Let the Sunshine In: Failure to Post Contact Information on Website Does Not Violate California’s Shine the Light Law
On demurrer, the defendant argued, among other things, that “to have standing under the STL (and, derivatively, under the U[nfair] C[ompetition] L[aw]), a customer must either have made, or attempted to make, a disclosure request under section 1798.83, subdivision (a).” The trial court agreed, and the Court of Appeal affirmed.
To have standing under the STL, a plaintiff must be a “customer” who has been “injured by a violation of this title.” Failure to post contact information on a website – the Court of Appeal held – does not constitute such a violation. “A failure to post information on a website . . . is a continuing event that cannot readily be quantified, and section 1798.84 does not provide a method for calculating a civil penalty for such a continuing event. Thus, we conclude that a continuing violation of this kind, without more, is not an actionable ‘violation of this title.’”
Looking to the legislative history, the Court noted that its reading of the STL is supported by the “safe harbor” provision in section 1798.84(d). That subsection provides a “complete defense” for a business that cures its failure to provide the information, its provision of inaccurate information, or an untimely response to an STL request within 90 days:
The Court noted that its rejection of standing in this case is consistent with the recent rulings of federal courts in virtually identical class actions brought under the STL: Boorstein v. Men’s Journal, 2012 WL 2152815 (C.D. Cal. 2012); Miller v. Hearst, 2012 WL 3205241 (C.D. Cal. 2012); King v. Conde Nast, 2012 WL 3186578 (C.D. Cal. 2012); and Murray v. Time Inc., 2012 WL 3634387 (N.D. Cal. 2012).
For those of us who live and breathe privacy law, the Court’s decision is also highly interesting because it rejected plaintiff’s argument that he suffered a cognizable injury in the form of an “informational injury” because he did not receive information to which he was statutorily entitled. The Court noted that the plaintiff had “not cited any California cases recognizing ‘informational injury,’” and stated that it was “not aware of any such cases.” The Court did not suggest that there are no circumstances where informational injuries may be cognizable, instead focusing its decision on the STL – “a defendant’s failure to post information on its website in the manner the statute requires, without more, does not give rise to a cause of action.”
Bottom line - the developing STL case law is sending a clear message that a mere failure to post contact information on a website is not enough to violate the STL. That being said - organizations need to continue to make sure that they have made their STL contact information available in one of the three ways allowed by the STL, and, if they receive an STL request, they must respond to it in the manner and in the timeframe required by the law.
Happy New Year to all!