[Senate Hearing 112-869]
[From the U.S. Government Publishing Office]
S. Hrg. 112-869
THE VIDEO PRIVACY PROTECTION ACT: PROTECTING VIEWER PRIVACY IN THE 21ST
CENTURY
=======================================================================
HEARING
before the
SUBCOMMITTEE ON PRIVACY,
TECHNOLOGY AND THE LAW
of the
COMMITTEE ON THE JUDICIARY
UNITED STATES SENATE
ONE HUNDRED TWELFTH CONGRESS
SECOND SESSION
__________
JANUARY 31, 2012
__________
Serial No. J-112-59
__________
Printed for the use of the Committee on the Judiciary
U.S. GOVERNMENT PRINTING OFFICE
87-342 WASHINGTON : 2012
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing Office,
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, U.S. Government Printing Office. Phone 202�09512�091800, or 866�09512�091800 (toll-free). E-mail, [email protected].
COMMITTEE ON THE JUDICIARY
PATRICK J. LEAHY, Vermont, Chairman
HERB KOHL, Wisconsin CHUCK GRASSLEY, Iowa
DIANNE FEINSTEIN, California ORRIN G. HATCH, Utah
CHUCK SCHUMER, New York JON KYL, Arizona
DICK DURBIN, Illinois JEFF SESSIONS, Alabama
SHELDON WHITEHOUSE, Rhode Island LINDSEY GRAHAM, South Carolina
AMY KLOBUCHAR, Minnesota JOHN CORNYN, Texas
AL FRANKEN, Minnesota MICHAEL S. LEE, Utah
CHRISTOPHER A. COONS, Delaware TOM COBURN, Oklahoma
RICHARD BLUMENTHAL, Connecticut
Bruce A. Cohen, Chief Counsel and Staff Director
Kolan Davis, Republican Chief Counsel and Staff Director
------
Subcommittee on Privacy, Technology and the Law
AL FRANKEN, Minnesota, Chairman
CHUCK SCHUMER, New York TOM COBURN, Oklahoma
SHELDON WHITEHOUSE, Rhode Island ORRIN G. HATCH, Utah
RICHARD BLUMENTHAL, Connecticut LINDSEY GRAHAM, South Carolina
Alvaro Bedoya, Democratic Chief Counsel
Elizabeth Hays, Republican Chief Counsel
C O N T E N T S
----------
STATEMENTS OF COMMITTEE MEMBERS
Page
Franken, Hon. Al, a U.S. Senator from the State of Minnesota..... 1
Coburn, Hon. Tom, a U.S. Senator from the State of Oklahoma...... 4
Leahy, Hon. Patrick J., a U.S. Senator from the State of Vermont. 7
prepared statement........................................... 28
WITNESSES
Watt, Melvin L., a Representative in Congress from the State of
North Carolina................................................. 4
prepared statement........................................... 30
Hyman, David, General Counsel, Netflix, Inc., Los Gatos,
California..................................................... 10
prepared statement........................................... 42
McGeveran, William, Professor, University of Minnesota Law
School, Minneapolis, Minnesota................................. 11
prepared statement........................................... 45
Rotenberg, Marc, Executive Director, Electronic Privacy
Information Center, Washington, DC............................. 13
prepared statement........................................... 51
Wolf, Christopher, Director, Privacy and Information Management
Group, Hogan Lovells LLP, Washington, DC....................... 15
prepared statement........................................... 63
QUESTIONS
Questions for William McGeveran submitted by Senator Al Franken.. 68
Questions for Marc Rotenberg submitted by Senator Al Franken..... 69
Questions for David Hyman submitted by Senator Tom Coburn........ 70
Questions for Christopher Wolf submitted by Senator Tom Coburn... 72
QUESTIONS AND ANSWERS
Statement of no response for William McGeveran and Marc Rotenberg 73
Responses of David Hyman to questions submitted by Senator Coburn 74
Responses of Christopher Wolf to questions submitted by Senator
Coburn......................................................... 81
SUBMISSIONS FOR THE RECORD
American Civil Liberties Union, Laura W. Murphy, Director,
Washington Legislative Office and Christopher Calabrese,
Legislative Counsel, Washington, DC, January 31, 2012, joint
letter......................................................... 85
Entertainment Merchants Association, Crossan R. Andersen,
President & CEO, Encino, California, December 13, 2011, letter. 90
THE VIDEO PRIVACY PROTECTION ACT: PROTECTING VIEWER PRIVACY IN THE 21ST
CENTURY
----------
TUESDAY, JANUARY 31, 2012
U.S. Senate,
Subcommittee on Privacy, Technology, and the Law,
Committee on the Judiciary,
Washington, DC.
The Subcommittee met, pursuant to notice, at 10:02 a.m., in
Room SD-226, Dirksen Senate Office Building, Hon. Al Franken,
Chairman of the Subcommittee, presiding.
Present: Senators Franken, Leahy, and Coburn.
OPENING STATEMENT OF HON. AL FRANKEN, A U.S. SENATOR FROM THE
STATE OF MINNESOTA
Senator Franken. This hearing will come to order. It is my
pleasure to welcome all of you to the third hearing of the
Senate Judiciary Subcommittee on Privacy, Technology, and the
Law.
Now, before we start, I just want to applaud the Supreme
Court for its decision in the Jones case. It was, I believe,
the right result, but it was also a call to action to Congress
because, while law enforcement now needs a warrant to track
your location, all of the companies that get your location
information almost every day--your smartphone company, your in-
car navigation company, and even the apps on your phone--are
still in most cases free to give out your location to whomever
they want, as long as it is not the Government. I have a bill
to fix that, and I think we need to take action on it right
away.
But today's hearing will focus on the Video Privacy
Protection Act, a powerful privacy law that was written and
passed by Chairman Leahy and Ranking Member Grassley of the
full Judiciary Committee. I want to use this hearing to make
sure that everyone knows what the Video Privacy Protection Act
is and how it protects our privacy and our civil liberties. I
want to look at how we might update the Video Privacy
Protection Act for the 21st century, and I want to look at a
specific bill to amend the law that was just passed in the
House.
Twenty-five years ago, Judge Robert Bork was before the
full Senate Judiciary Committee as a nominee to the Supreme
Court. During that hearing, a local reporter asked Judge Bork's
video store for a record of the movies he had watched. There
was no law against it, so the video store gave him the records,
and the reporter wrote a story about them. The Senate Judiciary
Committee was split on Judge Bork's nomination, but it was
unanimous in its outrage over what had happened. There was not
anything particularly memorable about Judge Bork's movie
rentals. In fact, they consisted primarily of mysteries and
caper films. But that was not the point. The point was that the
movies we choose to watch are our business and not anyone
else's.
Soon after this, Senator Leahy and Senator Grassley
introduced the Video Privacy Protection Act. The bill was
reported out of the Committee unanimously and passed through
the Senate and the House on voice votes.
There has been renewed interest in the Video Privacy
Protection Act in recent months, and I think that is great. But
I have seen a lot of people talking about the law like it was
some kind of relic, something that is so outdated that it does
not make any sense anymore. So I want to take a moment to
explain in simple terms what this law does for consumers.
Thanks to the Video Privacy Protection Act, your video
company cannot tell other people what you are watching unless
you give them permission to do that. Now, when Chairman Leahy
and Senator Grassley wrote the law, they were really smart
about it, if I might say. They did not just say that a video
company has to at some point get you to sign some form that
says, ``I am OK with you telling people what I watch.'' No.
They said that every time a video company wants to tell people
what you watch, they have to check with you first. And that is
an important right, because you probably do not care if people
know that you watched some summer blockbuster. But if you are
suddenly having trouble with your marriage and you are trying
to get help, you might not want your friends and relatives to
find out that you have been watching videos about marriage
counseling or divorce. I also think that parents of a young
child may want to watch documentaries about autism or
developmental disabilities without broadcasting that to the
world.
This can be really sensitive stuff, and that is why the
Video Privacy Protection Act is so important. It gives you the
right to tell your video company what can be shared and what
cannot.
The Video Privacy Protection Act also protects your private
sector against the government. Under the law, if the government
wants to get your viewing records, it has to get a warrant, a
grand jury subpoena, or a court order. This came up in one
famous case where a local police department thought that the
1979 movie ``The Tin Drum'' was obscene. Now, mind you, this
was a movie about what happened in Nazi Germany just before
World War II. It won an Oscar for best foreign film. But the
police department went out and seized a list of everyone who
had the movie and then drove around confiscating every copy.
And in that case, the ACLU chapter in the Ranking Member's
State of Oklahoma used the Video Privacy Protection Act to stop
that.
And so, without objection, I will add to the record a
letter from the American Civil Liberties Union that stresses
that this is a civil liberties law, too, not just a consumer
protection law.
[The letter appears as a submission for the record.]
Senator Franken. The Video Privacy Protection Act also
makes sure that video companies do not keep information about
what you have watched after that information is no longer
needed. This protects that information from getting lost,
stolen, or hacked.
Finally, the law gives people the right to have their day
in court to defend their rights if a video company or the
government violates these rights.
So the Video Privacy Protection Act is a really important
law for consumer privacy and for civil liberties, but things do
change in a quarter century, and I am calling this hearing to
see if we can update the law so that it can protect our privacy
for another 25 years.
One way we need to update this law is to make sure that it
is keeping up with technology. It used to be that if you wanted
to watch a video, you had to go to the video store or then wait
for it in the mail after that. Now you can stream it directly
to your computer in seconds. Streaming is the future of video,
but no judge has ever decided whether or not the Video Privacy
Protection Act covers streaming video companies. I think it is
clear that the law does cover new technologies like streaming
because it does not just cover ``prerecorded video cassette
tapes.'' It also covers ``similar audio-visual materials.''
But I do think there is a real risk that a judge might look
at this law and say it does not cover streaming, it just covers
DVDs and VHS tapes and things like that. So I do not want to
leave the future of video privacy up to a judge. So if we are
updating the Video Privacy Protection Act, I think we need to
confirm that it covers video streaming technology. I also know
that the courts are split about whether or not people have the
right to enforce the data retention provision. That might need
to be clarified as well.
Those are just two ideas. I am sure the witnesses will have
other suggestions. My goal here is to lay the groundwork for a
fair and comprehensive update of the entirety of this law.
Before I close, I want to touch on H.R. 2471, a recently
passed House bill that would modify one aspect of the Video
Privacy Protection Act. H.R. 2471 lets a video company ask for
your consent just once up front to disclose the videos you
watch instead of asking for consent on a case-by-case basis.
Netflix has strongly supported this bill and has explained that
it will make it easier for them to integrate into social media
sites like Facebook. I am pleased to report that Netflix is
here with us today to talk about their support.
I want to be honest. Based on what I have seen so far, I
have some reservations about H.R. 2471. First, it looks like
the bill will basically undo users' ability to give case-by-
case permission to a video company on what it can tell people
and what it cannot. And that worries me because case-by-case
consent, I believe, is a really good thing. It is a really good
thing that people can easily tell their video company, ``Sure,
go ahead and tell people I watched `The Godfather,' but, no, do
not tell them I watched `Yoga for Health, Depression, and
Gastrointestinal Problems.' ''
Senator Coburn. Is that one of----
Senator Franken. Yes, for the record, that is a real title
in the Netflix catalogue. And, by the way, it is an excellent
film.
[Laughter.]
Senator Franken. So I am worried that H.R. 2471 will
eliminate our ability to give case-by-case consent, but I am
also worried that this bill will make these changes without
confirming that streaming is covered or doing anything else to
strengthen the law for consumers.
Finally, I want to know how this bill will affect the Video
Privacy Protection Act's protections against government
snooping into our video records. But I am here to listen and to
learn more about this, and this is a hearing on all proposals
to update the Video Privacy Protection Act, not just H.R. 2471.
And we have two great panels for that, but before I introduce
them--do you want me to go to the Chairman first?
Chairman Leahy. I tell you what. We have Senator Coburn
here, and my----
Senator Coburn. I am happy to yield to the Chairman.
Chairman Leahy. No, no. I will yield to you and also to--I
know Congressman Watt, who has been such a leader in this, has
to get back to matters in the House, so I will wait until after
he has testified and, of course, I will follow the rest of you.
Senator Franken. We will go to the Ranking Member, Senator
Coburn, for his remarks. Thank you, Senator.
STATEMENT OF HON. TOM COBURN, A U.S. SENATOR FROM THE STATE OF
OKLAHOMA
Senator Coburn. Mr. Chairman, thank you. I believe the
Video Privacy Protection Act has become antiquated given all
the new technology that is out there, and I would just note
that you right now can share your music preferences through
Spotify by setting up one time. You can share your book
preferences by signing up one time. You can share your
television programs through Hulu by signing up one time and
news articles through Social Reader by signing up one time.
I think the Chairman of the Subcommittee makes some good
points, and I am anxious to hear Congressman Watt and his
thoughts on this. I did have a chance to talk to your Ranking
Member yesterday and hear his input in it, and I look forward
to the input.
Thank you, Mr. Chairman.
Senator Franken. Thank you to the Ranking Member.
I think we will go to our first witness. That is what the
Chairman would like, and what the Chairman would like, the
Chairman gets. Our first witness is Hon. Melvin L. Watt, the
distinguished Representative for North Carolina's 12th
District. He has represented the people of the 12th District
since 1992. Representative Watt serves on the House Judiciary
Committee where he is the Ranking Member on the Subcommittee on
Intellectual Property, Competition, and the Internet. Prior to
his election to the House of Representatives, Representative
Watt practiced civil rights law for more than two decades. He
received his J.D. from Yale School and his B.S. from the
University of North Carolina.
Representative Watt, welcome, and the floor is all yours.
STATEMENT OF HON. MELVIN L. WATT, A REPRESENTATIVE IN CONGRESS
FROM THE STATE OF NORTH CAROLINA
Representative Watt. Thank you, Chairman Franken, Ranking
Member Coburn, Senator Leahy, and Members of the Subcommittee.
I am truly honored to have this opportunity to address the
Subcommittee about the amendments proposed in H.R. 2471 to the
Video Privacy Protection Act and consumer privacy in this
rapidly evolving Digital Age.
While I am the Ranking Member of the House Judiciary
Committee's Subcommittee on Intellectual Property, Competition,
and the Internet, the views I express here today are my
individual views, and I do not speak for the Committee or the
Subcommittee.
I believe there are countless reasons to oppose H.R. 2471,
which relate both to what the bill does and what it does not do
and how that fits into the broader debate about how best to
protect individual privacy in the volatile online environment.
It is particularly timely that the Subcommittee holds this
hearing today. Although online privacy has been at the
forefront of discussion for the past few years, there has been
a recent flurry of more intense discussion that I believe makes
your hearing timely. Business leaders, consumer advocates,
State and local elected representatives, and officials from
each branch of the Federal Government have all weighed in with
a variety of concerns and proposed solutions to address the
absence of a uniform framework or approach to safeguard
individual information in the thriving online environment.
Attention has appropriately intensified as two Internet
giants, Facebook and Google, have come under scrutiny for their
data uses, policies, and practices. Likewise, Netflix, the main
proponent of this bill, has had more than its fair share of
regulatory complaints and consumer lawsuits with regard to the
handling of user information.
In the coming weeks, both the FTC and the Department of
Commerce are expected to issue long-anticipated final reports
on online privacy policy based on a series of roundtable
discussions with relevant stakeholders and following up on
their initial studies in 2010.
Senators Kerry and McCain in the Senate and Representative
Cliff Stearns in the House last year introduced comprehensive
legislation designed to prescribe standards for the collection,
storage, use, retention, and dissemination of users' personally
identifiable information, and these bills generated debate more
generally in the halls of Congress.
This Subcommittee also held hearings to address the
security of sensitive health records and personal privacy on
mobile devices, and last week, in deciding whether GPS tracking
violates a criminal defendant's Fourth Amendment right against
unreasonable search and seizure, a majority of the Justices of
the Supreme Court acknowledged the challenges we confront as a
society in determining the so-called new normal for privacy
expectations in the Digital Age.
Against this backdrop, I will direct the remainder of my
comments to H.R. 2471, which passed the House under suspension
of the rules. While I may not always avail myself of all the
new technology and revolutionary tools and services available
over the Internet, let me say at the outset that I applaud the
explosion of technological advances that has transformed
forever the way we communicate and transact business. While I
support innovation on the Web, however, I cannot do so at the
expense of individual privacy. Given the gravity of issues
involved, I believe it was a mistake for this bill to move
through the House under the radar and without the benefit of a
single hearing. But my concerns are not just about process. I
believe that H.R. 2471 would have unintended negative
consequences for consumers as well as affected businesses that
will undoubtedly lose the confidence of their subscribers with
the first privacy violation or data breach. Consumer desire to
have access to the next cool tool should not be mistaken for
the voluntary surrender of fundamental privacy interests.
In addition to the lack of thoughtful process in the House,
I believe there are at least four substantive problems with
H.R. 2471.
First, the bill leaves unaddressed the question of who the
bill applies to, which I believe creates collateral, but
important, intellectual property enforcement concerns. By
declining to define what constitutes a videotape service
provider under the VPPA, H.R. 2471 leaves open the possibility
that businesses that provide video on demand over the Internet
or those with dual distribution platforms like Netflix can
avoid or delay compliance with legitimate discovery requests in
copyright infringement actions.
Second, the debate on H.R. 2471 centered on the online
experiences of consumers with social media like Facebook.
However, the bill as passed applies to physical and online
videotape service providers alike, and disclosures are
authorized to any person, not on friends on Facebook.
Consequently, a consumer's private information is vulnerable to
release to third parties like the news reporter who published
the video rental history of Judge Robert Bork that paved the
way to enactment of the Video Privacy Protection Act.
Third, despite claims that the Video Privacy Protection Act
is outdated, only a single provision of the statute was
updated, leaving consumer-oriented provisions that should have
been reviewed and strengthened unaltered.
Fourth, and finally, no consideration was given to the
effect that changes in the Video Privacy Protection Act will
have on State laws that afford similar and sometimes broader
protections to consumers. This oversight is likely to invite
thorny conflict of laws disputes given the borderless
boundaries of the Internet.
While Internet users have a responsibility to self-censor
and restrict the information they share about themselves, the
reality is that many online users have a false sense of privacy
due to their lack of understanding of lengthy and complex
privacy policies they are compelled to agree to in order to use
the service. As a result, online users often share a lot of
personal information unknowingly and to unintended audiences. I
do not believe that unsuspecting, unsophisticated, or casual
Internet users should be deemed to relinquish their right to a
basic level of privacy. And my concerns are heightened even
more when the user is a vulnerable teen or young adult whose
ability to adequately assess risk has not fully matured.
Third-party access to dynamic social platforms are
constantly in flux. A consumer's consent today to allow
perpetual access to their viewing history is clearly not
informed by who will be their friend tomorrow. Today, when
online bullying of teens and young adults can lead to
depression or even suicide and online predators can learn
otherwise confidential, private information about their prey, I
believe the selective and piecemeal amendment of the Video
Privacy Protection Act is irresponsible.
As one commentator has written, movie and rating data
contains information of a more highly personal and sensitive
nature. The member's movie data exposes a member's personal
interest and/or struggles with various highly personal issues,
including sexuality, mental illness, recovery from alcoholism,
and victimization from incest, physical abuse, domestic
violence, adultery, and rape.
Justice Marshall wrote years ago that ``Privacy is not a
discrete commodity, possessed absolutely or not at all.'' The
objective is to strike an appropriate balance to develop
meaningful protections for consumers while promoting a healthy
online economy. I do not believe that H.R. 2471 has found that
appropriate balance. I support a comprehensive online privacy
plan that will address and mitigate the unintended consequences
of third-party sharing. In that regard, I believe Justice Alito
got it right when he said: ``In circumstances involving
dramatic technological change, the best solution to privacy
concerns may be legislative. A legislative body is well
situated to gauge changing public attitudes, to draw detailed
lines, and to balance privacy and public safety in a
comprehensive way.''
This hearing is an important step toward finding the right
balance, and it is more critically important because the House
failed to give the matters the kind of attention they required.
I thank the Chairman for this opportunity and look forward
to working across the Capitol to move forward. Thank you so
much.
[The prepared statement of Representative Watt appears as a
submission for the record.]
Senator Franken. Thank you, Representative Watt, and the
purpose of this is to give a hearing to all these matters and
issues. Your complete written testimony will be made part of
the record.
We are fortunate to have with us Chairman Leahy, who is the
author of the Video Privacy Protection Act, and I understand
that I left out Alan Simpson's role when I touted----
Chairman Leahy. Alan was very important in that.
Senator Franken. OK, so I apologize for that. He is a good
friend. Today this law, the Video Privacy Protection Act, is
just one of several critical privacy laws that the Chairman has
written and passed during his tenure in the Senate, so I turn
it over to the Chairman.
STATEMENT OF HON. PATRICK J. LEAHY, A U.S. SENATOR FROM THE
STATE OF VERMONT
Chairman Leahy. I thank you very much, and it is good to
see my friend Congressman Watt. We have worked together on so
many things, from privacy issues to the Voting Rights Act, and
I appreciate that collaboration.
I should tell Chairman Franken--and I thank him for his
responsible leadership he has done on this issue of privacy--we
Vermonters come about it naturally. I see a smile from a friend
of mine in the audience who probably has heard this story more
than once, but one of the few things I have ever saved written
about me in the press--and I actually framed it--was a sidebar
to a New York Times profile.
Now, to put this in perspective, you have to understand, my
wife and I live in an old farmhouse in Vermont on a dirt road.
We celebrated our--well, actually had part of our honeymoon
there nearly 50 years ago, 50 years ago this summer. And
hundreds of acres of land and fields that have been hayed and
watched over by an adjoining farmer's family from the time I
was a teenager, and they have known me since then.
So the whole story goes like this: On a Saturday morning, a
reporter in an out-of-State car sees this farmer sitting on the
porch and asks, ``Does Senator Leahy live up this road?''
He said, ``Are you a relative of his?''
He said, ``No, I am not.''
``Are you a friend of his?''
``No, not really.''
``He expecting you?''
``No.''
``Never heard of him.''
Now, we like our privacy in Vermont. In the Digital Age,
ensuring the right to privacy is critical. But I think it
becomes ever more difficult as our Government and businesses
collect and store and mine and use our most sensitive personal
information for their own purposes--not ours, but theirs.
Whether it is sensitive medical records, private financial
information, or personal thoughts and feelings, I have worked,
as so many others on this Committee have, to ensure that
Americans' privacy rights are respected.
We talked about the Video Privacy Protection Act from 1988.
When I introduced the bill, I said that it was intended to help
make all of us a little freer to watch what we choose, without
public scrutiny. More recently, I have worked at protections
for library and book seller records in Section 215 of the USA
PATRIOT Act.
Now, it is true that technology has changed, as the
Chairman mentioned that Justice Alito said, but I think we
should all agree that we have to be faithful to our fundamental
right to privacy and freedom. Today the social networking,
video streaming, the cloud, mobile apps, and other new
technologies have revolutionized the availability of Americans'
information. But they are also outpacing our privacy laws. That
is one of the things we have to think about.
So I continue to push to enact the Personal Data Privacy
and Security Act to create a nationwide data breach
notification standard and better combat cyber crime. That is
why I proposed a comprehensive review and update of the
Electronic Communications Privacy Act.
Recently some companies that dominate various aspects of
cyberspace have announced that they want to simplify matters so
that they can more easily track Americans' activities across
the board, obviously to their own financial benefit. But I
worry that sometimes what is simpler for corporate purposes is
not better for consumers. It might be simpler for some if we
had no privacy protections, if we had no antitrust protections,
if we had no consumer protections. It would be simpler for
some, but it certainly would not be better for Americans. And I
worry about a loss of privacy because of the claimed benefit of
simplicity.
Privacy advocates and elected representatives from both
sides of the aisle have serious concerns and serious questions.
We are looking for information and answers. When dominant
corporate interests entice a check-off in order to receive what
may seem like a fun new app or service, they may not be
presenting a realistic and informed choice to consumers. A one-
time check-off that has the effect of an all-time surrender of
privacy does not seem like the best course for consumers. I
worry that the availability of vast stores of information via
corporate data banks also makes this information readily
available to the government, which has almost unfettered power
to obtain information with an administrative subpoena and so-
called national security letters. So I think we need to have
comprehensive reform.
Now, Representative Mel Watt is a thoughtful leader on
these issues, and it is good that he is here, as well as those
from corporate America. But I am hearing from many privacy
advocates who have expressed concern about the privacy
implications of the House-passed proposal. A key concern is
that a one-time check-off of consent to disclose, mine, sell--
sell, sell--and share information does not adequately protect
the privacy of consumers. And the House's proposal updating the
law does not cover streaming and cloud computing to the extent
I would like. So we need to move forward with a comprehensive
review and update of the Electronic Communications Privacy Act
and also see how best to update to the Video Privacy Protection
Act.
I want to thank the Chairman for doing this, and I just
want to stress again that this Vermonter likes his privacy. And
I especially do not like it when somebody says, ``We are just
going to make life simpler if we sell your privacy.''
Senator Franken. Thank you, Mr. Chairman.
We are now going to go to the second panel. Thank you
again, Representative Watt. You were the first panel. Evidently
a single person can be a panel.
Senator Franken. If the panel would come forward, I would
like to introduce our second panel of witnesses.
David Hyman is the general counsel of Netflix. Mr. Hyman
has served in this role for the past decade and has seen the
company grow tremendously during that period. Prior to joining
Netflix, Mr. Hyman was the general counsel of Webvan, an
Internet-based grocery delivery service. He received both his
J.D. and B.A. from the University of Virginia.
Bill McGeveran is an associate professor of law at the
University of Minnesota, where he specializes in information
law, including digital identity and data privacy. Before
joining the university, he was a resident fellow at Harvard's
Berkman Center for Interest and Society and a litigator in
Boston. Professor McGeveran received his J.D. from NYU and his
B.A. from Carleton College in Minnesota. Finally, I should add
that Professor McGeveran was once a staffer for Senator Schumer
back in the days in the House of Representatives.
Marc Rotenberg is the executive director of the Electronic
Privacy Information Center, which he co-founded in 1994. He
chairs the American Bar Association Committee on Privacy and
Information Protection and has edited several privacy law
textbooks. Prior to founding EPIC--that is, again, the
Electronic Privacy Information Center, EPIC--Mr. Rotenberg was
counsel to Senator Leahy, where he advised the Senator on the
law that we are considering today, the Video Privacy Protection
Act. He received his J.D. from Stanford Law School and his B.A.
from Harvard College.
Christopher Wolf is the director of the privacy and
information management practice at Hogan Lovells here in
Washington, and he is also the founder and co-chair of the
Future of Privacy Forum. He was the editor and lead author of
the Practicing Law Institute's first treatise on privacy law
and has authored numerous publications on privacy. He received
his J.D. from Washington and Lee University and his A.B. from
Bowdoin College.
I want to thank you all for being here today. We will start
with Mr. Hyman.
STATEMENT OF DAVID HYMAN, GENERAL COUNSEL, NETFLIX, INC., LOS
GATOS, CALIFORNIA
Mr. Hyman. Chairman Franken, Ranking Member Coburn, thank
you for the opportunity to testify today on the Video Privacy
Protection Act. My name is David Hyman. I have served as the
general counsel of Netflix since 2002: a time when streaming
video over the Internet to a ``smart'' TV was more the stuff of
a sci-fi miniseries than a topic of serious consideration in a
board room, much less a Congressional hearing. How far we have
come in such a short period of time. Today's hearing is a
testimony to the incredibly dynamic and powerful innovation
engine of our Internet economy.
Netflix was founded in 1997 as a DVD-by-mail service. To
many, the use of the Internet and the Netflix Web site was
nothing more than a way to submit orders for physical disc
delivery. But for Netflix, we saw an opportunity to use
technology in a way that helped consumers discover movies and
TV shows they would love, as well as provide business
opportunities for content producers and distributors. The
popularity of our DVD-by-mail service grew rapidly. But with
innovation deeply rooted in our corporate DNA, we continued to
research and try new and compelling consumer offerings. We were
an early pioneer in the streaming of movies and TV shows over
the Internet to personal computers. And in 2008, we began to
deliver instant streaming video to televisions through the use
of a handful of Internet-connected devices. Today, more than 21
million consumers in the United States use the Netflix
streaming service on more than 700 different types of Internet-
connected devices, including game consoles, mobile phones, and
tablets. And in the last three months of 2011, we delivered
more than two billion hours of streaming movies and TV shows to
those consumers.
At the same time that the Netflix streaming service has
seen such uptake by consumers, the world of social media has
exploded in popularity. Embodied by the growth of Facebook, the
social Internet offers tremendous opportunities for consumers
and businesses. Netflix believes that social media offers a
powerful new way for consumers to enjoy and discover movies and
TV shows they will love. To this end, we have been offering our
members outside the United States the opportunity to share and
discover movies with their friends through the Facebook
platform. While it is early in the innovation process, we have
seen strong consumer interest in our social application, with
more than half a million subscribers outside the United States
connected with Facebook.
Unfortunately, we have elected not to offer our Facebook
application in the United States because of ambiguities in the
Video Privacy Protection Act. Under this law, it is unclear
whether consumers can give ongoing consent to allow Netflix to
share the movies and TV shows they have instantly watched
through our service. The VPPA is an unusual law; unlike most
Federal privacy statutes, the VPPA could be read to prohibit
consumers who have provided explicit opt-in consent from being
able to authorize the disclosure on an ongoing basis of
information they so desire to share. The friction that this
ambiguity creates places a drag on social video innovation that
is not present in any other medium, including music, books, and
even news articles.
Recognizing this, the House recently passed a bipartisan
bill, H.R. 2471, that clarifies consumers' ability to elect to
share movies and TV shows they have watched on an ongoing
basis. H.R. 2471 leaves the opt-in standard for privacy within
the VPPA undisturbed. Netflix supports the opt-in standard and
believes that this approach is workable and consistent with our
members' expectations and desires.
The VPPA singles out one type of data sharing. Instead of
trying to graft specific notions about video privacy from
almost 25 years ago into the dynamic information age of today,
we would encourage a measured and holistic review of privacy
for the 21st century, one designed to foster continued
innovation while balancing the desires and privacy expectations
of consumers. Such a review will understandably take
considerable time and effort, and we are ready to assist. In
the interim, it is our hope that the Senate will see the value
in clarifying the right of consumers to opt in to ongoing
sharing under the VPPA and quickly approve H.R. 2471.
Again, I thank you for the opportunity to be here today,
and I look forward to your questions.
[The prepared statement of Mr. Hyman appears as a
submission for the record.]
Senator Franken. Thank you, Mr. Hyman.
By the way, your complete written testimony will be made
part of the record.
Professor McGeveran.
STATEMENT OF WILLIAM MCGEVERAN, PROFESSOR, UNIVERSITY OF
MINNESOTA LAW SCHOOL, MINNEAPOLIS, MINNESOTA
Mr. McGeveran. Thank you. Chairman Franken, Ranking Member
Coburn, and Members of the Subcommittee and staff, thank you
for inviting me to testify here today.
My name is William McGeveran. I am a law professor at the
University of Minnesota. My teaching and research focus on
Internet, privacy, and intellectual property law. In that
context, I have written about the Video Privacy Protection Act,
which I consider a model for privacy legislation more
generally.
Now, unquestionably, there are enormous benefits to the
online recommendations we get from friends through sources like
Facebook or Spotify, and I myself use social media and those
recommendations heavily. But the potential problems are serious
too, as others have noted. In one article, I argued that the
key to getting that balance right is securing genuine consent.
That means an individual sent a social message intentionally,
not by mistake. If we have too many accidental disclosures, we
undermine the privacy of personal matters and also the accuracy
of the recommendations, the fact that our friend really wants
us to see this movie rather than passively letting us know that
he saw it and it turns out maybe he did not like it very much.
The VPPA is designed to secure that sort of genuine consent.
I want to emphasize three points: first, the important
interests behind the VPPA; second, the fact that amendments are
not necessary to keep up with technology; and, finally, the
problems with H.R. 2471.
First, the VPPA safeguards important interests, as others
have noted. Why else did a newspaper reporter think Judge
Bork's rental history might be interesting in the first place
except that it would be revealing of something about him?
In my view, the greatest flaw in the existing VPPA is its
limitation to video, which arises from a historical accident
around its enactment. Unintended disclosure of a user's choices
of books, music, films, or Web sites can also constrain the
capacity to experiment and explore ideas freely. If the
Committee revisits this statute, I believe you should consider
extending protection to reading and listening habits as well as
viewing. That was part of the intent of the California Reader
Protection Act, which took effect at the beginning of the
month. In general, the law ought to protect private access to
any work covered by copyright, not just movies.
Second, the VPPA, in its current form, already allows video
companies to implement social media strategies, including, if
they wish, integration with Facebook. Now, it is true that the
VPPA requires opt-in consent every time a viewer's movie
choices get forwarded to a third party, and that includes
friends in a social network. That is not an ambiguity. That is
actually clearly what the law says.
But it is actually easier to satisfy those requirements
online than off. The statute's authors, after all, such as
Senator Leahy, envisioned a video rental store getting the
customer to sign a separate document with pen and paper every
time in person. On the Internet, by comparison, each time users
push the button to play a movie, they could be offered a ``play
and share'' button right alongside it allowing them to both
show the video and post that information in social networks.
I think it would be quite radical to assert that an
electronic format does not fulfill the requirement for written
consent under the statute. That interpretation would undermine
every clickwrap and ``I agree'' button that is on the Internet.
It is contrary to the E-SIGN Act and to all the case law I have
seen.
I think the real objection here is not about technology. It
is a disagreement with the VPPA's explicit policy choice to get
case-by-case consent rather than a one-time authorization.
Finally, I do want to note that H.R. 2471 has a lot of
problems and misses some opportunities for reasonable
compromise. I will just note a few.
Changes to the statute apply to every disclosure, not just
those in social networks. By rushing to address Netflix and
Facebook, the bill reduces privacy in many other settings, from
law enforcement to behavioral advertising. By specifically
mentioning the Internet, I am concerned the bill may foreclose
electronic consent through other technologies such as cable or
satellite, and that is a real concern.
The provision for withdrawing consent says nothing about
how it is supposed to be done. That vagueness may, apparently,
permit companies to comply by making it easy to give consent
but very cumbersome to withdraw that consent.
Most important, the bill passed by the House replaces a
robust consent provision with a very weak alternative. There
may be other ways to get genuine consent than what is offered
in the VPPA. For example, what about general authorization with
a short time limit, say one month, and granular, clear opt-out
for individual postings? I urge the Committee and the bill's
supporters to explore those sorts of creative compromises to
streamline the VPPA for the 21st century without vitiating its
important protection for individual privacy.
Thank you, and I look forward to questions.
[The prepared statement of Mr. McGeveran appears as a
submission for the record.]
Senator Franken. Thank you very much, Professor.
Mr. Rotenberg.
STATEMENT OF MARC ROTENBERG, EXECUTIVE DIRECTOR, ELECTRONIC
PRIVACY INFORMATION CENTER, WASHINGTON, DC
Mr. Rotenberg. Mr. Chairman, Senator Coburn, thank you very
much for the opportunity to testify today.
As you know, there are few issues of greater concern to
Internet users than the protection of privacy. In fact,
according to the Federal Trade Commission, over the past decade
the top concern of American consumers has been privacy and
identity theft, so the hearing that you are holding today is
very important, very timely, and of great concern to a lot of
people.
I wanted to begin by talking about the purpose and passage
of the Video Privacy Protection Act. As you suggested, Mr.
Chairman, in many ways this was a smart and forward-looking
piece of legislation. Among the various provisions that
Congress enacted 25 years ago was one that said let us not keep
personal information longer than is necessary. Today we have an
enormous problem in this country with data breaches, identity
theft, and companies keeping data on their customers and their
clients for much longer than they should. Fortunately, in this
area there are strong safeguards that have prevented and
protected users of these new services from those types of
problems.
What the Video Privacy Protection Act sought to do was to
deal with the new reality in video services. Prior to the mid-
1980s, as you know, most people watched broadcast television or
saw movies. There was very little collection of personal data
about individuals' particular movie preferences. And so when
the story broke about the access to Judge Bork's video rental
records, Congress appropriately said we need to put in place
some safeguards for that information that businesses were now
able to collect.
Now, the act establishes a strong presumption in favor of
privacy, but it is not a prohibition against disclosure.
Individuals always have the right to consent to disclosure. Law
enforcement has the right under a court order to get access to
records in the course of an interrogation. And even for
marketing purposes, personal information can be disclosed, and
this is the key provision that I would like to draw your
attention to, because there was an important compromise that
the Congress struck when they were considering the act. They
said when it comes to the fact that someone may happen to be a
customer of a video service, there really should be few
restrictions on disclosing that fact, and the privacy
protection was essentially an opt-out. Congress even said that
if the company wanted to disclose the fact that a person was
interested in science fiction movies or mystery movies or
action adventure, companies in those circumstances as well
could disclose those facts simply with the opt-out protection.
But when it came to the actual titles of particular movies
that would reveal so much about a person's personal interests
and the likes, Congress said, well, there we need a higher
level of protection. That should really be opt-in. And if a
person chooses in a particular case to disclose that
information, they should be free to do so, and the act allows
for it.
Now, I want to say very directly to Netflix that this
argument that they are making that this law somehow stands in
the way of integration with Facebook is simply not right. They
have the freedom today under the law to note when Netflix users
are using Netflix services. They can even go the next step and
talk about the types of movies that their customers are
viewing. What the law tries to do is establish a line at the
point that the company wants to say, ``And here is the
particular movie that one of our users is now viewing.'' That
is where the law says, please, in those circumstances, get opt-
in consent.
Now, I want to make a further point here because I actually
believe that many of the House members who voted for this bill
do not fully understand the consequence of the amendment. It is
not just the friends of that individual to whom the fact of the
specific movie viewing will be disclosed. It is also to Netflix
business partners, and it is also potentially to law
enforcement, because what Netflix is asking users to do is to
provide a blanket consent that gives them the opportunity to
disclose specific movie viewing to any party under any
circumstance that Netflix chooses to. This knocks out the
cornerstone of the act. It takes away the key provision that
was put in place to give users meaningful consent.
Obviously, I do not think this is going to support online
privacy and, frankly, I do not think Netflix users want this
provision. But I do think changes could be made to the act to
modernize it and to update it. I think it should be applied to
all streaming services. I think that data destruction provision
needs to be coupled to the private right of action. I would
also like to see more transparency so that users of the service
actually know how their personal information is being used, and
I think companies should be required to routinely encrypt the
data they collect. Those types of changes to the act actually
would update it, would continue to promote a viable and useful
service for many users, and I hope they will be considered by
the Committee.
Thank you.
[The prepared statement of Mr. Rotenberg appears as a
submission for the record.]
Senator Franken. Thank you, Mr. Rotenberg.
Mr. Wolf.
STATEMENT OF CHRISTOPHER WOLF, DIRECTOR, PRIVACY AND
INFORMATION MANAGEMENT GROUP, HOGAN LOVELLS LLP, WASHINGTON, DC
Mr. Wolf. Thank you, Chairman Franken, Ranking Member
Coburn, and Members of the Subcommittee. My name is Christopher
Wolf, and I am a privacy lawyer at Hogan Lovells, where I lead
that firm's global privacy practice. I am also a privacy
advocate. As part of my pro bono work, I won a leading case
against the government for violating the Electronic
Communications Privacy Act. I am part of a group advising the
OECD on its privacy guidelines. I am on the EPIC Advisory
Board, and I founded and co-chair the Future of Privacy Forum,
a think tank with advisory board members from business,
consumer advocacy and academia, focused on practical ways to
advance privacy. I am pleased that Professor McGeveran is a
member of that advisory board.
Fundamentally, privacy is about control. Indeed, a
principal goal of privacy law is to put choices and decisions
in the hands of informed consumers. With the advent of video
streaming and social sharing, the Video Privacy Protection
today stands in the way of consumers' exercising control and,
thus, limits their choices and even limits free expression.
The VPPA, enacted nearly a quarter of a century ago during
the Betamax era, was designed to prevent prying into people's
video rental history. The purpose of that law was not to stop
people from sharing information about the videos they watched
or to dictate how they share. Indeed, the law's laudable
purpose was to give control and choice to consumers, to let the
consumers decide whether and how to share their video-watching
information.
In 1988, when the VPPA was enacted, no one dreamed of
streaming video and social sharing. So when that pre-Internet
era law is applied to the world of online video and social
media, it can be read to frustrate the choices of consumers to
authorize the disclosure on an ongoing basis of the streaming
movies they have watched online.
For many people, automatic sharing in social media is how
they shape their online identities and how they share ideas.
Facebook users commonly utilize a one-time authorization, a
durable sharing option, to share a wide range of information
with their friends. But when it comes to sharing their online
video experiences, the law gets in the way.
Take a person who is an avid video watcher watching 100
short videos per week. She wants to share every video she
watches with her friends, just as she shares every song she
listens to on the streaming music service Spotify and just as
she shares every item she reads online on the Washington Post
through a Facebook social sharing app. But current law suggests
she is not fit to make the frictionless sharing decision with
respect to videos she watches. Should this video file have to
opt in 100 times per week? Does making her do so serve any
purpose other than to annoy her and to take needless time? The
constant, legally required interruption to her online
experience harkens back to the day when pop-ups had to be
clicked on to proceed online. Our frequent video viewers should
be given the opt-in choice to share all of her viewing
experience if that is what she wants.
In contrast to the restrictions of the VPPA, there are no
legal restrictions on her ability to socially share every e-
book she reads. Through a durable sharing option, she easily
can share the fact that she read the book entitled ``The
Godfather,'' but the law stands in the way of her similarly
sharing the fact that she watched the movie entitled ``The
Godfather.'' That makes no sense.
Of course, not everyone wants to share their viewing
experiences with their friends online, and they do not have to
share. And if someone prefers to share their video-watching
experiences on a case-by-case basis, he or she can do so
manually, just as people occasionally post news stories they
read on the Washington Post on Facebook rather than choosing
the automatic sharing option.
Similarly, a person who chooses to share on a continuous
basis can disable the share function before watching a
streaming video that he or she wants to exclude from online
post, such the ``Yoga for Health'' video that Senator Franken
referenced.
In order to clarify the uncertainty of the language in the
VPPA on disclosures, I support an amendment such as H.R. 2471
allowing durable sharing choice for consumers, which in turn
will permit frictionless social sharing. I agree that as a
privacy best practice, the durable choice option should be opt
in and presented prominently, separate and distinct from the
general privacy policy and the terms of use of an online
service. That is genuine consent.
I join the Center for Democracy and Technology in
concluding that such an amendment will not undermine the
fundamental purpose of the VPPA. Even though some Senators
personally may feel that sharing all the movies one watches is,
to use a phrase not heard much anymore, TMI, too much
information, people should as a matter of free expression be
able to share as they choose, and companies should not face
legal penalties for providing them with that choice.
As governments around the world, including our own,
consider ways to improve their privacy frameworks, there are
big decisions to be made, as Representative Watt pointed out in
his presentation. Starting a legislative process in the name of
privacy protection through which lawmakers decide case by case
what information and by what means consumers can share online
seems terribly ill-advised. In contrast, amendment of the VPPA
to permit full user choice and control fits squarely within the
preferred privacy framework, one that empowers consumers.
Thank you for the opportunity to appear here today. I look
forward to your questions.
[The prepared statement of Mr. Wolf appears as a submission
for the record.]
Senator Franken. Thank you, Mr. Wolf, for your testimony.
Let me start with Professor McGeveran because I want to
make a few things clear about what this bill does and does not
do. I talked a little in my opening statement--or about what
the amendment does and does not do, about what the video--I
talked about what the Video Privacy Protection Act does. I want
to talk for a moment about what it does not do. A lot of people
have been saying that the Video Privacy Protection Act actually
prohibits people from sharing their viewing habits on social
networking. In fact, one article said that, ``An antiquated
1988 bill called the Video Privacy Protection Act forbids the
disclosure of one's video rental information even if the renter
is OK with the disclosure.''
Is that right, Professor McGeveran? Does this law prevent--
and I am talking about the VPPA--video companies from
integrating into Facebook or other social networking sites even
if the user wants them to?
Mr. McGeveran. No, it is not right, Senator. The underlying
existing statute, which I am concerned it is called
``antiquated'' since that is the year I graduated from high
school. But the statute requires consent every time. But as I
mentioned in my opening statement, that can be done simply by
saying here is a button to press when you play the movie,
because presumably you have to press a button to play the
movie, and right next to it here is a button to both play and
share. You can post. You just have to be asked every time you
see a movie online. That seems relatively easy to effectuate.
Senator Franken. So it would be easy to say I can share.
Mr. McGeveran. That is right.
Senator Franken. Mr. Wolf talked about it would be really
easy to disable the sharing, but is there anything in the
amendment that says how that would happen? Could an online
video company, one less scrupulous than Netflix, just have it
really hard--is there anything in the law that would prevent
them from making it almost impossible to figure out how to
disable it?
Mr. McGeveran. In the House bill, the way it is set up now,
it says that you could enable consent until you took it away,
but there is nothing in the bill that gives any requirements
about how that would be done.
Mr. Wolf mentioned some best practices. You know, I think a
scrupulous company would make it easy. But this law is not only
going to apply to companies that we believe are going to do the
right things, and it does not--the company could have no button
or access anywhere on its Web site to do this. It could perhaps
have no explanation on its Web site that you had the right to
do this, and it would be up to the consumer to figure it out.
And the House bill allows that kind of arrangement.
Senator Franken. OK. I just want to make that kind of
clear, that to opt in to sharing a video, what movie you are
watching, would be no more burdensome than just watching the
movie itself.
Mr. McGeveran. Under current law.
Senator Franken. So, in other words, press one button.
However, disabling the overall consent to watch everything
could be impossible to find, essentially.
Mr. McGeveran. That is right. The House bill does not----
Senator Franken. Mr. Rotenberg, do you agree with that?
Mr. Rotenberg. I think this is a very important point,
Senator, and also what Professor McGeveran has pointed out is
that there are innovative ways to allow individuals to click,
you know, ``play and share''. There is the integration, and
there is the disclosure, or to simply click ``play,'' which is
I just want to see a movie, I do not need to tell the world
about it. But the point that you are making which is of
particular concern to us is under the House approach, once you
basically have ``play and share stuck,'' that button setting,
it may be very difficult to unstick because there is nothing in
the proposal that would make it easy to withdraw the consent.
Senator Franken. OK, thank you.
Mr. Hyman, there is no company that better exemplifies the
promise of streaming than Netflix. Netflix introduced its
streaming in 2008. Today 90 percent of Netflix's 24 million
subscribers have streaming subscriptions; only 45 percent have
DVD subscriptions, and that number is dropping. In fact, if you
look at ``About Us,'' the ``About Us'' section on Netflix's Web
site, the word ``DVD'' does not appear once. It is all about
streaming, and for good reason, because that is the future of
video.
I mentioned in my opening statement that there may be some
disagreement as to whether or not streaming video companies are
covered by the Video Privacy Protection Act. Mr. Rotenberg
suggested in his testimony that it would be helpful to change
language in the Video Privacy Protection Act to confirm that it
does, in fact, cover streaming video companies.
Mr. Hyman, would Netflix support doing that?
Mr. Hyman. Mr. Franken, Netflix would probably not--we
would not support that. I think the issue for us is really one
of what is video in the future and how do you think about that
in the Internet age. Video embedded into news stories, does
that become a news story or is that streaming video? Music
videos, is that music or is that videos? Books. You know, I
recently read a book called ``A Visit from the Good Squad,''
which is a very good book. Interestingly, it uses in there
texting. It has a PowerPoint presentation. You can imagine in
the future that books will incorporate video. Does that now
mean that that is covered by the VPPA?
So I think we have a host of issues relative to what is
video in the future, and so just extending the Video Privacy
Protection Act into the Internet raises a host of issues, and I
think there is a host of other players that need to be involved
in that.
So, again, as we mentioned in the testimony, a holistic
approach and a comprehensive approach would be one that Netflix
would support and be involved in, but merely taking the VPPA
and saying it applies to streaming, I think, opens a whole host
of issues that need to be carefully addressed.
Senator Franken. Would anyone care to address that in terms
of--because I do not think this amendment is comprehensive at
all. And so I think you raise a lot of great issues about this,
but it seems to me to say that since the VPPA applied to what
we think of as movies, movies are going to be streamed.
Mr. Hyman. They are.
Senator Franken. They are going to be. So that this law, it
seems like that you need to apply streaming to this, and I am
troubled by your excluding, trying to exclude streaming at all.
Does anyone have anything to say about that?
Mr. Rotenberg. Well, Mr. Chairman, I think perhaps the
advocates of that approach are drawing the wrong line. The
Video Privacy Protection Act was not trying to regulate
technology. It was not saying we will treat, you know, video
rental cassettes in one way and other things in a different
way. It actually says similar materials should be treated in a
similar way.
What the act is trying to do is regulate the collection and
use of personally identifiable information, and the reason you
need to do that in the digital world is because when you move
from broadcast of television and movies to this kind of one-to-
one service offering, these companies are now collecting a lot
of personal information about their customers. And so what the
law tries to do is to say if you are going to collect all that
data, then you need to protect.
And I think the other point that should be brought out as
we think about these new techniques for delivering of video is
that companies today are collecting a lot more information than
they did 25 years ago. And so I would think that the
inclination at this point in Congress would actually be to
strengthen the law, recognizing how much more information is
collected.
Senator Franken. Well, thank you. We will go to another
round. I have run over my time. We will go to the Ranking
Member, Senator Coburn.
Senator Coburn. First of all, let me thank you for your
testimony. I learned a lot from what you had to say. And I am
prone to agree with the Chairman on his concerns about this
bill as I look at it. And I really do not see a big difference
from granting permission one click at a time to a blanket
consent. But I also think prudence in terms of protection of
privacy ought to be the thing that ought to guide us.
There is no question Netflix with their policy throughout
the rest of the world that is not available here to online
consent for that gives them an asset, my asset, my privacy
asset, that I readily give to me if I am one of those that
grants a blanket consent somewhere outside this country. I am
giving them something of value that they can use to make money
off of. And I am not sure--I am torn between whether we have
the right to tell somebody whether they can grant a blanket
consent or not. I do not know that that is our role. But I know
it is our role to be concerned about the ultimate privacy
protection that individuals deserve.
So I would go back and I would ask the professor if he
would give us a little further dissertation on what he thinks
or means by the words ``genuine consent.''
Mr. McGeveran. Thank you, Senator Coburn. The idea behind
genuine consent is to say that it is thought out, it is
intentional. We are helping a consumer, a customer, to post the
information that he or she wants to post.
I might have more sympathy toward changing the existing
VPPA if I thought it did, in fact, make it very difficult for
people to do that, because I think that recommendations of
movies to our friends are really valuable. I learn a lot about
movies I would like to see by hearing about them word of mouth
from my friends. But as I mentioned before, what we have online
is the capacity to make it very easy to secure a decision each
time from the user, to say yes, I do intend to share this
information now about this movie now. And the ability to say it
for all movies in advance, we are not actually inconveniencing
the user very much in an era where you are going to have to
push either just one button or the other. So I would say
genuine consent is making sure that it is intentional.
Senator Coburn. So when I go through Dallas airport and use
Dallas' wi-fi, at the bottom of that every time is ``I
consent,'' I agree to their terms. Now, how many of you in this
room have ever read that three pages of very fine print to say
you agree to consent?
Mr. McGeveran. Well, I have, but that is my job.
Senator Coburn. Yes.
[Laughter.]
Senator Coburn. But you are a rarity.
Mr. McGeveran. I am.
Senator Coburn. And so the fact is, what you are saying is
what is wrong with making a considered judgment each time.
Mr. McGeveran. Exactly.
Senator Coburn. Mr. Wolf.
Mr. Wolf. Senator, I think you pointed out the problem with
that, that when consumers are presented with choices over and
over and over again, they tend to tune them out, and they will
ignore them, and they will have no meaning whatsoever. They
will just click through it to get to the function that they
want to exercise.
Senator Coburn. Well, let me bring you back to this point.
If the question that comes up on my iPad is, Do you want to
share this information through your social media?, and I have
to say yes or no, that is all that is going to be required for
Netflix to put up with each movie: Do you want this to be
shared? You have to make a decision there. That is a one-line
statement, which is very different. So if I am looking at a
movie, an Arnold Schwarzenegger, which my wife hates but I love
the action in them, and I am going to make a decision that I
want everybody to know I am watching Arnold Schwarzenegger, and
I am going to have to--it is one sentence. I am going to have
to make that decision. Why is that not protecting the rights
rather than blanket, and, ``Oh, I forgot about it,'' or ``I am
hung over from the night before, and I am not thinking
clearly,'' so, therefore, I have already granted--and I punched
a button on something that I really do not want shared.
The question is: Should we err on the side of privacy, or
should we err on the side of commerce? And that is the real rub
here. That is the thing that we have to decide.
Mr. Wolf. I actually do not think that is the choice. If a
consumer wants to share everything on their Facebook page, as
many do--they share every article they read in the Washington
Post, every book they read, every song they listen to. It is
not a choice you or I might make, but a law that takes away
that choice really ignores that there are people who want to do
that. And as long as they are informed of the consequences of
doing that and provided an opportunity--and I agree with the
professor that the opportunity ought to be just as easy as it
is to opt in--then I really do not see how it is the business
of Congress to dictate how and when people share.
Again, we are talking about legislating today, but we have
no idea what the sharing techniques will be 20 years from now.
And I will leave this to Mr. Hyman, but I understand that there
are some devices to access Netflix where you cannot have that
button or it is not easy to have that kind of button that you
are talking about.
Senator Coburn. That is fair. The point is there is a rub.
There is a rub. And the argument is not simply that we are
going to take away somebody's right to share. And it is not
being a Big Brother. I will go back. I believe the decision is
between protecting privacy and promoting commerce, and I think
we ought to be able to figure out how to do both.
Mr. Wolf. But I get back to my fundamental point, that
privacy is and has all along been giving people the choice to
control their information and who sees it and how it is
disclosed.
Senator Coburn. So there is no limitation to that choice if
I get to make that choice each time. You are still giving them
the choice. You are still giving--actually, we had a reference
to the testimony that some think that the ability to use
Spotify right now ought to have a choice each time. Is that not
true? Did I not get that inference from your statement, Mr.
McGeveran?
Mr. McGeveran. Spotify is not set up in a way that would be
compliant with the VPPA if it were video because your scroll of
songs is sent out to all your friends automatically.
Senator Coburn. Yes, but the point is, was it not your
inference that you thought maybe people ought to be making
decisions on that as well?
Mr. McGeveran. That is right. I think the same thing, you
press a ``play'' button for a song, you should be making a
choice time by time whether that is something that goes out.
Senator Coburn. So the question is how big of a choice do
you make and whether you reconsider it. The question I would
have technically is if I opt in for all of it, each time
Netflix brings me a movie, do I have the option to opt out of
that? In other words, do I have a default button that goes out?
Mr. Wolf. Again, I think the opt-out option ought to be
easy, but, you know, there are people who have webcams and they
leave them on all the time, and some people think that is ill-
advised, they are oversharing, it invades their privacy.
Imagine a law that Congress passes that says that the webcam as
a matter of law will be turned off once every 24 hours, and you
have to make the choice to turn it back on. That just has never
been the business of Congress to tell people how they publish,
how they share, and with whom they share. Privacy is about
allowing people that choice.
Senator Coburn. Again, I do not say your arguments do not
carry large weight. I am just saying in terms of effectuating
the protection of privacy, how are we going to do that? Let us
say we go to this and we are going to have an opt-in. Where are
the details on the opt-out?
Mr. Wolf. Well, I agree, that needs to be----
Senator Coburn. It is not in there.
Mr. Wolf. That needs to be specified. But I really caution
against the slippery slope of controlling every kind of
information and every kind of technology in terms of how people
share.
Senator Coburn. We are not controlling it. What we are
saying is you got to make a choice, and, you know, the
question----
Mr. Wolf. But only the choice you want them to make, not
the choice that is available as to other information.
Senator Coburn. No, no. There are two choices: opt in or
opt out. The point is you got to still make the choice with
your privacy, and I think there is a legitimate concern that if
you opt in, will you have the same presence and available
information to opt out. So the question I would have of Netflix
is, if you have this or where you have it in Europe, does
somebody every movie have an opportunity to opt out?
Mr. Hyman. On the current implementation in Europe, there
is an opt-out, do not share opportunity, beginning----
Senator Coburn. Every time?
Mr. Hyman. Every time. As Mr. Wolf pointed out, certain
devices because technologically do not support that, it is not
available on every device. It is available through the computer
on every device, and you can unshare afterwards. But the
implementation that we have made is you start the movie, the
presumption is sharing, and there is a ``do not share'' button
that you can click afterwards, right when the movie starts.
Anytime you deal with the movie, you can elect to not share.
And then after the movie is displayed on Facebook, you can go
back and adjust your setting within Netflix to unshare that.
There are also sharings that you can do in the Facebook side.
Senator Coburn. So here is my question: What is the
difference between an unshare opt-out and a share opt-out? They
are both asking the same question. One is a presumption you are
going to share all the time, but you are still making a
decision each movie, unshare or not unshare.
Mr. Hyman. Well, one is opt in and one is opt out.
Senator Coburn. Yes, but the point is the decision for
privacy is still made individually on every movie that they
send down the stream. So what is the difference of having an
opt-in or an opt-out? It defeats your whole argument. They have
the same thing.
Mr. Wolf. It does not defeat my argument, because I do not
think it should be a matter of law.
Mr. Hyman. I was going to say, I was going to echo--that is
our implementation. Under the H.R. 2471, that is not required
under law.
Senator Coburn. I understand that.
Mr. Hyman. We have done that because that is what we
believe consumers want. I think the issue for us at the highest
level is really an informed consent. I think most everyone on
this panel agrees, I think, philosophically on making sure that
consumers understand what information they are disclosing or
how their information is being handled. So at the high level, I
think we are all coming to it from the same approach. I think
there is a philosophical difference that in some way you
highlighted on: Is it opt in, is it opt out, or is it--you
know, how does Congress control the way in which consumers can
share, are available to share? The presumption that we are
trying to advocate for in connection with supporting H.R. 2471
is that it is really within the consumer's control to elect to
do that if they so desire. It is an opt-in mechanism, and it is
one in which they should be able to get informed consent.
I think there is a question on this panel of whether or not
consumers can ever give informed consent. On our side, I think
we would take the position that, yes, consumers can give
informed consent. And, in fact, under the legislation there is
a specific opt-out so that it is not buried in some terms of
use, which we are in support of. So the issue about----
Senator Coburn. But if privacy is so important and if
everybody at the table supports that, what is wrong with having
the reminder that you are sharing your privacy? If it is that
much of a value, if personal property rights and privacy rights
are that important, what is wrong with having a reminder that
you are giving away your privacy rights? If it is a value to be
protected, if it is a virtue to be protected, your privacy,
then what is wrong with the government saying there should be a
reminder that you are giving your privacy away? What is wrong
with that?
Mr. Wolf. There ought to be reminders, and government ought
to support education of consumers through cyber education of
kids to tell them what harm they might do themselves online by
sharing TMI. But the number of reminders one would need every
day would be in the thousands----
Senator Coburn. I do not need any reminders because I do
not share anything.
[Laughter.]
Mr. Wolf. You are sharing your ideas right here, Senator.
Senator Coburn. But the point is I have to, under the
ethics law, fill out forms at the end of every year, and I have
to get that. As a part of participating in the Senate, there
are certain things I have to do as part of my responsibility.
But the point is, if privacy is of that value and you value
that privacy and the protection of that privacy, what is wrong
with us saying you need to have a reminder, to me, the
Chairman, a 12-year-old, that you need to have a prompt to say
you are giving away your privacy?
Mr. Wolf. So I can imagine someone opening up their mobile
phone and they are about to talk in a public place and there is
a law in Congress that says a pop-up has to appear that says,
``You are in a public place. This is a reminder that you may be
revealing private information about yourself. Click here to
proceed.''
Senator Coburn. You can imagine that. Again----
[Laughter.]
Mr. Wolf. Well, it is not so far away from what you are
describing, Senator, because if we are going to require it for
videos, there is no reason why we would not require it for all
the other information that people choose to share. That is the
world we live in. Certainly they should be given the right not
to share, and they should be given the choice not to share. But
I really do not think it is the job of Congress on such a
granular basis to make that choice so difficult.
Senator Coburn. Well, what is difficult? They are having to
pop the button now to say do not share. There is no difference.
They are hitting the button share and unshare right now, so
what is difficult about saying share versus unshare?
Mr. Wolf. I actually do not know what the experience has
been in Europe with that and whether consumers object to it,
whether they think it interferes with their experience or not.
Senator Coburn. He just testified that his consumers wanted
that.
Mr. Wolf. I know it is available.
Mr. Hyman. One issue, Senator, is that technology changes
over time. So in order to implement that technology today, we
are able to do it on certain devices. On other devices we are
not able to do it. You know, and older legacy devices, we
cannot go back and change those because of the way they have
been designed. So, you know, people who have paid for some of
our devices before now will not be able to take advantage of
that feature because we cannot give them opt-out every time
because Congress has told us we have to give them an opt-out
every time?
I think the issue for us, again, is, you know, giving that
control to the consumer, and if the consumer so elects to share
on an ongoing basis, and perhaps even you could say to opt out
of the notice to unshare, if they do not want to be bothered by
it every time because that is inconvenient for them, they have
chosen to give their movie watching onto Facebook or other
social media platforms, should it be a law that they cannot do
that? And I think from our perspective, it is very important
that the consumers understand what they are doing and be given
a choice. But to dictate exactly how that is implemented,
especially in a dynamically changing environment in technology,
I think it is important to be careful.
Senator Coburn. So what is wrong with what you just
suggested, is you have an ability to opt out and then you have
the ability to opt out of the opt-out question? What is wrong
with that?
Mr. Hyman. Fundamentally, I think that is fine, as long as
you can get to the--you know, the way in which the process
works, as long as----
Senator Coburn. Let me say it again. I am going to give you
consent, Netflix, to share my movies. And then when a movie
comes up, do you want to opt out? Or would you like to not see
this screen again for six months and let all your sharing
continue in your opt-in? In other words, for those that want to
share everything, do not send me the reminder.
Mr. Hyman. If that is what consumers want the way in which
we would implement it, I am fine doing it. I have a little bit
of trouble having that being legislated because I think over
time that may change. It may be that six months is not the
right amount of time. Is it three months? Is it a year? Is it
never for certain people?
So in that sense, I think, from my perspective--I think the
fundamental of taking a principle-based approach of consumers
having control and consumers understanding what they are opting
into or not opting into at their choice is the important thing
that, you know, we as a people and you as legislators ought to
focus on that fundamental.
And then the way in which it gets implemented, because
things change over time, given technology, given the way people
share and change, that should be somewhat left to being
implemented.
Senator Coburn. OK, great point. Thank you, Mr. Chairman.
Sorry I went over.
Senator Franken. Not at all. I thought that was a very good
line of questioning. I think it brought out a lot of great
things, and we may not go to a second round because I was
afraid that the Ranking Member would not be able to get enough
time if he only got one round. But the Ranking Member went into
a lot of great points, started early with an alcoholic husband
who is afraid of his wife. I thought that was a good point. You
might have a hangover and watch something his wife does not
approve of. I thought that was a very good point.
That is a joke. I was kidding.
[Laughter.]
Senator Franken. I think----
Senator Coburn. I am just not old enough to appreciate your
humor.
Senator Franken. No, I do not think it is that. I think
that was probably--I think that joke curved foul.
[Laughter.]
Senator Franken. But I think we do not need another round,
but I think we--unless anyone wants to respond to a couple of
observations I have here, because I think, Mr. Hyman, you said
that it would not be buried in the terms of agreement, the
ability to opt out. We do not know that. This piece of
legislation does not say at all how opting out would work.
Mr. Hyman. Actually, in 2471, there is a specific provision
that was added in an amendment that said the actual agreement
to share has to be separate and distinct from other legal and
financial terms.
Senator Franken. Yes, but not to opt out of the agreement.
Mr. Hyman. Correct. The opt-out is not.
Senator Franken. So that is the point. And you said that
that would not be buried in the terms of agreement, and you
talked yourself about how this is voluntary, and you were
uncomfortable with that being in the law. This is voluntary
because Netflix does what you do in Europe, but no other
company would have to do it.
So I think that you underscore the point that the Ranking
Member was making, which is it could be incredibly difficult to
find out how to opt out of this once you have agreed--once you
are sharing everything. I see Professor McGeveran nodding his
head. I wonder if you have any thoughts on that.
Mr. McGeveran. I am just agreeing. The Nadler amendment
that was passed in the House bill does set up some specific
requirements for how the original blanket consent has to be
effectuated, but the bill is silent about what will be required
to withdraw that consent later on if you decided you did not
want a particular movie to be shared with your friends or that
you wanted to cancel the previous authorization. It just does
not say anything at all about how that would happen.
Senator Franken. Right, and, you know, I think that, again,
Netflix in Europe, where it can, on the devices where it works,
gives people a clearer way to do that, but less scrupulous
companies under the law would not be required to do that, and
you would have to go through the terms and conditions, which
can be pages and pages long, which none of us except for
Professor McGeveran actually read.
Mr. Wolf. I read them, too, Senator.
Senator Franken. OK, but they are privacy lawyers. Come on.
No one reads those things. And I think that we almost got to
the point of absurdity when--of course, you know, you do not
have to be reminded that when you talk on your phone in public,
we are not going to make it a law that, you know, someone could
overhear you. And to reach for that kind of underscores, I
think, sort of the common sense of if it is just as easy to
click one button that says, ``I want to share,'' you know,
``watch and share,'' as opposed to ``watch,'' it is no more
burdensome to share each time on a one-by-one basis, as the
original law claims, as opposed to having a consumer of a movie
basically agree to sharing and then not be able to find where
to opt out of that because it is buried in some place in the
terms of agreement. No one has disputed that that is not
written--that that is in the law to dictate that you can find
it.
So I want to work with the Ranking Member on this because I
think he really got to the gist of this, which is that we have
to find--when you mentioned 30 days or 60 days or six months or
something like that, I think maybe you could find a thing where
someone says, ``You know what? For the next 30 days, just share
everything I like, and then remind me in 30 days,'' or
something like that. I mean, I just think that this was kind of
rushed through the Hous, maybe, and that we need to work on
this----
Senator Coburn. I am happy to work with you.
Senator Franken. Great. OK. So I am going to adjourn, and I
know I am--I do not chair that much, so let me find--the record
will be held open for a week.
[Laughter.]
[Whereupon, at 11:30 a.m., the Subcommittee was adjourned.]
[Questions and answers and submissions for the record
follows.]
A P P E N D I X
Additional Material Submitted for the Record
[GRAPHIC] [TIFF OMITTED] T7342.001
Prepared Statement of Hon. Patrick J. Leahy
[GRAPHIC] [TIFF OMITTED] T7342.002
[GRAPHIC] [TIFF OMITTED] T7342.003
Prepared Statements of Witnesses
[GRAPHIC] [TIFF OMITTED] T7342.004
[GRAPHIC] [TIFF OMITTED] T7342.005
[GRAPHIC] [TIFF OMITTED] T7342.006
[GRAPHIC] [TIFF OMITTED] T7342.007
[GRAPHIC] [TIFF OMITTED] T7342.008
[GRAPHIC] [TIFF OMITTED] T7342.009
[GRAPHIC] [TIFF OMITTED] T7342.010
[GRAPHIC] [TIFF OMITTED] T7342.011
[GRAPHIC] [TIFF OMITTED] T7342.012
[GRAPHIC] [TIFF OMITTED] T7342.013
[GRAPHIC] [TIFF OMITTED] T7342.014
[GRAPHIC] [TIFF OMITTED] T7342.015
[GRAPHIC] [TIFF OMITTED] T7342.016
[GRAPHIC] [TIFF OMITTED] T7342.017
[GRAPHIC] [TIFF OMITTED] T7342.018
[GRAPHIC] [TIFF OMITTED] T7342.019
[GRAPHIC] [TIFF OMITTED] T7342.020
[GRAPHIC] [TIFF OMITTED] T7342.021
[GRAPHIC] [TIFF OMITTED] T7342.022
[GRAPHIC] [TIFF OMITTED] T7342.023
[GRAPHIC] [TIFF OMITTED] T7342.024
[GRAPHIC] [TIFF OMITTED] T7342.025
[GRAPHIC] [TIFF OMITTED] T7342.026
[GRAPHIC] [TIFF OMITTED] T7342.027
[GRAPHIC] [TIFF OMITTED] T7342.028
[GRAPHIC] [TIFF OMITTED] T7342.029
[GRAPHIC] [TIFF OMITTED] T7342.030
[GRAPHIC] [TIFF OMITTED] T7342.031
[GRAPHIC] [TIFF OMITTED] T7342.032
[GRAPHIC] [TIFF OMITTED] T7342.033
[GRAPHIC] [TIFF OMITTED] T7342.034
[GRAPHIC] [TIFF OMITTED] T7342.035
[GRAPHIC] [TIFF OMITTED] T7342.036
[GRAPHIC] [TIFF OMITTED] T7342.037
[GRAPHIC] [TIFF OMITTED] T7342.038
[GRAPHIC] [TIFF OMITTED] T7342.039
[GRAPHIC] [TIFF OMITTED] T7342.040
[GRAPHIC] [TIFF OMITTED] T7342.041
Questions for William McGeveran Submitted by Senator Al Franken
[GRAPHIC] [TIFF OMITTED] T7342.042
Questions for Marc Rotenberg Submitted by Senator Al Franken
[GRAPHIC] [TIFF OMITTED] T7342.043
Questions for David Hyman Submitted by Senator Tom Coburn
[GRAPHIC] [TIFF OMITTED] T7342.044
[GRAPHIC] [TIFF OMITTED] T7342.045
Questions for Christopher Wolf Submitted by Senator Tom Coburn
[GRAPHIC] [TIFF OMITTED] T7342.046
Questions and Answers
NOTE: At the time of printing, after several attempts to
obtain responses to the written questions, the Committee had
not received any communication from William McGeveran.
NOTE: At the time of printing, after several attempts to
obtain responses to the written questions, the Committee had
not received any communication from Marc Rotenberg.
Responses of David Hyman to Questions Submitted by Senator Tom Coburn
[GRAPHIC] [TIFF OMITTED] T7342.047
[GRAPHIC] [TIFF OMITTED] T7342.048
[GRAPHIC] [TIFF OMITTED] T7342.049
[GRAPHIC] [TIFF OMITTED] T7342.050
[GRAPHIC] [TIFF OMITTED] T7342.051
[GRAPHIC] [TIFF OMITTED] T7342.052
[GRAPHIC] [TIFF OMITTED] T7342.053
Responses of Christopher Wolf to Questions Submitted by Senator Tom
Coburn
[GRAPHIC] [TIFF OMITTED] T7342.054
[GRAPHIC] [TIFF OMITTED] T7342.055
[GRAPHIC] [TIFF OMITTED] T7342.056
[GRAPHIC] [TIFF OMITTED] T7342.057
Miscellaneous Submissions for the Record
[GRAPHIC] [TIFF OMITTED] T7342.058
[GRAPHIC] [TIFF OMITTED] T7342.059
[GRAPHIC] [TIFF OMITTED] T7342.060
[GRAPHIC] [TIFF OMITTED] T7342.061
[GRAPHIC] [TIFF OMITTED] T7342.062
[GRAPHIC] [TIFF OMITTED] T7342.063
[GRAPHIC] [TIFF OMITTED] T7342.064