APPLE INC., Petitioner, v. THE SUPERIOR COURT OF LOS ANGELES COUNTY, Respondent; DAVID KRESCENT, Real Party in Interest.
No. S199384
Supreme Court of California
Feb. 4, 2013.
128-147
Gibson, Dunn & Crutcher, Daniel M. Kolkey, S. Ashlie Beringer, Austin V. Schwing, Timothy W. Loose and Molly Cutler for Petitioner.
Willenken Wilson Loh & Delgado, William A. Delgado and Eileen M. Ahern for Ticketmaster LLC as Amicus Curiae on behalf of Petitioner.
Drinker Biddle & Reath, Sheldon Eisenberg and Kristopher Davis for eHarmony, Inc., as Amicus Curiae on behalf of Petitioner.
Sidley Austin, Mark E. Haddad, David R. Carpenter; Paul Hastings, Thomas P. Brown and Kristin M. Hall for eBay, Inc., Walmart.com USA, LLC, California Retailers Association and NetChoice as Amici Curiae on behalf of Petitioner.
No appearance for Respondent.
Schreiber & Schreiber, Edwin C. Schreiber and Eric A. Schreiber for Real Party in Interest.
OPINION
LIU, J.—The Song-Beverly Credit Card Act of 1971 (Credit Card Act) governs the issuance and use of credit cards. (
Like Pineda, this case involves an asserted violation of
Our dissenting colleagues warn that today‘s decision “relegate[s] to the dust heap” the “‘robust’ consumer protection . . . at the heart of
Because this case comes to us following summary denial of a writ of mandate after the denial of a demurrer, we assume as true all facts alleged in the operative complaint. (Sheehan v. San Francisco 49ers, Ltd. (2009) 45 Cal.4th 992, 996.) Petitioner Apple Inc. (Apple), defendant below, operates an Internet Web site and an online iTunes store through which it sells digital media such as downloadable audio and video files. In June 2011, plaintiff below, David Krescent, sued Apple on behalf of himself and a putative class of similarly situated individuals for alleged violations of
In September 2011, Apple filed a demurrer, arguing that the Credit Card Act does not apply to online transactions and that deciding otherwise would undermine the prevention of identity theft and fraud. After a hearing, the trial court overruled the demurrer. The court noted that “the Act itself is silent on exempting online credit card transactions from its purview (and otherwise does not address online credit card transactions specifically).” While acknowledging that Apple‘s “assertions with respect to preventing fraud have definite appeal (a problem which the Court acknowledges is widespread in credit transactions generally, and in online credit card transactions specifically),” the trial court said it “is not prepared, at the pleading stage, to read the [Credit Card] Act as completely exempting online credit transactions from its reach.” The court also found, pursuant to
Apple filed a petition for writ of mandate seeking review of the trial court‘s order, which the Court of Appeal summarily denied. We granted
II.
We review de novo questions of statutory construction. In doing so, “‘our fundamental task is “to ascertain the intent of the lawmakers so as to effectuate the purpose of the statute.“‘” (Mays v. City of Los Angeles (2008) 43 Cal.4th 313, 321.) As always, we start with the language of the statute, “giv[ing] the words their usual and ordinary meaning [citation], while construing them in light of the statute as a whole and the statute‘s purpose [citation].” (Pineda, supra, 51 Cal.4th at pp. 529-530.)
A.
We begin with the text of the statute.
The prohibitions codified in
Finally,
At the outset, we observe that the text of
Although
Apple, on the other hand, argues that the first sentence of
We think the text of
For example, in O‘Grady v. Superior Court (2006) 139 Cal.App.4th 1423, the Court of Appeal considered whether an online news magazine constitutes a “‘periodical publication‘” for purposes of California‘s journalism shield law, which was enacted well before the advent of “digital magazines.” (Id. at p. 1461.) The court considered the argument that “the shield law only applies to ‘periodical publications’ in print, because that
In Ni v. Slocum (2011) 196 Cal.App.4th 1636, 1649 (Slocum), the Court of Appeal considered “whether the use of electronic signature qualifies as ‘personally affix[ing]’ the signature” on an initiative petition as that phrase is used in the
Rather, the court in Slocum ultimately concluded that an electronic signature system was “not entirely consistent with the present statutory scheme for the endorsement of initiative petitions because . . . electronic signature software deletes the circulator from the signature collection process” by allowing “voters to gain access to petitions from the Internet and execute them without the assistance or intervention of a circulator.” (Slocum, supra, 196 Cal.App.4th at pp. 1652-1653.) The court explained that the “. . . Elections Code requires each petition submitted to county election officials to be accompanied by the declaration of the circulator, attesting to the genuineness of the signatures on the petition,” and that “the Legislature viewed the participation of the circulator as a protection against fraud in the collection of signatures.” (Id. at p. 1652.) Thus, the court concluded that “the electronic signature system is partially incompatible with the current statutory scheme . . .” because it “eliminates from the signature collection system one of its primary protections against fraud.” (Id. at p. 1653.)
B.
We recently considered the history and purpose of the Credit Card Act in Pineda, supra, 51 Cal.4th 524. There we said “[t]he statute‘s overriding purpose was to ‘protect the personal privacy of consumers who pay for transactions with credit cards.‘” (Id. at p. 534, quoting Assem. Com. on Finance and Insurance, Analysis of Assem. Bill No. 2920 (1989-1990 Reg. Sess.) as amended Mar. 19, 1990, p. 2.) Specifically, the Legislature “sought to address the misuse of personal identification information for, inter alia, marketing purposes, and found that there would be no legitimate need to obtain such information from credit card customers if it was not necessary to the completion of the credit card transaction.” (Absher v. AutoZone, Inc. (2008) 164 Cal.App.4th 332, 345, quoted in Pineda, at p. 535.) “To protect consumers, the Legislature sought to prohibit businesses from ‘requiring information that merchants, banks or credit card companies do not require or need.‘” (Pineda, at p. 535, quoting Assem. Com. on Finance and Insurance, Analysis of Assem. Bill No. 2920 (1989-1990 Reg. Sess.) as amended Mar. 19, 1990, p. 2.)
While it is clear that the Legislature enacted the Credit Card Act to protect consumer privacy, it is also clear that the Legislature did not intend to achieve privacy protection without regard to exposing consumers and retailers to undue risk of fraud. The legislative history shows that the Legislature enacted the statute‘s prohibitions only after carefully considering and rejecting the possibility that the collection of personal identification information by brick-and-mortar retailers could serve a legitimate purpose such as fraud prevention. In particular, the Senate Judiciary Committee considered the standard procedure followed by brick-and-mortar retailers in the 1990s to verify the identity of credit card users—which included “verify[ing] the identification of the cardholder by comparing the signature on the credit card transaction form with the signature on the back of the card” and “contact[ing] the credit card issuer‘s authorization center [to] obtain approval” for sales above a specified “floor limit“—and concluded that the collection of personal identification information was not a necessary step in that procedure. (Sen. Com. on Judiciary, Analysis of Assem. Bill No. 2920 (1989-1990 Reg. Sess.) as amended June 27, 1990, p. 3.) This finding supported the Legislature‘s judgment that brick-and-mortar retailers in the 1990s had no genuine need to collect personal identification information and would instead use such information primarily for unsolicited marketing. (See id. at pp. 3-4 [noting that
Further, the Legislature in 1991 “added a provision (former
The safeguards against fraud that are provided in
Krescent‘s complaint reinforces our conclusion insofar as it failed to allege that Apple does not require any personal identification information to verify the identity of the credit card user. His complaint merely alleged that “the credit card transaction would be permitted to proceed without any further information” and that Apple “is not contractually obligated to provide a consumer‘s telephone number and/or address in order to complete the credit card transaction,” thereby rendering inapplicable the exception set forth in
In addition, Krescent suggested in his complaint and expressly conceded at oral argument that Apple may need at least a valid billing address, if not a telephone number, to verify the credit card. However, according to Krescent‘s own allegations, there would be no way for Apple to collect this information under the statute. As noted, Krescent alleged that Apple is neither contractually nor legally obligated to collect such information; hence, the exceptions in
At oral argument, Krescent suggested that Apple might be able to collect a customer‘s billing address as a “reasonable form[] of positive identification”
In his brief (but not in his complaint), Krescent argued that requiring a customer to provide his or her name, credit card number, card expiration date, and credit card identification number suffices to prevent fraud. But it is clear that the Legislature has disagreed. A customer‘s name, credit card number, expiration date, and security code are all apparent to a “brick-and-mortar” retailer on the credit card itself when the card is presented during an in-person transaction. Yet the Legislature expressly authorized retailers to request additional information—namely, a driver‘s license, state identification card, or another form of photo identification—in order to combat fraud. (
Our dissenting colleagues offer various arguments against the conclusion that the statute, if applied to the online transaction in this case, would prohibit Apple from collecting information necessary to combat fraud. Justice Kennard cites
In his dissent, Justice Baxter asserts that we indulge an unwarranted “factual assumption that the personal identification information defendant allegedly demanded and recorded here, i.e., cardholder addresses and telephone numbers, are ‘necessary to combat fraud and identity theft’ in online credit card transactions.” (Dis. opn. of Baxter, J., post, at p. 161.) But we do nothing of the sort. We express no view as to what type of information—whether an address, telephone number, or something else—is essential to verify a cardholder‘s identity. We hold only that the statutory scheme and legislative history make clear the Legislature‘s concern that there be some mechanism by which retailers can verify that a person using a credit card is authorized to do so. No such mechanism would exist in the context of online purchases of electronically downloadable products if the statute were read to apply to such transactions. Because the statutory scheme provides no means for online retailers selling electronically downloadable products to protect against credit card fraud, we conclude that the Legislature could not have intended
We have no occasion here to decide whether
Krescent contends that the text and legislative history of a 2011 amendment to the Credit Card Act show that
In 2011, the Legislature amended the Credit Card Act to add
The logic of Krescent‘s argument holds only if one assumes that a remote transaction conducted at a gas station stands on equal footing with an online transaction, and that by addressing the former in 2011, the Legislature necessarily signaled the statute‘s applicability to the latter. But there are good reasons to doubt this assumption. As Apple points out in its brief, “the customer engaging in a pay-at-the-pump transaction has physical possession of the card, which must be swiped,” and “is capable of being seen, either because an employee is at the gas station, or because there is video surveillance of the pump.” Thus, pay-at-the-pump transactions arguably present less risk of fraud than online transactions because a customer engaged in an online transaction need not possess a physical card and can complete the transaction in the privacy of his or her own home. It seems counterintuitive to posit that the Legislature created a fraud prevention exemption only for pay-at-the-pump retailers while leaving online retailers unprotected, when online retailers—a multibillion-dollar industry by the year 2011—have at least as much if not more need for an exemption to protect themselves and consumers from fraud.
We acknowledge that the legislative history of the 2011 amendment contains some indications that appear to support Krescent‘s position. The gas station exemption became law with the passage of Assembly Bill No. 1219 (2011-2012 Reg. Sess.). One version of the bill proposed to “amend the Song-Beverly Credit Card Act in a manner that would restrict its application to instances in which a card is ‘physically presented’ to a retailer, apparently with the intent of allowing retailers to collect personal information for fraud prevention purposes where the card is not physically presented, as in an on-line or other electronic transaction.” (Assem. Com. on Judiciary, Analysis of Assem. Bill No. 1219 (2011-2012 Reg. Sess.) as amended May 4, 2011, p. 1, italics & underscoring omitted.) In reviewing this version, the Assembly Committee on Judiciary concluded it “sweeps too broadly in effectively removing on-line and telephonic transactions from the scope of the existing law‘s protection.” (Ibid., italics omitted.) Because “this was not the bill‘s intent” according to its sponsor, the committee said it “strongly recommends that this language come out of the bill.” (Id. at p. 5, underscoring omitted.) Consistent with that recommendation, Assembly Bill No. 1219 (2011-2012 Reg. Sess.) was enacted without the restrictive language. (
For several reasons, however, we do not find this legislative history persuasive on the meaning of
Third, the legislative history on whether the statute applies to online transactions is conflicting. For example, when the 2011 amendment was first proposed, a federal district court had already ruled in Saulic v. Symantec Corp. (C.D.Cal. 2009) 596 F.Supp.2d 1323 that
Fourth, in contrast to the conflicting evidence and legally dubious inferences from the 2011 legislative history as to whether the 1990 statute applies to online transactions, what is clear from the legislative history is that the 2011 amendment was enacted to address a very specific problem. Our 2011 holding in Pineda, supra, 51 Cal.4th 524, that a ZIP code constitutes “‘personal identification information‘” within the meaning of
Thus, the problem the Legislature sought to address in 2011 was a narrow one: how to deal with lawsuits filed against traditional brick-and-mortar retailers, particularly gas stations, that had been collecting ZIP codes for years under the mistaken belief that they were not prohibited from doing so under
IV.
Finally, the California Online Privacy Protection Act of 2003 (COPPA) shows that the Legislature knows how to make clear that it is regulating online privacy and that it does so by carefully balancing concerns unique to online commerce. COPPA provides that “[a]n operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service shall conspicuously post its privacy policy on its Web site . . . .” (
Although it is theoretically possible to construe COPPA as imposing requirements on online transactions that go above and beyond the requirements of
The enactment of COPPA suggests that when the Legislature intends to address online transactions, it does so unambiguously. In addition, the fact that COPPA enacts merely a disclosure regime suggests that the Legislature in 2003 sought to proceed cautiously in regulating online commerce or, at least for the time being, to strike a different policy balance than the Credit Card Act did in 1990 for the collection of personally identifiable information.
COPPA also refutes our dissenting colleagues’ assertion that today‘s decision will leave online retailers “free to require personal identification information as a condition of credit card acceptance and to use such information for whatever purposes they wish.” (Dis. opn. of Baxter, J., post, at p. 164; see dis. opn. of Kennard, J., post, at pp. 151, 154–155.) As noted,
Federal law also provides some degree of protection against the use of personal identification information for unwanted commercial solicitation. The
There can be no doubt that retail commerce has changed dramatically since
In light of our holding today, the Legislature may wish to revisit the issue of consumer privacy and fraud prevention in online credit card transactions, just as it revisited the use of ZIP codes in the wake of our 2011 decision in Pineda. We cast no doubt on Krescent‘s claim that protecting consumer privacy in online transactions is an important policy goal, nor do we suggest that combating fraud is as important or more important than protecting privacy. We express no view on this significant issue of public policy. Our role is to determine what the Legislature intended by the statute it enacted. Here the statutory scheme, considered as a whole, reveals that the Legislature intended to safeguard consumer privacy while also protecting retailers and consumers against fraud. This accommodation of interests struck by the Legislature would not be achieved if
CONCLUSION
For the foregoing reasons, the Court of Appeal‘s judgment summarily denying the petition for writ of mandate or prohibition is reversed, and the matter is remanded to that court with directions to issue a writ consistent with this opinion.
Cantil-Sakauye, C. J., Werdegar, J., and Corrigan, J., concurred.
Unlike the majority, I conclude that the statute means just what it says and contains no exemption, express or implied, for online sales of downloadable products. The majority‘s expressed concern that this plain-meaning construction of the statute leaves online sellers with no way to detect and prevent fraudulent purchases is unjustified, as I explain.
I
David Krescent filed a complaint alleging that on four occasions in 2010, he bought downloadable products from Apple Inc. (Apple); that he used a credit card to pay for those products; and that Apple, as a condition of completing those purchases and in violation of
Apple filed a demurrer. A demurrer is, in essence, a request that the case be dismissed because the facts alleged in the complaint are insufficient as a matter of law to justify any relief. In this situation, “we review the allegations of the operative complaint for facts sufficient to state a claim for relief.” (C.A. v. William S. Hart Union High School Dist. (2012) 53 Cal.4th 861, 866 [138 Cal.Rptr.3d 1, 270 P.3d 699].) In support of its demurrer, Apple argued that
In overruling Apple‘s demurrer, the trial court said it was “not prepared, at the pleading stage, to read [
II
No significant difference exists between a purchase conducted over the Internet and one conducted through the mail or by telephone. In both cases, the credit card is not physically presented to the seller, who nevertheless has limited ways of confirming the buyer‘s identity. Also, in some mail and telephone sales (as with online sales of downloadable products) the seller does not need the purchaser‘s mailing address for shipping purposes. Some examples: when the buyer has a gift sent to a third party‘s address, or pays for news, entertainment, or other information to be conveyed by telephone. (See maj. opn., ante, at p. 143.) Although modern-day Internet commerce did not exist in 1990, when the statutory provisions at issue were enacted, by that time mail-order and telephone order transactions (hereafter also referred to as MOTO transactions) were well established. (See, e.g., Winn, Clash of the Titans: Regulating the Competition between Established and Emerging Electronic Payment Systems (1999) 14 Berkeley Tech. L.J. 675, 688 (hereafter Winn) [“decades of MOTO transactions” preceded the advent of Internet commerce].)
Jane K. Winn (the Charles I. Stone Professor of Law at the University of Washington School of Law) has written numerous academic publications on electronic commerce and is considered a leading international authority in that field. In the article cited above, Professor Winn observes that merchants who accepted credit cards as payment in mail-order and telephone order transactions developed “sophisticated security systems . . . to keep fraud and error losses to a minimum” (Winn, supra, at pp. 687, 688), thus accommodating the desire of these merchants to conduct business remotely. After the Internet‘s emergence, the same antifraud practices that had applied to mail-order and telephone order transactions were “transferred [to the Internet] to manage risks with Internet-based commerce.” (Ibid.)
The Law Revision Commission‘s comment on
Although Professor Winn‘s factual assertions are not part of the meager record before us, further development of the factual record could establish those assertions beyond question. By holding in Apple‘s favor and ending the litigation, the majority precludes such further development of the record.
Succinctly put, the similarity between online transactions and mail-order or telephone order transactions belies the majority‘s insistence that its holding exempting online sellers such as Apple from compliance with
The majority‘s focus on fraud protection for sellers is at odds with this court‘s recent statement in Pineda v. Williams-Sonoma Stores, Inc. (2011) 51 Cal.4th 524 [120 Cal.Rptr.3d 531, 246 P.3d 612] that
Moreover, application of
A final point: The majority states that when the Legislature wants to regulate online businesses, it must do so expressly, as it did in the California Online Privacy Protection Act of 2003. (Maj. opn., ante, at p. 148.) Under that reasoning, the civil rights protections of the Unruh Civil Rights Act (
III
As noted (see p. 154, ante), this court recently held unanimously that the Legislature‘s “overriding” purpose in enacting
Baxter, J., and Jones, J.,* concurred.
BAXTER, J., Dissenting.—I respectfully dissent.
I.
Because this case comes to us on a demurrer, “we review the allegations of the operative complaint for facts sufficient to state a claim for relief. In doing so, we treat the demurrer as admitting all material facts properly pleaded. ‘ “Further, we give the complaint a reasonable interpretation, reading it as a whole and its parts in their context.” ’ [Citation.]” (C.A. v. William S. Hart Union High School Dist. (2012) 53 Cal.4th 861, 866 [138 Cal.Rptr.3d 1, 270 P.3d 699].)
Plaintiff seeks statutory penalties for defendant‘s alleged violations of
Plaintiff‘s complaint contains the following allegations, some of which are based on information and belief. Plaintiff purchased media downloads from defendant on various occasions in 2010. Defendant‘s Web site would not permit plaintiff to obtain his purchases by credit card unless he first provided his telephone number and address. Such personal information was not required by the credit card processing company to complete the transaction. But even if the credit card processing company required a valid billing address and credit card identification number, under no circumstance would plaintiff‘s telephone number be required to complete the purchase transaction. Defendant “records each consumer‘s personal information, including, but not limited to a telephone number and address, in line with each credit card transaction, and keeps records of such personal information.” Defendant “is not contractually obligated to provide a consumer‘s telephone number and/or address in order to complete the credit card transaction,” nor is defendant required to record such personal information under federal or state law or regulation or for any incidental purpose such as shipping.
Assuming the truth of these allegations, they establish that defendant required and recorded plaintiff‘s personal identification information when plaintiff used his credit card to make purchases, and that none of the exceptions listed in
The majority implicitly agrees that defendant‘s conduct falls within the plain terms of
The rules governing statutory construction are uncomplicated and settled. When construing a statute, our goal “is to ascertain the intent of the lawmakers so as to effectuate the purpose of the statute.” (Estate of Griswold (2001) 25 Cal.4th 904, 910 [108 Cal.Rptr.2d 165, 24 P.3d 1191].) We look first to the language of the statute, mindful that the words “ ‘ “should be given the meaning they bear in ordinary use. [Citations.]” ’ ” (DiCampli-Mintz v. County of Santa Clara (2012) 55 Cal.4th 983, 992 [150 Cal.Rptr.3d 111, 289 P.3d 884].) Judicial construction, and judicially crafted exceptions, are appropriate only when literal interpretation of a statute would yield absurd results or implicate due process. (Cassel v. Superior Court (2011) 51 Cal.4th 113, 124 [119 Cal.Rptr.3d 437, 244 P.3d 1080]; In re C.H. (2011) 53 Cal.4th 94, 107 [133 Cal.Rptr.3d 573, 264 P.3d 357].) Otherwise, a statute “must be applied in strict accordance with [its] plain terms.” (Cassel, at p. 124.) “ ‘Only when the statute‘s language is ambiguous or susceptible of more than one reasonable interpretation, may the court turn to extrinsic aids to assist in interpretation.’ [Citation.] ” (In re Ethan C. (2012) 54 Cal.4th 610, 627 [143 Cal.Rptr.3d 565, 279 P.3d 1052].) Under no circumstance, however, may the court “ ‘under the guise of construction, rewrite the law or give the words an effect different from the plain and direct import of the terms used.’ [Citation.]” (Dicampli-Mintz, at p. 992.) In this regard, the court “ ‘must assume that the Legislature knew how to create an exception if it wished to do so. . . .’ [Citation.] ” (Ibid.)
Had
In sum, applying
Undeterred by the plain language of
Even assuming resort to extrinsic aids is appropriate, the majority bases its construction of
The language of
The legislative history is in accord. As we recently explained in our unanimous opinion in Pineda, supra, 51 Cal.4th 524, the Legislature enacted the predecessor to
Significantly, neither Pineda nor the legislative history itself mentions a legislative intent to protect retailers from undue risk of fraud. That is not surprising, because the Legislature enacted the consumer privacy protections with the understanding that a retailer was not put at risk of loss from fraud, so long as the retailer complied with the card issuer‘s operating procedures for credit card transactions. (See Dept. of Consumer Affairs, Enrolled Bill Rep. on Assem. Bill No. 2920 (1989–1990 Reg. Sess.) July 21, 1990, p. 2 (Enrolled Bill Report) [“the credit card issuer guarantees payment to the retailer if proper procedures are followed (even if the consumer does not pay the credit card company)”].) Thus, notwithstanding counsel‘s factual assertions at oral argument (see maj. opn., ante, at p. 141), the relevant legislative
Although the legislative history discloses a concern about credit card fraud, such concern pertained specifically to the circumstance that recordation of unnecessary personal information posed a fraud risk to the cardholder, not the retailer, because the information could be used “in conjunction with the credit card number to order goods by phone or mail and charge it to the cardholder” or “to apply for other sources of credit in the cardholder‘s name.” (Enrolled Bill Rep., supra, at p. 2 [“By the time the subterfuge is discovered, the consumer‘s credit and credit history could be severely damaged.”].) Yet, despite this awareness in 1990 that credit cards were being used to “order goods by phone or mail” (ibid.), the Legislature provided no exception to
Like retailers that accept credit cards for online purchases, those that accept credit cards for MOTO transactions have no opportunity to visually inspect a driver‘s license or other forms of photo identification as allowed by
The majority additionally views
Finally, the majority views the enactment of the California Online Privacy Protection Act of 2003 (
COPPA‘s disclosure requirements do nothing to restrict an online retailer‘s use of a consumer‘s personal identification information; nor do they prevent the sharing or sale of such information. True, consumers who are not satisfied with a retailer‘s posted privacy policy may always decline to purchase the retailer‘s products. But today‘s decision deprives consumers of
III.
Pure and simple, a literal interpretation of
If defendant and other retailers wish to demonstrate that
Kennard, J., and Jones, J.,* concurred.
*Presiding Justice, Court of Appeal, First Appellate District, Division Five, assigned by the Chief Justice pursuant to article VI, section 6 of the California Constitution.