• by Wendy Davis , Staff Writer @wendyndavis, December 18, 2009

When Netflix released a trove of "anonymized" information about consumers as part of a contest for a better recommendation tool, it only took a few weeks for researchers at the University of Texas at Austin to show how easily the data could be de-anonymized.

"An adversary who knows only a little bit about an individual subscriber can easily identify this subscriber's record in the dataset," they wrote.

If Netflix was chagrined by this development, you'd never know it. Not only did the company continue with the contest, but proudly declared it intends to hold a second one -- for which it will release even more information than last time. For the new contest, Netflix will make available customers' gender, ages, ZIP codes and previously rented movies in hopes of gleaning insight into users' tastes.

Stunned privacy experts wasted no time bashing the plan. University of Colorado law professor Paul Ohm implored Netflix to reverse course. "Researchers have known for more than a decade that gender plus ZIP code plus birthdate uniquely identifies a significant percentage of Americans," Ohm wrote. Even without birthdates, he said, interested researchers will be able to figure out many people's identities.

Attorney Jay Edelson predicted that Netflix would face a class-action lawsuit if it went through with its plans.

As it turns out, Edelson's law firm, KamberEdelson, along with Joseph Malley of Dallas and other lawyers, decided not to wait for Netflix to start the contest. This week, they filed suit on behalf of four Netflix consumers, arguing that releasing the information would violate the federal Video Protection Privacy Act -- a 21-year-old law, passed after a newspaper obtained the movie rental records of Supreme Court nominee Robert Bork -- that bans movie rental stores from revealing personally identifiable information about consumers.

The lawsuit, filed in federal district court in San Jose, Calif., seeks damages on behalf of people whose information was released by Netflix in the past.

The consumers also seek an order prohibiting Netflix from making any information available about their video records. One of the four, who sued under the pseudonym Jane Doe, alleges that she is a closeted lesbian who would be harmed if people figured out that she had rented a number of "gay-themed" movies from Netflix. "Plaintiff Doe does not want her movie selection or rating transactions to be included in any public disclosure of data for purposes such as the Netflix contest, regardless of any attempts by Netflix to anonymize or perturb the data," the lawsuit alleges.

A Netflix spokesperson declined to comment on the lawsuit.