Boorstein v. CBS Interactive, Inc.
222 Cal. App. 4th 456
Cal. Ct. App.2013Background
- Plaintiff David Boorstein registered on cbssports.com and alleged CBS Interactive shared users’ personal information with third parties for direct marketing, triggering California’s "Shine the Light" law (Civ. Code §1798.83 et seq.).
- Boorstein sued for violations of the STL and the UCL, alleging CBS failed to provide required website contact links and descriptions (e.g., a "Your Privacy Rights" link) and thereby deprived him of statutorily required information and the opportunity to request disclosures.
- Plaintiff sought actual damages, statutory penalties, injunctive relief, and attorney’s fees on behalf of himself and a class of California residents who provided personal information to CBS.
- CBS demurred, arguing Boorstein did not allege CBS actually shared his data, nor that he requested disclosures under §1798.83(a); CBS also argued it had complied with STL requirements.
- The trial court sustained the demurrer without leave to amend, holding STL standing requires a customer to have made (or attempted to make) a disclosure request; the UCL claim failed derivatively for lack of injury and causation.
- The Court of Appeal affirmed, holding a plaintiff must plead a statutory injury (i.e., being a customer injured by a statutory violation) and that mere failure to post contact information, without a request or attempted request for disclosures, is not an actionable STL injury.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether standing under the STL requires a customer to have made or attempted a §1798.83(a) disclosure request | Boorstein: no request required; statutory posting failures alone create standing because they deprived him of statutorily entitled information | CBS: yes — STL obligations are triggered by (a) sharing for direct marketing and (b) a customer request; absent a request there is no actionable violation | Held: Standing requires that the customer be injured by a statutory violation; typically that means the customer made or attempted to make a disclosure request and was denied or not timely/accurately answered |
| Whether §1798.84(c) and (e) create independent causes of action allowing penalties or injunctions without pleading statutory injury | Boorstein: penalties and injunctions are available independent of actual injury | CBS: remedies in (c) and (e) are derivative of (b)’s private right to sue and thus require the (b) injury threshold | Held: Remedies are derivative; a plaintiff must meet (b)’s terms (customer injured by a violation) to seek damages, penalties, or injunctions |
| Whether failure to post contact info is an actionable "violation" under the STL absent a disclosure request | Boorstein: failure to post contact information deprived him of required disclosures and constitutes an injury | CBS: posting contact info is a means to enable requests, not an independent, actionable violation; penalties are per discrete violations (i.e., per failed disclosure response) | Held: Failure to post contact info alone is a procedural deprivation, not a cognizable STL injury unless plaintiff alleges he tried and was unable to make a request or would have requested and did not receive disclosures |
| Whether the STL’s 90-day safe-harbor supports plaintiff’s broader reading | Boorstein: (argued implicitly) safe harbor does not limit types of violations that can be sued | CBS: safe harbor shows legislature contemplated suits based on failed responses to requests and provided cure for those discrete failures | Held: Court reads safe harbor as supporting that actionable violations are failures to provide accurate, complete, timely responses to disclosure requests, not mere failures to post contact info |
Key Cases Cited
- McCall v. PacifiCare of Cal., 25 Cal.4th 412 (2001) (standard for reviewing judgment after demurrer; de novo review of statutory construction)
- Bruns v. E-Commerce Exchange, Inc., 51 Cal.4th 717 (2011) (statutory interpretation principles: plain meaning, context, and purpose)
- Price v. Starbucks Corp., 192 Cal.App.4th 1136 (2011) (mere deprivation of statutorily required information is not necessarily a cognizable injury; statute requires resulting injury)
- Edwards v. First Am. Corp., 610 F.3d 514 (9th Cir. 2010) (illustrates that whether statutory text creates an injury-free cause of action depends on the statute’s plain language)