Privacy on Trial: Reflections on Hoang v. IMDb
[Post by Venkat Balasubramani]
Hoang v. IMDb.com, C11-1709MJP (W.D. Wash. Mar. 18, 2013)
[Added: the jury ruled against Hoang and in favor of IMDb.]
At Eriq Gardner’s suggestion, I attended the trial in Hoang v. IMDb and reported on the proceedings for the Hollywood Reporter’s “THR, Esq.” blog. (Day 1: “Actress Suing IMDb Takes the Witness Stand“; Day 2: “Actress Suing IMDb Faces Tough Questions on Second Day of Trial“.) Although I was hesitant to sink a few days into the glamorous and unpaid world of covering a trial as a law blogger, it was an educational experience and it was also fun (and very interesting). The trial also focused some of the issues that frequently come up in privacy cases. I wanted to offer a few anecdotal observations below. (Note: the parties finished, and the case is in the hands of the jury; I’m going to refrain from making a prediction one way or the other, but I wanted to get this post up before the verdict comes out just so it does not influence my thinking.)
The facts are somewhat basic and for the most part tough to contest. Hoang was an actress who in 2003 or 2004 signed up for a short trial subscription to IMDb Pro. 
In 2007 she moved to Los Angeles and focused her acting efforts there, gaining some traction. She signed up again for an IMDb pro account. She tried to get IMDb to remove the birthdate on her profile on the basis that it was incorrect. IMDb asked her to verify her identity by sending in a photocopy of her passport. Instead, she sent in a copy of her birth certificate with her name and date of birth redacted. (She was reluctant to send in a copy of the passport due to identity theft concerns.) IMDb repeatedly refused or ignored her requests to change the birthdate. Eventually, she grew exasperated and sent an all caps email asking what documentation IMDb had for the birthdate and asking them to remove it (I can’t remember the precise wording, although it’s somewhat important).
IMDb’s customer service czar, Giancarlo Cairella, viewed her email as an invitation to check whatever records he had. He looked in the database where registration information was kept and ascertained her real name. From here, he went to privateyee.com, a database, and conducted a paid search to determine her birth date. Once determined, he replaced the 1978 date with Hoang’s true date of birth (1971). This prompted further escalation from Hoang, who sent in a image of a fake passport and a novelty ID in an effort to get IMDb to delete the 1971 date of birth.
Eventually, it culminated in a lawsuit. (Interestingly, the lawsuit was originally filed as a Doe lawsuit, but Judge Pechman ordered the plaintiff to proceed using her real identity. Hoang’s agent testified that he learned of her true age as a result of the publicity around the lawsuit.) As it proceeded to trial, the case revolved around the single issue of whether IMDb’s use of Hoang’s real name to access her birthdate and subsequent publication of her birthdate was a breach of contract (a violation of IMDb’s privacy policy which was incorporated by reference into the contract).
Regardless of how it resolves, here are some of the interesting themes that came out during the course of the trial:
Privacy damages: Privacy damages can be difficult to prove, and this was very much highlighted in this case. It was a struggle for Hoang to put on testimony that disclosure of her age harmed her. For procedural reasons not relevant here, Hoang did not have an expert testify. The court also excluded testimony from the Screen Actors Guild who has complained vociferously to IMDb about age discrimination as a systemic problem. Even still, you got the impression that while Hoang had been harmed, it would be very difficult to put a dollar figure on that harm with any degree of accuracy. There’s also the question of whether someone can be harmed from disclosure of information about them that is accurate. There was testimony that disclosure of your real-life details can harm your prospects in the make-believe world of Hollywood, but would an award in Hoang’s favor allow her to implicitly perpetuate misinformation?
Online agreements are terrible: A fair amount of time was spent walking through the IMDb user agreement (and its privacy policy, which as mentioned above was expressly made a part of the agreement). IMDb has highly competent lawyers representing it and the policy is about as good as any privacy policy out there I’m sure, but it was still painfully ambiguous about what IMDb could do with the information it “collected”. The privacy policy had the typical flowery language that many privacy policies have and it left Hoang room to make a couple of different arguments. First, she argued that IMDb’s use of her name didn’t squarely fit within IMDb’s examples of ways it would use information provided by users:
[w]e use the information that you provide for such purposes as responding to your requests, customizing future browsing for you, improving our site, and communicating with you…
Second, the policy contained a promise to obtain consent before disclosing the information to third parties:
Other than as set out above, you will always receive notice when information about you might go to third parties, and you will have an opportunity to choose not to share the information.
I would guess this type of language is in 99% of the policies out there, but it was still unclear what category of information Hoang’s real name fell under, and whether either of these provisions of the policies applied.
Do people even read user agreements?: A related point is whether people even read user agreements. As the agreements were being hashed out in court, you couldn’t help but wonder whether Hoang even read and digested the agreements when she signed up for IMDb Pro. Interestingly, IMDb’s customer service manager said something to the effect that the privacy policy was a marketing-driven document. All of this raised the question of how a terms of service agreement should even be interpreted. Ordinarily, if there’s some ambiguity in the agreement, the parties would testify as to what they understood the agreement to mean, but who on IMDb’s side would offer this testimony? The court did discuss a jury instruction that any ambiguity should be interpreted against IMDb as the drafter, but ultimately, the agreement would end up being interpreted in accordance the jury’s common sense … which, when it comes to online privacy, may vary wildly.
Connecting information and de-identification: IMDb’s ability to look into its registration database and determine Hoang’s true name, and from there obtain her date of birth with just a few mouse-clicks, was a great illustration that you’re never as anonymous or pseudonymous as you think you are. Hoang’s lawyer jokingly brought up the fact that she couldn’t stuff cash into her computer and send it to IMDb, but he had a good point. To sign up as a paying customer, you had to tell IMDb your real identity, and along with it, your birthdate (which was readily accessible with her identity). Eric has referenced Prof. Paul Ohm’s paper on de-identification on the blog. This seemed like a good illustration.
Internet customer service isn’t so great: IMDb is this cool company that has aggregated a ton of information. It lets people settle bets about who acted in what movies and it may be disrupting a certain segment of the casting process in Hollywood. But it has terrible customer service. No offense to their customer service manager that testified, but IMDb’s customer service just came across as lackluster. I certainly wouldn’t characterize it as having an attitude that the customer (IMDb pro subscribers) is always right. Maybe it’s because as an internet company it feels that it can hide behind the veil of its computers and servers and never have to conduct business in person. Who knows. Hoang never talked to a live person at IMDb. Ever. I got the feeling that the entire dispute may have just resolved if she were able to talk to someone in person at IMDb.
Who gets to control her information: The ultimate resolution may be influenced by the jury’s views on who gets to control her information. IMDb’s position, which is one that plenty of internet companies share, is that it will never take down information (in IMDb’s case, it says it will replace incorrect information with factually correct information). Having voluntarily submitted incorrect information into the IMDb vortex, should Hoang be forever precluded from exerting some control over that information? Was IMDb right to “connect the dots” and reach into its subscription database to ascertain her true date of birth? Does it matter that Hoang’s true name was not available anywhere online, except for sites that collected it in connection with payment for goods or services?
Another interesting aspect of the lawsuit will come if the jury decides to award nominal damages, indicating that IMDb’s disclosure of her birthdate was improper. Hoang may ask the court to issue an injunction forcing IMDb to remove her birthdate. The will set up an interesting dispute that requires the court to weigh a variety of factors, including the public interest, what ongoing harm Hoang will suffer from ongoing publication of her age, and IMDb’s own interest in publishing accurate information. This isn’t really a First Amendment dispute as such, given the existence of a contract, but it has interesting First Amendment undertones.
Previous posts:
Actress Suing IMDB Can Assert Claim Based on Privacy Policy – Hoang v. Amazon.com, Inc.
IMDB’s Disclosure of Actress’s Age Will Go To Trial – Hoang v. Amazon