Boorstein v. CBS Interactive, Inc. (2013) · DecisionDepot
Boorstein v. CBS Interactive, Inc.
California Court of Appeal Dec 19, 2013 No. B247472Published
Before: Suzukawa
Filed 12/19/13 CERTIFIED FOR PUBLICATION
IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA
SECOND APPELLATE DISTRICT
DIVISION FOUR
DAVID BOORSTEIN, B247472
Plaintiff and Appellant, (Los Angeles County Super. Ct. No. BC476015) v.
CBS INTERACTIVE, INC.,
Defendant and Respondent.
APPEAL from a judgment of the Superior Court of Los Angeles County, Anthony J. Mohr, Judge. Affirmed. The Reis Law Firm, Sean Reis; Edelson and Ari Scharg for Plaintiff and Appellant. Fenwick & West, Rodger R. Cole, Songmee L. Connolly, and Molly R. Melcher for Defendant and Respondent.
Plaintiff appeals from the judgment of dismissal entered after the trial court sustained defendant’s demurrer to causes of action for violations of Civil Code section 1798.83 et seq. (the shine the light law or STL) and Business and Professions Code section 17200 et seq. (the unfair competition law or UCL).1 We agree with the trial court that plaintiff lacks standing to pursue causes of action under either statute, and thus we affirm.
FACTUAL AND PROCEDURAL BACKGROUND
I. The Present Action The STL is a disclosure statute designed to “shine the light” on businesses’ information-sharing practices by requiring them to establish procedures by which customers can obtain information about those practices. (Miller v. Hearst Communications, Inc. (C.D. Cal. 2012) 2012 WL 3205241, quoting Boorstein v. Men’s Journal LLC (C.D. Cal. 2012) 2012 WL 2152815.) The STL requires businesses that share customers’ personal information with third parties for direct marketing to disclose, upon a customer’s request, the names and addresses of third parties who have received personal information and the categories of personal information revealed. (§ 1798.83, subd. (a).) The STL also requires businesses to make their contact information available to customers in one of three statutorily prescribed ways, and it provides that businesses need not make the disclosures required by section 1798.83, subdivision (a), if they instead give customers the opportunity to opt in or opt out of the disclosure of their personal information. (§1798.83, subds. (b), (c).) Finally, the STL provides for damages, civil penalties, injunctions, and attorney fees. (§ 1798.84.) Plaintiff David Boorstein filed the present action on December 28, 2011, and filed the operative first amended complaint, asserting violations of the STL and the UCL, on September 24, 2012. Plaintiff alleges that in or about 2005, he subscribed to
1 All further undesignated statutory references are to the Civil Code.
2
cbssports.com, a website owned and operated by defendant CBS Interactive, Inc. (CBS), to compete in “fantasy” football, baseball, and basketball. When he did so, he provided personal information to CBS, including his name, email address, date of birth, and zip code. Plaintiff alleges that CBS shares users’ personal information, including that of the type he provided to CBS, with third parties for direct marketing purposes, and thus is required to comply with the STL. CBS willfully violated the STL by “failing to provide a link on its home page (www.cbssports.com) titled ‘Your Privacy Rights’; [¶] failing to provide a link on its home page to a separate web page titled ‘Your Privacy Rights’; [¶] failing to provide—on the ‘first page’ of the link from its home page—a description of its ‘customer[s’] rights’ under the Act, including the right to request information about its information sharing practices or the right to opt out of information sharing altogether; and [¶] failing to provide—on the ‘first page’ of the link from its home page—the designated mailing address, email address, telephone number, or facsimile number for customer requests.” (Fn. omitted.) As a result, plaintiff alleges, he is “deprived of information that he was statutorily entitled to under the Act, including notice of his right to request Shine the Light Disclosures and contact information to make such requests; [¶] deprived of a meaningful opportunity to exercise his statutorily-guaranteed right to inquire about and receive a detailed response explaining CBS Interactive’s information sharing practices (i.e., by identifying what categories of information are disclosed and to whom); [¶] deprived of a meaningful opportunity to exercise his statutorily-guaranteed right to make informed decisions about his privacy and personal information; and [¶] deprived of a meaningful opportunity to exercise his statutorily-guaranteed right to monitor and control the disclosure and use of his personal information.” Plaintiff purported to bring the present action for himself and a class of similarly situated individuals defined as “All California residents who have provided personal information to CBS Interactive.” He sought actual damages, civil penalties of $3,000 per violation, injunctive relief, reasonable litigation expenses, and attorney fees.
3
II. CBS’s Demurrer CBS demurred to the first amended complaint. It asserted: (1) plaintiff has not and cannot allege CBS ever shared his personal information with any third parties for any direct marketing purposes; (2) plaintiff has not and cannot allege that he ever contacted or attempted to contact CBS about how his personal information might have been shared, or that CBS ever provided him with any incomplete, inaccurate, or untimely information; (3) plaintiff did not allege a cognizable injury; (4) CBS complied with the STL by providing designated contact information on its website; and (5) CBS complied with the STL because its privacy policy informs users how their personal information is shared with third parties for direct marketing purposes only with consent, as well as how to opt out and how to contact CBS with questions. The trial court held a hearing on the demurrer on December 13, 2012. Plaintiff’s counsel conceded that the first amended complaint did not allege plaintiff had made a disclosure request under the STL, but urged that such a request was not required. The trial court disagreed and sustained the demurrer without leave to amend. Its order stated as follows: “[A] business’s obligation to provide STL disclosures is triggered only if it (1) discloses a customer’s information to third parties for their direct marketing purposes; and (2) a customer makes a request for information. Cal. Civ. Code § 1798.83(a). The 90-day safe harbor in Cal. Civ. Code § 1798.84(d) further underscores that the Act only applies once a customer makes a request. Its plain language precisely describes violations for which a Shine the Light suit may be brought: the failure to provide accurate and complete Cal. Civ. Code § 1798.83(a) disclosures or timely disclosures under Cal. Civ. Code § 1798.83(b). If a plaintiff’s personal information was never shared or the plaintiff did not request (or want to, try to, or was unable to request any STL disclosures), the business has no obligation to provide any disclosures in the first instance. “Here, Plaintiff fails to state a claim against CBSi [CBS Interactive] for violation of the Act. First, Plaintiff fails to allege that CBSi actually disclosed his personal
4
information to a third party for direct marketing purposes. If plaintiff’s personal information was never shared, CBSi had no obligation to provide the Act’s disclosures to him in the first instance. “Worse yet, Plaintiff fails to allege that he ever requested, or even tried to, wanted to, or was unable to request, any STL disclosures from CBSi or that CBSi failed to provide a complete, accurate or timely response. Plaintiff confirmed at oral argument that he never requested, or tried to request, any STL disclosures from CBSi. If Plaintiff did not request, or want to request, any STL disclosures from CBSi, there is no obligation for CBSi to provide the disclosures to him. Because Plaintiff cannot state a claim under the Act, CBSi’s demurrer to Plaintiff’s first cause of action is sustained without leave to amend. “. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . “Plaintiff’s second claim for violation of the UCL hinges on alleged violations of the Act. It thus fails for the reasons above. [Citation.] Moreover, Plaintiff has failed to allege injury-in-fact and causation, and thus has no standing under the UCL. [Citation.] Thus, CBSi’s demurrer to the UCL claim is also SUSTAINED WITOUT LEAVE TO AMEND.” Notice of entry of the order sustaining defendant’s demurrer without leave to amend was served December 31, 2012. The court entered a final judgment of dismissal on January 28, 2013, from which plaintiff timely appealed.
DISCUSSION
Central to the dispute between the parties is whether plaintiff has standing to pursue the present action. CBS contends, and the trial court agreed, that to have standing under the STL (and, derivatively, under the UCL), a customer must either have made, or attempted to make, a disclosure request under section 1798.83, subdivision (a). Plaintiff disagrees, contending that a disclosure request is not necessary; it is enough that the defendant failed to make its contact information available as the STL requires.
5
We review independently the trial court’s judgment of dismissal following a demurrer, considering de novo whether the complaint alleges facts sufficient to state a cause of action or discloses a complete defense. (McCall v. PacifiCare of Cal., Inc. (2001) 25 Cal.4th 412, 415; Aubry v. Tri-City Hospital Dist. (1992) 2 Cal.4th 962, 967.) We assume the truth of the properly pleaded factual allegations, facts that reasonably can be inferred from those expressly pleaded, and matters of which judicial notice has been taken. (Regents of University of California v. Superior Court (2013) 220 Cal.App.4th 549, 558.) We also review de novo issues of statutory construction, ascertaining the intent of the lawmakers so as to effectuate the purpose of the statutes. (Day v. City of Fontana (2001) 25 Cal.4th 268, 272; Regents of University of California v. Superior Court, supra, 220 Cal.App.4th at p. 558.) For the reasons that follow, we agree with the trial court that a plaintiff must have made, or attempted to make, a disclosure request in order to have standing under the STL. Therefore, because it is undisputed that plaintiff has not alleged, and cannot allege, that he made or attempted to make such a disclosure request, the demurrer to the first cause of action was properly sustained. Because the UCL claim is derivative of the STL claim, the demurrer to the second cause of action was also properly sustained.
I. Overview of the STL The substantive provisions of the STL are set out in section 1798.83, subdivisions (a) through (h). As relevant here, subdivision (a) provides that if a business with an established relationship with a customer has, within the preceding calendar year, disclosed specified categories of personal information to third parties for direct marketing purposes, the business shall, upon a customer’s request, disclose the categories of personal information disclosed during the preceding year and the names and addresses of third parties who received personal information for direct marketing purposes during the preceding year. (§ 1798.83, subd. (a).) Subdivision (c) permits businesses to opt out of the subdivision (a) disclosure requirement; under subdivision (c), if a business required to comply with subdivision (a) adopts and discloses to the public a policy of disclosing
6
personal information to third parties only if the customer agrees to the disclosure, or of not disclosing personal information if the customer has exercised a nondisclosure option, the business may respond to a disclosure request by “notifying the customer of his or her right to prevent disclosure of personal information, and providing the customer with a cost-free means to exercise that right.” (Subd. (c)(2).) Finally, subdivision (b) requires businesses to designate a mailing address, email address, telephone number, or facsimile number where customers may send disclosure requests, and it requires businesses to advise customers of the designated addresses or telephone numbers in at least one of three ways: (1) notify managers who supervise employees who regularly interact with customers of the designated addresses and phone numbers and instruct those employees that customers who inquire shall be informed of the addresses or phone numbers; (2) add to the home page of its web site a link either to a page titled “Your Privacy Rights” or add the words “Your Privacy Rights” to the home page’s link to the business’s privacy policy; the first page of the link “shall describe a customer’s rights pursuant to this section and shall provide the designated mailing address, e-mail address, as required, or toll-free telephone number or facsimile number, as appropriate;” or (3) make the designated addresses or phone numbers readily available upon request of a customer at every place of business in California where the business or its agents regularly have contact with customers. (Subd. (b)(1).) Responses to disclosure requests must be provided within 30 days. (Subd. (b)(1)(C).) Section 1798.84, subdivisions (a) through (h) provide the remedies available for violations of the STL. As relevant here (and as discussed in greater detail below), subdivision (b) provides for a private right of action and damages, subdivision (c) provides for civil penalties, and subdivision (e) permits a court to enjoin any business “that violates, proposes to violate, or has violated this title.” According to its legislative history, the STL was intended to “provide consumers with information on how their information is being shared by businesses.” The bill’s author said that at the time of the STL’s enactment, consumers were not only unable to stop the buying and selling of their personal information, “they do not even know
7
whether and to what extent it is taking place.” The STL, thus, “is designed to let free market forces work by ‘shining the light’ on businesses’ information-sharing practices so consumers can make educated privacy decisions and knowledgeable marketplace decisions.”
II. Standing Under the STL A. Standing Generally A litigant’s standing to sue is a “threshold issue to be resolved before the matter can be reached on the merits. (Hernandez v. Atlantic Finance Co. (1980) 105 Cal.App.3d 65, 71.) ‘If we were to conclude that plaintiff did not have standing to maintain the action, not having been personally damaged by the defendants’ conduct, then there would be no need to address the merits of her cause. Equally wasteful of judicial resources would be a resolution on the merits without reaching the standing issue.’ (Ibid.) We will not address the merits of litigation when the plaintiff lacks standing, because ‘“California courts have no power . . . to render advisory opinions or give declaratory relief.”’ (Municipal Court v. Superior Court (Gonzalez) (1993) 5 Cal.4th 1126, 1132.)” (Blumhorst v. Jewish Family Services of Los Angeles (2005) 126 Cal.App.4th 993, 1000 . . . .) “As a general principle, standing to invoke the judicial process requires an actual justiciable controversy as to which the complainant has a real interest in the ultimate adjudication because he or she has either suffered or is about to suffer an injury of sufficient magnitude reasonably to assure that all of the relevant facts and issues will be adequately presented to the adjudicator. (Pacific Legal Foundation v. California Coastal Com. (1982) 33 Cal.3d 158, 169-172; Municipal Court v. Superior Court (1988) 202 Cal.App.3d 957, 960-964; California Water & Telephone Co. v. County of Los Angeles (1967) 253 Cal.App.2d 16, 22; 3 Witkin, Cal. Procedure (4th ed. 1996) Actions, §§ 73- 74, pp. 132-135.) To have standing, a party must be beneficially interested in the controversy; that is, he or she must have ‘some special interest to be served or some particular right to be preserved or protected over and above the interest held in common
8
with the public at large.’ (Carsten v. Psychology Examining Com. (1980) 27 Cal.3d 793, 796.) The party must be able to demonstrate that he or she has some such beneficial interest that is concrete and actual, and not conjectural or hypothetical.” (Holmes v. California Nat. Guard (2001) 90 Cal.App.4th 297, 315.) The prerequisites for standing to assert statutorily-based causes of action are determined from the statutory language, as well as the underlying legislative intent and the purpose of the statute. (Surrey v. TrueBeginnings, LLC (2008) 168 Cal.App.4th 414, 417-418.)
B. Standing to Pursue a Cause of Action Under the STL As relevant here, section 1798.84, which sets out the remedies available for a violation of section 1798.83, provides: “(b) Any customer injured by a violation of this title may institute a civil action to recover damages. “(c) In addition, for a willful, intentional, or reckless violation of Section 1798.83, a customer may recover a civil penalty not to exceed three thousand dollars ($3,000) per violation; otherwise, the customer may recover a civil penalty of up to five hundred dollars ($500) per violation for a violation of Section 1798.83. “. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . “(e) Any business that violates, proposes to violate, or has violated this title may be enjoined.” Plaintiff contends that subdivisions (b), (c), and (e) of section 1798.84 are wholly independent of one another, and thus an individual need not have been “injured by a violation of this title” within the meaning of subdivision (b) to have standing to recover civil penalties or obtain an injunction under subdivisions (c) and (e). CBS disagrees, urging that a plaintiff must have suffered a statutory injury in order to seek the remedies available under subdivisions (b), (c), or (e). We agree with CBS that a plaintiff must have suffered a statutory injury to have standing to pursue a cause of action under the STL, regardless of the remedies he or she
9
seeks. As the statutory language quoted above makes clear, section 1798.84, subdivision (b) creates a private right of action in any customer “injured by a violation of this title.” Subdivisions (c) and (e) do not repeat the “may institute a civil action” language of subdivision (b), and thus they do not create independent rights of action. Because the right to institute a civil action arises only under subdivision (b), a plaintiff must meet the terms of that section—i.e., he or she must be a “customer” who has been “injured by a violation of this title”—to pursue an action for a violation of section 1798.83. In the context of that action, the plaintiff may seek any of the remedies provided by section 1798.84—damages, statutory penalties, or injunctive relief. Our conclusion is consistent with that reached by the district court in Boorstein v. Men’s Journal LLC, supra, 2012 WL 2152815, a STL action brought by the present plaintiff in federal district court. There, the court held that to have standing under the STL, a plaintiff must suffer an injury caused by a violation of the statute. Because the plaintiff could not show he had suffered such an injury, the court granted the defendant’s motion to dismiss. (Id. at pp. [2], [5].) It explained: “[T]he STL law does not allow a cause of action based solely upon a failure to comply with the statute. Rather, [§ 1798.84(b)] expressly requires an injury resulting from a violation. Thus, a violation of the statute, without more, is insufficient.” (Id. at p. [3].) The district court similarly concluded in Miller v. Hearst Communications, Inc., supra, 2012 WL 3205241, at page [7]: “[T]he STL law’s remedy provision requires an ‘injury’ in conjunction with a violation. Because Plaintiff fails to allege a cognizable injury, she lacks statutory standing for her STL claim, regardless of whether her allegations are sufficient to state a violation of the STL law.” (See also King v. Conde Nast Publications (C.D. Cal. 2012) 2012 WL 3186578, [5] [“[T]he STL law’s remedy provision requires an ‘injury’ in conjunction with a violation. Because Plaintiff fails to allege a cognizable injury, he lacks statutory standing for his STL claim, regardless of whether his allegations are sufficient to state a violation of the STL law.”].) Plaintiff cites Edwards v. First Am. Corp. (9th Cir. 2010) 610 F.3d 514 (Edwards) for the proposition that civil penalties “are available in addition to—and, importantly,
10
even in the absence of—economic damages caused by a violation of the Act.” Edwards does not so hold—nor, indeed, could it have done so, because the claim in Edwards was brought under the Real Estate Settlement Procedures Act of 1974 (RESPA), not the STL. The Edwards court held the plaintiff stated a claim under RESPA even though she had not alleged she had been overcharged because RESPA created a statutory cause of action whether or not an overcharge occurred. (Id. at pp. 516-517.) The court explained: “‘Essentially, the standing question . . . is whether the constitutional or statutory provision on which the claim rests properly can be understood as granting persons in the plaintiff’s position a right to judicial relief.’ [Citation.] Thus, we must look to the text of RESPA to determine whether it prohibited Defendants’ conduct; if it did, then Plaintiff has demonstrated an injury sufficient to satisfy Article III. [¶] . . . [¶] Because the statutory text does not limit liability to instances in which a plaintiff is overcharged, we hold that Plaintiff has established an injury sufficient to satisfy Article III.” (Id. at p. 517.) Edwards, therefore, stands for the proposition that a plaintiff need not have suffered an injury to bring a claim under RESPA because an injury was not required by the plain language of the statute. Edwards does not purport to announce a general rule that standing never requires an injury, nor to opine on the injury requirement under the STL.2
2 Deacon v. Pandora Media, Inc. (N.D. Cal. 2012) 901 F.Supp.2d 1166, 1172, also does not aid plaintiff. Like Edwards, it expressly ties its injury requirement to the language of the particular statute at issue—there, Michigan’s Video Rental Privacy Act (VRPA). (Id. at p. 1172 [“As an initial matter, the VRPA does not explicitly impose an actual injury requirement. Rather, the statute’s civil remedy provision allows for recovery based on a showing of actual damages or statutory damages. [Citation.] Though there is no decisional authority interpreting the VRPA, the Ninth Circuit has recognized that, in order to deter the prohibited conduct, a statute may allow for the imposition of statutory damages without a showing of actual damages. [Citations.] That aside, Plaintiff has sufficiently alleged the disclosure of information governed by the VRPA. Plaintiff alleges that Pandora disclosed his name and ‘listening history,’ i.e., a list of the songs he listened to on Pandora’s radio service, to the general public. [Citation.] Assuming arguendo that those songs are deemed to have been sold, rented or lent to the subscriber (which is discussed below), the disclosure of this
11
III. Plaintiff Lacks Standing to Pursue This Action Because He Has Not, and Cannot, Plead a Statutory Injury Having concluded that plaintiff must plead a statutory injury to state a claim under the STL, we now move to the second part of our inquiry—whether plaintiff has alleged such an injury. As we have said, section 1798.84, subdivision (b) says that a customer may institute a civil action if he or she was injured “by a violation of this title.” Nowhere, however, does the statute define a “violation of this title.” Plaintiff contends that a failure to comply with any provision of the statute constitutes an actionable “violation of this title.” Thus, he says, he has stated a claim for relief because he alleged that CBS did not provide contact information on its website in the manner required by section 1798.83, subdivision (b). CBS disagrees, urging that the only violation for which suit may be brought is the failure to provide complete, accurate, and timely disclosures in response to customer disclosure requests pursuant to section 1798.83, subdivision (a). The failure to post the contact information required by section 1798.83, subdivision (b), CBS says, is not an actionable violation because the posting of contact information is merely a means to permit a customer to make a subdivision (a) disclosure request, not an independent obligation under the statute. Thus, CBS urges, because plaintiff admittedly did not make a subdivision (a) disclosure request, he cannot state a claim for relief. For the reasons that follow, CBS is correct.
A. Statutory Language We begin with the language of the statute. “‘Our fundamental task in interpreting a statute is to determine the Legislature’s intent so as to effectuate the law’s purpose. We first examine the statutory language, giving it a plain and commonsense meaning. We do not examine that language in isolation, but in the context of the statutory framework as a whole in order to determine its scope and purpose and to harmonize the various parts of
information is sufficient to constitute an injury for purposes of Article III standing. [Citation.]”].)
12
the enactment. If the language is clear, courts must generally follow its plain meaning unless a literal interpretation would result in absurd consequences the Legislature did not intend. If the statutory language permits more than one reasonable interpretation, courts may consider other aids, such as the statute’s purpose, legislative history, and public policy.’ [Citation.]” (Bruns v. E-Commerce Exchange, Inc. (2011) 51 Cal.4th 717, 724.) Section 1798.84, subdivision (c) imposes a statutory penalty “per violation”: “[A] customer may recover a civil penalty not to exceed three thousand dollars ($3,000) per violation; otherwise, the customer may recover a civil penalty of up to five hundred dollars ($500) per violation for a violation of Section 1798.83.” (Italics added.) That the Legislature authorized penalties “per violation” suggests that a statutory “violation” is a discrete event, such that a court can quantify the number of violations. A failure to timely, accurately, or completely respond to a disclosure request is a discrete event; a court can calculate a civil penalty for each failure by counting the number of disclosure requests to which the defendant did not appropriately respond. A failure to post information on a website, in contrast, is a continuing event that cannot readily be quantified, and section 1798.84 does not provide a method for calculating a civil penalty for such a continuing event.3 Thus, we conclude that a continuing violation of this kind, without more, is not an actionable “violation of this title.”4
3 In contrast, many statutes expressly authorize penalties for continuing violations on a “per day” or other basis. (E.g., 47 U.S.C. § 503 [“the amount of any forfeiture penalty determined under this section shall not exceed $ 25,000 for each violation or each day of a continuing violation”], italics added; 42 U.S.C. § 2282 [“Any person who . . . violates any licensing or certification provision [of this title] . . . shall be subject to a civil penalty, to be imposed by the Commission, of not to exceed $ 100,000 for each such violation. If any violation is a continuing one, each day of such violation shall constitute a separate violation for the purpose of computing the applicable civil penalty”], italics added.) 4 Although we need not reach this issue in the present case, we assume that a plaintiff alleging that he or she wished to make a disclosure request but could not do so because the defendant did not make contact information available would also state a claim under the STL.
13
Our reading of the statute is supported by section 1798.84, subdivision (d), the so- called “safe harbor” provision. Subdivision (d) provides: “[A] business that is alleged to have not provided all the information required by subdivision (a) of Section 1798.83, to have provided inaccurate information, failed to provide any of the information required by subdivision (a) of Section 1798.83, or failed to provide information in the time period required by subdivision (b) of Section 1798.83, may assert as a complete defense in any action in law or equity that it thereafter provided regarding the information that was alleged to be untimely, all the information, or accurate information, to all customers who were provided incomplete or inaccurate information, respectively, within 90 days of the date the business knew that it had failed to provide the information, timely information, all the information, or the accurate information, respectively.” (Italics added.) According to the statute’s legislative history, this provision was added to an amended version of the bill “to accommodate business concerns” that businesses “might find themselves subject to liability under Business and Professions Code Section 17200 to individuals who wish to use the bill’s provisions as a liability trap.” (Sen. Com. on Judiciary, Rep. on Sen. Bill No. 27 (2003-2004 Reg. Sess.) p. 5.) The amendment “[p]rovide[s] businesses with a 90-day right to cure unintentional violations, which provides a complete defense to lawsuits.” (State and Consumer Services Agency, Enrolled Bill Rep. on Sen. Bill No. 27 (2003-2004 Reg. Sess.) (Sept. 22, 2003) p. 13, italics added.) While legislators acknowledged that the bill could result in increased litigation, they described the safe-harbor provision as providing businesses “with a 90- day right to cure unintentional violations that permit[s] business[es] that come into full compliance within 90 days to assert a complete defense against any legal action.” (Id. at p. 16, italics added.) That the subsequent (albeit tardy) provision of complete, accurate information is described as a complete defense in any action suggests that the actionable violation contemplated by the statute is the failure completely and accurately “to provide any of the information required by subdivision (a) of Section 1798.83” (i.e., the categories of personal information disclosed to third parties for direct marketing purposes and the
14
names and addresses of the third parties who received such information) within the time required by section 1798.83, subdivision (b). Were the failure to disclose contact information also an actionable violation under the statute, it is hard to understand why the subsequent provision of “all the information, or accurate information, to all customers who were provided incomplete or inaccurate information” would be a complete defense—or, indeed, in the absence of a section 1798.83, subdivision (a) request for information, how a company would know to whom to provide this information. Further, to construe “a violation” to include anything other than a company’s failure to provide a timely, complete, and accurate response to disclosure requests would eviscerate the safe harbor intended by section 1798.84, subdivision (d) and invite the very “liability trap” the Legislature sought to avoid. If we interpret the statute as plaintiff suggests, customers could bring suit whether or not they ever tried to contact a business about its privacy policy. Indeed, if the law is interpreted as plaintiff suggests, a customer who made a request for information and received a timely, complete, and accurate response could still sue for a STL violation by challenging the manner in which the company disclosed its contact information on its website. As CBS notes, this would create an anomalous result whereby businesses would enjoy significant protection for nonintentional violations of the statute’s primary directive (to provide complete, accurate, and timely disclosures under section 1798.83, subdivision (a)), but would enjoy no such protection for nonintentional violations of the statute’s secondary directive (to provide an address, email address, or phone number to which such disclosure requests can be sent). We do not interpret the statute to create such an anomaly.
B. Federal Case Law Our interpretation of the STL is consistent with that of the federal district courts that have considered claims under the statute. The first court to do so was the district court in Boorstein v. Men’s Journal LLC, supra, 2012 WL 2152815. There, as here, the plaintiff alleged that defendant failed to properly disclose its contact information on its website; plaintiff did not, however, allege he had sought STL disclosures from defendant
15
or would have done so had defendant’s contact information been available. (Id. at p. [2].) On those facts, the court held that the plaintiff had not pled a statutory injury under the STL. It explained that although a plaintiff may suffer an “injury in fact” when he or she fails to obtain information that must be publicly disclosed pursuant to a statute, “the existing case law only recognizes such ‘informational injury’ where the plaintiffs have requested information and have subsequently been denied it. This approach to defining an ‘injury’ is supported by the provisions of the STL law, which specifically allow a customer to recover damages where a business has failed to provide information, provided inaccurate or incomplete information, or failed to provide information in a timely manner. See Cal. Civ. Code § 1798.84(b)-(c). Each of these provisions clearly contemplates a previous request for information. However, Plaintiff’s claim is not that he requested information and was denied, nor that he would have requested information had he been provided with the proper contact information, but rather that Defendant violated the statute by failing to provide information in the required manner. Plaintiff’s contention that he need not claim that he sought a STL disclosure [citation] goes against established precedent requiring plaintiffs to request information to suffer an injury.” (Boorstein, supra, at p. [3].) Courts adopted the Boorstein court’s analysis in Miller v. Hearst Communications, Inc., supra, 2012 WL 3205241, [6]-[7], King v. Conde Nast Publications, supra, 2012 WL 3186578, [3]-[5], and Murray v. Time Inc. (N.D. Cal. 2012) 2012 WL 3634387, in each case holding that the plaintiff had not stated a claim for relief because he or she had neither requested information from the defendant nor alleged that he or she would have done so had the appropriate contact information been provided.
C. Plaintiff’s Contention That He Suffered Injury Because He Was Deprived of Access to Information Is Without Merit Plaintiff contends that he suffered a cognizable injury—an “informational injury”—because he did not receive information to which he was statutorily entitled. He urges: “Boorstein suffered an informational injury because CBS failed to designate
16
contact information for customers to use in making requests under the STL law and failed to accurately and completely describe its customer’s rights. . . . [¶] . . . CBS’s ‘violation’ thereafter caused ‘injury’ when Boorstein actually visited the website and the required information wasn’t there.” For the reasons that follow, we do not agree. Plaintiff has not cited any California cases recognizing “informational injury,” and we are not aware of any such cases. Indeed, in Price v. Starbucks Corp. (2011) 192 Cal.App.4th 1136, the court rejected plaintiff’s “informational injury” claim that he had been injured because information was missing from his itemized wage statement, in violation of Labor Code section 226, subdivision (e).5 The court explained: “The injury requirement in section 226, subdivision (e), cannot be satisfied simply because one of the nine itemized requirements in section 226, subdivision (a) is missing from a wage statement. [Citations.] By employing the term ‘“suffering injury,”’ the statute requires that an employee may not recover for violations of section 226, subdivision (a) unless he or she demonstrates an injury arising from the missing information. [Citation.] Thus, the ‘deprivation of that information,’ standing alone, is not a cognizable injury.” (Id. at pp. 1142-1143, italics added.) As plaintiff notes, federal courts have recognized injuries resulting from some kinds of withheld information in the Article III context. In FEC v. Akins (1998) 524 U.S. 11, 24, for example, the United States Supreme Court has held “a plaintiff suffers an ‘injury in fact’ when the plaintiff fails to obtain information which must be publicly disclosed pursuant to a statute.” Boorstein v. Men’s Journal LLC, supra, 2012 WL 2152815, however, noted that courts have recognized that “informational injuries” are distinct from mere “procedural injuries.” The court explained: “In Wilderness Soc’y
5 That section said: “An employee suffering injury as a result of a knowing and intentional failure by an employer to comply with subdivision (a) is entitled to recover the greater of all actual damages or fifty dollars ($50) for the initial pay period in which a violation occurs and one hundred dollars ($100) per employee for each violation in a subsequent pay period, not to exceed an aggregate penalty of four thousand dollars ($4,000), and is entitled to an award of costs and reasonable attorney’s fees.” (Price v. Starbucks, supra, 192 Cal.App.4th at p. 1142, fn. 6, italics added.)
17
[Inc. v. Rey (9th Cir. 2010) 622 F.3d 1251], the court looked to the purpose of a statute to determine whether the withheld information was the kind that the legislature meant to ensure access to (indicating informational injury), or whether the plaintiffs were merely deprived of a procedural right, which, alone, is not enough to create standing. See id. As in Wilderness Soc’y, the alleged violations here do not inflict an informational injury by depriving Plaintiff of statutorily-required disclosures about how his personal information is used. Instead, it deprives the Plaintiff of Defendant’s contact information— information meant to facilitate requests for such disclosures. The STL law’s requirements are not designed to ensure that consumers have access to contact information for its own sake, and thus the failure to provide that information inflicts merely a procedural injury.” (Boorstein, supra, at p. [4].) We agree with the Boorstein court that, although informational injuries may be cognizable in some cases, under the STL a defendant’s failure to post information on its website in the manner the statute requires, without more, does not give rise to a cause of action. The trial court therefore correctly sustained the demurrer to plaintiff’s first cause of action.
IV. Plaintiff Failed to State a Claim Under the UCL The UCL provides that to pursue a claim for relief under the statute, an individual must have “suffered injury in fact and ha[ve] lost money or property as a result of the unfair competition.” (Bus. & Prof. Code, § 17204.) For the reasons stated above, plaintiff failed to allege an “injury in fact.” Thus, he has not stated a claim for relief under the UCL. The demurrer to the second cause of action was properly sustained.
18
DISPOSITION
The judgment of dismissal is affirmed. CBS shall recover its costs on appeal.
CERTIFIED FOR PUBLICATION
SUZUKAWA, J.
We concur:
WILLHITE, Acting P. J.
MANELLA, J.
19
AI Brief
AI-generated · verify before citing
Holding. The court held that a plaintiff must have made, or attempted to make, a disclosure request to a business to have standing to pursue a cause of action under the Shine the Light (STL) law. Because the plaintiff failed to allege such a request, he lacked standing to sue under the STL and the derivative Unfair Competition Law.
Issues
Does a plaintiff have standing to sue under the Shine the Light law without having made or attempted to make a disclosure request?
Is a plaintiff required to suffer a statutory injury to have standing to pursue remedies under the Shine the Light law?
Is the Unfair Competition Law claim derivative of the Shine the Light law claim in this action?
Disposition. Affirmed
Quotations verified verbatim against the opinion
“We agree with the trial court that a plaintiff must have made, or attempted to make, a disclosure request in order to have standing under the STL.”
“Because the UCL claim is derivative of the STL claim, the demurrer to the second cause of action was also properly sustained.”