California Appeals Court Holds Injury Required For Standing Under State Shine The Light Law


Recently, the California Court of Appeals, Second District, held that a plaintiff must have suffered a statutory injury to have standing to pursue a cause of action under the state’s “Shine the Light Act” (SLA). Boorstein v. CBS Interactive, Inc., No. B247472, 2013 WL 6680796 (Cal. Ct. App. Dec. 19, 2013). The SLA requires businesses that collect California residents’ personal data and then share that data for marketing purposes to disclose or allow consumers to opt out of that sharing. Specifically, all businesses must make consumers aware of their SLA rights by (i) maintaining a disclosure on their website and providing contact information for consumers to make a request about information shared with direct marketers; (ii) requiring customer service agents to provide the contact information upon request; or (iii) making the contact information available at every place of business in the state. In recent years, consumers filed a series of class actions, including the instant case, alleging that companies failed to properly disclose their contact information on their websites. The class plaintiffs did not, however, allege that they had sought SLA disclosures or would have done so had contact information been available. Consistent with federal district courts that have considered these claims, the state appeals court here determined that a failure to timely, accurately, or completely respond to a disclosure request is a discrete event upon which a court could calculate a civil penalty for each violation, whereas a failure to post information on a website is a continuing event that cannot readily be quantified. The court held that such a continuing violation, without more, is not an actionable violation. The court rejected the plaintiff’s claim that he suffered an “informational injury” because he did not receive information to which he was statutorily entitled, and upheld the trial court’s holding that the alleged failure was merely a procedural injury insufficient to establish standing.

Topics:  Cybersecurity, Data Collection, Data Protection, Disclosure Requirements, Opt-Outs, Personally Identifiable Information, Standing

Published In: Civil Procedure Updates, General Business Updates, Communications & Media Updates, Constitutional Law Updates, Consumer Protection Updates

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© BuckleySandler LLP | Attorney Advertising

Don't miss a thing! Build a custom news brief:

Read fresh new writing on compliance, cybersecurity, Dodd-Frank, whistleblowers, social media, hiring & firing, patent reform, the NLRB, Obamacare, the SEC…

…or whatever matters the most to you. Follow authors, firms, and topics on JD Supra.

Create your news brief now - it's free and easy »