digital world is because when you move
    from broadcast of television and movies to this kind of one-to-
    one service offering, these companies are now collecting a lot
    of personal information about their customers. And so what the
    law tries to do is to say if you are going to collect all that
    data, then you need to protect.
        And I think the other point that should be brought out as
    we think about these new techniques for delivering of video is
    that companies today are collecting a lot more information than
    they did 25 years ago. And so I would think that the
    inclination at this point in Congress would actually be to
    strengthen the law, recognizing how much more information is
    collected.
        Senator Franken. Well, thank you. We will go to another
    round. I have run over my time. We will go to the Ranking
    Member, Senator Coburn.
        Senator Coburn. First of all, let me thank you for your
    testimony. I learned a lot from what you had to say. And I am
    prone to agree with the Chairman on his concerns about this
    bill as I look at it. And I really do not see a big difference
    from granting permission one click at a time to a blanket
    consent. But I also think prudence in terms of protection of
    privacy ought to be the thing that ought to guide us.
        There is no question Netflix with their policy throughout
    the rest of the world that is not available here to online
    consent for that gives them an asset, my asset, my privacy
    asset, that I readily give to me if I am one of those that
    grants a blanket consent somewhere outside this country. I am
    giving them something of value that they can use to make money
    off of. And I am not sure--I am torn between whether we have
    the right to tell somebody whether they can grant a blanket
    consent or not. I do not know that that is our role. But I know
    it is our role to be concerned about the ultimate privacy
    protection that individuals deserve.
        So I would go back and I would ask the professor if he
    would give us a little further dissertation on what he thinks
    or means by the words ``genuine consent.''
        Mr. McGeveran. Thank you, Senator Coburn. The idea behind
    genuine consent is to say that it is thought out, it is
    intentional. We are helping a consumer, a customer, to post the
    information that he or she wants to post.
        I might have more sympathy toward changing the existing
    VPPA if I thought it did, in fact, make it very difficult for
    people to do that, because I think that recommendations of
    movies to our friends are really valuable. I learn a lot about
    movies I would like to see by hearing about them word of mouth
    from my friends. But as I mentioned before, what we have online
    is the capacity to make it very easy to secure a decision each
    time from the user, to say yes, I do intend to share this
    information now about this movie now. And the ability to say it
    for all movies in advance, we are not actually inconveniencing
    the user very much in an era where you are going to have to
    push either just one button or the other. So I would say
    genuine consent is making sure that it is intentional.
        Senator Coburn. So when I go through Dallas airport and use
    Dallas' wi-fi, at the bottom of that every time is ``I
    consent,'' I agree to their terms. Now, how many of you in this
    room have ever read that three pages of very fine print to say
    you agree to consent?
        Mr. McGeveran. Well, I have, but that is my job.
        Senator Coburn. Yes.
        [Laughter.]
        Senator Coburn. But you are a rarity.
        Mr. McGeveran. I am.
        Senator Coburn. And so the fact is, what you are saying is
    what is wrong with making a considered judgment each time.
        Mr. McGeveran. Exactly.
        Senator Coburn. Mr. Wolf.
        Mr. Wolf. Senator, I think you pointed out the problem with
    that, that when consumers are presented with choices over and
    over and over again, they tend to tune them out, and they will
    ignore them, and they will have no meaning whatsoever. They
    will just click through it to get to the function that they
    want to exercise.
        Senator Coburn. Well, let me bring you back to this point.
    If the question that comes up on my iPad is, Do you want to
    share this information through your social media?, and I have
    to say yes or no, that is all that is going to be required for
    Netflix to put up with each movie: Do you want this to be
    shared? You have to make a decision there. That is a one-line
    statement, which is very different. So if I am looking at a
    movie, an Arnold Schwarzenegger, which my wife hates but I love
    the action in them, and I am going to make a decision that I
    want everybody to know I am watching Arnold Schwarzenegger, and
    I am going to have to--it is one sentence. I am going to have
    to make that decision. Why is that not protecting the rights
    rather than blanket, and, ``Oh, I forgot about it,'' or ``I am
    hung over from the night before, and I am not thinking
    clearly,'' so, therefore, I have already granted--and I punched
    a button on something that I really do not want shared.
        The question is: Should we err on the side of privacy, or
    should we err on the side of commerce? And that is the real rub
    here. That is the thing that we have to decide.
        Mr. Wolf. I actually do not think that is the choice. If a
    consumer wants to share everything on their Facebook page, as
    many do--they share every article they read in the Washington
    Post, every book they read, every song they listen to. It is
    not a choice you or I might make, but a law that takes away
    that choice really ignores that there are people who want to do
    that. And as long as they are informed of the consequences of
    doing that and provided an opportunity--and I agree with the
    professor that the opportunity ought to be just as easy as it
    is to opt in--then I really do not see how it is the business
    of Congress to dictate how and when people share.
        Again, we are talking about legislating today, but we have
    no idea what the sharing techniques will be 20 years from now.
    And I will leave this to Mr. Hyman, but I understand that there
    are some devices to access Netflix where you cannot have that
    button or it is not easy to have that kind of button that you
    are talking about.
        Senator Coburn. That is fair. The point is there is a rub.
    There is a rub. And the argument is not simply that we are
    going to take away somebody's right to share. And it is not
    being a Big Brother. I will go back. I believe the decision is
    between protecting privacy and promoting commerce, and I think
    we ought to be able to figure out how to do both.
        Mr. Wolf. But I get back to my fundamental point, that
    privacy is and has all along been giving people the choice to
    control their information and who sees it and how it is
    disclosed.
        Senator Coburn. So there is no limitation to that choice if
    I get to make that choice each time. You are still giving them
    the choice. You are still giving--actually, we had a reference
    to the testimony that some think that the ability to use
    Spotify right now ought to have a choice each time. Is that not
    true? Did I not get that inference from your statement, Mr.
    McGeveran?
        Mr. McGeveran. Spotify is not set up in a way that would be
    compliant with the VPPA if it were video because your scroll of
    songs is sent out to all your friends automatically.
        Senator Coburn. Yes, but the point is, was it not your
    inference that you thought maybe people ought to be making
    decisions on that as well?
        Mr. McGeveran. That is right. I think the same thing, you
    press a ``play'' button for a song, you should be making a
    choice time by time whether that is something that goes out.
        Senator Coburn. So the question is how big of a choice do
    you make and whether you reconsider it. The question I would
    have technically is if I opt in for all of it, each time
    Netflix brings me a movie, do I have the option to opt out of
    that? In other words, do I have a default button that goes out?
        Mr. Wolf. Again, I think the opt-out option ought to be
    easy, but, you know, there are people who have webcams and they
    leave them on all the time, and some people think that is ill-
    advised, they are oversharing, it invades their privacy.
    Imagine a law that Congress passes that says that the webcam as
    a matter of law will be turned off once every 24 hours, and you
    have to make the choice to turn it back on. That just has never
    been the business of Congress to tell people how they publish,
    how they share, and with whom they share. Privacy is about
    allowing people that choice.
        Senator Coburn. Again, I do not say your arguments do not
    carry large weight. I am just saying in terms of effectuating
    the protection of privacy, how are we going to do that? Let us
    say we go to this and we are going to have an opt-in. Where are
    the details on the opt-out?
        Mr. Wolf. Well, I agree, that needs to be----
        Senator Coburn. It is not in there.
        Mr. Wolf. That needs to be specified. But I really caution
    against the slippery slope of controlling every kind of
    information and every kind of technology in terms of how people
    share.
        Senator Coburn. We are not controlling it. What we are
    saying is you got to make a choice, and, you know, the
    question----
        Mr. Wolf. But only the choice you want them to make, not
    the choice that is available as to other information.
        Senator Coburn. No, no. There are two choices: opt in or
    opt out. The point is you got to still make the choice with
    your privacy, and I think there is a legitimate concern that if
    you opt in, will you have the same presence and available
    information to opt out. So the question I would have of Netflix
    is, if you have this or where you have it in Europe, does
    somebody every movie have an opportunity to opt out?
        Mr. Hyman. On the current implementation in Europe, there
    is an opt-out, do not share opportunity, beginning----
        Senator Coburn. Every time?
        Mr. Hyman. Every time. As Mr. Wolf pointed out, certain
    devices because technologically do not support that, it is not
    available on every device. It is available through the computer
    on every device, and you can unshare afterwards. But the
    implementation that we have made is you start the movie, the
    presumption is sharing, and there is a ``do not share'' button
    that you can click afterwards, right when the movie starts.
    Anytime you deal with the movie, you can elect to not share.
    And then after the movie is displayed on Facebook, you can go
    back and adjust your setting within Netflix to unshare that.
    There are also sharings that you can do in the Facebook side.
        Senator Coburn. So here is my question: What is the
    difference between an unshare opt-out and a share opt-out? They
    are both asking the same question. One is a presumption you are
    going to share all the time, but you are still making a
    decision each movie, unshare or not unshare.
        Mr. Hyman. Well, one is opt in and one is opt out.
        Senator Coburn. Yes, but the point is the decision for
    privacy is still made individually on every movie that they
    send down the stream. So what is the difference of having an
    opt-in or an opt-out? It defeats your whole argument. They have
    the same thing.
        Mr. Wolf. It does not defeat my argument, because I do not
    think it should be a matter of law.
        Mr. Hyman. I was going to say, I was going to echo--that is
    our implementation. Under the H.R. 2471, that is not required
    under law.
        Senator Coburn. I understand that.
        Mr. Hyman. We have done that because that is what we
    believe consumers want. I think the issue for us at the highest
    level is really an informed consent. I think most everyone on
    this panel agrees, I think, philosophically on making sure that
    consumers understand what information they are disclosing or
    how their information is being handled. So at the high level, I
    think we are all coming to it from the same approach. I think
    there is a philosophical difference that in some way you
    highlighted on: Is it opt in, is it opt out, or is it--you
    know, how does Congress control the way in which consumers can
    share, are available to share? The presumption that we are
    trying to advocate for in connection with supporting H.R. 2471
    is that it is really within the consumer's control to elect to
    do that if they so desire. It is an opt-in mechanism, and it is
    one in which they should be able to get informed consent.
        I think there is a question on this panel of whether or not
    consumers can ever give informed consent. On our side, I think
    we would take the position that, yes, consumers can give
    informed consent. And, in fact, under the legislation there is
    a specific opt-out so that it is not buried in some terms of
    use, which we are in support of. So the issue about----
        Senator Coburn. But if privacy is so important and if
    everybody at the table supports that, what is wrong with having
    the reminder that you are sharing your privacy? If it is that
    much of a value, if personal property rights and privacy rights
    are that important, what is wrong with having a reminder that
    you are giving away your privacy rights? If it is a value to be
    protected, if it is a virtue to be protected, your privacy,
    then what is wrong with the government saying there should be a
    reminder that you are giving your privacy away? What is wrong
    with that?
        Mr. Wolf. There ought to be reminders, and government ought
    to support education of consumers through cyber education of
    kids to tell them what harm they might do themselves online by
    sharing TMI. But the number of reminders one would need every
    day would be in the thousands----
        Senator Coburn. I do not need any reminders because I do
    not share anything.
        [Laughter.]
        Mr. Wolf. You are sharing your ideas right here, Senator.
        Senator Coburn. But the point is I have to, under the
    ethics law, fill out forms at the end of every year, and I have
    to get that. As a part of participating in the Senate, there
    are certain things I have to do as part of my responsibility.
    But the point is, if privacy is of that value and you value
    that privacy and the protection of that privacy, what is wrong
    with us saying you need to have a reminder, to me, the
    Chairman, a 12-year-old, that you need to have a prompt to say
    you are giving away your privacy?
        Mr. Wolf. So I can imagine someone opening up their mobile
    phone and they are about to talk in a public place and there is
    a law in Congress that says a pop-up has to appear that says,
    ``You are in a public place. This is a reminder that you may be
    revealing private information about yourself. Click here to
    proceed.''
        Senator Coburn. You can imagine that. Again----
        [Laughter.]
        Mr. Wolf. Well, it is not so far away from what you are
    describing, Senator, because if we are going to require it for
    videos, there is no reason why we would not require it for all
    the other information that people choose to share. That is the
    world we live in. Certainly they should be given the right not
    to share, and they should be given the choice not to share. But
    I really do not think it is the job of Congress on such a
    granular basis to make that choice so difficult.
        Senator Coburn. Well, what is difficult? They are having to
    pop the button now to say do not share. There is no difference.
    They are hitting the button share and unshare right now, so
    what is difficult about saying share versus unshare?
        Mr. Wolf. I actually do not know what the experience has
    been in Europe with that and whether consumers object to it,
    whether they think it interferes with their experience or not.
        Senator Coburn. He just testified that his consumers wanted
    that.
        Mr. Wolf. I know it is available.
        Mr. Hyman. One issue, Senator, is that technology changes
    over time. So in order to implement that technology today, we
    are able to do it on certain devices. On other devices we are
    not able to do it. You know, and older legacy devices, we
    cannot go back and change those because of the way they have
    been designed. So, you know, people who have paid for some of
    our devices before now will not be able to take advantage of
    that feature because we cannot give them opt-out every time
    because Congress has told us we have to give them an opt-out
    every time?
        I think the issue for us, again, is, you know, giving that
    control to the consumer, and if the consumer so elects to share
    on an ongoing basis, and perhaps even you could say to opt out
    of the notice to unshare, if they do not want to be bothered by
    it every time because that is inconvenient for them, they have
    chosen to give their movie watching onto Facebook or other
    social media platforms, should it be a law that they cannot do
    that? And I think from our perspective, it is very important
    that the consumers understand what they are doing and be given
    a choice. But to dictate exactly how that is implemented,
    especially in a dynamically changing environment in technology,
    I think it is important to be careful.
        Senator Coburn. So what is wrong with what you just
    suggested, is you have an ability to opt out and then you have
    the ability to opt out of the opt-out question? What is wrong
    with that?
        Mr. Hyman. Fundamentally, I think that is fine, as long as
    you can get to the--you know, the way in which the process
    works, as long as----
        Senator Coburn. Let me say it again. I am going to give you
    consent, Netflix, to share my movies. And then when a movie
    comes up, do you want to opt out? Or would you like to not see
    this screen again for six months and let all your sharing
    continue in your opt-in? In other words, for those that want to
    share everything, do not send me the reminder.
        Mr. Hyman. If that is what consumers want the way in which
    we would implement it, I am fine doing it. I have a little bit
    of trouble having that being legislated because I think over
    time that may change. It may be that six months is not the
    right amount of time. Is it three months? Is it a year? Is it
    never for certain people?
        So in that sense, I think, from my perspective--I think the
    fundamental of taking a principle-based approach of consumers
    having control and consumers understanding what they are opting
    into or not opting into at their choice is the important thing
    that, you know, we as a people and you as legislators ought to
    focus on that fundamental.
        And then the way in which it gets implemented, because
    things change over time, given technology, given the way people
    share and change, that should be somewhat left to being
    implemented.
        Senator Coburn. OK, great point. Thank you, Mr. Chairman.
    Sorry I went over.
        Senator Franken. Not at all. I thought that was a very good
    line of questioning. I think it brought out a lot of great
    things, and we may not go to a second round because I was
    afraid that the Ranking Member would not be able to get enough
    time if he only got one round. But the Ranking Member went into
    a lot of great points, started early with an alcoholic husband
    who is afraid of his wife. I thought that was a good point. You
    might have a hangover and watch something his wife does not
    approve of. I thought that was a very good point.
        That is a joke. I was kidding.
        [Laughter.]
        Senator Franken. I think----
        Senator Coburn. I am just not old enough to appreciate your
    humor.
        Senator Franken. No, I do not think it is that. I think
    that was probably--I think that joke curved foul.
        [Laughter.]
        Senator Franken. But I think we do not need another round,
    but I think we--unless anyone wants to respond to a couple of
    observations I have here, because I think, Mr. Hyman, you said
    that it would not be buried in the terms of agreement, the
    ability to opt out. We do not know that. This piece of
    legislation does not say at all how opting out would work.
        Mr. Hyman. Actually, in 2471, there is a specific provision
    that was added in an amendment that said the actual agreement
    to share has to be separate and distinct from other legal and
    financial terms.
        Senator Franken. Yes, but not to opt out of the agreement.
        Mr. Hyman. Correct. The opt-out is not.
        Senator Franken. So that is the point. And you said that
    that would not be buried in the terms of agreement, and you
    talked yourself about how this is voluntary, and you were
    uncomfortable with that being in the law. This is voluntary
    because Netflix does what you do in Europe, but no other
    company would have to do it.
        So I think that you underscore the point that the Ranking
    Member was making, which is it could be incredibly difficult to
    find out how to opt out of this once you have agreed--once you
    are sharing everything. I see Professor McGeveran nodding his
    head. I wonder if you have any thoughts on that.
        Mr. McGeveran. I am just agreeing. The Nadler amendment
    that was passed in the House bill does set up some specific
    requirements for how the original blanket consent has to be
    effectuated, but the bill is silent about what will be required
    to withdraw that consent later on if you decided you did not
    want a particular movie to be shared with your friends or that
    you wanted to cancel the previous authorization. It just does
    not say anything at all about how that would happen.
        Senator Franken. Right, and, you know, I think that, again,
    Netflix in Europe, where it can, on the devices where it works,
    gives people a clearer way to do that, but less scrupulous
    companies under the law would not be required to do that, and
    you would have to go through the terms and conditions, which
    can be pages and pages long, which none of us except for
    Professor McGeveran actually read.
        Mr. Wolf. I read them, too, Senator.
        Senator Franken. OK, but they are privacy lawyers. Come on.
    No one reads those things. And I think that we almost got to
    the point of absurdity when--of course, you know, you do not
    have to be reminded that when you talk on your phone in public,
    we are not going to make it a law that, you know, someone could
    overhear you. And to reach for that kind of underscores, I
    think, sort of the common sense of if it is just as easy to
    click one button that says, ``I want to share,'' you know,
    ``watch and share,'' as opposed to ``watch,'' it is no more
    burdensome to share each time on a one-by-one basis, as the
    original law claims, as opposed to having a consumer of a movie
    basically agree to sharing and then not be able to find where
    to opt out of that because it is buried in some place in the
    terms of agreement. No one has disputed that that is not
    written--that that is in the law to dictate that you can find
    it.
        So I want to work with the Ranking Member on this because I
    think he really got to the gist of this, which is that we have
    to find--when you mentioned 30 days or 60 days or six months or
    something like that, I think maybe you could find a thing where
    someone says, ``You know what? For the next 30 days, just share
    everything I like, and then remind me in 30 days,'' or
    something like that. I mean, I just think that this was kind of
    rushed through the Hous, maybe, and that we need to work on
    this----
        Senator Coburn. I am happy to work with you.
        Senator Franken. Great. OK. So I am going to adjourn, and I
    know I am--I do not chair that much, so let me find--the record
    will be held open for a week.
        [Laughter.]
        [Whereupon, at 11:30 a.m., the Subcommittee was adjourned.]
        [Questions and answers and submissions for the record
    follows.]

                                A P P E N D I X

                  Additional Material Submitted for the Record

    [GRAPHIC] [TIFF OMITTED] T7342.001

                  Prepared Statement of Hon. Patrick J. Leahy

    [GRAPHIC] [TIFF OMITTED] T7342.002

    [GRAPHIC] [TIFF OMITTED] T7342.003

                        Prepared Statements of Witnesses

    [GRAPHIC] [TIFF OMITTED] T7342.004

    [GRAPHIC] [TIFF OMITTED] T7342.005

    [GRAPHIC] [TIFF OMITTED] T7342.006

    [GRAPHIC] [TIFF OMITTED] T7342.007

    [GRAPHIC] [TIFF OMITTED] T7342.008

    [GRAPHIC] [TIFF OMITTED] T7342.009

    [GRAPHIC] [TIFF OMITTED] T7342.010

    [GRAPHIC] [TIFF OMITTED] T7342.011

    [GRAPHIC] [TIFF OMITTED] T7342.012

    [GRAPHIC] [TIFF OMITTED] T7342.013

    [GRAPHIC] [TIFF OMITTED] T7342.014

    [GRAPHIC] [TIFF OMITTED] T7342.015

    [GRAPHIC] [TIFF OMITTED] T7342.016

    [GRAPHIC] [TIFF OMITTED] T7342.017

    [GRAPHIC] [TIFF OMITTED] T7342.018

    [GRAPHIC] [TIFF OMITTED] T7342.019

    [GRAPHIC] [TIFF OMITTED] T7342.020

    [GRAPHIC] [TIFF OMITTED] T7342.021

    [GRAPHIC] [TIFF OMITTED] T7342.022

    [GRAPHIC] [TIFF OMITTED] T7342.023

    [GRAPHIC] [TIFF OMITTED] T7342.024

    [GRAPHIC] [TIFF OMITTED] T7342.025

    [GRAPHIC] [TIFF OMITTED] T7342.026

    [GRAPHIC] [TIFF OMITTED] T7342.027

    [GRAPHIC] [TIFF OMITTED] T7342.028

    [GRAPHIC] [TIFF OMITTED] T7342.029

    [GRAPHIC] [TIFF OMITTED] T7342.030

    [GRAPHIC] [TIFF OMITTED] T7342.031

    [GRAPHIC] [TIFF OMITTED] T7342.032

    [GRAPHIC] [TIFF OMITTED] T7342.033

    [GRAPHIC] [TIFF OMITTED] T7342.034

    [GRAPHIC] [TIFF OMITTED] T7342.035

    [GRAPHIC] [TIFF OMITTED] T7342.036

    [GRAPHIC] [TIFF OMITTED] T7342.037

    [GRAPHIC] [TIFF OMITTED] T7342.038

    [GRAPHIC] [TIFF OMITTED] T7342.039

    [GRAPHIC] [TIFF OMITTED] T7342.040

    [GRAPHIC] [TIFF OMITTED] T7342.041

        Questions for William McGeveran Submitted by Senator Al Franken

    [GRAPHIC] [TIFF OMITTED] T7342.042

          Questions for Marc Rotenberg Submitted by Senator Al Franken

    [GRAPHIC] [TIFF OMITTED] T7342.043

           Questions for David Hyman Submitted by Senator Tom Coburn

    [GRAPHIC] [TIFF OMITTED] T7342.044

    [GRAPHIC] [TIFF OMITTED] T7342.045

         Questions for Christopher Wolf Submitted by Senator Tom Coburn
    [GRAPHIC] [TIFF OMITTED] T7342.046

                             Questions and Answers

        NOTE: At the time of printing, after several attempts to
    obtain responses to the written questions, the Committee had
    not received any communication from William McGeveran.

        NOTE: At the time of printing, after several attempts to
    obtain responses to the written questions, the Committee had
    not received any communication from Marc Rotenberg.

     Responses of David Hyman to Questions Submitted by Senator Tom Coburn

    [GRAPHIC] [TIFF OMITTED] T7342.047

    [GRAPHIC] [TIFF OMITTED] T7342.048

    [GRAPHIC] [TIFF OMITTED] T7342.049

    [GRAPHIC] [TIFF OMITTED] T7342.050

    [GRAPHIC] [TIFF OMITTED] T7342.051

    [GRAPHIC] [TIFF OMITTED] T7342.052

    [GRAPHIC] [TIFF OMITTED] T7342.053

      Responses of Christopher Wolf to Questions Submitted by Senator Tom
                                     Coburn

    [GRAPHIC] [TIFF OMITTED] T7342.054

    [GRAPHIC] [TIFF OMITTED] T7342.055

    [GRAPHIC] [TIFF OMITTED] T7342.056

    [GRAPHIC] [TIFF OMITTED] T7342.057

                    Miscellaneous Submissions for the Record

    [GRAPHIC] [TIFF OMITTED] T7342.058

    [GRAPHIC] [TIFF OMITTED] T7342.059

    [GRAPHIC] [TIFF OMITTED] T7342.060

    [GRAPHIC] [TIFF OMITTED] T7342.061

    [GRAPHIC] [TIFF OMITTED] T7342.062

    [GRAPHIC] [TIFF OMITTED] T7342.063

    [GRAPHIC] [TIFF OMITTED] T7342.064