opportunity to be here today and look forward to your questions. >> thank you, mr. hyman. by the way, your complete written testimony will be made part of the record. professor mcgovern? >> thank you. thank you. chairman franken, members of the subcommittee and staff, thank you for inviting me to testify here today. my name is william mcgeve aran. i specialize on intellectual property law. i consider a model for privacy legislation i myself use social media and those recommendations heavily but the potential problems are serious, too. in one article i write that the

key is to getting consent. not by mistake. if we have too many accidental disclosures, we undermine personal matters and the accuracy of the recommendations, the fact that our friend really wants us to see this movie rather than passively letting us know that he saw it and didn't like it very much. the bppa is going to emphasize that consent. first, the importance, second, that it's not able to keep up with technology and finally, the problems with hr-4271. in my view, the greatest view is

the video of the enactment. unintended of music, films, websites, can constrain the capacity experiment and explore ideas freely but if the committee revisits the statute, i believe you should extend as well as viewing. that was part of the intent of california reader protection act which took effect at the beginning of the month. in general, it ought to prevent private access not just movies. second, the bppa in its current form allows video companies to implement strategy, including integration with facebook. now, it's true that the bppa requires consent every time a viewer's movie choice gets transferred to a third party. that's not ambiguity. it's what the law says.

but it's actually easier to satisfy those requirements online than off. the statute's authors, getting a customer to sign a separate document with pen and paper in person and to play a movie, could be offered a play and share button right alongside it, allowing them to both show the video and post that information in social networks. i think it would be quite radical to assert that it does not require written consent under the statute. it is contrary to the east sign act and to all of the case law that i've seen. and to get case by case consent rather than one-time authorization. finally, i want to note that

hr-2471 has a lot of problems and this is some opportunities for reasonable compromise. i'll just note a few. changes to the statute apply to every disclosure, not just those in social networks. by rushing to address netflix and face boork, the bill reduces privacy in many other settings from law enforcement to behavioral advertising. by specifically mentioning internet, i'm concerned that the bill may foreclose electronic consent by other technologies such as cable and satellite and that's a real concern. the provisions for withdrawing consent says nothing about how it's supposed to be done. that vagueness may apparently permit companies to comply by making it easy to give consent but very cumbersome to withdraw that consent. most important, the bill passed by the house replaces a robust consent to provision with a very weak alternative. there may be other ways to get genuine consent than what's offered in the vppa. for example, what about general

authorization with a very short time limit, say one month, and then a granular clear opt-out? i urge the committee to explore those sorts of creative compromises to streamline. thank you and i look forward to questions. >> thank you very much, professor. mr. rodenberg. >> mr. chairman, thank you very much for the opportunity to testify here today. as you know, there are a few issues of greater concern to internet. the hearing that you're holding today is very important, very timely and of great concern to a lot of people. i want to begin by talking about the purpose and passage of the video privacy protection act

monday the various provisions that congress enacted 25 years ago was one that said let's not keep personal information longer than is necessary. today we have an enormous problem in this country with data breaches, identity theft, and companies keeping data on their customers and their clients for much longer than they should. what the video private protection act sougt to do, most people watched broadcast television or saw movies there. was very little collection of personal data about an individual's personal movie

preferences. so when a story broke about the judge's personal records, congress said we need to put into safeguard that information that businesses were now able to collect now, that is a strong assumption in favor of privacy but not a strong prohibition against disclosure. law enforcement has the right under court order to get access to records in the course of an investigation and even for marketing purposes, personal information can be disclosed and this is the key information that i would like to draw your attention to they said that when it comes to a fact that someone happens to be a customer of a video service, it really should be few restrictions on disclosing that fact and the privacy protection was essentially an opt-out. congress even said that if the company wanted to disclose the fact that a person was

interested in science fiction movies or mystery movies or action adventure, cop companies could disclose those facts simply with the opt-out protection. but when it came to the actual titles of particular movies that would reveal so much about a personal interest and their likes, congress said, there we need a higher level of protection. that should really be opt in and if a person chooses in a particular case to disclose that information, they should be free to do so. and the act allows for it. now, i want to say very directly to netflix that this argument that they are making that this law somehow stands in the way of integration of facebook is simply not right. they have the freedom today under the law to know when netflix users are using netflix services that can even go the next step and talk about the

types of movies that their customers are viewing. what the law tries to do is establish a line at the point that the company wants to say, and here's the particular movie that one of our users is now viewing. that's where the law says, please, in those circumstances, get opt-in consent. i want to make a further point here because i actually believe that many of the house members that voted for this bill don't fully understand the consequence of the amendment. it's not just the friends of that individual to whom the fact of the specific movie viewing will be disclosed. it's also to netflix business partners and also potentially to law enforcement because what netflix is asking users to do is to provide a blanket consent that gives them the opportunity to disclose specific movie viewing to any party under any circumstance that netflix chooses to. this knocks out the cornerstone of the act. it takes away the key provision

that was put in place to give users meaningful consent. obviously i don't think this is going to support online privacy and i don't think netflix users want this provision. but i do think changes could be made to the act to modernize it and to update it and it should be applied to all streaming services. i think data needs to be to the private right of action and i also want to see more transparency so that viewers actually know how their information is being used and companies should be required to routinely encrypt the data that they collect. those types of changes to the act would update and continue to promote a viable and useful service for many users and i hope they will be considered by the committee. thank you. >> thank you, mr. rotenberg. and mr. wolf? >> thank you, my name is christopher wolf and i'm a

privacy lawyer. i'm also a privacy advocate. as part of my pro bono work, i won a case against the government and advise on privacy guidelines, epic advisory board and i founded and co-chair a think tank with advisory board members from businesses focused on practical ways to advance privacy. i'm pleased that mr. mcgeveran is a member of that board. privacy is about control. it's to put choices and decisions in the hands of informed consumers. with the advent of video streaming and social sharing, the video privacy protection act stands in the way of viewers exercising control and limits free expression. the vppa was designed to prevent

prying into people's rental history. it was not to dictate how they share. indeed, the multiple purpose was to give control and choice to consumers, to let the consumers decide whether and how to share the video watching information. in 1988 when the vppa was enacted, no one dreamed of streaming video and social sharing. so when that preinternet law is applied to the world of online video and social media, it could be read to frustrate and authorize the disclosure on an ongoing basis. for many people automatic sharing and social media is how they shape their online indemnities and how they share ideas. facebook users commonly utilize a one-time authorization, a durable sharing option, to share a wide range of information with their friends. when it comes to sharing their online video experiences, the law gets in the way. take a person who is an avid

video watcher. she wants to share every video she watches with her friends as she shares every song she listens to on the streaming music service spotify and on the washington post through a facebook social sharing app. should this video file have to opt in more than 100 times a week? the constant interruption has to be online. our frequent video viewers should be given the opt-in choice to share all of her viewing experience if that's what she wants n contrast, with the restrictions of the vppa, there are no restrictions to share every e-book that she reads but the law stands in the

way of her similarly sharing the fact that she watched the movie entitled "the fodfearlt." that makes no sense. if someone prefers to share their video watching experience on a case by case basis, he or she can do so manually as people post news stories that they post on facebook rather than choosing the automatic sharing option. similarly, a person who chooses to share on a continuous basis that he or she wants to exclude from online posting, such as the yoga for health video that senator franken referenced. in turn it will prevent social

sharing. i join the center for democracy concluding that it will not undermine the purpose of the vppa. even though some senators personally feel that sharing off of the movies that one watches, is tmi, too much information, people should as a matter of free expression be able to share as they choose and companies should not be able to be penalized for sharing that choice. starting a legislature process and is terribly ichlt ll-advised n contrast, to permit use and control fits squarely within the privacy framework. thank you for the opportunity to appear here today.

i look forward to your questions. >> thank you, mr. wolf for your testimony let me start with professor mcgeveran. i want to be clear about what this bill does and does not do. i talked a little bit in my opening statement about what the amount does or does not do or what -- i talked about what the video privacy protection act does. i want to talk for a moment about what it does not do. a lot of people have been saying that the video privacy protection act actually prohibits people from sharing their viewing habits on social networking. in fact, one article said that, quote, an ant kwated 1988 bill called the video privacy protection act forbids the

disclosure of one's video information even if the renter is okay with the disclosure. is that right, professor mcgeveran? and i'm talking about the vppa. prevent companies from integrating into facebook or other social networking sites even if the viewer wants them to? >> no, it's not right, senator. the underlying existing statute the statute can be done because presumably you have to press a button. so here's a button to both play and share. you can post but just every time you -- >> so it's easy to say, i can share. >> that's right.

>> mr. wolf talked about it would be really easy to disable the sharing but is there anything in the amendment that says how that would happen and netflix really have it hard? is there anything in the law that would prevent them from making it almost impossible to how to disable it? >> it says that you could enable consent until you took it away but there's nothing in the bill that says there are requirements about how that should be done. i think a scrupulous company would make it easy but it's not only going to apply to companies that we believe are going to do the right thing and it does not require -- the company could have no button or access anywhere on its website to do

this. it could perhaps have no access on its information or website that you have a right to do this and it would be up to the consumer to figure it out and the house allows that kind of an arrangement. >> i want to make that clear, that to opt in to sharing a video, what movie you're watching, would be no more burdensome than just watching the movie itself. >> under the current law. >> hourve, disabling the overall consent, to watch everything, can be impossible to find, essentially. >> that's right. >> mr. rotenberg, do you agree with that? >>.

>> there's the integration and i want to see a movie and not tell the world about it and specifically play and share stock with that setting and there is no company and streaming in 2008 today, 90% of streaming subscriptions, dvd subscriptions and that number is dropping. in fact, if you look at about us, the about us section on netflix website, the word dvd doesn't appear once. it's all about streaming and for good reason because that is the future of video. i mentioned my opening statement

that there may be some disagreement as to whether or not streaming video companies are covered by the video protection act. mr. rotenberg subjected in his testimony that it would be helpful to confirm that it does. would netflix support doing that? >> we wouldn't support that. i think the issue for us is really one video embedded into news stories, does that become a new story or is that streaming video? books, you know, i recently read

a book called visit from the lagoon squad. it uses in there texting. it's a power point presentation. you can imagine in the future that books will incorporate video. does that now mean that that's covered by the vppa? i think we have a host of issues to what is video in the future. so just ex teblding the video 3r50i6 see protection act is a host of other players that need to be involved in that. so, again, as we mentioned in the testimony, a holistic approach and comprehensive approach is one that net could be involved in. but taking it to vppa and say that it applies to streaming is a whole host of issues that need to be carefully addressed. >> would anyone care to address that in terms of -- because i don't think this amendment is comprehensive at all and so i think you raise a lot of great

issues about this but it seems to me to say that since the vppa apply to what we think of as movies, movies are going to be streamed. >> they are. >> they are going to be. >> so that this law, is teams like that you need to apply streaming to this and i'm troubled by your excluding -- trying to exclude streaming at all. anyone have anything to say about that? >> mr. chairman, i think perhaps the advocates of that approach, drawing the wrong line, the video protection act was not trying to regulate technology. it wasn't saying it will treat video rental cassettes in one way and other things in a different way. it actually says it should be treated in a similar way. what the act is trying to do is regulate the collection and use of personal identifiable information and the reason you

need to do that in the digital world is when you move from broadcast of television and movies to this kind of one to one service offering, these companies are now collecting a lot of personal information about their customers so what the law tries to do is say, if you're going to collect all of that data, then you need to protect it. and the other point that should be brought out, as we think about these new techniques for delivering video is that companies today are collecting a lot more information than they did 25 years ago. i would think that the inclination at this point in congress would be to strengthen the law, recognizing how much more information is collected. >> well, thank you. we'll go another round. i've run over my time so i'll go to the ranking member. mcgeveran. >> first of all, let me thank you for your testimony. i learned a lot from what you had to say. and i'm prone to agree with the

chairman on his concerns about this bill as i look at it and i really don't see a big difference from granting permission one click at a time to a blanket consent but i also think prudence ought to be the thing that guides us. that it gives them an asset, my privacy asset that i readily give to them if i have a blanket consent and if i'm giving them something of value that they can use and make money off of and

i'm torn between whether we have the right to tell somebody whether they can grant a consent or not so i would go back and i would ask the professor if he would give a further dissertation on what he thinks or means by the word genuine consent. >> thank you, professorcob cobu. we're helping a customer post the information that he or she wants to post. i might have more sympathy towards changing the existing vppa if i thought it did in fact

make it different for people to do that because i think recommendations of movies to our friends are really valuable. i read a lot about movies that i want to see by word of mouth from my friends. but as i mentioned before, what we have online is the capacity to make it very easy to secure a decision each time for the user to say, yes, i intend to share this information about this movie now. and the ability to say it for all movies in advance, we're not actually inconveniencing the user very much in an era where you're going to have to push one button or another. i would say genuine consent is making sure that it's intentional. >> so when i go through dallas airport, every time i consent i agree to the terms. how many of you have read that three pages of very fine print to say that i agree to consent. >> well, i have, but that's my job. >> but you're a rarity.

>> i am. >> the fact is, what you're saying is, what's wrong with making a considered judgment each time? >> exactly. >> senator, i think you pointed out, the problem with that, when consumers are presented with choices over and over and over again, they tend to tune them out and will ignore them and have no meaning whatsoever. they'll just click through it to get to the function that they want to exercise. >> well, let me bring it back to this point. if the question that comes up on my ipad is, do you want to share this information through your social media and i have to say yes or no, the question that's all that's going to be required for netflix so if i'm looking at an arnold schwarzenegger movie

that my wife hates and i love the action in them, i want everybody to know that i'm watching arnold schwarzenegger. and i'm going to -- i'm going to have to -- it's one sentence. i'm going to have to make that decision. why is that not protecting their rights rather than i'm hungover from the night before and i'm not thinking clearly and i've already granted and punched a button on something that i really don't want shared. the question is, should we error on the side of privacy or on the side of confidence. and that's the thing we have to decide. >> i actually don't think that's the choice. if a consumer wants to share everything on their facebook page, as they most do, it's not a choice that you or i might make, but a law that takes away that choice really ignores that there are people who want to do that.