Case Information
*1 Filed 12/19/13
CERTIFIED FOR PUBLICATION
IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA SECOND APPELLATE DISTRICT DIVISION FOUR
DAVID BOORSTEIN, B247472 Plaintiff and Appellant, (Los Angeles County Super. Ct. No. BC476015) v.
CBS INTERACTIVE, INC.,
Defendant and Respondent. APPEAL from a judgment of the Superior Court of Los Angeles County, Anthony J. Mohr, Judge. Affirmed.
The Reis Law Firm, Sean Reis; Edelson and Ari Scharg for Plaintiff and Appellant.
Fenwick & West, Rodger R. Cole, Songmee L. Connolly, and Molly R. Melcher for Defendant and Respondent.
Plaintiff appeals from the judgment of dismissal entered after the trial court sustained defendant’s demurrer to causes of action for violations of Civil Code section 1798.83 et seq. (the shine the light law or STL) and Business and Professions Code section 17200 et seq. (the unfair competition law or UCL). [1] We agree with the trial court that plaintiff lacks standing to pursue causes of action under either statute, and thus we affirm.
FACTUAL AND PROCEDURAL BACKGROUND
I. The Present Action
The STL is a disclosure statute designed to “shine the light” on businesses’
information-sharing practices by requiring them to establish procedures by which
customers can obtain information about those practices. (
Miller v. Hearst
Communications, Inc.
(C.D. Cal. 2012)
Plaintiff David Boorstein filed the present action on December 28, 2011, and filed the operative first amended complaint, asserting violations of the STL and the UCL, on September 24, 2012. Plaintiff alleges that in or about 2005, he subscribed to [1] All further undesignated statutory references are to the Civil Code. *3 cbssports.com, a website owned and operated by defendant CBS Interactive, Inc. (CBS), to compete in “fantasy” football, baseball, and basketball. When he did so, he provided personal information to CBS, including his name, email address, date of birth, and zip code. Plaintiff alleges that CBS shares users’ personal information, including that of the type he provided to CBS, with third parties for direct marketing purposes, and thus is required to comply with the STL. CBS willfully violated the STL by “failing to provide a link on its home page (www.cbssports.com) titled ‘Your Privacy Rights’; [¶] failing to provide a link on its home page to a separate web page titled ‘Your Privacy Rights’; [¶] failing to provide—on the ‘first page’ of the link from its home page—a description of its ‘customer[s’] rights’ under the Act, including the right to request information about its information sharing practices or the right to opt out of information sharing altogether; and [¶] failing to provide—on the ‘first page’ of the link from its home page—the designated mailing address, email address, telephone number, or facsimile number for customer requests.” (Fn. omitted.) As a result, plaintiff alleges, he is “deprived of information that he was statutorily entitled to under the Act, including notice of his right to request Shine the Light Disclosures and contact information to make such requests; [¶] deprived of a meaningful opportunity to exercise his statutorily-guaranteed right to inquire about and receive a detailed response explaining CBS Interactive’s information sharing practices (i.e., by identifying what categories of information are disclosed and to whom); [¶] deprived of a meaningful opportunity to exercise his statutorily-guaranteed right to make informed decisions about his privacy and personal information; and [¶] deprived of a meaningful opportunity to exercise his statutorily-guaranteed right to monitor and control the disclosure and use of his personal information.”
Plaintiff purported to bring the present action for himself and a class of similarly situated individuals defined as “All California residents who have provided personal information to CBS Interactive.” He sought actual damages, civil penalties of $3,000 per violation, injunctive relief, reasonable litigation expenses, and attorney fees.
II. CBS’s Demurrer
CBS demurred to the first amended complaint. It asserted: (1) plaintiff has not and cannot allege CBS ever shared his personal information with any third parties for any direct marketing purposes; (2) plaintiff has not and cannot allege that he ever contacted or attempted to contact CBS about how his personal information might have been shared, or that CBS ever provided him with any incomplete, inaccurate, or untimely information; (3) plaintiff did not allege a cognizable injury; (4) CBS complied with the STL by providing designated contact information on its website; and (5) CBS complied with the STL because its privacy policy informs users how their personal information is shared with third parties for direct marketing purposes only with consent, as well as how to opt out and how to contact CBS with questions.
The trial court held a hearing on the demurrer on December 13, 2012. Plaintiff’s counsel conceded that the first amended complaint did not allege plaintiff had made a disclosure request under the STL, but urged that such a request was not required. The trial court disagreed and sustained the demurrer without leave to amend. Its order stated as follows:
“[A] business’s obligation to provide STL disclosures is triggered only if it (1) discloses a customer’s information to third parties for their direct marketing purposes; and (2) a customer makes a request for information. Cal. Civ. Code § 1798.83(a). The 90-day safe harbor in Cal. Civ. Code § 1798.84(d) further underscores that the Act only applies once a customer makes a request. Its plain language precisely describes violations for which a Shine the Light suit may be brought: the failure to provide accurate and complete Cal. Civ. Code § 1798.83(a) disclosures or timely disclosures under Cal. Civ. Code § 1798.83(b). If a plaintiff’s personal information was never shared or the plaintiff did not request (or want to, try to, or was unable to request any STL disclosures), the business has no obligation to provide any disclosures in the first instance.
“Here, Plaintiff fails to state a claim against CBSi [CBS Interactive] for violation of the Act. First, Plaintiff fails to allege that CBSi actually disclosed his personal *5 information to a third party for direct marketing purposes. If plaintiff’s personal information was never shared, CBSi had no obligation to provide the Act’s disclosures to him in the first instance.
“Worse yet, Plaintiff fails to allege that he ever requested, or even tried to, wanted to, or was unable to request, any STL disclosures from CBSi or that CBSi failed to provide a complete, accurate or timely response. Plaintiff confirmed at oral argument that he never requested, or tried to request, any STL disclosures from CBSi. If Plaintiff did not request, or want to request, any STL disclosures from CBSi, there is no obligation for CBSi to provide the disclosures to him. Because Plaintiff cannot state a claim under the Act, CBSi’s demurrer to Plaintiff’s first cause of action is sustained without leave to amend.
“. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . “Plaintiff’s second claim for violation of the UCL hinges on alleged violations of the Act. It thus fails for the reasons above. [Citation.] Moreover, Plaintiff has failed to allege injury-in-fact and causation, and thus has no standing under the UCL. [Citation.] Thus, CBSi’s demurrer to the UCL claim is also SUSTAINED WITOUT LEAVE TO AMEND. ”
Notice of entry of the order sustaining defendant’s demurrer without leave to amend was served December 31, 2012. The court entered a final judgment of dismissal on January 28, 2013, from which plaintiff timely appealed.
DISCUSSION
Central to the dispute between the parties is whether plaintiff has standing to pursue the present action. CBS contends, and the trial court agreed, that to have standing under the STL (and, derivatively, under the UCL), a customer must either have made, or attempted to make, a disclosure request under section 1798.83, subdivision (a). Plaintiff disagrees, contending that a disclosure request is not necessary; it is enough that the defendant failed to make its contact information available as the STL requires.
We review independently the trial court’s judgment of dismissal following a
demurrer, considering de novo whether the complaint alleges facts sufficient to state a
cause of action or discloses a complete defense. (
McCall v. PacifiCare of Cal., Inc
.
(2001)
For the reasons that follow, we agree with the trial court that a plaintiff must have made, or attempted to make, a disclosure request in order to have standing under the STL. Therefore, because it is undisputed that plaintiff has not alleged, and cannot allege, that he made or attempted to make such a disclosure request, the demurrer to the first cause of action was properly sustained. Because the UCL claim is derivative of the STL claim, the demurrer to the second cause of action was also properly sustained.
I. Overview of the STL
The substantive provisions of the STL are set out in section 1798.83, subdivisions (a) through (h). As relevant here, subdivision (a) provides that if a business with an established relationship with a customer has, within the preceding calendar year, disclosed specified categories of personal information to third parties for direct marketing purposes, the business shall, upon a customer’s request, disclose the categories of personal information disclosed during the preceding year and the names and addresses of third parties who received personal information for direct marketing purposes during the preceding year. (§ 1798.83, subd. (a).) Subdivision (c) permits businesses to opt out of the subdivision (a) disclosure requirement; under subdivision (c), if a business required to comply with subdivision (a) adopts and discloses to the public a policy of disclosing *7 personal information to third parties only if the customer agrees to the disclosure, or of not disclosing personal information if the customer has exercised a nondisclosure option, the business may respond to a disclosure request by “notifying the customer of his or her right to prevent disclosure of personal information, and providing the customer with a cost-free means to exercise that right.” (Subd. (c)(2).) Finally, subdivision (b) requires businesses to designate a mailing address, email address, telephone number, or facsimile number where customers may send disclosure requests, and it requires businesses to advise customers of the designated addresses or telephone numbers in at least one of three ways: (1) notify managers who supervise employees who regularly interact with customers of the designated addresses and phone numbers and instruct those employees that customers who inquire shall be informed of the addresses or phone numbers; (2) add to the home page of its web site a link either to a page titled “Your Privacy Rights” or add the words “Your Privacy Rights” to the home page’s link to the business’s privacy policy; the first page of the link “shall describe a customer’s rights pursuant to this section and shall provide the designated mailing address, e-mail address, as required, or toll-free telephone number or facsimile number, as appropriate;” or (3) make the designated addresses or phone numbers readily available upon request of a customer at every place of business in California where the business or its agents regularly have contact with customers. (Subd. (b)(1).) Responses to disclosure requests must be provided within 30 days. (Subd. (b)(1)(C).)
Section 1798.84, subdivisions (a) through (h) provide the remedies available for violations of the STL. As relevant here (and as discussed in greater detail below), subdivision (b) provides for a private right of action and damages, subdivision (c) provides for civil penalties, and subdivision (e) permits a court to enjoin any business “that violates, proposes to violate, or has violated this title.”
According to its legislative history, the STL was intended to “provide consumers with information on how their information is being shared by businesses.” The bill’s author said that at the time of the STL’s enactment, consumers were not only unable to stop the buying and selling of their personal information, “they do not even know *8 whether and to what extent it is taking place.” The STL, thus, “is designed to let free market forces work by ‘shining the light’ on businesses’ information-sharing practices so consumers can make educated privacy decisions and knowledgeable marketplace decisions.”
II. Standing Under the STL
A. Standing Generally
A litigant’s standing to sue is a “threshold issue to be resolved before the matter
can be reached on the merits. (
Hernandez v. Atlantic Finance Co
. (1980) 105 Cal.App.3d
65, 71.) ‘If we were to conclude that plaintiff did not have standing to maintain the
action, not having been personally damaged by the defendants’ conduct, then there would
be no need to address the merits of her cause. Equally wasteful of judicial resources
would be a resolution on the merits without reaching the standing issue.’ (
Ibid
.) We will
not address the merits of litigation when the plaintiff lacks standing, because ‘“California
courts have no power . . . to render advisory opinions or give declaratory relief.”’
(
Municipal Court v. Superior Court
(
Gonzalez
) (1993)
“As a general principle, standing to invoke the judicial process requires an actual
justiciable controversy as to which the complainant has a real interest in the ultimate
adjudication because he or she has either suffered or is about to suffer an injury of
sufficient magnitude reasonably to assure that all of the relevant facts and issues will be
adequately presented to the adjudicator. (
Pacific Legal Foundation v. California Coastal
Com
. (1982)
The prerequisites for standing to assert statutorily-based causes of action are
determined from the statutory language, as well as the underlying legislative intent and
the purpose of the statute. (
Surrey v. TrueBeginnings, LLC
(2008)
B. Standing to Pursue a Cause of Action Under the STL As relevant here, section 1798.84, which sets out the remedies available for a violation of section 1798.83, provides:
“(b) Any customer injured by a violation of this title may institute a civil action to recover damages.
“(c) In addition, for a willful, intentional, or reckless violation of Section 1798.83, a customer may recover a civil penalty not to exceed three thousand dollars ($3,000) per violation; otherwise, the customer may recover a civil penalty of up to five hundred dollars ($500) per violation for a violation of Section 1798.83.
“. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . “(e) Any business that violates, proposes to violate, or has violated this title may be enjoined.”
Plaintiff contends that subdivisions (b), (c), and (e) of section 1798.84 are wholly independent of one another, and thus an individual need not have been “injured by a violation of this title” within the meaning of subdivision (b) to have standing to recover civil penalties or obtain an injunction under subdivisions (c) and (e). CBS disagrees, urging that a plaintiff must have suffered a statutory injury in order to seek the remedies available under subdivisions (b), (c), or (e).
We agree with CBS that a plaintiff must have suffered a statutory injury to have standing to pursue a cause of action under the STL, regardless of the remedies he or she *10 seeks. As the statutory language quoted above makes clear, section 1798.84, subdivision (b) creates a private right of action in any customer “injured by a violation of this title.” Subdivisions (c) and (e) do not repeat the “may institute a civil action” language of subdivision (b), and thus they do not create independent rights of action. Because the right to institute a civil action arises only under subdivision (b), a plaintiff must meet the terms of that section—i.e., he or she must be a “customer” who has been “injured by a violation of this title”—to pursue an action for a violation of section 1798.83. In the context of that action, the plaintiff may seek any of the remedies provided by section 1798.84—damages, statutory penalties, or injunctive relief.
Our conclusion is consistent with that reached by the district court in
Boorstein v.
Men’s Journal LLC
,
supra
,
Plaintiff cites
Edwards v. First Am. Corp.
(9th Cir. 2010)
[2]
Deacon v. Pandora Media, Inc
. (N.D. Cal. 2012)
Cannot, Plead a Statutory Injury
Having concluded that plaintiff must plead a statutory injury to state a claim under the STL, we now move to the second part of our inquiry—whether plaintiff has alleged such an injury. As we have said, section 1798.84, subdivision (b) says that a customer may institute a civil action if he or she was injured “by a violation of this title.” Nowhere, however, does the statute define a “violation of this title.”
Plaintiff contends that a failure to comply with any provision of the statute constitutes an actionable “violation of this title.” Thus, he says, he has stated a claim for relief because he alleged that CBS did not provide contact information on its website in the manner required by section 1798.83, subdivision (b). CBS disagrees, urging that the only violation for which suit may be brought is the failure to provide complete, accurate, and timely disclosures in response to customer disclosure requests pursuant to section 1798.83, subdivision (a). The failure to post the contact information required by section 1798.83, subdivision (b), CBS says, is not an actionable violation because the posting of contact information is merely a means to permit a customer to make a subdivision (a) disclosure request, not an independent obligation under the statute. Thus, CBS urges, because plaintiff admittedly did not make a subdivision (a) disclosure request, he cannot state a claim for relief. For the reasons that follow, CBS is correct.
A. Statutory Language
We begin with the language of the statute. “‘Our fundamental task in interpreting a statute is to determine the Legislature’s intent so as to effectuate the law’s purpose. We first examine the statutory language, giving it a plain and commonsense meaning. We do not examine that language in isolation, but in the context of the statutory framework as a whole in order to determine its scope and purpose and to harmonize the various parts of information is sufficient to constitute an injury for purposes of Article III standing. [Citation.]”].)
the enactment. If the language is clear, courts must generally follow its plain meaning
unless a literal interpretation would result in absurd consequences the Legislature did not
intend. If the statutory language permits more than one reasonable interpretation, courts
may consider other aids, such as the statute’s purpose, legislative history, and public
policy.’ [Citation.]” (
Bruns v. E-Commerce Exchange, Inc
. (2011)
Section 1798.84, subdivision (c) imposes a statutory penalty “per violation”: “[A] customer may recover a civil penalty not to exceed three thousand dollars ($3,000) per violation ; otherwise, the customer may recover a civil penalty of up to five hundred dollars ($500) per violation for a violation of Section 1798.83.” (Italics added.) That the Legislature authorized penalties “per violation” suggests that a statutory “violation” is a discrete event, such that a court can quantify the number of violations. A failure to timely, accurately, or completely respond to a disclosure request is a discrete event; a court can calculate a civil penalty for each failure by counting the number of disclosure requests to which the defendant did not appropriately respond. A failure to post information on a website, in contrast, is a continuing event that cannot readily be quantified, and section 1798.84 does not provide a method for calculating a civil penalty for such a continuing event. [3] Thus, we conclude that a continuing violation of this kind, without more, is not an actionable “violation of this title.” [4]
[3] In contrast, many statutes expressly authorize penalties for continuing violations on a “per day” or other basis. (E.g., 47 U.S.C. § 503 [“the amount of any forfeiture penalty determined under this section shall not exceed $ 25,000 for each violation or each day of a continuing violation ”], italics added; 42 U.S.C. § 2282 [“Any person who . . . violates any licensing or certification provision [of this title] . . . shall be subject to a civil penalty, to be imposed by the Commission, of not to exceed $ 100,000 for each such violation. If any violation is a continuing one, each day of such violation shall constitute a separate violation for the purpose of computing the applicable civil penalty ”], italics added.)
[4] Although we need not reach this issue in the present case, we assume that a plaintiff alleging that he or she wished to make a disclosure request but could not do so because the defendant did not make contact information available would also state a claim under the STL.
Our reading of the statute is supported by section 1798.84, subdivision (d), the so- called “safe harbor” provision. Subdivision (d) provides: “[A] business that is alleged to have not provided all the information required by subdivision (a) of Section 1798.83, to have provided inaccurate information, failed to provide any of the information required by subdivision (a) of Section 1798.83, or failed to provide information in the time period required by subdivision (b) of Section 1798.83, may assert as a complete defense in any action in law or equity that it thereafter provided regarding the information that was alleged to be untimely, all the information, or accurate information, to all customers who were provided incomplete or inaccurate information, respectively, within 90 days of the date the business knew that it had failed to provide the information, timely information, all the information, or the accurate information, respectively.” (Italics added.) According to the statute’s legislative history, this provision was added to an amended version of the bill “to accommodate business concerns” that businesses “might find themselves subject to liability under Business and Professions Code Section 17200 to individuals who wish to use the bill’s provisions as a liability trap.” (Sen. Com. on Judiciary, Rep. on Sen. Bill No. 27 (2003-2004 Reg. Sess.) p. 5.) The amendment “[p]rovide[s] businesses with a 90-day right to cure unintentional violations, which provides a complete defense to lawsuits .” (State and Consumer Services Agency, Enrolled Bill Rep. on Sen. Bill No. 27 (2003-2004 Reg. Sess.) (Sept. 22, 2003) p. 13, italics added.) While legislators acknowledged that the bill could result in increased litigation, they described the safe-harbor provision as providing businesses “with a 90- day right to cure unintentional violations that permit[s] business[es] that come into full compliance within 90 days to assert a complete defense against any legal action. ” ( Id. at p. 16, italics added.)
That the subsequent (albeit tardy) provision of complete, accurate information is described as a complete defense in any action suggests that the actionable violation contemplated by the statute is the failure completely and accurately “to provide any of the information required by subdivision (a) of Section 1798.83” (i.e., the categories of personal information disclosed to third parties for direct marketing purposes and the *15 names and addresses of the third parties who received such information) within the time required by section 1798.83, subdivision (b). Were the failure to disclose contact information also an actionable violation under the statute, it is hard to understand why the subsequent provision of “all the information, or accurate information, to all customers who were provided incomplete or inaccurate information” would be a complete defense—or, indeed, in the absence of a section 1798.83, subdivision (a) request for information, how a company would know to whom to provide this information.
Further, to construe “a violation” to include anything other than a company’s failure to provide a timely, complete, and accurate response to disclosure requests would eviscerate the safe harbor intended by section 1798.84, subdivision (d) and invite the very “liability trap” the Legislature sought to avoid. If we interpret the statute as plaintiff suggests, customers could bring suit whether or not they ever tried to contact a business about its privacy policy. Indeed, if the law is interpreted as plaintiff suggests, a customer who made a request for information and received a timely, complete, and accurate response could still sue for a STL violation by challenging the manner in which the company disclosed its contact information on its website. As CBS notes, this would create an anomalous result whereby businesses would enjoy significant protection for nonintentional violations of the statute’s primary directive (to provide complete, accurate, and timely disclosures under section 1798.83, subdivision (a)), but would enjoy no such protection for nonintentional violations of the statute’s secondary directive (to provide an address, email address, or phone number to which such disclosure requests can be sent). We do not interpret the statute to create such an anomaly.
B. Federal Case Law
Our interpretation of the STL is consistent with that of the federal district courts
that have considered claims under the statute. The first court to do so was the district
court in
Boorstein v. Men’s Journal LLC
,
supra
,
Courts adopted the
Boorstein
court’s analysis in
Miller v. Hearst Communications,
Inc.
,
supra
,
C. Plaintiff’s Contention That He Suffered Injury Because He Was Deprived of Access to Information Is Without Merit
Plaintiff contends that he suffered a cognizable injury—an “informational injury”—because he did not receive information to which he was statutorily entitled. He urges: “Boorstein suffered an informational injury because CBS failed to designate *17 contact information for customers to use in making requests under the STL law and failed to accurately and completely describe its customer’s rights. . . . [¶] . . . CBS’s ‘violation’ thereafter caused ‘injury’ when Boorstein actually visited the website and the required information wasn’t there.” For the reasons that follow, we do not agree.
Plaintiff has not cited any California cases recognizing “informational injury,” and we are not aware of any such cases. Indeed, in Price v. Starbucks Corp. (2011) 192 Cal.App.4th 1136, the court rejected plaintiff’s “informational injury” claim that he had been injured because information was missing from his itemized wage statement, in violation of Labor Code section 226, subdivision (e). [5] The court explained: “The injury requirement in section 226, subdivision (e), cannot be satisfied simply because one of the nine itemized requirements in section 226, subdivision (a) is missing from a wage statement. [Citations.] By employing the term ‘“suffering injury,”’ the statute requires that an employee may not recover for violations of section 226, subdivision (a) unless he or she demonstrates an injury arising from the missing information . [Citation.] Thus, the ‘deprivation of that information,’ standing alone, is not a cognizable injury.” ( Id. at pp. 1142-1143, italics added.)
As plaintiff notes, federal courts have recognized injuries resulting from some
kinds of withheld information in the Article III context. In
FEC v. Akins
(1998) 524 U.S.
11, 24, for example, the United States Supreme Court has held “a plaintiff suffers an
‘injury in fact’ when the plaintiff fails to obtain information which must be publicly
disclosed pursuant to a statute.”
Boorstein v. Men’s Journal LLC
,
supra
, 2012 WL
2152815, however, noted that courts have recognized that “informational injuries” are
distinct from mere “procedural injuries.” The court explained: “In
Wilderness Soc’y
[5]
That section said: “An employee
suffering injury
as a result of a knowing and
intentional failure by an employer to comply with subdivision (a) is entitled to recover
the greater of all actual damages or fifty dollars ($50) for the initial pay period in which a
violation occurs and one hundred dollars ($100) per employee for each violation in a
subsequent pay period, not to exceed an aggregate penalty of four thousand dollars
($4,000), and is entitled to an award of costs and reasonable attorney’s fees.” (
Price v.
Starbucks
,
supra
,
We agree with the Boorstein court that, although informational injuries may be cognizable in some cases, under the STL a defendant’s failure to post information on its website in the manner the statute requires, without more , does not give rise to a cause of action. The trial court therefore correctly sustained the demurrer to plaintiff’s first cause of action.
IV. Plaintiff Failed to State a Claim Under the UCL
The UCL provides that to pursue a claim for relief under the statute, an individual must have “suffered injury in fact and ha[ve] lost money or property as a result of the unfair competition.” (Bus. & Prof. Code, § 17204.) For the reasons stated above, plaintiff failed to allege an “injury in fact.” Thus, he has not stated a claim for relief under the UCL. The demurrer to the second cause of action was properly sustained.
DISPOSITION
The judgment of dismissal is affirmed. CBS shall recover its costs on appeal. CERTIFIED FOR PUBLICATION
SUZUKAWA, J.
We concur:
WILLHITE, Acting P. J.
MANELLA, J.