2 Personal Data Processed by Electronic Means
2.1 Services Provided at a Distance
The primary piece of legislation that is designed to protect personal data related to
services provided at a distance is the Fair and Accurate Credit Transactions Act
(FACTA) enacted in 2003.
70 FACTA was specifically designed to protect consumers from identify theft and to ensure that consumers’ credit information is
accurate. The Act requires the three main credit reporting agencies in the U.S. to
provide consumers with one free credit report per year. In an effort to improve the
security of card-related data, the Act requires retail systems that print payment card
receipts to use PAN truncation (personal account number truncation) so that transaction receipts do not contain a consumer’s complete account number.
71 The Act
also contains a provision that allows consumer to place fraud alerts in their credit
files so that they may monitor certain types of purchases to protect against fraud. The
Act creates a private cause of action for consumers who can show a “concrete
harm”.
72
With respect to the privacy of entertainment services, there are two federal
statutes on the books: the Cable Communications Policy Act of 1984 (CCPA)
73
and the Video Privacy Protection Act of 1988 (VPPA).
74 Under the terms of the
CCPA, cable companies are prohibited from collecting personally identifiable information concerning subscribers without the prior consent of the subscriber.
75 Cable
companies must also destroy personal data when that data is no longer necessary for
the purpose for which it was collected.
76 The VPPA contains provisions similar to
the CCPA and prevents providers from knowingly disclosing personal information
without the subscriber’s written consent.
77 Courts have denied the claims of a
number of parties seeking damages under VPPA in cases where the court has held
that the shared data did not qualify as personally identifiable information. These
denials have included cases involving a consumer’s Roku serial number
78 as well as
an encrypted serial number on a digital streaming device.
79
Although the FTC proposed a “Do Not Track” mechanism in 2010 that would
allow consumers to choose whether to allow websites to collect information about
70 Pub. L. No. 108–159, 117 Stat. 1952, codified to 15 U.S.C. §§ 1681–1681x.
71 Braverman (2013).
72 Spokeo, Inc. v. Robins, 136 S.Ct. 1540 (2016).
73 47 U.S.C. §551.
74 18 U.S.C. §§2710–2711.
75 47 U.S.C. §551(b)(1).
76 47 U.S.C. §551(e).
77 18 U.S.C. §§2710(2)(B). Pursuant to the Amendments Act of 2012, a videotape service provider
may obtain a consumer’s consent through the internet. 18 U.S.C. §2710.
78 Eichenberger v. ESPN, Inc., No. C14-463 TSZ, 2015 WL 7252985 (W.D. Wash. May 7, 2015).
79 Robinson v. Disney Online, 152 F.Supp.3d 176 (S.D.N.Y. 2015).
418
S. M. Boyne
2.1 Services Provided at a Distance
The primary piece of legislation that is designed to protect personal data related to
services provided at a distance is the Fair and Accurate Credit Transactions Act
(FACTA) enacted in 2003.
70 FACTA was specifically designed to protect consumers from identify theft and to ensure that consumers’ credit information is
accurate. The Act requires the three main credit reporting agencies in the U.S. to
provide consumers with one free credit report per year. In an effort to improve the
security of card-related data, the Act requires retail systems that print payment card
receipts to use PAN truncation (personal account number truncation) so that transaction receipts do not contain a consumer’s complete account number.
71 The Act
also contains a provision that allows consumer to place fraud alerts in their credit
files so that they may monitor certain types of purchases to protect against fraud. The
Act creates a private cause of action for consumers who can show a “concrete
harm”.
72
With respect to the privacy of entertainment services, there are two federal
statutes on the books: the Cable Communications Policy Act of 1984 (CCPA)
73
and the Video Privacy Protection Act of 1988 (VPPA).
74 Under the terms of the
CCPA, cable companies are prohibited from collecting personally identifiable information concerning subscribers without the prior consent of the subscriber.
75 Cable
companies must also destroy personal data when that data is no longer necessary for
the purpose for which it was collected.
76 The VPPA contains provisions similar to
the CCPA and prevents providers from knowingly disclosing personal information
without the subscriber’s written consent.
77 Courts have denied the claims of a
number of parties seeking damages under VPPA in cases where the court has held
that the shared data did not qualify as personally identifiable information. These
denials have included cases involving a consumer’s Roku serial number
78 as well as
an encrypted serial number on a digital streaming device.
79
Although the FTC proposed a “Do Not Track” mechanism in 2010 that would
allow consumers to choose whether to allow websites to collect information about
70 Pub. L. No. 108–159, 117 Stat. 1952, codified to 15 U.S.C. §§ 1681–1681x.
71 Braverman (2013).
72 Spokeo, Inc. v. Robins, 136 S.Ct. 1540 (2016).
73 47 U.S.C. §551.
74 18 U.S.C. §§2710–2711.
75 47 U.S.C. §551(b)(1).
76 47 U.S.C. §551(e).
77 18 U.S.C. §§2710(2)(B). Pursuant to the Amendments Act of 2012, a videotape service provider
may obtain a consumer’s consent through the internet. 18 U.S.C. §2710.
78 Eichenberger v. ESPN, Inc., No. C14-463 TSZ, 2015 WL 7252985 (W.D. Wash. May 7, 2015).
79 Robinson v. Disney Online, 152 F.Supp.3d 176 (S.D.N.Y. 2015).
418
S. M. Boyne