Plaintiff appeals from the judgment of dismissal entered after the trial court sustained defendant's demurrer to causes of action for violations of Civil Code section 1798.83 et seq. (the shine the light law or STL) and Business and Professions Code section 17200 et seq. (the unfair competition law or UCL).
The STL is a disclosure statute designed to "shine the light" on businesses' information-sharing practices by requiring them to establish procedures by which customers can obtain information about those practices. (Miller v. Hearst Communications, Inc. (C.D.Cal., Aug. 3, 2012, No. CV 12-0733-GHK (PLAx)) 2012 WL 3205241, quoting Boorstein v. Men's Journal LLC (C.D.Cal., June 14, 2012, No. CV 12-771 DSF (Ex)) 2012 WL 2152815.) The STL requires businesses that share customers' personal information with third parties for direct marketing to disclose, upon a customer's request, the names and addresses of third parties who have received personal information and the categories of personal information revealed. (§ 1798.83, subd. (a).) The STL also requires businesses to make their contact information available to customers in one of three statutorily prescribed ways, and it provides that businesses need not make the disclosures required by section 1798.83,
Plaintiff David Boorstein filed the present action on December 28, 2011, and filed the operative first amended complaint, asserting violations of the STL and the UCL, on September 24, 2012. Plaintiff alleges that in or about 2005, he subscribed to cbssports.com, a Web site owned and operated by defendant CBS Interactive, Inc. (CBS), to compete in "fantasy" football, baseball, and basketball. When he did so, he provided personal information to CBS, including his name, e-mail address, date of birth, and ZIP Code. Plaintiff alleges that CBS shares users' personal information, including that of the type he provided to CBS, with third parties for direct marketing purposes, and thus is required to comply with the STL. CBS willfully violated the STL by "failing to provide a link on its home page (www.cbssports.com) titled `Your Privacy Rights'; [¶] failing to provide a link on its home page to a separate web page titled `Your Privacy Rights'; [¶] failing to provide — on the `first page' of the link from its home page — a description of its `customer[s'] rights' under the Act, including the right to request information about its information sharing practices or the right to opt out of information sharing altogether; and [¶] failing to provide — on the `first page' of the link from its home page — the designated mailing address, email address, telephone number, or facsimile number for customer requests." (Fn. omitted.) As a result, plaintiff alleges, he is "deprived of information that he was statutorily entitled to under the Act, including notice of his right to request Shine the Light Disclosures and contact information to make such requests; [¶] deprived of a meaningful opportunity to exercise his statutorily-guaranteed right to inquire about and receive a detailed response explaining CBS Interactive's information sharing practices (i.e., by identifying
Plaintiff purported to bring the present action for himself and a class of similarly situated individuals defined as "All California residents who have provided personal information to CBS Interactive." He sought actual damages, civil penalties of $3,000 per violation, injunctive relief, reasonable litigation expenses, and attorney fees.
CBS demurred to the first amended complaint. It asserted (1) plaintiff has not and cannot allege CBS ever shared his personal information with any third parties for any direct marketing purposes; (2) plaintiff has not and cannot allege that he ever contacted or attempted to contact CBS about how his personal information might have been shared, or that CBS ever provided him with any incomplete, inaccurate, or untimely information; (3) plaintiff did not allege a cognizable injury; (4) CBS complied with the STL by providing designated contact information on its Web site; and (5) CBS complied with the STL because its privacy policy informs users how their personal information is shared with third parties for direct marketing purposes only with consent, as well as how to opt out and how to contact CBS with questions.
The trial court held a hearing on the demurrer on December 13, 2012. Plaintiff's counsel conceded that the first amended complaint did not allege plaintiff had made a disclosure request under the STL, but urged that such a request was not required. The trial court disagreed and sustained the demurrer without leave to amend. Its order stated as follows:
Notice of entry of the order sustaining defendant's demurrer without leave to amend was served December 31, 2012. The court entered a final judgment of dismissal on January 28, 2013, from which plaintiff timely appealed.
Central to the dispute between the parties is whether plaintiff has standing to pursue the present action. CBS contends, and the trial court agreed, that to have standing under the STL (and, derivatively, under the UCL), a customer must either have made, or attempted to make, a disclosure request under section 1798.83, subdivision (a). Plaintiff disagrees, contending that a disclosure request is not necessary; it is enough that defendant failed to make its contact information available as the STL requires.
We review independently the trial court's judgment of dismissal following a demurrer, considering de novo whether the complaint alleges facts sufficient to state a cause of action or discloses a complete defense. (McCall v. PacifiCare of Cal., Inc. (2001) 25 Cal.4th 412, 415 [106 Cal.Rptr.2d 271, 21 P.3d 1189]; Aubry v. Tri-City Hospital Dist. (1992) 2 Cal.4th 962, 967 [9 Cal.Rptr.2d 92, 831 P.2d 317].) We assume the truth of the properly pleaded factual allegations, facts that reasonably can be inferred from those expressly pleaded, and matters of which judicial notice has been taken. (Regents of University of California v. Superior Court (2013) 220 Cal.App.4th 549, 558 [163 Cal.Rptr.3d 205].) We also review de novo issues of statutory construction, ascertaining the intent of the lawmakers so as to effectuate the purpose of the statutes. (Day v. City of Fontana (2001) 25 Cal.4th 268, 272 [105 Cal.Rptr.2d 457, 19 P.3d 1196]; Regents of University of California v. Superior Court, supra, 220 Cal.App.4th at p. 558.)
Section 1798.84, subdivisions (a) through (h) provide the remedies available for violations of the STL. As relevant here (and as discussed in greater
According to its legislative history, the STL was intended to "provide consumers with information on how their information is being shared by companies." (Sen. Com. on Judiciary, Analysis of Sen. Bill No. 27 (2003-2004 Reg. Sess.) as amended Apr. 30, 2003, p. 1.) The bill's author said that at the time of the STL's enactment, consumers were not only unable to stop the buying and selling of their personal information, "they do not even know whether and to what extent it is taking place...." (Sen. Com. on Judiciary, Analysis of Sen. Bill No. 27 (2003-2004 Reg. Sess.) as amended Apr. 30, 2003, p. 3.) The STL, thus, "is designed to let market forces work by shining light on [businesses' ]information sharing practices" so consumers can make educated privacy decisions and knowledgeable marketplace decisions. (Sen. Com. on Banking and Finance, Analysis of Sen. Bill No. 27 (2003-2004 Reg. Sess.) as amended July 2, 2003, p. 5.)
"As a general principle, standing to invoke the judicial process requires an actual justiciable controversy as to which the complainant has a real interest in the ultimate adjudication because he or she has either suffered or is about to suffer an injury of sufficient magnitude reasonably to assure that all of the relevant facts and issues will be adequately presented to the adjudicator. (Pacific Legal Foundation v. California Coastal Com. (1982) 33 Cal.3d 158, 169-172 [188 Cal.Rptr. 104, 655 P.2d 306]; Municipal Court v. Superior
As relevant here, section 1798.84, which sets out the remedies available for a violation of section 1798.83, provides:
Plaintiff contends that subdivisions (b), (c), and (e) of section 1798.84 are wholly independent of one another, and thus an individual need not have been "injured by a violation of this title" within the meaning of subdivision (b) to have standing to recover civil penalties or obtain an injunction under subdivisions (c) and (e). CBS disagrees, urging that a plaintiff must have suffered a statutory injury in order to seek the remedies available under subdivisions (b), (c), or (e).
Our conclusion is consistent with that reached by the district court in Boorstein v. Men's Journal LLC, supra, 2012 WL 2152815, an STL action brought by the present plaintiff in federal district court. There, the court held that to have standing under the STL, a plaintiff must suffer an injury caused by a violation of the statute. Because the plaintiff could not show he had suffered such an injury, the court granted the defendant's motion to dismiss. (Id. at pp. *2, *5.) It explained: "[T]he STL law does not allow a cause of action based solely upon a failure to comply with the statute. Rather, § 1798.84(b) expressly requires an injury resulting from a violation. Thus, a violation of the statute, without more, is insufficient." (Id. at p. *3.) The district court similarly concluded in Miller v. Hearst Communications, Inc., supra, 2012 WL 3205241 at page *7: "[T]he STL law's remedy provision requires an `injury' in conjunction with a violation. Because Plaintiff fails to allege a cognizable injury, she lacks statutory standing for her STL claim, regardless of whether her allegations are sufficient to state a violation of the STL law." (See King v. Conde Nast Publications (C.D.Cal., Aug. 3, 2012, No. CV 12-0719-GHK (Ex)) 2012 WL 3186578, p. *5 ["[T]he STL law's remedy provision requires an `injury' in conjunction with a violation. Because Plaintiff fails to allege a cognizable injury, he lacks statutory standing for his STL claim, regardless of whether his allegations are sufficient to state a violation of the STL law."].)
Plaintiff cites Edwards v. First American Corp. (9th Cir. 2010) 610 F.3d 514 (Edwards) for the proposition that civil penalties "are available in addition to — and, importantly, even in the absence of — economic damages caused by a violation of the Act." Edwards does not so hold — nor, indeed, could it have done so, because the claim in Edwards was brought under the Real Estate Settlement Procedures Act of 1974 (RESPA; 12 U.S.C. § 2601 et seq.), not the STL. The Edwards court held the plaintiff stated a claim under RESPA even though she had not alleged she had been overcharged because RESPA
Having concluded that plaintiff must plead a statutory injury to state a claim under the STL, we now move to the second part of our inquiry — whether plaintiff has alleged such an injury. As we have said, section 1798.84, subdivision (b) says that a customer may institute a civil action if he or she was injured "by a violation of this title." Nowhere, however, does the statute define a "violation of this title."
Plaintiff contends that a failure to comply with any provision of the statute constitutes an actionable "violation of this title." Thus, he says, he has stated a claim for relief because he alleged that CBS did not provide contact information on its Web site in the manner required by section 1798.83,
Our reading of the statute is supported by section 1798.84, subdivision (d), the so-called "safe harbor" provision. Subdivision (d) provides: "[A] business that is alleged to have not provided all the information required by subdivision (a) of Section 1798.83, to have provided inaccurate information, failed to provide any of the information required by subdivision (a) of Section 1798.83, or failed to provide information in the time period required by subdivision (b) of Section 1798.83, may assert as a complete defense in any action in law or equity that it thereafter provided regarding the information that was alleged to be untimely, all the information, or accurate information, to all customers who were provided incomplete or inaccurate information, respectively, within 90 days of the date the business knew that it had failed to provide the information, timely information, all the information, or the accurate information, respectively." (Italics added.) According to the statute's legislative history, this provision was added to an amended version of the bill "to accommodate business concerns" that businesses "might find themselves subject to liability under Business and Professions Code Section 17200 to individuals who wish to use the bill's provisions as a liability trap." (Sen. Com. on Judiciary, Analysis of Sen. Bill No. 27 (2003-2004 Reg. Sess.) as amended Sept. 5, 2003, p. 6.) The amendment "[p]rovide[s] businesses with a 90-day right to cure unintentional violations, which provides a complete defense to lawsuits." (State and Consumer Services Agency, Enrolled Bill Rep. on Sen. Bill No. 27 (2003-2004 Reg. Sess.) (Sept. 22, 2003) p. 13, italics added.) While legislators acknowledged that the bill could result in increased litigation, they described the safe-harbor provision as providing businesses "with a 90-day right to cure unintentional violations that permit[s] business[es] that come into full compliance within 90 days to assert a complete defense against any legal action." (Id. at p. 16, italics added.)
That the subsequent (albeit tardy) provision of complete, accurate information is described as a complete defense in any action suggests that the actionable violation contemplated by the statute is the failure completely and
Further, to construe "a violation" to include anything other than a company's failure to provide a timely, complete, and accurate response to disclosure requests would eviscerate the safe harbor intended by section 1798.84, subdivision (d) and invite the very "liability trap" the Legislature sought to avoid. If we interpret the statute as plaintiff suggests, customers could bring suit whether or not they ever tried to contact a business about its privacy policy. Indeed, if the law is interpreted as plaintiff suggests, a customer who made a request for information and received a timely, complete, and accurate response could still sue for an STL violation by challenging the manner in which the company disclosed its contact information on its Web site. As CBS notes, this would create an anomalous result whereby businesses would enjoy significant protection for nonintentional violations of the statute's primary directive (to provide complete, accurate, and timely disclosures under § 1798.83, subd. (a)), but would enjoy no such protection for nonintentional violations of the statute's secondary directive (to provide an address, e-mail address, or phone number to which such disclosure requests can be sent). We do not interpret the statute to create such an anomaly.
Our interpretation of the STL is consistent with that of the federal district courts that have considered claims under the statute. The first court to do so was the district court in Boorstein v. Men's Journal LLC, supra, 2012 WL 2152815. There, as here, the plaintiff alleged that the defendant failed to properly disclose its contact information on its Web site; the plaintiff did not, however, allege he had sought STL disclosures from the defendant or would have done so had the defendant's contact information been available. (Id. at p. *2.) On those facts, the court held that the plaintiff had not pled a statutory injury under the STL. It explained that although a plaintiff may suffer an "injury in fact" when he or she fails to obtain information that must be publicly disclosed pursuant to a statute, "the existing case law only recognizes such `informational injury' where the plaintiffs have requested information and have subsequently been denied it. This approach to defining an
Courts adopted the Boorstein court's analysis in Miller v. Hearst Communications, Inc., supra, 2012 WL 3205241 at pp. *6-*7, King v. Conde Nast Publications, supra, 2012 WL 3186578 at pp. *3-*5, and Murray v. Time Inc. (N.D.Cal., Aug. 24, 2012, No. C 12-00431 JSW) 2012 WL 3634387, in each case holding that the plaintiff had not stated a claim for relief because he or she had neither requested information from the defendant nor alleged that he or she would have done so had the appropriate contact information been provided.
Plaintiff contends that he suffered a cognizable injury — an "informational injury" — because he did not receive information to which he was statutorily entitled. He urges: "Boorstein suffered an informational injury because CBS failed to designate contact information for customers to use in making requests under the STL law and failed to accurately and completely describe its customer's rights.... [¶] ... CBS's `violation' thereafter caused `injury' when Boorstein actually visited the website and the required information wasn't there." For the reasons that follow, we do not agree.
Plaintiff has not cited any California cases recognizing "informational injury," and we are not aware of any such cases. Indeed, in Price v. Starbucks Corp. (2011) 192 Cal.App.4th 1136 [122 Cal.Rptr.3d 174], the court rejected the plaintiff's "informational injury" claim that he had been injured because information was missing from his itemized wage statement, in violation of Labor Code section 226, subdivision (e).
As plaintiff notes, federal courts have recognized injuries resulting from some kinds of withheld information in the United States Constitution, article III context. In Federal Election Comm'n v. Akins (1998) 524 U.S. 11, 21 [141 L.Ed.2d 10, 118 S.Ct. 1777], for example, the United States Supreme Court has held "a plaintiff suffers an `injury in fact' when the plaintiff fails to obtain information which must be publicly disclosed pursuant to a statute." Boorstein v. Men's Journal LLC, supra, 2012 WL 2152815, however, noted that courts have recognized that "informational injuries" are distinct from mere "procedural injuries." The court explained: "In Wilderness Soc'y [Inc. v. Rey (9th Cir. 2010) 622 F.3d 1251], the court looked to the purpose of a statute to determine whether the withheld information was the kind that the legislature meant to ensure access to (indicating informational injury), or whether the plaintiffs were merely deprived of a procedural right, which, alone, is not enough to create standing. See id. As in Wilderness Soc'y, the alleged violations here do not inflict an informational injury by depriving Plaintiff of statutorily-required disclosures about how his personal information is used. Instead, it deprives the Plaintiff of Defendant's contact information — information meant to facilitate requests for such disclosures. The STL law's requirements are not designed to ensure that consumers have access to contact information for its own sake, and thus the failure to provide that information inflicts merely a procedural injury." (Boorstein, supra, at p. *4.)
The judgment of dismissal is affirmed. CBS shall recover its costs on appeal.
Willhite, Acting P. J., and Manella, J., concurred.
