Netflix has agreed to change the way it retains information about customers in order to settle a class-action privacy lawsuit, according to court papers filed on Friday. The settlement, which is still awaiting approval, also requires Netflix to pay around $6.75 million to various privacy organizations and up to $2.25 million to the lawyers who sued the company.
Netflix said in a February SEC filing that it had agreed to settle the privacy lawsuit for $9 million, but didn't reveal further details at the time.
The agreement specifically calls for Netflix to "decouple" former customers' movie-rental history from their personal information 365 days after they cancel their accounts. In the past, Netflix allegedly stored the information for up to two years after cancellation.
The consumers who sued Netflix alleged that the company's prior data retention practices violated the 23-year-old federal Video Privacy Protection Act, enacted after a Washington newspaper obtained and printed the movie rental records of Supreme Court nominee Robert Bork. The law bans movie rental services from disclosing customers' records without their written consent. It also says that rental services must destroy users' personal information “as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected.”
U.S. District Court Judge Edward Davila in the Northern District of California still has to approve the deal. He will hold a hearing about the matter on June 29.