Some reflections on Netflix password sharing crackdown and EU law
According to news reports, Netflix is preparing to impose a crackdown on the practice of what it calls 'password sharing', that is the use of the service by multiple people outside the same household. Looking at the reports it seems Netflix is going a lot further than simply password sharing and instead is taking the opportunity to reduce the ability for content to be consumed outside of the home. Within the EU this approach cuts across the spirit (but maybe not the rules) of the Portability Regulation, which was (poorly) designed to allow consumers of online content to have access to their services anywhere in the Union.
Netflix is proposing what seems to be a double test for subscribers to maintain access to the service. First, each device must sign in into the home Wi-Fi (whatever that means…) every 31 days to be considered a 'trusted device' and if it is not, well it gets blocked. Furthermore, for travelling purposes, if one is using a device that has not been classified as 'trusted' such as a company laptop, Netflix graciously allows people to request a temporary code which allows the device to be used for 7 days. Now, it may well be that this is a balloon being floated or that these are the general guidelines before those pesky local (and EU) laws kick in. Speaking of which…
The Portability Regulation is one of the various pieces of legislation from the last few years trying to establish a Digital Single Market. As with the Geo-blocking Regulation, its scope and effect are underwhelming in my opinion. In what regards Netflix proposed changes, I can identify two problems. First, the lack of substantive definition of "temporarily present". Second, the possibility of using just the IP as a verification of the Member State of residence.
Article 2(4) of the Portability Regulation includes a definition of 'temporarily present' which means "means being present in a Member State other than the Member State of residence for a limited period of time". As you can imagine, the whole idea of the right to portability hangs on this concept of temporary presence. Unfortunately, the Regulation does not take the logical step of providing any sort of substantive definition for what consists a limited period of time. Not even the recitals help us here as the most we can find on Recital 1 is that this Regulation is "for purposes such as leisure, travel, business trips or learning mobility." It seems the Regulation is trying to have the proverbial cake and eat it, provide a right and creating enough of a grey zone that the actual scope of the right may vary depending on the generosity of the service provider. While the going was good, Netflix was incredibly generous in that regard but it seems that what the company gives, the company takes away.
The second problem is connected with the rules to determine what is the Member State of residence which are… special to say the least. Article 3 establishes the moment to verify the residence as at the conclusion or renewal of the contract and includes a list of different types of means for verification of residence. Service providers are to use at most two from the list of 11 options and with a particular caveat for the last three in the list: billing/postal address, declaration from the subscriber and - finally - IP address. These three have to be used in conjunction with the one of the other 8 and not by themselves. However, Netflix seems to be underpinning its mechanism to assess the locale on the IP address of the 'home wifi'.
Unfortunately, at face value, it seems this approach falls under Article 5(2) where providers who have 'reasonable doubts' about the subscriber Member State of residence are entitled to use IP address information as the sole method of verification. However, while the crux of the matter turns on what consists in determining 'reasonable doubts' it seems to me that enforcing a 31 day window to sue content abroad does not amount to reasonable doubt on the Member State of residence of the subscriber. Nonetheless, I expect Netflix to just point out to the apparent support in the letter of Article 5(2), especially as there is no provision for the subscriber to prove its residence by other means in this regard.
The grey zone offered by two poorly defined concepts gives Netflix the opportunity to impose the proposed limits and until cases make their way through the courts, the measures will stick.