Senator Leahy's Anti-Privacy Gift to Netflix

Senator Patrick Leahy offered an amendment to the now-stalled cybersecurity bill that would allow Facebook users to automatically share the titles of movies they rent through Netflix. His proposal would strengthen ecommerce at the expense of a decades-old bill that keeps video rental record private. Guess what? The Vermont Democrat also wrote the old privacy bill, and he seemed to think it was smart public policy as late as the start of this year. Here's the story behind the flip-flop.

The old Video Privacy Protection Act may have reflected Congress' instinct to protect itself as much as the public. It was 1987, and Washington was consumed with debate over U.S. Supreme Court nominee Robert Bork’s thinking on a Constitutional right to privacy. Bork’s hand-written records from his local Washington, DC, video store were leaked to Michael Dolan, who published a fairly goofy piece in the Washington City Paper on them. “The Bork Tapes,” as the ensuing kerfuffle was called, was in many ways a small-town affair, but the case set Washington on fire. A panicked Congress set out in the special way that it has to solve its own problems.

“If we’re going to tell people, especially people who want to be in any form of public life,” said Leahy 24 years ago this week, “well, if you do, we are going to go all the way back and find out what you checked out at your public library, what you took out on videos or what you watch at night on television programs, then we are in a sorry state.”

The issue wasn’t what Bork had popped into his VCR. Recapping the incident at a hearing this past January, Senator Al Franken described the judge’s predilection for “mysteries and caper films.” It was that no one from Joe Average to high-ranking public officials seemed to be safe from snoops. The Judiciary Committee was split on Bork, but it was “unanimous in its outrage,” the Minnesota Democrat recalled, over the revelation of Bork’s rental records. “The point was that the movies we choose to watch are our business and not anyone else’s,” said Franken.

The problem is that, two dozen years after the Bork Tapes, the movies we chose to watch are exactly someone else’s business. Data on our personal habits drive the digital economy, from Facebook to Google to countless other social-enabled sites. Netflix wants its own targeted fix specifically so it can integrate with Facebook. Never mind the argument made by some that the Video Privacy Protection Act (VPPA) doesn’t apply to streaming video or that Netflix could satisfy the law by giving users a "play-and-share" option. That ambiguity, Netflix’s general counsel has said, creates “a drag on social video innovation that is not present in any other medium.” User accounts for music or books stores didn't exist in pre-iTunes era, but in 2012 what sense does it make that I can tell my Facebook friends what’s on my Spotify or Hulu or Social Reader playlist but can’t easily share what movies that I watched this weekend?

In December, the U.S. House of Representative agreed. The way things stand now, video tape providers can disclose rental records only when the customer gives written disclosure, which must happen each time they’re sought. But under H.R. 2471, consent can be given online and ahead of time, and is considered binding until the user says stop.

“Durable sharing,” as advocates have called it, would be a boon for Netflix. For one thing, it increases the possibility of targeted ads like the ones Spotify displays, which are tailored to the information Facebook knows about the user. For another, there’s simple word of mouth. Netflix is betting on its streaming business, and Facebook is a high-profile venue for promoting its wares, including in places like Latin America and Europe where it is hoping to grow its business.

To opponents, moves to modernize VPPA put privacy at risk. There’s nothing in the bill, for one thing, that limits Netflix to sharing my watching habits with Facebook—or to any other social network, for that matter. For another, our viewing histories might reveal more about us than we’d like others to know. It might be fine for the world to know you just rented The Godfather, Franken said at the hearing. Less comfortable might be sharing the fact that checked out Yoga for Health, Depression, and Gastrointestinal Problems. “Why else,” testified William McGeveren, an associate professor at the University of  Minnesota Law School, “did a newspaper reporter think Judge Bork’s rental history might be interesting in the first place?”

But there’s a bigger critique with this bit of lawmaking. It's that Congress is modernizing the country’s video privacy laws in one direction only: Netflix’s. Legislators are not otherwise coping with the new digital economy by, say, clarifying that privacy protections written for the video tape era apply to modern video streaming. And they’re not redefining the personal account information covered by VPPA to cover things like IP addresses.

In fact, some have argued that VPPA’s protections should be expanded, not reduced. Let’s go the other way and cover listening and reading habits, too, McGeveren argued, like California did in October with its Amazon-targeting Reader Privacy Act.

Not long ago, Patrick Leahy seemed to agree with that way of thinking. He opened that January hearing by telling a joke about how privacy comes naturally to Vermonters like him. It’s also perfectly natural, he explained, for companies like Netflix and Facebook to want to increase the flow of user data online. But that doesn’t make it right. Waving his hands in seeming consternation, Leahy raised the idea that “a one-time check off has the effect of an all-time surrender of privacy.”

So what changed in the last seven months? One possibility: Leahy is eager to get tech company support on the much-contested cybersecurity bill he and others have been working on for years. Netflix has been a high-profile backer of VPPA modernization, but there are others: Facebook, Google, Barry Diller’s IAC. The bill stood to benefit any tech company that wants to mine the streaming-plus-social space. Throwing an otherwise non-germane amendment into the cybersecurity mix might be a nice inducement to tech companies to help push the cybersecurity bill through the Senate.

But the video privacy amendment is also a test case in Washington’s effort to grapple with digital privacy and consumer choice. Lawmakers, generally, can’t seem to bring themselves to imagine that people are willing to share as much of themselves on Facebook as we regularly demonstrate we’re perfectly willing to do. Congress might not understand social media, but it doesn’t want to kill it. It only wants to figure out the artful public policy that lets the digital economy flourish while upholding very high personal privacy standards. It's not ready to face the possibility that that might not be possible. So, instead, it tweaks laws, responding to its own needs here, responding to the needs of the increasingly vocal tech industry there.

An open question is what actual consumers in the digital age “like” when it comes to privacy. And that’s something that Congress and tech companies would, for now, rather not know.