People Ex Rel. Harris v. Delta Air Lines, Inc.

247 Cal. App. 4th 884, 202 Cal. Rptr. 3d 395, 2016 WL 3001805, 2016 Cal. App. LEXIS 419
CourtCalifornia Court of Appeal
DecidedMay 25, 2016
DocketA139238
StatusPublished
Cited by2 cases

This text of 247 Cal. App. 4th 884 (People Ex Rel. Harris v. Delta Air Lines, Inc.) is published on Counsel Stack Legal Research, covering California Court of Appeal primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
People Ex Rel. Harris v. Delta Air Lines, Inc., 247 Cal. App. 4th 884, 202 Cal. Rptr. 3d 395, 2016 WL 3001805, 2016 Cal. App. LEXIS 419 (Cal. Ct. App. 2016).

Opinion

*888 Opinion

JENKINS, J.

In this appeal we hold that this lawsuit filed by the People, on behalf of the State of California (the State), under the unfair competition law (Bus. & Prof. Code § 17200 et seq.; UCL), 1 against Delta Air Lines, Inc. (Delta), is expressly preempted by the Airline Deregulation Act of 1978 (49 U.S.C. § 41713(b)(1)) (ADA). By its complaint, the State seeks injunctive and monetary damages based on an allegation that Delta’s Fly Delta mobile application is in violation of the privacy policy requirements mandated by California’s Online Privacy Protection Act of 2003 (Bus. & Prof. Code, §§ 22575-22579). Agreeing with Delta that the State’s lawsuit was expressly preempted by the ADA, the superior court dismissed the complaint with prejudice after sustaining Delta’s demurrer without leave to amend. 2 We affirm.

FACTUAL AND PROCEDURAL BACKGROUND 3

A. California’s Online Privacy Protection Act of 2003

In 2003, the Legislature added sections 22575 through 22579 to the Business and Professions Code, known as the Online Privacy Protection Act of 2003 (OPPA), to address the obligations of an operator of a commercial Web site or online service regarding the posting of a privacy policy on the Internet. (Stats. 2003, ch. 829, § 1, p. 6183.) The Legislature found and declared all of the following: [¶] “(a) Each operator of a commercial Web site or online service has an obligation to post privacy policies that inform consumers who are located in California of the Web site’s or online service’s information practices with regard to the consumers’ personally identifiable information and to abide by those policies. [¶] (b) It is the intent of the Legislature to require each operator of a commercial Web site or online service to provide individual consumers residing in California who use or visit the commercial *889 Web site or online service with notice of its privacy policies, thus improving the knowledge these individuals have as to whether personally identifiable information obtained by the commercial Web site through the Internet may be disclosed, sold, or shared. [¶] (c) It is the intent of the Legislature that Internet service providers or similar entities shall have no obligations under this act related to personally identifiable information that they transmit or store at the request of third parties.” (Stats. 2003, ch. 829, § 2, p. 6183.)

‘“The Senate Rules Committee’s third reading analysis of [the OPPA] indicated that this legislation was necessary because ‘[existing law does not directly regulate the privacy practices of online business entities.’ (Sen. Rules Com., Off. of Sen. Floor Analyses, 3d reading analysis of Assem. Bill No. 68 (2003-2004 Reg. Sess.) as amended Sept. 3, 2003, p. 2.) The bill’s author explained that because ‘many consumers refuse to do business online because they have little protection against abuse,’ online retailers should be required at least to disclose in their online privacy policies what personal information may be collected and how it is used. (Assem. Com. on Business and Professions, Analysis of Assem. Bill No. 68 (2003-2004 Reg. Sess.) as amended Apr. 28, 2003, p. 2; see Assem. Com. on Judiciary, Analysis of Assem. Bill No. 68 (2003-2004 Reg. Sess.) as amended Apr. 2, 2003, p. 3 [‘ “Any policy will do. The bill simply requires that an operator have a policy and then follow it.” ’].) According to the bill’s author, this disclosure regime would ‘provide[] meaningful privacy protection[] that will help foster the continued growth of the Internet economy.’ (Assem. Com. on Business and Professions, Analysis of Assem. Bill No. 68 (2003-2004 Reg. Sess.) as amended Apr. 28, 2003, p. 2.)” (Apple Inc. v. Superior Court (2013) 56 Cal.4th 128, 148 [151 Cal.Rptr.3d 841, 292 P.3d 883].)

Since its enactment in 2003, the OPPA has been amended three times. (Stats. 2004, ch. 183, § 21, p. 975; Stats. 2004, ch. 865, § 32, p. 6627; Stats. 2013, ch. 390, § 1.) The statute currently contains detailed requirements addressing the drafting of a privacy policy and the posting of the privacy policy on an Internet Web site or online services. (Bus. & Prof. Code, §§ 22575, 22576, 22577, subds. (a), (b).) In pertinent part, Business and Professions Code section 22575 reads: “(a) An operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service shall conspicuously post its privacy policy . . . . [¶] (b) The privacy policy required by subdivision (a) shall do all of the following: [¶] (1) Identify the categories of personally identifiable information that the operator collects through the Web site or online service about individual consumers who use or visit its commercial Web site or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information. [¶] (2) If the operator maintains a process for an individual consumer who *890 uses or visits its commercial Web site or online service to review and request changes to any of his or her personally identifiable information that is collected through the Web site or online service, provide a description of that process. [¶] (3) Describe the process by which the operator notifies consumers who use or visit its commercial Web site or online service of material changes to the operator’s privacy policy for that Web site or online service. [¶] (4) Identify its effective date. [¶] (5) Describe how the operator responds to Web browser ‘do not hack’ signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer’s online activities over time and across third-party Web sites or online services, if the operator engages in that collection. [¶] (6) Disclose whether other parties may collect personally identifiable information about an individual consumer’s online activities over time and across different Web sites when a consumer uses the operator’s Web site or service. [¶] (7) An operator may satisfy the requirement of paragraph (5) by providing a clear and conspicuous hyperlink in the operator’s privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.” Additionally, Business and Professions Code section 22577 defines certain terms used in the statute in the following manner: “(a) The term ‘personally identifiable information’ means individually identifiable information about an individual consumer collected online by the operator from that individual and maintained by the operator in an accessible form, including any of the following: [¶] (1) A first and last name. [¶] (2) A home or other physical address, including sheet name and name of a city or town. [¶] (3) An e-mail address. [¶] (4) A telephone number. [¶] (5) A social security number.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Kemp v. Super. Ct.
California Court of Appeal, 2022

Cite This Page — Counsel Stack

Bluebook (online)
247 Cal. App. 4th 884, 202 Cal. Rptr. 3d 395, 2016 WL 3001805, 2016 Cal. App. LEXIS 419, Counsel Stack Legal Research, https://law.counselstack.com/opinion/people-ex-rel-harris-v-delta-air-lines-inc-calctapp-2016.