Tag Archives: California

The New CA Consumer Privacy Act: Don’t Panic (Yet)

California has pushed through an online privacy law that is sending some shockwaves through the Internet economy. On Thursday, June 29, the legislature passed the California Consumer Privacy Act of 2018 (“CCPA”), which the Governor signed swiftly. Beginning January 1, 2020, many companies that do business in California will need to make significant changes and … Continue Reading

InfoLawGroup Partner Jamie Rubin Provides Advice to Companies that Offer Auto-Renewal Subscriptions

With stepped up enforcement from the FTC and the California auto-renewal law updates going into effect in July, InfoLawGroup Partner Jamie Rubin offers companies insights on running auto-renewal subscription programs. Read his article in Internet Retailer magazine.    … Continue Reading

California Amends Data Breach Notification Law, Does Not Require Mandatory Offering of Credit Monitoring

California Governor Jerry Brown signed into law an amendment to California’s data breach notification law on Monday. Although at least one news outlet has reported that the law requires a company to offer credit monitoring services, this interpretation is misguided. Rather, the law only places restrictions on certain companies if they choose to offer identity … Continue Reading

New California Regulation Regarding Minors Is Coming: Are You Ready? Part 2 – The Advertising Provisions

A new California statute, which originated as SB 568 and will be codified as § 22580 et seq. of the Cal. Bus. & Prof. Code, takes effect January 1, 2015.  The law has two key provisions: one addressing online advertising in connection with minors, which this post addresses, and one addressing a minor’s right to delete … Continue Reading

FAQs Concerning the Legal Implications of the Heartbleed Vulnerability

(Contributors to this post include:  Scott Koller, David Navetta, Mark Paulding and Boris Segalis) By now, most of the world is aware of the massive security vulnerability known as Heartbleed (it even comes with a slick logo and its own website  created by the organization that discovered the vulnerability).  According to reports this vulnerability has been … Continue Reading

California Attorney General Files Lawsuit Based on Late Breach Notification

In the first case of its kind (that I am aware of), the California Attorney General’s office filed a complaint against the Kaiser Foundation Health Plan, Inc. (“Kaiser”) alleging a violation of California’s “unfair competition law” (Business and Professions Code sections 17200-17210) arising out of a personal information security breach and delayed notification.  This lawsuit … Continue Reading

California Supreme Court: Online Sales of Downloadable Products Not Covered by Song-Beverly Credit Card Act

The California Supreme Court ruled this week in a 4-3 decision that an online retailer may request personal information when selling a downloadable product.  See Apple, Inc. v. Superior Court, Case No. S199384 (Cal. Feb. 4, 2013). This decision, interpreting the Song-Beverly Credit Card Act of 1971, Cal. Civ. Code § 1747.08 (the “Credit Card … Continue Reading

California AG Releases Mobile App Guidelines; Industry Responds

Last week, California Attorney General Kamala Harris released a set of recommendations titled “Privacy on the Go” directed toward the mobile app industry that seeks to “educate the industry and promote privacy best practices.”  The guidelines separately address app developers, app platform providers, mobile ad networks, operating system providers, and mobile carriers. A coalition of … Continue Reading

Illinois Second State to Enact Law Barring Employers from Obtaining Current or Prospective Employees’ Social Media Account Credentials

By Boris Segalis and Nihar Shah. Earlier this week, following in the footsteps of Maryland, Illinois Governor Pat Quinn signed a law amending the state’s Right to Privacy in the Workplace Act to prohibit employers from asking current and prospective employees for their personal social media account credentials. The Maryland and Illinois legislation is a response to reports that circulated earlier this … Continue Reading

FCC Seeks Public Comment on Mobile Carrier Privacy Policies Following Data Collection Controversy

In re-launching the inquiry into carriers' data privacy and security practices, the FCC argues that not informing customers about the software or its data practices may have violated the carriers' responsibility pursuant to Section 222 of the Communications Act of 1934 to protect customer data "that is made available to a carrier solely by virtue of the carrier-customer relationship." The law allows such data to be used only in "limited circumstances," a term which is not defined in Section 222. It appears that one of the goals of the renewed inquiry is for the FCC to define the scope of the "limited circumstances." … Continue Reading

First Reported Shine the Light Suit Dismissed for Failure to State Cognizable Injury

Last week, a plaintiff's putative class action alleging a violation of California's Shine the Light law, Cal. Civ. Code § 1798.83, was dismissed without prejudice. See Boorstein v. Men's Journal LLC, No. 12-cv-00771-DSF-E, 2012 WL 2152815 (C.D. Cal. June 14, 2012). The suit, one of several other similar pending suits, is the first reported decision applying the Shine the Light Law. … Continue Reading

Class Certification Ruling Suggests that a Plaintiff’s Membership in a Retailer’s Pre-Existing Rewards Program May Not Excuse a Retailer’s Request for Personal Information at the Register

The U.S. District Court for the Southern District of California recently granted class certification in a Song-Beverly Credit Card Act case, refusing to exclude from the class individuals who joined the retailer's rewards program months after the alleged Song-Beverly violation. See Yeoman v. IKEA U.S. West, Inc., No. 11CV701, 2012 WL 1598051 (S.D. Cal. May 4, 2012). The Court's discussion suggests that a retailer may also face Song-Beverly liability even if it requests personal information at the register that it already holds by virtue of the customer's membership in its rewards program. … Continue Reading

Privacy in Principle (As California Goes, So Goes the Nation? Part Four)

What happened in the privacy world last week? On Thursday, just before the release of the White House Paper, California Attorney General Kamala Harris announced an agreement with the leading operators of mobile application platforms to privacy principles designed to bring the mobile app industry in line with a California law requiring mobile apps that collect personal information to have a privacy policy. It might be argued that the White House is now enunciating principles and best practices, and encouraging legislation of principles, that have long been embodied not only as best practice but as actual legislation under California law. … Continue Reading

Twitter Followers = Trade Secrets?

Phonedog v. Kravitz, currently pending in the Northern District of California, raises unprecedented issues regarding social media. Is a list of Twitter followers protected as trade secret under California law? What is the value of a Twitter follower? $2.50 per month? I discussed these questions today with Fox News. … Continue Reading

California Amends Its Data Breach Law – For Real, This Time! (As California Goes, So Goes the Nation? Part Three)

California's infamous SB 1386 (California Civil Code sections 1798.29 and 1798.82) was the very first security breach notification law in the nation in 2002, and nearly every state followed suit. Many states added their own new twists and variations on the theme - new triggers for notification requirements, regulator notice requirements, and content requirements for the notices themselves. Over the years, the California Assembly and Senate have passed numerous bills aimed at amending California's breach notification law to add a regulator notice provision and to require the inclusion of certain content. However, Governor Schwarzenegger vetoed the bills on multiple occasions, at least three times. Earlier this year, State Sen. Joe Simitian (D-Palo Alto) introduced Senate Bill 24, again attempting to enact such changes. Yesterday, August 31, 2011, Governor Brown signed SB 24 into law. … Continue Reading

California Federal Court Dismisses Bulk of Privacy Suit Against Facebook

In late 2010, David Gould and Mike Robertson filed a class action lawsuit against Facebook for disclosing users’ personal information to third-party advertisers without users’ consent. The Plaintiffs asserted eight causes of action against Facebook, including violations of the Electronic Communications Privacy Act (“ECPA”) and California’s Unfair Competition Law (“UCL”). Expressing skepticism about the actual … Continue Reading

California Supreme Court Says Zip Codes are PII-Really. (As California Goes, So Goes the Nation? Part Two)

The California Supreme Court ruled Thursday, in Pineda v. Williams-Sonoma, that zip codes are "personal identification information" for purposes of California's Song-Beverly Credit Card Act, California Civil Code section 1747.08. Really. … Continue Reading

As California Goes, so Goes the Nation? Part One

Many of you probably read earlier this month that California's Office of Administrative Law approved the California Department of Insurance's proposal to repeal certain privacy regulations. The California changes actually have greater significance than may be apparent on a quick glance. Although rarely noted in the media coverage, State insurance privacy regulations across the country (not just in California) find their roots in the federal Gramm Leach Bliley Act, so California's decision to make such changes provides a helpful illustration of the extraordinarily complex and confusing web of privacy regulation that governs even small organizations in this country. Also, California's move with respect to these changes contravenes the conventional wisdom that California is a renegade pro-consumer state when it comes to privacy regulation. Many of our followers have asked me to break down this newest California development, so here goes. … Continue Reading

California Department of Public Health Breach Fines and Legally Defensible Security

The California Department of Public Health (“CDPH”) recently announced its imposition of $675,000 in fines to six hospitals that had reported security breaches involving medical records (since January 1, 2009, the CDPH has issued fines totaling $1.1 million). The story has been extensively reported on in the media . You can listen to the CDPH’s … Continue Reading

California Court Rejects Class Action Based on Data Collection for PII Aggregation Purposes

On Friday, the California Court of Appeal, Fourth Appellate District, certified for publication its October 8 opinion in Pineda v. Williams-Sonoma, the most recent in a string of decisions regarding California's Song-Beverly Credit Card Act of 1971, California Civil Code § 1747.08. On first glance, Pineda appears uneventful. The Court merely reiterated its December 2008 holding in Party City v. Superior Court, 169 Cal.App.4th 497 (2008), that zip codes are not personal identification information for purposes of the Act, right? Not so fast. In fact, the Pineda court added a couple of new wrinkles that are worth a second look. First, the court reaffirmed its Party City holding even though Pineda specifically alleged that Williams-Sonoma collected the zip code for the purpose of using it and the customer's name to obtain even MORE personal identification information, the customer's address, through the use of a "reverse search" database. Second, the court held that a retailer's use of a legally obtained zip code to acquire, view, print, distribute or use an address that is otherwise publicly available does not amount to an offensive intrusion of a consumer's privacy under California law. … Continue Reading
LexBlog