Boorstein v. CBS Interactive, Inc. , 222 Cal. App. 4th 456 ( 2013 )

Filed 12/19/13
CERTIFIED FOR PUBLICATION
IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA
SECOND APPELLATE DISTRICT
DIVISION FOUR
DAVID BOORSTEIN, B247472
Plaintiff and Appellant, (Los Angeles County
Super. Ct. No. BC476015)
v.
CBS INTERACTIVE, INC.,
Defendant and Respondent.
APPEAL from a judgment of the Superior Court of Los Angeles County,
Anthony J. Mohr, Judge. Affirmed.
The Reis Law Firm, Sean Reis; Edelson and Ari Scharg for Plaintiff and
Appellant.
Fenwick & West, Rodger R. Cole, Songmee L. Connolly, and Molly R. Melcher
for Defendant and Respondent.
Plaintiff appeals from the judgment of dismissal entered after the trial court
sustained defendant’s demurrer to causes of action for violations of Civil Code section
1798.83 et seq. (the shine the light law or STL) and Business and Professions Code
section 17200 et seq. (the unfair competition law or UCL).1 We agree with the trial court
that plaintiff lacks standing to pursue causes of action under either statute, and thus we
affirm.
FACTUAL AND PROCEDURAL BACKGROUND
I. The Present Action
The STL is a disclosure statute designed to “shine the light” on businesses’
information-sharing practices by requiring them to establish procedures by which
customers can obtain information about those practices. (Miller v. Hearst
Communications, Inc. (C.D. Cal. 2012) 2012 WL 3205241, quoting Boorstein v. Men’s
Journal LLC (C.D. Cal. 2012) 2012 WL 2152815.) The STL requires businesses that
share customers’ personal information with third parties for direct marketing to disclose,
upon a customer’s request, the names and addresses of third parties who have received
personal information and the categories of personal information revealed. (§ 1798.83,
subd. (a).) The STL also requires businesses to make their contact information available
to customers in one of three statutorily prescribed ways, and it provides that businesses
need not make the disclosures required by section 1798.83, subdivision (a), if they
instead give customers the opportunity to opt in or opt out of the disclosure of their
personal information. (§1798.83, subds. (b), (c).) Finally, the STL provides for
damages, civil penalties, injunctions, and attorney fees. (§ 1798.84.)
Plaintiff David Boorstein filed the present action on December 28, 2011, and filed
the operative first amended complaint, asserting violations of the STL and the UCL, on
September 24, 2012. Plaintiff alleges that in or about 2005, he subscribed to
1
All further undesignated statutory references are to the Civil Code.
2
cbssports.com, a website owned and operated by defendant CBS Interactive, Inc. (CBS),
to compete in “fantasy” football, baseball, and basketball. When he did so, he provided
personal information to CBS, including his name, email address, date of birth, and zip
code. Plaintiff alleges that CBS shares users’ personal information, including that of the
type he provided to CBS, with third parties for direct marketing purposes, and thus is
required to comply with the STL. CBS willfully violated the STL by “failing to provide
a link on its home page (www.cbssports.com) titled ‘Your Privacy Rights’; [¶] failing to
provide a link on its home page to a separate web page titled ‘Your Privacy Rights’; [¶]
failing to provide—on the ‘first page’ of the link from its home page—a description of its
‘customer[s’] rights’ under the Act, including the right to request information about its
information sharing practices or the right to opt out of information sharing altogether; and
[¶] failing to provide—on the ‘first page’ of the link from its home page—the designated
mailing address, email address, telephone number, or facsimile number for customer
requests.” (Fn. omitted.) As a result, plaintiff alleges, he is “deprived of information that
he was statutorily entitled to under the Act, including notice of his right to request Shine
the Light Disclosures and contact information to make such requests; [¶] deprived of a
meaningful opportunity to exercise his statutorily-guaranteed right to inquire about and
receive a detailed response explaining CBS Interactive’s information sharing practices
(i.e., by identifying what categories of information are disclosed and to whom); [¶]
deprived of a meaningful opportunity to exercise his statutorily-guaranteed right to make
informed decisions about his privacy and personal information; and [¶] deprived of a
meaningful opportunity to exercise his statutorily-guaranteed right to monitor and control
the disclosure and use of his personal information.”
Plaintiff purported to bring the present action for himself and a class of similarly
situated individuals defined as “All California residents who have provided personal
information to CBS Interactive.” He sought actual damages, civil penalties of $3,000 per
violation, injunctive relief, reasonable litigation expenses, and attorney fees.
3
II. CBS’s Demurrer
CBS demurred to the first amended complaint. It asserted: (1) plaintiff has not
and cannot allege CBS ever shared his personal information with any third parties for any
direct marketing purposes; (2) plaintiff has not and cannot allege that he ever contacted or
attempted to contact CBS about how his personal information might have been shared, or
that CBS ever provided him with any incomplete, inaccurate, or untimely information;
(3) plaintiff did not allege a cognizable injury; (4) CBS complied with the STL by
providing designated contact information on its website; and (5) CBS complied with the
STL because its privacy policy informs users how their personal information is shared
with third parties for direct marketing purposes only with consent, as well as how to opt
out and how to contact CBS with questions.
The trial court held a hearing on the demurrer on December 13, 2012. Plaintiff’s
counsel conceded that the first amended complaint did not allege plaintiff had made a
disclosure request under the STL, but urged that such a request was not required. The
trial court disagreed and sustained the demurrer without leave to amend. Its order stated
as follows:
“[A] business’s obligation to provide STL disclosures is triggered only if it
(1) discloses a customer’s information to third parties for their direct marketing purposes;
and (2) a customer makes a request for information. Cal. Civ. Code § 1798.83(a). The
90-day safe harbor in Cal. Civ. Code § 1798.84(d) further underscores that the Act only
applies once a customer makes a request. Its plain language precisely describes
violations for which a Shine the Light suit may be brought: the failure to provide
accurate and complete Cal. Civ. Code § 1798.83(a) disclosures or timely disclosures
under Cal. Civ. Code § 1798.83(b). If a plaintiff’s personal information was never shared
or the plaintiff did not request (or want to, try to, or was unable to request any STL
disclosures), the business has no obligation to provide any disclosures in the first
instance.
“Here, Plaintiff fails to state a claim against CBSi [CBS Interactive] for violation
of the Act. First, Plaintiff fails to allege that CBSi actually disclosed his personal
4
information to a third party for direct marketing purposes. If plaintiff’s personal
information was never shared, CBSi had no obligation to provide the Act’s disclosures to
him in the first instance.
“Worse yet, Plaintiff fails to allege that he ever requested, or even tried to, wanted
to, or was unable to request, any STL disclosures from CBSi or that CBSi failed to
provide a complete, accurate or timely response. Plaintiff confirmed at oral argument
that he never requested, or tried to request, any STL disclosures from CBSi. If Plaintiff
did not request, or want to request, any STL disclosures from CBSi, there is no obligation
for CBSi to provide the disclosures to him. Because Plaintiff cannot state a claim under
the Act, CBSi’s demurrer to Plaintiff’s first cause of action is sustained without leave to
amend.
“. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
“Plaintiff’s second claim for violation of the UCL hinges on alleged violations of
the Act. It thus fails for the reasons above. [Citation.] Moreover, Plaintiff has failed to
allege injury-in-fact and causation, and thus has no standing under the UCL. [Citation.]
Thus, CBSi’s demurrer to the UCL claim is also SUSTAINED WITOUT LEAVE TO
AMEND.”
Notice of entry of the order sustaining defendant’s demurrer without leave to
amend was served December 31, 2012. The court entered a final judgment of dismissal
on January 28, 2013, from which plaintiff timely appealed.
DISCUSSION
Central to the dispute between the parties is whether plaintiff has standing to
pursue the present action. CBS contends, and the trial court agreed, that to have standing
under the STL (and, derivatively, under the UCL), a customer must either have made, or
attempted to make, a disclosure request under section 1798.83, subdivision (a). Plaintiff
disagrees, contending that a disclosure request is not necessary; it is enough that the
defendant failed to make its contact information available as the STL requires.
5
We review independently the trial court’s judgment of dismissal following a
demurrer, considering de novo whether the complaint alleges facts sufficient to state a
cause of action or discloses a complete defense. (McCall v. PacifiCare of Cal., Inc.
(2001) 25 Cal.4th 412, 415; Aubry v. Tri-City Hospital Dist. (1992) 2 Cal.4th 962, 967.)
We assume the truth of the properly pleaded factual allegations, facts that reasonably can
be inferred from those expressly pleaded, and matters of which judicial notice has been
taken. (Regents of University of California v. Superior Court (2013) 220 Cal.App.4th
549, 558.) We also review de novo issues of statutory construction, ascertaining the
intent of the lawmakers so as to effectuate the purpose of the statutes. (Day v. City of
Fontana (2001) 25 Cal.4th 268, 272; Regents of University of California v. Superior
Court, supra, 220 Cal.App.4th at p. 558.)
For the reasons that follow, we agree with the trial court that a plaintiff must have
made, or attempted to make, a disclosure request in order to have standing under the STL.
Therefore, because it is undisputed that plaintiff has not alleged, and cannot allege, that
he made or attempted to make such a disclosure request, the demurrer to the first cause of
action was properly sustained. Because the UCL claim is derivative of the STL claim,
the demurrer to the second cause of action was also properly sustained.
I. Overview of the STL
The substantive provisions of the STL are set out in section 1798.83, subdivisions
(a) through (h). As relevant here, subdivision (a) provides that if a business with an
established relationship with a customer has, within the preceding calendar year,
disclosed specified categories of personal information to third parties for direct marketing
purposes, the business shall, upon a customer’s request, disclose the categories of
personal information disclosed during the preceding year and the names and addresses of
third parties who received personal information for direct marketing purposes during the
preceding year. (§ 1798.83, subd. (a).) Subdivision (c) permits businesses to opt out of
the subdivision (a) disclosure requirement; under subdivision (c), if a business required to
comply with subdivision (a) adopts and discloses to the public a policy of disclosing
6
personal information to third parties only if the customer agrees to the disclosure, or of
not disclosing personal information if the customer has exercised a nondisclosure option,
the business may respond to a disclosure request by “notifying the customer of his or her
right to prevent disclosure of personal information, and providing the customer with a
cost-free means to exercise that right.” (Subd. (c)(2).) Finally, subdivision (b) requires
businesses to designate a mailing address, email address, telephone number, or facsimile
number where customers may send disclosure requests, and it requires businesses to
advise customers of the designated addresses or telephone numbers in at least one of
three ways: (1) notify managers who supervise employees who regularly interact with
customers of the designated addresses and phone numbers and instruct those employees
that customers who inquire shall be informed of the addresses or phone numbers; (2) add
to the home page of its web site a link either to a page titled “Your Privacy Rights” or
add the words “Your Privacy Rights” to the home page’s link to the business’s privacy
policy; the first page of the link “shall describe a customer’s rights pursuant to this
section and shall provide the designated mailing address, e-mail address, as required, or
toll-free telephone number or facsimile number, as appropriate;” or (3) make the
designated addresses or phone numbers readily available upon request of a customer at
every place of business in California where the business or its agents regularly have
contact with customers. (Subd. (b)(1).) Responses to disclosure requests must be
provided within 30 days. (Subd. (b)(1)(C).)
Section 1798.84, subdivisions (a) through (h) provide the remedies available for
violations of the STL. As relevant here (and as discussed in greater detail below),
subdivision (b) provides for a private right of action and damages, subdivision (c)
provides for civil penalties, and subdivision (e) permits a court to enjoin any business
“that violates, proposes to violate, or has violated this title.”
According to its legislative history, the STL was intended to “provide consumers
with information on how their information is being shared by businesses.” The bill’s
author said that at the time of the STL’s enactment, consumers were not only unable to
stop the buying and selling of their personal information, “they do not even know
7
whether and to what extent it is taking place.” The STL, thus, “is designed to let free
market forces work by ‘shining the light’ on businesses’ information-sharing practices so
consumers can make educated privacy decisions and knowledgeable marketplace
decisions.”
II. Standing Under the STL
A. Standing Generally
A litigant’s standing to sue is a “threshold issue to be resolved before the matter
can be reached on the merits. (Hernandez v. Atlantic Finance Co. (1980) 105 Cal.App.3d
65, 71.) ‘If we were to conclude that plaintiff did not have standing to maintain the
action, not having been personally damaged by the defendants’ conduct, then there would
be no need to address the merits of her cause. Equally wasteful of judicial resources
would be a resolution on the merits without reaching the standing issue.’ (Ibid.) We will
not address the merits of litigation when the plaintiff lacks standing, because ‘“California
courts have no power . . . to render advisory opinions or give declaratory relief.”’
(Municipal Court v. Superior Court (Gonzalez) (1993) 5 Cal.4th 1126, 1132.)”
(Blumhorst v. Jewish Family Services of Los Angeles (2005) 126 Cal.App.4th 993, 1000
. . . .)
“As a general principle, standing to invoke the judicial process requires an actual
justiciable controversy as to which the complainant has a real interest in the ultimate
adjudication because he or she has either suffered or is about to suffer an injury of
sufficient magnitude reasonably to assure that all of the relevant facts and issues will be
adequately presented to the adjudicator. (Pacific Legal Foundation v. California Coastal
Com. (1982) 33 Cal.3d 158, 169-172; Municipal Court v. Superior Court (1988) 202
Cal.App.3d 957, 960-964; California Water & Telephone Co. v. County of Los Angeles
(1967) 253 Cal.App.2d 16, 22; 3 Witkin, Cal. Procedure (4th ed. 1996) Actions, §§ 73-
74, pp. 132-135.) To have standing, a party must be beneficially interested in the
controversy; that is, he or she must have ‘some special interest to be served or some
particular right to be preserved or protected over and above the interest held in common
8
with the public at large.’ (Carsten v. Psychology Examining Com. (1980) 27 Cal.3d 793,
796.) The party must be able to demonstrate that he or she has some such beneficial
interest that is concrete and actual, and not conjectural or hypothetical.” (Holmes v.
California Nat. Guard (2001) 90 Cal.App.4th 297, 315.)
The prerequisites for standing to assert statutorily-based causes of action are
determined from the statutory language, as well as the underlying legislative intent and
the purpose of the statute. (Surrey v. TrueBeginnings, LLC (2008) 168 Cal.App.4th 414,
417-418.)
B. Standing to Pursue a Cause of Action Under the STL
As relevant here, section 1798.84, which sets out the remedies available for a
violation of section 1798.83, provides:
“(b) Any customer injured by a violation of this title may institute a civil action
to recover damages.
“(c) In addition, for a willful, intentional, or reckless violation of Section
1798.83, a customer may recover a civil penalty not to exceed three thousand dollars
($3,000) per violation; otherwise, the customer may recover a civil penalty of up to five
hundred dollars ($500) per violation for a violation of Section 1798.83.
“. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
“(e) Any business that violates, proposes to violate, or has violated this title may
be enjoined.”
Plaintiff contends that subdivisions (b), (c), and (e) of section 1798.84 are wholly
independent of one another, and thus an individual need not have been “injured by a
violation of this title” within the meaning of subdivision (b) to have standing to recover
civil penalties or obtain an injunction under subdivisions (c) and (e). CBS disagrees,
urging that a plaintiff must have suffered a statutory injury in order to seek the remedies
available under subdivisions (b), (c), or (e).
We agree with CBS that a plaintiff must have suffered a statutory injury to have
standing to pursue a cause of action under the STL, regardless of the remedies he or she
9
seeks. As the statutory language quoted above makes clear, section 1798.84, subdivision
(b) creates a private right of action in any customer “injured by a violation of this title.”
Subdivisions (c) and (e) do not repeat the “may institute a civil action” language of
subdivision (b), and thus they do not create independent rights of action. Because the
right to institute a civil action arises only under subdivision (b), a plaintiff must meet the
terms of that section—i.e., he or she must be a “customer” who has been “injured by a
violation of this title”—to pursue an action for a violation of section 1798.83. In the
context of that action, the plaintiff may seek any of the remedies provided by section
1798.84—damages, statutory penalties, or injunctive relief.
Our conclusion is consistent with that reached by the district court in Boorstein v.
Men’s Journal LLC, supra, 2012 WL 2152815, a STL action brought by the present
plaintiff in federal district court. There, the court held that to have standing under the
STL, a plaintiff must suffer an injury caused by a violation of the statute. Because the
plaintiff could not show he had suffered such an injury, the court granted the defendant’s
motion to dismiss. (Id. at pp. *2, *5.) It explained: “[T]he STL law does not allow a
cause of action based solely upon a failure to comply with the statute. Rather,
[§ 1798.84(b)] expressly requires an injury resulting from a violation. Thus, a violation
of the statute, without more, is insufficient.” (Id. at p. *3.) The district court similarly
concluded in Miller v. Hearst Communications, Inc., supra, 2012 WL 3205241, at
page *7: “[T]he STL law’s remedy provision requires an ‘injury’ in conjunction with a
violation. Because Plaintiff fails to allege a cognizable injury, she lacks statutory
standing for her STL claim, regardless of whether her allegations are sufficient to state a
violation of the STL law.” (See also King v. Conde Nast Publications (C.D. Cal. 2012)
2012 WL 3186578, *5 [“[T]he STL law’s remedy provision requires an ‘injury’ in
conjunction with a violation. Because Plaintiff fails to allege a cognizable injury, he
lacks statutory standing for his STL claim, regardless of whether his allegations are
sufficient to state a violation of the STL law.”].)
Plaintiff cites Edwards v. First Am. Corp. (9th Cir. 2010) 610 F.3d 514 (Edwards)
for the proposition that civil penalties “are available in addition to—and, importantly,
10
even in the absence of—economic damages caused by a violation of the Act.” Edwards
does not so hold—nor, indeed, could it have done so, because the claim in Edwards was
brought under the Real Estate Settlement Procedures Act of 1974 (RESPA), not the STL.
The Edwards court held the plaintiff stated a claim under RESPA even though she had
not alleged she had been overcharged because RESPA created a statutory cause of action
whether or not an overcharge occurred. (Id. at pp. 516-517.) The court explained:
“‘Essentially, the standing question . . . is whether the constitutional or statutory
provision on which the claim rests properly can be understood as granting persons in the
plaintiff’s position a right to judicial relief.’ [Citation.] Thus, we must look to the text of
RESPA to determine whether it prohibited Defendants’ conduct; if it did, then Plaintiff
has demonstrated an injury sufficient to satisfy Article III. [¶] . . . [¶] Because the
statutory text does not limit liability to instances in which a plaintiff is overcharged, we
hold that Plaintiff has established an injury sufficient to satisfy Article III.” (Id. at
p. 517.) Edwards, therefore, stands for the proposition that a plaintiff need not have
suffered an injury to bring a claim under RESPA because an injury was not required by
the plain language of the statute. Edwards does not purport to announce a general rule
that standing never requires an injury, nor to opine on the injury requirement under the
STL.2
2
Deacon v. Pandora Media, Inc. (N.D. Cal. 2012) 901 F.Supp.2d 1166, 1172, also
does not aid plaintiff. Like Edwards, it expressly ties its injury requirement to the
language of the particular statute at issue—there, Michigan’s Video Rental Privacy Act
(VRPA). (Id. at p. 1172 [“As an initial matter, the VRPA does not explicitly impose an
actual injury requirement. Rather, the statute’s civil remedy provision allows for
recovery based on a showing of actual damages or statutory damages. [Citation.]
Though there is no decisional authority interpreting the VRPA, the Ninth Circuit has
recognized that, in order to deter the prohibited conduct, a statute may allow for the
imposition of statutory damages without a showing of actual damages. [Citations.] That
aside, Plaintiff has sufficiently alleged the disclosure of information governed by the
VRPA. Plaintiff alleges that Pandora disclosed his name and ‘listening history,’ i.e., a
list of the songs he listened to on Pandora’s radio service, to the general
public. [Citation.] Assuming arguendo that those songs are deemed to have been sold,
rented or lent to the subscriber (which is discussed below), the disclosure of this
11
III. Plaintiff Lacks Standing to Pursue This Action Because He Has Not, and
Cannot, Plead a Statutory Injury
Having concluded that plaintiff must plead a statutory injury to state a claim under
the STL, we now move to the second part of our inquiry—whether plaintiff has alleged
such an injury. As we have said, section 1798.84, subdivision (b) says that a customer
may institute a civil action if he or she was injured “by a violation of this title.”
Nowhere, however, does the statute define a “violation of this title.”
Plaintiff contends that a failure to comply with any provision of the statute
constitutes an actionable “violation of this title.” Thus, he says, he has stated a claim for
relief because he alleged that CBS did not provide contact information on its website in
the manner required by section 1798.83, subdivision (b). CBS disagrees, urging that the
only violation for which suit may be brought is the failure to provide complete, accurate,
and timely disclosures in response to customer disclosure requests pursuant to section
1798.83, subdivision (a). The failure to post the contact information required by section
1798.83, subdivision (b), CBS says, is not an actionable violation because the posting of
contact information is merely a means to permit a customer to make a subdivision (a)
disclosure request, not an independent obligation under the statute. Thus, CBS urges,
because plaintiff admittedly did not make a subdivision (a) disclosure request, he cannot
state a claim for relief. For the reasons that follow, CBS is correct.
A. Statutory Language
We begin with the language of the statute. “‘Our fundamental task in interpreting
a statute is to determine the Legislature’s intent so as to effectuate the law’s purpose. We
first examine the statutory language, giving it a plain and commonsense meaning. We do
not examine that language in isolation, but in the context of the statutory framework as a
whole in order to determine its scope and purpose and to harmonize the various parts of
information is sufficient to constitute an injury for purposes of Article III standing.
[Citation.]”].)
12
the enactment. If the language is clear, courts must generally follow its plain meaning
unless a literal interpretation would result in absurd consequences the Legislature did not
intend. If the statutory language permits more than one reasonable interpretation, courts
may consider other aids, such as the statute’s purpose, legislative history, and public
policy.’ [Citation.]” (Bruns v. E-Commerce Exchange, Inc. (2011) 51 Cal.4th 717, 724.)
Section 1798.84, subdivision (c) imposes a statutory penalty “per violation”: “[A]
customer may recover a civil penalty not to exceed three thousand dollars ($3,000) per
violation; otherwise, the customer may recover a civil penalty of up to five hundred
dollars ($500) per violation for a violation of Section 1798.83.” (Italics added.) That the
Legislature authorized penalties “per violation” suggests that a statutory “violation” is a
discrete event, such that a court can quantify the number of violations. A failure to
timely, accurately, or completely respond to a disclosure request is a discrete event; a
court can calculate a civil penalty for each failure by counting the number of disclosure
requests to which the defendant did not appropriately respond. A failure to post
information on a website, in contrast, is a continuing event that cannot readily be
quantified, and section 1798.84 does not provide a method for calculating a civil penalty
for such a continuing event.3 Thus, we conclude that a continuing violation of this kind,
without more, is not an actionable “violation of this title.”4
3
In contrast, many statutes expressly authorize penalties for continuing violations
on a “per day” or other basis. (E.g., 47 U.S.C. § 503 [“the amount of any forfeiture
penalty determined under this section shall not exceed $ 25,000 for each violation or
each day of a continuing violation”], italics added; 42 U.S.C. § 2282 [“Any person who
. . . violates any licensing or certification provision [of this title] . . . shall be subject to a
civil penalty, to be imposed by the Commission, of not to exceed $ 100,000 for each such
violation. If any violation is a continuing one, each day of such violation shall constitute
a separate violation for the purpose of computing the applicable civil penalty”], italics
added.)
4
Although we need not reach this issue in the present case, we assume that a
plaintiff alleging that he or she wished to make a disclosure request but could not do so
because the defendant did not make contact information available would also state a
claim under the STL.
13
Our reading of the statute is supported by section 1798.84, subdivision (d), the so-
called “safe harbor” provision. Subdivision (d) provides: “[A] business that is alleged to
have not provided all the information required by subdivision (a) of Section 1798.83, to
have provided inaccurate information, failed to provide any of the information required
by subdivision (a) of Section 1798.83, or failed to provide information in the time period
required by subdivision (b) of Section 1798.83, may assert as a complete defense in any
action in law or equity that it thereafter provided regarding the information that was
alleged to be untimely, all the information, or accurate information, to all customers who
were provided incomplete or inaccurate information, respectively, within 90 days of the
date the business knew that it had failed to provide the information, timely information,
all the information, or the accurate information, respectively.” (Italics added.)
According to the statute’s legislative history, this provision was added to an amended
version of the bill “to accommodate business concerns” that businesses “might find
themselves subject to liability under Business and Professions Code Section 17200 to
individuals who wish to use the bill’s provisions as a liability trap.” (Sen. Com. on
Judiciary, Rep. on Sen. Bill No. 27 (2003-2004 Reg. Sess.) p. 5.) The amendment
“[p]rovide[s] businesses with a 90-day right to cure unintentional violations, which
provides a complete defense to lawsuits.” (State and Consumer Services Agency,
Enrolled Bill Rep. on Sen. Bill No. 27 (2003-2004 Reg. Sess.) (Sept. 22, 2003) p. 13,
italics added.) While legislators acknowledged that the bill could result in increased
litigation, they described the safe-harbor provision as providing businesses “with a 90-
day right to cure unintentional violations that permit[s] business[es] that come into full
compliance within 90 days to assert a complete defense against any legal action.” (Id. at
p. 16, italics added.)
That the subsequent (albeit tardy) provision of complete, accurate information is
described as a complete defense in any action suggests that the actionable violation
contemplated by the statute is the failure completely and accurately “to provide any of the
information required by subdivision (a) of Section 1798.83” (i.e., the categories of
personal information disclosed to third parties for direct marketing purposes and the
14
names and addresses of the third parties who received such information) within the time
required by section 1798.83, subdivision (b). Were the failure to disclose contact
information also an actionable violation under the statute, it is hard to understand why the
subsequent provision of “all the information, or accurate information, to all customers
who were provided incomplete or inaccurate information” would be a complete
defense—or, indeed, in the absence of a section 1798.83, subdivision (a) request for
information, how a company would know to whom to provide this information.
Further, to construe “a violation” to include anything other than a company’s
failure to provide a timely, complete, and accurate response to disclosure requests would
eviscerate the safe harbor intended by section 1798.84, subdivision (d) and invite the very
“liability trap” the Legislature sought to avoid. If we interpret the statute as plaintiff
suggests, customers could bring suit whether or not they ever tried to contact a business
about its privacy policy. Indeed, if the law is interpreted as plaintiff suggests, a customer
who made a request for information and received a timely, complete, and accurate
response could still sue for a STL violation by challenging the manner in which the
company disclosed its contact information on its website. As CBS notes, this would
create an anomalous result whereby businesses would enjoy significant protection for
nonintentional violations of the statute’s primary directive (to provide complete, accurate,
and timely disclosures under section 1798.83, subdivision (a)), but would enjoy no such
protection for nonintentional violations of the statute’s secondary directive (to provide an
address, email address, or phone number to which such disclosure requests can be sent).
We do not interpret the statute to create such an anomaly.
B. Federal Case Law
Our interpretation of the STL is consistent with that of the federal district courts
that have considered claims under the statute. The first court to do so was the district
court in Boorstein v. Men’s Journal LLC, supra, 2012 WL 2152815. There, as here, the
plaintiff alleged that defendant failed to properly disclose its contact information on its
website; plaintiff did not, however, allege he had sought STL disclosures from defendant
15
or would have done so had defendant’s contact information been available. (Id. at p. *2.)
On those facts, the court held that the plaintiff had not pled a statutory injury under the
STL. It explained that although a plaintiff may suffer an “injury in fact” when he or she
fails to obtain information that must be publicly disclosed pursuant to a statute, “the
existing case law only recognizes such ‘informational injury’ where the plaintiffs have
requested information and have subsequently been denied it. This approach to defining
an ‘injury’ is supported by the provisions of the STL law, which specifically allow a
customer to recover damages where a business has failed to provide information,
provided inaccurate or incomplete information, or failed to provide information in a
timely manner. See Cal. Civ. Code § 1798.84(b)-(c). Each of these provisions clearly
contemplates a previous request for information. However, Plaintiff’s claim is not that he
requested information and was denied, nor that he would have requested information had
he been provided with the proper contact information, but rather that Defendant violated
the statute by failing to provide information in the required manner. Plaintiff’s
contention that he need not claim that he sought a STL disclosure [citation] goes against
established precedent requiring plaintiffs to request information to suffer an injury.”
(Boorstein, supra, at p. *3.)
Courts adopted the Boorstein court’s analysis in Miller v. Hearst Communications,
Inc., supra, 2012 WL 3205241, *6-*7, King v. Conde Nast Publications, supra, 2012 WL
3186578, *3-*5, and Murray v. Time Inc. (N.D. Cal. 2012) 2012 WL 3634387, in each
case holding that the plaintiff had not stated a claim for relief because he or she had
neither requested information from the defendant nor alleged that he or she would have
done so had the appropriate contact information been provided.
C. Plaintiff’s Contention That He Suffered Injury Because He Was Deprived of
Access to Information Is Without Merit
Plaintiff contends that he suffered a cognizable injury—an “informational
injury”—because he did not receive information to which he was statutorily entitled. He
urges: “Boorstein suffered an informational injury because CBS failed to designate
16
contact information for customers to use in making requests under the STL law and failed
to accurately and completely describe its customer’s rights. . . . [¶] . . . CBS’s
‘violation’ thereafter caused ‘injury’ when Boorstein actually visited the website and the
required information wasn’t there.” For the reasons that follow, we do not agree.
Plaintiff has not cited any California cases recognizing “informational injury,” and
we are not aware of any such cases. Indeed, in Price v. Starbucks Corp. (2011) 192
Cal.App.4th 1136, the court rejected plaintiff’s “informational injury” claim that he had
been injured because information was missing from his itemized wage statement, in
violation of Labor Code section 226, subdivision (e).5 The court explained: “The injury
requirement in section 226, subdivision (e), cannot be satisfied simply because one of the
nine itemized requirements in section 226, subdivision (a) is missing from a wage
statement. [Citations.] By employing the term ‘“suffering injury,”’ the statute requires
that an employee may not recover for violations of section 226, subdivision (a) unless he
or she demonstrates an injury arising from the missing information. [Citation.] Thus,
the ‘deprivation of that information,’ standing alone, is not a cognizable injury.” (Id. at
pp. 1142-1143, italics added.)
As plaintiff notes, federal courts have recognized injuries resulting from some
kinds of withheld information in the Article III context. In FEC v. Akins (1998) 524 U.S.
11, 24, for example, the United States Supreme Court has held “a plaintiff suffers an
‘injury in fact’ when the plaintiff fails to obtain information which must be publicly
disclosed pursuant to a statute.” Boorstein v. Men’s Journal LLC, supra, 2012 WL
2152815, however, noted that courts have recognized that “informational injuries” are
distinct from mere “procedural injuries.” The court explained: “In Wilderness Soc’y
5
That section said: “An employee suffering injury as a result of a knowing and
intentional failure by an employer to comply with subdivision (a) is entitled to recover
the greater of all actual damages or fifty dollars ($50) for the initial pay period in which a
violation occurs and one hundred dollars ($100) per employee for each violation in a
subsequent pay period, not to exceed an aggregate penalty of four thousand dollars
($4,000), and is entitled to an award of costs and reasonable attorney’s fees.” (Price v.
Starbucks, supra, 192 Cal.App.4th at p. 1142, fn. 6, italics added.)
17
[Inc. v. Rey (9th Cir. 2010) 622 F.3d 1251], the court looked to the purpose of a statute to
determine whether the withheld information was the kind that the legislature meant to
ensure access to (indicating informational injury), or whether the plaintiffs were merely
deprived of a procedural right, which, alone, is not enough to create standing. See id. As
in Wilderness Soc’y, the alleged violations here do not inflict an informational injury by
depriving Plaintiff of statutorily-required disclosures about how his personal information
is used. Instead, it deprives the Plaintiff of Defendant’s contact information—
information meant to facilitate requests for such disclosures. The STL law’s
requirements are not designed to ensure that consumers have access to contact
information for its own sake, and thus the failure to provide that information inflicts
merely a procedural injury.” (Boorstein, supra, at p. *4.)
We agree with the Boorstein court that, although informational injuries may be
cognizable in some cases, under the STL a defendant’s failure to post information on its
website in the manner the statute requires, without more, does not give rise to a cause of
action. The trial court therefore correctly sustained the demurrer to plaintiff’s first cause
of action.
IV. Plaintiff Failed to State a Claim Under the UCL
The UCL provides that to pursue a claim for relief under the statute, an individual
must have “suffered injury in fact and ha[ve] lost money or property as a result of the
unfair competition.” (Bus. & Prof. Code, § 17204.) For the reasons stated above,
plaintiff failed to allege an “injury in fact.” Thus, he has not stated a claim for relief
under the UCL. The demurrer to the second cause of action was properly sustained.
18
DISPOSITION
The judgment of dismissal is affirmed. CBS shall recover its costs on appeal.
CERTIFIED FOR PUBLICATION
SUZUKAWA, J.
We concur:
WILLHITE, Acting P. J.
MANELLA, J.
19