• by Wendy Davis , Staff Writer @wendyndavis, July 26, 2016

The advocacy group Electronic Privacy Information Center is asking a federal appellate court to revive iPhone user Ryan Perry's battle with CNN.

The dispute largely centers on whether the 12 random numbers and letters that make up an iPhone's Media Access Control address should be considered "anonymous." EPIC argues in new court papers that the MAC address actually serves as a better way to identify iPhones' owners than their names.

"In many cases a name would be insufficient, without more, to link a transaction to a specific individual," EPIC says in papers filed late last week with the 11th Circuit Court of Appeals.

"For example, the name 'Ryan Perry' is insufficient on its own to identify which of the 425 Ryan Perrys in the United States brought this lawsuit," EPIC adds. "But a unique, persistent identifier such as a device’s MAC address is a much better identifier than a name."

EPIC makes the argument in a proposed friend-of-the-court brief siding with Perry in his fight with CNN. The dispute dates to 2013, when Perry alleged in a potential class-action lawsuit that CNN disclosed information about video clips watched by himself and other iPhone users, along with their 12-digit Media Access Control addresses, to the analytics company Bango. (In 2014, Apple began restricting third parties from accessing MAC addresses as identifiers.)

Perry argued that CNN violated the Video Privacy Protection Act, which prohibits video rental companies from disclosing consumers' personally identifiable information.

U.S. District Court Judge Eleanor Ross in Atlanta dismissed the case in April. She ruled that MAC addresses aren't "personally identifiable," and that Perry wasn't a "consumer" for purposes of the video privacy law.

Perry appealed that ruling to the 11th Circuit Court of Appeals. On Friday, EPIC asked for permission to weigh in against CNN.

The privacy organization argues that Ross "got it exactly backwards" when she ruled that device identifiers aren't personally identifiable information.

Ross "simply did not understand the significance of the MAC address used by the service provider to track the activity of the customer," the organization says.

EPIC also says Ross wrongly ruled that Perry wasn't a consumer. "Whether a user streams a video under a subscription plan or under an ad supported option, that user is still a 'consumer' of the video service," EPIC says. "Mobile apps have simply created another way for video service providers to obtain the personal data of users."

CNN recently argued it is entitled to dismissal of the lawsuit due to the recent Supreme Court decision in a matter involving Spokeo. The Supreme Court ruled in that matter that consumers must show they were injured before they can sue in federal court.

CNN says Perry doesn't identify a "concrete injury" or a risk of harm due to the alleged disclosures to Bango.

Perry countered in papers filed earlier this month that "CNN’s invasion of [his] legally protected interest" was a concrete injury.

CNN is expected to file additional arguments by Sept. 1.