Morrison Foerster’s Class Dismissed blog provides insights, recommendations, and timely reports on the latest defense news, developments, and trends in the most current class actions lawsuits and product liability issues that affect consumer-facing companies. Through Class Dismissed, attorneys from our nationally recognized Consumer Class Action and Products Liability practices offer a real-time assessment of the developments in matters that are shaping the industry. This blog examines the full spectrum of consumer-related class action and product liability lawsuits ranging from false advertising, privacy, consumer product safety, ADA, food misbranding, TCPA, environment, retail, and government actions as well as nationwide and multidistrict litigation class actions.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

Editors

hunt_adam_blog_150x150.png

hunt_adam_common_640x280.jpg

hunt_adam_heroretina_2700x1160.jpg

hunt_adam_mobileretina_750x1040.jpg

hunt_adam_social_600x600.jpg

Partner

Adam Hunt is a partner in the Litigation Department of Morrison Foerster’s New York office. His practice focuses on complex litigation, with an emphasis on class action and commercial litigation.

Adam Hunt

Alexandra Barlow is a partner in the Litigation Department of Morrison Foerster’s San Diego office.Alexandra litigates product liability matters involving medical devices, pharmaceuticals, consumer products, automobiles, and AI. Alexandra's litigation expertise spans the entire case life cycle in both state and federal courts. She handles all phases of discovery, including fact investigation and expert discovery. Alexandra has taken over twenty-five depositions, including experts, plaintiffs, treating physicians, and third-party witnesses. She drafts and argues motions of all types, including motions for summary judgment, motions to quash, and motions for preliminary injunction.Alexandra has significant trial experience. She has first-chaired a one-week jury trial and second-chaired a five‑week jury trial, both involving multiple claims and witnesses. She also has extensive experience in alternative dispute resolution, representing clients at mediations, mandatory settlement conferences, and early neutral evaluations.Alexandra enjoys tracking developments and keeping her clients updated on product liability and personal injury claims, frequently writing or presenting on emerging areas such as autonomous vehicles and smart devices. Alexandra’s experience also extends to professional liability, warranty claims, eminent domain, and construction law.Alexandra earned her J.D. from the University of San Diego School of Law. While in law school, the San Diego Law Review published her comment on the recovery of damages by plaintiffs in a persistent vegetative state, and she also served as a comment editor. She received her B.A. from the University of California, Los Angeles, where she majored in Political Science and minored in Spanish. A San Diego native, she attended a Spanish immersion school through the eighth grade. Alexandra is active in the San Diego community, advising students at a local college. She is also a member of several legal organizations in San Diego, including Lawyer’s Club, the Association of Business Trial Lawyers, and Wallace Inn of Court.

preece_alex_blog_150x150.png

preece_alex_common_640x280.jpg

preece_alex_heroretina_2700x1160.jpg

preece_alex_mobileretina_750x1040.jpg

preece_alex_social_600x600.jpg

Alexandra Barlow is a partner in the Litigation Department of Morrison Foerster’s San Diego office. Alexandra litigates product liability matters involving medical devices, pharmaceuticals, consumer products, automobiles, and AI. Alexandra’s litigation expertise spans the entire case life cycle in both state and federal courts. She handles all phases of discovery, including fact investigation and expert discovery. Alexandra has taken over twenty-five depositions, including experts, plaintiffs, treating physicians, and third-party witnesses. She drafts and argues motions of all types, including motions for summary judgment, motions to quash, and motions for preliminary injunction.

Alexandra Barlow is a partner in the Litigation Department of Morrison Foerster’s San Diego office. Alexandra litigates product liability matters involving medical devices, pharmaceuticals, automobiles, AI, and robotics. Alexandra's litigation expertise spans the entire case life cycle in both state and federal courts. She handles all phases of discovery, including fact investigation and expert discovery. Alexandra has taken over twenty-five depositions, including experts, plaintiffs, treating physicians, and third-party witnesses. She drafts and argues motions of all types, including motions for summary judgment, motions to quash, and motions for preliminary injunction.

Alexandra Barlow

<div class="videoWrapper"><iframe frameborder="0" class="sticky-video" allowfullscreen="1" title="Meet Penny Preovolos, Litigation Partner" src="https://www.youtube-nocookie.com/embed/hv7hYn-Bl7c?rel=0&showinfo=0;vq=hd1080" title="iframe"></iframe></div>Penelope has served as lead counsel in major consumer class actions and antitrust cases for more than 35 years, successfully representing high-profile defendants in antitrust, consumer fraud, and product defect matters. Her clients span a range of industries, including consumer electronics, technology, retail, publishing, food and beverage, cosmetics, and household products. According to Chambers USA, Penelope has a “great reputation for antitrust and product liability work” and is a “superb all-around antitrust lawyer.”Penelope was named the 2019 Antitrust Lawyer of the Year by the Antitrust, UCL, and Privacy Section of the California Lawyers Association. She was co-chair of MoFo’s antitrust practice for 14 years. She has served as chair of the Antitrust and Trade Regulation Section of the State Bar of California and as a member of the Ninth Circuit Advisory Committee on Local Rules and Operations. She is an editor of and frequent contributor to Morrison & Foerster’s <a href="https://classdismissed.mofo.com/">Class Dismissed blog</a>, as well as a frequent speaker about class action and antitrust issues.More About PenelopePenelope clerked for the Honorable Charles M. Merrill, United States Court of Appeals for the Ninth Circuit. She graduated cum laude from Harvard Law School, where she was executive editor of the Harvard Civil Rights – Civil Liberties Law Review. Penelope was a member of Phi Beta Kappa at the University of California, Berkeley. She was awarded the University Medal, the highest undergraduate honor at the university, as well as the English Departmental Citation (awarded to the outstanding graduate in that department).

preovolos_penelope_blog_150x150.png

preovolos_penelope_common_640x280.jpg

preovolos_penelope_heroretina_2700x1160.jpg

preovolos_penelope_mobileretina_750x1040.jpg

preovolos_penelope_social_600x600.jpg

Senior Counsel

Penelope has served as lead counsel in major consumer class actions and antitrust cases for more than 35 years, successfully representing high-profile defendants in antitrust, consumer fraud, and product defect matters. Her clients span a range of industries, including consumer electronics, technology, retail, publishing, food and beverage, cosmetics, and household products.

Penelope A. Preovolos

Zak is an associate in the Litigation Department in Morrison Foerster’s New York office.Zak’s practice focuses on class actions, commercial litigation, white collar defense, government investigations, and antitrust litigation and counseling. He has represented clients before federal and state courts in complex commercial matters, as well as in arbitration tribunals.Zak received his J.D. from New York University School of Law in 2018, where he was inducted into the Order of the Barristers. During law school, Zak also served as the Marden executive editor for the NYU Law Moot Court Board. In 2013, Zak received his B.A. and M.A. in political science from Yale University, receiving honors in his major and the Ellsworth Prize for Best Senior Essay in the Social Sciences.

newman_zak_blog_150x150.png

newman_zak_common_640x280.jpg

newman_zak_heroretina_2700x1160.jpg

newman_zak_mobileretina_750x1040.jpg

newman_zak_social_600x600.jpg

Associate

Zak Newman

Mitchell A. Hokanson is an associate in the Litigation Department of Morrison Foerster’s San Diego office.Mitchell’s practice focuses on commercial litigation and consumer class actions. He has extensive experience with civil litigation, including managing day-to-day strategy, propounding and responding to discovery, taking and defending depositions, and engaging in motion practice. He also has experience providing regulatory advice to clients, including pro bono partners and multinational corporations. Mitchell maintains an active pro bono practice.After law school, Mitchell worked as a judicial clerk for Justice Susan M. Carney of the Alaska Supreme Court, where he drafted bench memoranda and opinions on a wide range of state and federal law topics. Prior to joining MoFo, Mitchell worked for another international law firm, where he was a member of the Complex Civil Litigation practice group, in Los Angeles, California.Mitchell received his J.D. from Columbia Law School, where he was honored as a James Kent Scholar and Harlan Fiske Stone Scholar. While in law school he was the senior executive editor of the Columbia Journal of Environmental Law and worked as a judicial intern for Judge Sandra S. Ikuta of the United States Court of Appeals for the Ninth Circuit and Judge George B. Daniels of the United States District Court, Southern District of New York. Prior to that, Mitchell earned his B.A. from Stanford University.

hokanson_mitchell_blog_150x150.png

hokanson_mitchell_common_640x280.jpg

hokanson_mitchell_heroretina_2700x1160.jpg

hokanson_mitchell_mobileretina_750x1040.jpg

hokanson_mitchell_social_600x600.jpg

Mitchell Hokanson

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Morrison Foerster’s Class Dismissed blog provides insights and reports on the latest news, developments, and trends that affect consumer-facing companies. Subscribe to receive the latest updates by attorneys from our nationally recognized Consumer Class Action and Product Liability practices.

Welcome to Class Dismissed

class-dismissed-welcome-image.jpeg

class-dismissed-welcome-image

Morrison Foerster’s Class Dismissed blog provides insights and reports on the latest news, developments, and trends that affect consumer-facing companies. 

Class Action

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

Stay on top of emerging issues and stay informed of developments related to the law and business of social media.

Socially Aware

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

The latest news and insights from the nationally recognized Consumer Class Action and Product Liability practices of Morrison & Foerster.

Class Dismissed

  Linkedin

MoFo LinkedIN

Class Dismissed Blog - RSS

Stay Connected

By submitting your data to subscribe to this blog, you approved Morrison & Foerster LLP to email you future information about MoFo news and events. You may opt-out at any time by sending a request to <a href="mailto:mofonews@mofo.com">mofonews@mofo.com</a>. To learn more about how Morrison & Foerster LLP uses and protects your personal data, please view our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a> at <a href="https://www.mofo.com/">www.mofo.com</a>.

Never miss a post from Class Dismissed. Enter your email below to stay up-to-date.

Subscribe

Class Action and Product Insights for Your Business

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

TCPA

Topics

Blog - Editors

Blog - About

About

Blog - Subscribe

Adam J. Hunt

More

Alexandra Preece Barlow

Mitchell A. Hokanson

Software Gains New Status as a Product Under Strict Liability Law

MAHA Commission Publishes Report to Highlight Childhood Chronic Disease Drivers

Tenth Circuit Denies Challenge to CPSC Rule Regulating High-Powered Magnets

Ousted CPSC Democrats Fight Back Against President Trump

Setting Consumer Standards for Lithium-Ion Batteries Act

LinkedIN

Another court has allowed individuals to move past the preliminary stages of litigation by finding that “lost time” and the “time value of money” are injuries. Building on its prior rulings allowing data breach cases to jump over standing hurdles, on April 11, 2018, in Dieffenbach v. Barnes & Noble, Inc., No. 17-2408 (7th Cir. 2018), the court also allowed this data breach case to hop over the damages hurdle at the pleading stage.In Barnes & Noble, the plaintiffs alleged that in 2012, hackers breached PIN pads that Barnes & Noble used to verify customers’ payment information.  This breach allegedly allowed the hackers to steal customers’ names, card numbers, expiration dates, and PINs.  Barnes & Noble then announced to affected customers that it had been a victim of a data breach.  In response to this announcement, some customers allegedly spent monies on credit-monitoring services, while others allegedly expended merely their personal time to sort out issues related to the breach with their credit card companies and/or the police.Two lead plaintiffs brought this litigation: Heather Dieffenbach and Susan Winstead. Ms. Dieffenbach alleged four distinct injuries under California’s Customer Records Act and the Unfair Competition Law, three of which the Court found sufficient to allege injury: (1) her bank took three days to restore funds someone else had used to make a fraudulent purchase; (2) she had to spend time sorting things out with police and her bank; and (3) she could not make purchases using her compromised account for three days.  And Ms. Winstead alleged two theories of injury under Illinois’ Consumer Fraud and Deceptive Business Practices Act: (1) her bank contacted her about a potentially fraudulent charge on her credit card statement and deactivated her card for several days; and (2) the security breach at Barnes & Noble “was a decisive” factor in her renewing a credit-monitoring service.Consistent with its recent rulings in data breach actions, the Seventh Circuit noted that the alleged money spent for credit-monitoring services and the loss of the time value of money and one’s own time satisfied Article III standing. See Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015) (data breach plaintiffs may have standing based strictly on an alleged impending harm), and Lewert v. P.F. Chang’s China Bistro, Inc., No. 14-3700 (7th Cir. 2016) (the increased risk of fraudulent charges and identity theft that consumers faced because their data had been stolen was sufficient to confer standing).But the Seventh Circuit this time went further and held that the “time value of money” (the loss of access to plaintiff’s account for three days) and “significant time and paperwork costs incurred to rectify violations” can qualify as economic losses under the California statutory claims asserted. The Court also held that the Illinois plaintiff sufficiently pled injury under the Illinois consumer protection statute based on her allegation that the security breach “was a decisive factor” when she paid to renew her credit-monitoring service.While the Dieffenbach court seems to open the court doors to those who spend time “set[ting] things straight” after a data breach, the court expressly limited its decision to the pleadings stage.  The court stated, “All we hold today is that the complaint cannot be dismissed on the ground that the plaintiffs do not adequately allege compensation damages.”  The court also acknowledged the reality that, because Barnes & Noble was a victim of the data breach too, “[p]laintiffs may face a difficult task showing an entitlement to collect damages from a fellow victim of the data thieves” and that “it is far from clear that this suit should be certified as a class action.”  This is not the last word; plaintiffs continue to face an uphill battle in proving that a class should be certified and that defendant is liable for any damages.

Wiretap Act Class Action for Technology Company

BIPA Class Action for Social Media App

RICO and Fraud Class Action for Waste Management Company 

Copyright Class Action for AI Company

CCPA and Data Breach Class Action for Leading Software Company

TCPA and Other Class Actions for Major Technology Company

Wiretap Act Action Against a Major Consumer Electronics Manufacturer

cheung_tiffany_blog_150x150.png

cheung_tiffany_common_640x280.jpg

cheung_tiffany_heroretina_2700x1160.jpg

cheung_tiffany_mobileretina_750x1040.jpg

cheung_tiffany_social_600x600.jpg

Clients seek out Tiffany for her successful track record in defending class action claims on behalf of clients in a broad range of industries, including technology, healthcare, and consumer product companies. She represents numerous Fortune 500 companies in high-stakes litigation involving privacy and marketing claims in courts throughout the United States.

Tiffany Cheung

Clients seek out Tiffany for her successful track record in defending class action claims on behalf of clients in a broad range of industries, including technology, healthcare, and consumer product companies. She represents numerous Fortune 500 companies in high-stakes litigation involving privacy and marketing claims in courts throughout the United States.

creditbreach_gettyimages-512450113-600px_thumbnail.jpg

Time Is Money: Time Spent Resolving Issues Arising from Data Breaches Enough to Plead Standing and Damages

Time Is Money: Time Spent Resolving Issues Arising from Data Breaches Enough to Plead Standing and Damages

creditbreach_gettyimages-512450113-600px_image.jpg

Another court has allowed individuals to move past the preliminary stages of litigation by finding that “lost time” and the “time value of money” are injuries. 

Privacy

Class Certification

Product Liability

Retail

Overview Standing requirements have forced many a data breach action to stand down. Can a plaintiff have a claim (and on behalf of a massive class) when plaintiff hasn’t suffered any harm?  For those polling the Circuits, the Ninth Circuit votes “yes.”  And because no good deed goes unpunished, the Court interpreted defendant’s helpful advice to consumers as an “acknowledgment” of the harm.For years, district courts in the Ninth Circuit have debated whether the mere risk of future identity theft originating from a data breach constitutes an injury sufficient to confer Article III standing following the United States Supreme Court’s decision in Clapper v. Amnesty Int’l USA, 133 S.Ct. 1138 (2013).  On March 8, 2018, in In re Zappos.com, Inc., Customer Data Security Breach Litig., Case No. 16-16860 (9th Cir. 2018), the Ninth Circuit concluded that it did.  The Court found that, notwithstanding the Supreme Court’s decision in Clapper, its prior decision in Krottner v. Starbucks, 628 F.3d 1139 (9th Cir. 2010) – that the threat of future harm was sufficient to confer standing – remains the law in the Ninth Circuit.In In re Zappos, the plaintiffs alleged that in 2012 hackers breached the servers of online retailer Zappos.com.  The hackers allegedly stole the names, account numbers, passwords, email addresses, billing and shipping addresses, telephone numbers, and credit and debit card information for more than 24 million customers.  While some of the plaintiffs alleged that the hackers actually used their stolen information to conduct financial transactions, other plaintiffs did not.  Judge Robert C. Jones of the District of Nevada dismissed the claims of those plaintiffs who “failed to allege instances of actual identity theft or fraud” on the basis that they lacked Article III standing.  Those plaintiffs appealed.In re Zappos is the first time the Ninth Circuit considered whether Krottner could be reconciled with the Supreme Court’s later decision in Clapper.  In Krottner, the Ninth Circuit found that allegations of an “increased risk of future identity theft” resulting from the theft of a laptop represented a “credible threat of real and immediate harm” sufficient to establish Article III standing.  In Clapper, however, the Supreme Court found that the “objectively reasonable likelihood” that plaintiffs’ communications would be the subjects of governmental surveillance authorized by the Foreign Intelligence Surveillance Court did not rise to the level of a “certainly impending injury” necessary to establish Article III standing. Clapper thus undermined Krottner.In In re Zappos, however, the Ninth Circuit reasoned that Krottner and Clapper were not “clearly irreconcilable” and, thus, Krottner remained good law.  First, the Court noted that unlike in Clapper, the alleged injury in Krottner was not based on a “speculative multi-link chain of inferences” because “the Krottner laptop thief had all the information he needed to open accounts or spend money in the plaintiffs’ names.”  Second, the analysis of standing in Krottner did not involve any “national security or separation of powers concerns” as it did in Clapper.  And third, since Clapper, the Supreme Court has emphasized that allegations of a future injury may establish Article III standing when there is a “substantial risk that the harm will occur.”Operating within the Krottner framework, the Ninth Circuit decided that, while the information stolen in In re Zappos was not the exact same type as that stolen in Krottner, “the sensitivity of the stolen data” was “sufficiently similar.”  The Court reasoned that “the information taken in the data breach still gave hackers the means to commit fraud or identity theft.”  Notably, the Court relied upon Zappos’s own breach notice in reaching this conclusion, finding that Zappos itself effectively acknowledged the substantial risk of harm “by urging affected customers to change their passwords on any other account where they may have used ‘the same or a similar password.’”  As a result, the Court concluded that the plaintiffs had alleged an injury sufficient to confer Article III standing.With its decision in In re Zappos, the Ninth Circuit picks a side in the Circuit split and joins the circuit courts that have concluded that the threat of future harm is sufficient for purposes of Article III standing, including the D.C., Sixth, and Seventh Circuits. See, e.g., Attias v. Carefirst, Inc., 865 F.3d 620 (D.C. Cir. 2017), cert. denied, No. 17-641, 2018 WL 942459 (U.S. Feb. 20, 2018); Galaria v. Nationwide Mutual Ins. Co., 663 Fed.Appc. 384 (6th Cir. 2016); Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 693 (7th Cir. 2015).  Conversely, the Second, Fourth, and Eighth Circuits have determined that plaintiffs must allege an actual injury in the form of fraudulent charges or the opening of fraudulent financial accounts based upon their stolen information to establish Article III standing; general allegations of an increased risk of identity theft is not enough. See, e.g., Whalen v. Michaels Stores, Inc., 689 Fed.Appx. 89 (2d Cir. May 2017); Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017); In re SuperValu Customer Data Security Breach Litig., 870 F.3d 763 (8th Cir. 2017).Key Takeaways Companies should take note of the Court’s decision in In re Zappos for a variety of reasons.  Although data breach cases often involve consumers who did not actually experience fraudulent charges or identity theft, the Ninth Circuit allowed such consumers to overcome the standing hurdle ― at least at the motion to dismiss stage.  But the Court was quick to point out that “as litigation proceeds beyond the pleading stage, the Complaint’s allegations will not sustain Plaintiffs’ standing on their own.”  Accordingly, while plaintiffs may be able to survive a motion to dismiss on allegations that a data breach put them at risk of a future harm, Article III standing may still prove to be a strong defense on summary judgment.Additionally, the decision particularly impacts companies that suffer a breach that triggers a notification requirement under state law. For example, California statutes mandate that certain victims of data breaches issue statements warning consumers about risks to their online accounts or data.  But in In re Zappos, the Court relied upon the language from this statutory notice issued by Zappos to support the Court’s finding that plaintiffs had Article III standing.  Thus, companies subject to data breaches should pay close attention to the precise language used in the notices they issue to evaluate the potential impact on plaintiffs’ standing arguments.

shutterstock_540167380-600px_thumbnail.jpg

No Injury? No Problem: Mere Risk of Identity Theft Can Establish Standing

No Injury?  No Problem:  Mere Risk of Identity Theft Can Establish Standing

shutterstock_540167380-600px_image.jpg

Overview Standing requirements have forced many a data breach action to stand down. Can a plaintiff have a claim (and on behalf of a massive class) when plainti

Consumer Products

A split among U.S. Circuit Courts of Appeals regarding what harm should suffice to maintain standing in data breach litigation doesn’t get easier to address as new questions of whether extrinsic evidence from Dark Web searches of breached personal data for sale can be relied on at the motion to dismiss stage of litigation.The dark web—the alternative internet of websites often offering illegal products and stolen information for sale—presents complex issues in the context of considering harm in data breach litigation.Please see our full article as originally published by <a href="https://media2.mofo.com/v3/assets/blt5775cc69c999c255/bltb91f9a9dd9996fa2/627315370cffdf1eb1369d34/180319-dark-web-data-analysis.pdf">Bloomberg Law</a>. Reprinted with permission.

patel_purvi_blog_150x150.png

patel_purvi_common_640x280.jpg

patel_purvi_heroretina_2700x1160.jpg

patel_purvi_mobileretina_750x1040.jpg

patel_purvi_social_600x600.jpg

Purvi G. Patel is the former managing partner of the Los Angeles Office. She represents retail, e-commerce, and other businesses in significant advertising, unfair competition, consumer fraud, and privacy matters.

Purvi G. Patel is the former managing partner of the Los Angeles Office. She represents retail, e-commerce, and other businesses in significant advertising, unfair competition, consumer fraud, and privacy 

Purvi G. Patel

Purvi G. Patel defends retail, e-commerce, and other businesses in significant advertising, unfair competition, consumer fraud, and privacy matters. She has built a robust practice defending household names in complex and class action litigation in federal and state courts across the country, winning motions to dismiss, defeating class certification, and securing summary disposition in several multi-million dollar lawsuits. Purvi is a strategic and practical thinker who is in tune with her clients’ priorities, which leads to successful outcomes both inside and outside the courthouse.

Purvi Patel

shutterstock_350124851_small_thumbnail.jpg

The Dark Web—the Next Frontier in Data Breach Standing Analysis Amid a Deepening Circuit Split

The Dark Web—the Next Frontier in Data Breach Standing Analysis Amid a Deepening Circuit Split

shutterstock_350124851_small_image.jpg

A split among U.S. Circuit Courts of Appeals regarding what harm should suffice to maintain standing in data breach litigation doesn’t get easier to address as 

One year ago, the federal government test drove its first set of self-driving policies with a four-part <a href="https://www.transportation.gov/AV-factsheet" target="_blank" rel="noopener">announcement </a>from the U.S. Department of Transportation. In twelve months, much has changed, but the wheels are still turning.The U.S. House of Representatives earlier this month passed the bipartisan Safely Ensuring Lives Future Development and Research in Vehicle Evolution (SELF DRIVE) Act. The SELF DRIVE Act continues the work of clarifying state and federal government roles as well as the federal government’s responsibilities with regard to safety, cybersecurity, privacy, and consumer education.Although SELF DRIVE has now launched, the engine is still heating up: The U.S. Senate is still developing its approach to federal policy in this space. Last week, the U.S. Senate held a hearing to this end, inviting experts on self-driving trucks to <a href="https://www.commerce.senate.gov/public/index.cfm/pressreleases?ID=BAC7FBCE-424B-4C61-8082-71B3E3D9333B" target="_blank" rel="noopener">testify </a>before its Commerce Committee. This latest action built on a set of bipartisan “principles” for <a href="https://www.commerce.senate.gov/public/index.cfm/pressreleases?ID=3319E728-1F3A-4316-8F7E-8CAF66000F8C" target="_blank" rel="noopener">legislation </a>that the U.S. Senate had released in June.The Executive Branch has also announced a change to its approach. Specifically, U.S. Department of Transportation Secretary Chao unveiled <a href="https://www.nhtsa.gov/sites/nhtsa.dot.gov/files/documents/13069a-ads2.0_090617_v9a_tag.pdf" target="_blank" rel="noopener">“A Vision for Safety: 2.0” i</a>n Michigan <a href="https://www.transportation.gov/briefing-room/av-summit" target="_blank" rel="noopener">last week. </a>As Secretary Chao noted, this “replaces the Federal Automated Vehicle Policy Version 1.0” released last year, but it is not the Department’s final word: “DOT and NHTSA are already planning for Version 3.0 in 2018!”In short, for federal self-driving policy, the wheels are still turning – and the regulatory landscape will most certainly continue to evolve over the coming weeks and months.

shutterstock_458481676_417x251_thumbnail.jpg

Wheels Are Turning on Federal Self-Driving Policy

Wheels Are Turning on Federal Self-Driving Policy

shutterstock_458481676_417x251_image.jpg

One year ago, the federal government test drove its first set of self-driving policies with a four-part announcement from the U.S. Department of Transportation.

Aviation & Drones

Government Actions

On August 17, 2017, the Second Circuit Court of Appeals vacated a district court’s denial of Uber’s and Mr. Travis Kalanick’s motions to compel arbitration in a case involving price-fixing accusations.  In Meyer v. Kalanick, No. 16-2750 (2d Cir. Aug. 17, 2017), the Second Circuit held, as a matter of law, that plaintiff Spencer Meyer received objectively reasonable notice of the terms of service and unambiguously assented by clicking “register” on his smartphone when he signed up to use Uber’s services.  The Second Circuit also remanded for consideration of whether Uber and Mr. Kalanick waived the right to compel arbitration by defending the lawsuit.This was a heavily watched case with amici support on both sides.  The foes of arbitration hoped to use Meyer to call into question the viability of all click-through protocols that many companies use for their terms and conditions, not just Uber.Background of the Case.  In 2015, Mr. Meyer, on behalf of a putative class of Uber riders, filed an action against Mr. Kalanick, alleging that the Uber App allows drivers to fix prices amongst themselves, in violation of the Sherman Act, 15 U.S.C. § 1, and the Donnelly Act, N.Y. Gen. Bus. Law § 340.  Uber was subsequently joined as a defendant in 2016.  Uber and Mr. Kalanick filed motions to compel Meyer to arbitrate.  Judge Rakoff of the Southern District of New York denied the motions, concluding that Mr. Meyer did not have reasonably conspicuous notice of the terms of service and did not unambiguously manifest assent to the terms.  See Meyer v. Kalanick, 200 F. Supp. 3d 408, 420 (S.D.N.Y. 2016).  The district court did not reach Meyer’s other defenses to arbitration, including whether defendants waived their right to arbitrate by actively participating in the litigation.The District Court’s Determinations Were Subject to De Novo Review.  Plaintiff argued that the Second Circuit was limited to clear-error review of the district court’s findings and legal conclusions.  The Second Circuit disagreed, finding that it would review de novo the denial of a motion to compel arbitration.  While factual findings upon which a conclusion was based would be reviewed for clear error, the facts in Meyer were undisputed.Beyond “Clickwrap” and “Browsewrap.” The court discussed web-based contracts, noting that it had previously distinguished web-based contracts as either “clickwrap” or “browsewrap” agreements.  “Clickwrap” agreements, which courts routinely uphold, require a user to click an “I agree” box after being presented with the terms and conditions of use.  “Browsewrap” agreements, on the other hand, generally post terms and conditions on a website via a hyperlink at the bottom of the screen.  Because no affirmative action is required in “browsewrap” agreements, the determination of the validity of these agreements depends on whether the user has actual or constructive knowledge of the terms and conditions.  The Second Circuit noted, however, that not all interfaces would fit neatly into the “clickwrap” or “browsewrap” categories.  As such, classification of web-based contracts would not resolve the notice inquiry. The Parties Mutually Assented to the Agreement.  Under California law, the Second Circuit considered whether the undisputed facts established that there was: (1) reasonably conspicuous notice of the existence of contract terms; and (2) unambiguous manifestation of assent to those terms.  Analyzing Uber’s agreement, the court found both requirements were established.In analyzing the first requirement, the court considered “the perspective of a reasonably prudent smartphone user.”  Looking at the interface at issue in the case, the court concluded that the design of the screen and language used rendered the notice provided reasonable as a matter of law.  First, the registration payment screen was uncluttered.  The text on that screen advised Uber users that “By creating an Uber account, you agree to the TERMS OF SERVICE & PRIVACY POLICY.”  This text, along with a hyperlink to the terms of service, appeared directly below the buttons for registration.  Even more, the entire screen was visible without scrolling.  Finally, although the text was in a small font, its dark print contrasted with the bright white background, and the hyperlinks were in blue and underlined.The court also found that the fact that the terms of service were available by hyperlink did not preclude a determination of reasonable notice because the hyperlinked text was reasonably conspicuous.  Additionally, the court disagreed with the district court’s determination that the location of the arbitration clause within the terms of service was itself a “barrier to reasonable notice.”  Accordingly, the Uber App provided reasonably conspicuous notice as a matter of law.In analyzing the second requirement, the court found that although Meyer’s assent to arbitration was not express, it was unambiguous in light of the objectively reasonable notice of the terms.  A reasonable user would know that, by clicking the registration button, he or she was agreeing to the terms and conditions accessible via the hyperlink.  Plaintiff argued that the fact that clicking the register button had two functions—creation of a user account and assent to the terms of service—rendered plaintiff’s assent ambiguous.  The court disagreed.  The physical proximity of the notice  regarding the terms of service to the register button made clear to a user that the linked terms pertained to the action the user was about to take.The court concluded that, as a matter of law, Meyer agreed to arbitrate his claims with Uber.The District Court Would Decide the Issue of Waiver.  Plaintiff argued in the alternative that defendants waived their right to arbitrate by actively litigating the underlying lawsuit.  Although a defense of waiver would normally be decided by the arbitrator, the court found that, here, the district court could properly decide the question because defendants had participated in litigation.  As such, the court remanded the case to the district court to consider whether defendants had waived their right to arbitrate.The court’s decision signals what factors at least one Court of Appeal will consider in determining the validity of consent in hybrid agreements—those agreements that don’t fall expressly into the “clickwrap” or “browsewrap” categories.  It also confirms the validity of the electronic registration process used by Uber and many other companies.Request to amend its opinion denied.  On Tuesday, August 29, 2011, the Second Circuit denied Plaintiff’s motion to have the Second Circuit amend its August 17, 2017 opinion.  Plaintiff requested that the Second Circuit include language in its opinion stating that the district court could consider the extent to which Plaintiff may have been unable to see Uber’s Terms of Service hyperlink (an argument made by plaintiff in Metter v. Uber Technologies, Inc., Case No. 3:16-cv-06652-RS).  The Court denied the motion without prejudice to Plaintiff raising the issue in the district court in the first instance.

gettyimages-466452338_small_thumbnail.jpg

Second Circuit Scraps District Court’s Denial of Uber’s Motion to Compel Arbitration

Second Circuit Scraps District Court’s Denial of Uber’s Motion to Compel Arbitration

gettyimages-466452338_small_image.jpg

On August 17, 2017, the Second Circuit Court of Appeals vacated a district court’s denial of Uber’s and Mr. Travis Kalanick’s motions to compel arbitration in a

The Federal Trade Commission’s recent workshop on drones raised familiar issues related to the privacy implications of a new and evolving technology. While the many potential innovations and consumer benefits of drone technology were highlighted, the workshop’s focus was on whether drones raise unique privacy considerations and, if so, how such considerations should be addressed.

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance c

Julie O'Neill

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance challenges around a wide variety of both online and offline privacy issues, including tracking, interest-based advertising, geo-targeting and other mobile tracking, personalization, and cross-device tracking. Recognized in The Legal 500 US 2014, 2016, 2019, and 2020 and Chambers USA 2021 for her exceptional legal work, her clients praise her saying, “She is really good at giving practical, targeted advice and taking stock of what the risk profile of the client is, so that the advice is holistic.” (Chambers USA 2021).

FTC Workshop on New Drone Technologies Raises Familiar Privacy Issues

The Federal Trade Commission’s recent workshop on drones raised familiar issues related to the privacy implications of a new and evolving technology. While the 

FTC Workshop on New Drone Technologies Raises Familiar Privacy Issues

Defending the American people and economy from hostile state or state-sponsored actors is critical for both economic and national security reasons. However, while our state and federal law enforcement agencies vigorously protect people from criminals and assist victims of crimes, companies that publicly disclose that they have been the victim of a cybercrime are not treated like a typical victim by federal and state regulators. Instead, they are investigated by numerous agencies, including the Federal Trade Commission, the State Attorneys General, and the Security and Exchange Commission, while often simultaneously sued by consumers, business customers, and shareholders. In the face of the onslaught of cyber threats, U.S. companies are charged with defending themselves in cyberspace or facing legal liability. How did we arrive at holding those victimized by a cybercrime liable for the damage inflicted upon them?Read more in Miriam Wugmeister’s The Hill op-ed.

wugmeister_miriam_blog_150x150.png

wugmeister_miriam_common_640x280.jpg

wugmeister_miriam_heroretina_2700x1160.jpg

wugmeister_miriam_mobileretina_750x1040.jpg

wugmeister_miriam_social_600x600.jpg

Few lawyers in the world have Miriam’s breadth and understanding of privacy and data security laws, obligations, and practices.

Few lawyers in the world have Miriam Wugmeister’s breadth and understanding of privacy and data security laws, obligations, and practices. 

Miriam H. Wugmeister | Privacy and Data Security Lawyer

Few lawyers in the world have Miriam Wugmeister's breadth and understanding of privacy and data security laws, obligations, and practices. In the words of her clients, she is “extremely practical and phenomenally smart. Just about one of the best privacy advisers there is” (Chambers USA). Co-chair of Morrison & Foerster’s market-leading Global Privacy and Data Security Group and ranked among the top in the profession by all major directories, Ms. Wugmeister is regularly called upon by some of the world’s largest and most complex multinational organizations to confront their most difficult U.S. and international privacy challenges. “Tremendous at helping you come up with practical solutions to real problems” (Chambers USA), she develops cutting-edge solutions for clients that marry legal compliance with business realities.

Miriam Wugmeister

Stop Victim Shaming in Cyber Attacks

Defending the American people and economy from hostile state or state-sponsored actors is critical for both economic and national security reasons. However, whi

Stop Victim Shaming in Cyber Attacks

It is easier than ever to identify a consumer with just a few pieces of seemingly innocuous information.  Advances in big data analytics, combined with the increasing volume of data generated by consumers in their daily lives, have “increasingly blurred [the] line” between personally identifying information (PII) and non-PII, according to a recent speech by Federal Trade Commission (FTC) Chairwoman Edith Ramirez.  She expanded on her point by expressly stating that the FTC “now regard[s] data as personally identifiable when it can be reasonably linked to a particular person, computer, or device.”  According to the Chairwoman, “[i]n many cases, persistent identifiers, such as device identifiers, MAC addresses, static IP addresses, and retail loyalty card numbers meet this test.”

oneill_julie_blog_150x150.png

oneill_julie_common_640x280.jpg

oneill_julie_heroretina_2700x1160.jpg

oneill_julie_mobileretina_750x1040.jpg

oneill_julie_social_600x600.jpg

The Scope of “Personally Identifiable Information” Is Changing

It is easier than ever to identify a consumer with just a few pieces of seemingly innocuous information.  Advances in big data analytics, combined with the incr

The Scope of “Personally Identifiable Information” Is Changing

The First Circuit Court of Appeals’ recent decision in Yershov v. Gannett Satellite Information Network, Inc., — F.3d —-, Case No. 15-1719, 2016 WL 1719825 (1st Cir. Apr. 29, 2016), may carry important implications for mobile app providers seeking to navigate federal privacy laws—in particular, the Video Privacy Protection Act of 1988 (VPPA).  Although Yershov is not the first case to consider how the VPPA applies to mobile apps, the opinion contains two key holdings regarding (i) the scope of protectable personally identifiable information (PII) and (ii) the treatment of free app downloaders under the statute.The VPPA.  The VPPA was passed in 1988, after the video rental history of then-Supreme Court nominee Judge Robert Bork was disclosed in a newspaper article during debate over his nomination.  The VPPA is intended to preserve personal privacy in connection with the rental, purchase, or delivery of video and audio materials and creates a “civil remedy against a ‘videotape service provider’ for ‘knowingly disclos[ing], to any person, [PII] concerning any consumer of such provider.’”  Yershov, 2016 WL 1719825, at *2 (quoting 18 U.S.C. § 2710(b)(1), alterations in opinion).  Of relevance in Yershov, the statute defines “consumer” as “any renter, purchaser, or subscriber of goods or services from a videotape service provider.”  18 U.S.C. § 2710(a)(1).  The VPPA defines PII to “include[] information which identifies a person as having requested or obtained specific video materials or services from a videotape service provider.”  Id. § 2710(a)(3).Case Background.<a href="#_ftn1" name="_ftnref1">[1]</a>  In late 2013, Yershov downloaded the free USA Today Mobile App (the “App”) on his Android mobile device.  The App is offered by Gannett via the Google Play Store and allows the user to access various USA Today media and content, including videos, on the user’s mobile device.  Yershov claims that he watched numerous video clips on the App.  Each time, he says Gannett and its third-party marketing and analytics vendor collected three pieces of data:  (i) the title of the video Yershov viewed; (ii) the GPS coordinates of the device Yershov used; and (iii) Yershov’s unique Android ID.  According to Yershov, the vendor used this information to create “digital dossiers” for Yershov and similarly situated users, which Gannett in turn used to provide targeted advertising.  Yershov says he never consented to the collection of this data.  He filed a putative class action lawsuit as a result, claiming that Gannett’s actions violated the VPPA.Gannett successfully moved to dismiss Yershov’s VPPA claim.  Although the district court held that the information Gannett collected and disclosed to its vendor constituted PII, it concluded that Yershov failed to allege that he was a renter, purchaser, or subscriber of Gannett’s video content and, therefore, he was not a “consumer” with a right of action under the VPPA.  Yershov appealed.First Circuit Revives Yershov’s Claim.  The First Circuit reversed the district court’s dismissal order and remanded for further proceedings.  First, the panel agreed with the district court that the information conveyed to the vendor by Gannett constituted PII under the VPPA.  According to the panel, the VPPA’s “abstract formulation” of PII does not require the information at issue to “explicitly name[] a person” to come within the ambit of the statute.  Yershov, 2016 WL 1719825, at *2.  Rather, it is sufficient if the information “effectively reveal[s] the name,” or identity, “of the video viewer” without too much uncertainty or “yet-to-be-done, or unforeseeable detective work.”  Id. at *3.  Because Yershov alleged that Gannett’s vendor could connect the GPS coordinates and Android ID with a given person’s “name, address, phone number, and more,” the panel concluded that he sufficiently alleged a “firm and readily foreseeable” linkage between the data collected and the user’s identity.  Id.Second, the panel addressed the “closer question” of whether Yershov is a “subscriber” and, therefore, a consumer under the VPPA.<a href="#_ftn2" name="_ftnref2">[2]</a>  Lacking a clear statutory definition, the panel evaluated various dictionary definitions of “subscribe,” which “include as an element a payment of some type and/or presume more than a one-shot transaction.”  Id. at *4.  The panel expressly rejected the notion that the term “subscriber” incorporated a monetary payment requirement.  Requiring monetary payment as an element, the panel reasoned, would render “subscriber” superfluous vis-à-vis the terms “purchaser” and “renter,” both of which necessarily require monetary payment.  According to the panel, “Congress would have had no need to include a third category of persons [i.e., subscribers] protected under the Act if it had intended that only persons who pay money for videos be protected.”  Id.  The panel also found it significant that, in 2012, Congress considered the impact of the VPPA on video content in the age of the Internet and left the definition of “consumer” untouched—an indication, according to the panel, that “Congress understood its originally-provided definition to provide at least as much protection in the digital age as it provided in 1988.”  Id.In the end, the panel concluded that qualifying as a “subscriber” requires some kind of relationship between the individual and the video provider that gives the individual some form of special access to the video content.  As the panel stated:<ol style="list-style-type: none;"><li>[B]y installing the App on his phone, thereby establishing seamless access to an electronic version of USA Today, Yershov established a relationship with Gannett that is materially different from what would have been the case had USA Today simply remained one of millions of sites on the web that Yershov might have accessed through a web browser.</li></ol>Id. at *5.Looking Ahead.Yershov is not without its critics and, indeed, its holdings conflict with those of other courts that have considered similar issues.  For example, multiple courts have concluded that a unique, numerical device identifier is not PII under the statute.  See, e.g., In re Hulu Privacy Litig., Case No. C 11-03764 LB, 2014 WL 1724344, at *6-7 (N.D. Cal. Apr. 28, 2014); In re Nickelodeon Consumer Privacy Litig., Case Nos. 12-07829, 13-03755, 13-03729, 13-03757, 13-03731, 13-03756, 2015 WL 248334, at *3 (D.N.J. Jan. 20, 2015).  Yershov does not address these contrary decisions.Other courts have also adopted a narrower reading of “subscriber,” requiring more of a “commitment” than that which arises from downloading a free app.  See Ellis v. Cartoon Network, Inc., 803 F.3d 1251, 1256-58 (11th Cir. 2015).  Yershov distinguished Ellis on its facts—in particular, the alleged process associated with downloading and installing the apps involved in each case—but the diverging conclusions could indicate a more fundamental disagreement regarding what it means to download and use free software.Yershov shows the continuing split among courts interpreting the scope of the VPPA. <a href="#_ftnref1" name="_ftn1">[1]</a> This background comes from Yershov’s allegations in the operative complaint, which were taken as true for purposes of the Court’s opinion.<a href="#_ftnref2" name="_ftn2">[2]</a> Yershov did not claim to be a renter or purchaser for purposes of the statute.

First Circuit Issues Potentially Significant Ruling on Federal Video Privacy Statute’s Application to Mobile Apps

The First Circuit Court of Appeals’ recent decision in Yershov v. Gannett Satellite Information Network, Inc., — F.3d —-, Case No. 15-1719, 2016 WL 1719825 (1st

First Circuit Issues Potentially Significant Ruling on Federal Video Privacy Statute’s Application to Mobile Apps

In a recent ruling, California’s Court of Appeal unanimously affirmed the dismissal of California’s complaint against Delta Air Lines, Inc. (“Delta”), which alleged that the company’s Fly Delta mobile application violated California’s privacy laws.<a href="#_ftn1" name="_ftnref1">[1]</a> The Court of Appeal held that the lawsuit was expressly preempted by the Airline Deregulation Act of 1978 (ADA). The holding is in line with other cases broadly applying the ADA’s preemption provision and limits the extent to which airlines may be required to comply with state privacy laws.California’s LawsuitThe California Attorney General (AG) brought the lawsuit against Delta to enforce California’s Online Privacy Protection Act of 2003 (CalOPPA), Cal. Bus. & Prof. Code §§ 22575-22579. In pertinent part, CalOPPA requires an operator of a commercial website or online service to draft and post online a privacy policy informing consumers in California “of the Web site’s or online service’s information practices with regard to the consumers’ personally identifiable information[.]” CalOPPA also places certain other requirements on operators of websites or online services.The AG argued that Delta violated CalOPPA in connection with the Fly Delta mobile app, which can be downloaded from the Internet and used on smart phones and other mobile devices (and therefore arguably makes Delta “an operator of online services” subject to CalOPPA). Users can do a variety of things on the app, including checking in for flights, viewing reservations for air travel, pricing and buying tickets, paying for and tracking checked baggage, and accessing their frequent flyer accounts. The app also purportedly allows users to send and receive information over the Internet, and collects certain personally identifiable information (PII) about individuals residing in California.The AG alleged that Delta did not conspicuously post a privacy policy as required by CalOPPA.  According to the complaint, app users allegedly were not informed that their PII was collected, how Delta used such information, or with whom that information was shared, disclosed, or sold. The AG first notified Delta that the app did not comply with CalOPPA in an October 2012 letter.  Less than two months later, the AG filed its complaint alleging that the app “does not have a privacy policy conspicuously posted, i.e., reasonably accessible to consumers within the [mobile application.]” The AG’s complaint contained a single cause of action under California’s Business and Professions Code section 17200 (the “unfair competition law” or UCL), claiming that Delta’s CalOPPA violations were “unlawful, unfair, or fraudulent business acts and practices” under the UCL.Delta responded with a demurrer in which it argued that the ADA expressly preempted the AG’s lawsuit. The ADA is a 1978 federal law intended to remove government control over fares, routes, and new carriers entering the market in the commercial aviation field. The ADA contains an express preemption provision that prohibits the states from enacting or enforcing any law, regulation, or provision “related to a price, route, or service of an air carrier[.]” 49 U.S.C. § 41713(b)(1). The trial court agreed with Delta, sustaining the demurrer without leave to amend and dismissing the complaint with prejudice. The AG appealed.The Court of Appeal’s OpinionThe Court of Appeal affirmed, holding that the ADA preempted California’s UCL claim against Delta. The court began by reiterating the “‘two cornerstones’ of federal preemption analysis”: First, that congressional intent is the focus of the analysis, and second, that there is a presumption against preemption.            Supreme Court PrecedentApplying those cornerstone principles here, the court was guided by three cases in which the U.S. Supreme Court addressed the reach of the ADA’s preemption provision: Morales v. Trans World Airlines, Inc., 504 U.S. 374 (1992), American Airlines, Inc. v. Wolens, 513 U.S. 219 (1995), and Northwest, Inc. v. Ginsberg, 134 S.Ct. 1422 (2014).In Morales, the Supreme Court held that the ADA preempted Travel Industry Enforcement Guidelines composed by the National Association of Attorneys General (NAAG). The NAAG guidelines purported to govern the content and format of airline fare advertising and were designed to stop allegedly deceptive airline advertisements. The Supreme Court interpreted the “relating to” language in the ADA preemption clause broadly, and held that the ADA preempted the NAAG guidelines because they were “related to” a price, route, or service of an air carrier.  Morales, 504 U.S. at 383-384.The Court similarly found that the ADA preempted the plaintiffs’ claims in Wolens. In Wolens, the plaintiffs alleged American Airlines’ retroactive modification of its frequent flyer program violated Illinois’ Consumer Fraud and Deceptive Business Practices Act. The Supreme Court held that the claims related to American Airlines’ “‘[prices],’ i.e. American’s charges in the form of mileage credits for free tickets and upgrades, and . . . ‘services,’ i.e. access to flights and class‑of-service upgrades unlimited by retrospectively applied capacity controls and blackout dates.” Wolens, 513 U.S. at 226.  Because they related to prices and services, the claims were preempted by the ADA.In Ginsberg, the Supreme Court reaffirmed its broad interpretation of the ADA’s preemption provision. The Court concluded that the ADA preempted the plaintiffs’ claims for breach of the implied covenant of good faith and fair dealing stemming from allegations that the airline terminated their memberships to its frequent flyer program. The Court found that airline’s frequent flyer program was “related to” the airline’s prices and services, and thus that the claims were preempted by the ADA.            ADA Preemption, CalOPPA, and the Fly Delta AppTurning to California’s claim here, the court began by addressing a few issues that had been resolved by Morales and Wolens.First, the court noted that, in assessing whether the ADA preempts the AG’s UCL action, the court would examine the underlying state law predicate—i.e., CalOPPA.Second, the court explained that, in analyzing the preemption issue, it was not required to apply the presumption against preemption because the field governed by the ADA—air transportation—has long been regulated at the federal level.Third, the court rejected the AG’s argument that the complaint did not “relate to” Delta’s service. The app was designed to facilitate access to the airline’s services, and the AG was trying to compel Delta to maintain the app in compliance with CalOPPA.  Thus, the lawsuit “related to” Delta’s services. Notably, the court did not decide whether the app itself was a “service” within the meaning of the ADA.The court then concluded that the ADA preempts California’s UCL/CalOPPA claim as applied to Fly Delta. The court explained that CalOPPA is not a mere “disclosure regimen” within which operators of online services may act with broad discretion. Rather, CalOPPA is similar to the consumer protection legislation at issue in Morales and Wolens, and has the potential to intrusively regulate airlines.  Moreover, as in Morales, the obligations imposed by CalOPPA would significantly affect the airline’s ability to market its product through the app, and would therefore have a meaningful impact on the fares Delta charges. As the court explained, quoting Morales: “If each AG were to require Delta to comply with its own version of CalOPPA, it would force Delta to design different mobile applications to meet the requirements of each state. And, indeed, enforcement of the CalOPPA’s privacy policy requirements might well make it impossible for an airline to use a mobile application as a marketing mechanism at all.”Finally, the court rejected the AG’s argument that CalOPPA would have only “a peripheral effect on ticket prices, routes, or airline services.” CalOPPA would instead “require Delta to meet state standards regarding privacy policy requirements in place of the market forces currently dictating Delta’s selection and design of” Fly Delta.Because the ADA preempted California’s UCL claim for violation of CalOPPA, the court upheld the dismissal of the complaint. And it did so without leave to amend, finding that there was no reasonable possibility that the AG could amend to avoid ADA preemption.What This MeansDelta reinforces the broad scope of the ADA’s preemption provision. As the case makes clear, airlines have a strong argument that state laws like CalOPPA, which apply across industries and seem to have only a remote effect on the airline’s prices, routes, or services, simply cannot be applied to them. But this does not mean that the airlines may operate unchecked in areas governed by CalOPPA and other preempted laws. As the Delta court noted, quoting Wolens, Morales, and Ginsberg: “[T]he DOT retains authority to investigate unfair and deceptive practices and unfair methods of competition by airlines, and may order an airline to cease and desist from such practices or methods of competition.” The court further stated that DOT appears to have “taken action” related to the collection of PII by air carriers, and privacy policies for the sharing and storage of that PII. To date, however, the DOT has issued no regulations governing the form and placement of privacy policies related to an airline’s mobile app. And until the DOT does, state privacy laws cannot fill the gap. <a href="#_ftnref1" name="_ftn1">[1]</a> People ex rel. Harris v. Delta Air Lines, Inc., Case No. A139238, 2016 LEXIS 419 (Cal. Ct. App. May 25, 2016).

California Court of Appeal Finds AG’s Privacy Suit Over Fly Delta Mobile App Is Preempted

In a recent ruling, California’s Court of Appeal unanimously affirmed the dismissal of California’s complaint against Delta Air Lines, Inc. (“Delta”), which all

California Court of Appeal Finds AG’s Privacy Suit Over Fly Delta Mobile App Is Preempted