By Craig Cardon and Elizabeth Berman

The California Court of Appeal has recently published two new decisions involving data privacy class actions. Both involve claims under the Song-Beverly Credit Card Act. The most recent, Jessica Pineda v. Williams-Sonoma Stores, Inc., 2009 DJDAR 15191, affirmed the judgment against the plaintiff on the grounds that it is not a violation of Song-Beverly to request a zip code during a credit card transaction, even if the zip code is matched with a name to acquire that individual’s address, and that the same conduct is not a serious invasion of privacy where the home address information is publicly available and plaintiff has taken no special steps to protect it. Approximately one month earlier, the same panel held in Susan Powers v. Pottery Barn Inc., (2009) 177 Cal.App.4th 1039, that the federal CAN-SPAM Act does not preempt a Song-Beverly claim based on a request for an email address, and sent the case back to the trial court for further proceedings.

In Jessica Pineda v. Williams-Sonoma Stores, Inc., the plaintiff had alleged that Williams-Sonoma violated Song-Beverly by requesting her zip code during a credit card transaction and then used that zip code in conjunction with her name to look up her address. Song-Beverly prohibits the requesting of an address, among other things, during a credit card transaction. She also alleged that this same conduct constituted an invasion of her right to privacy under the California Constitution. The trial court sustained Williams-Sonoma’s demurrer to the class complaint. Shortly after the trial court’s dismissal, the Court of Appeal issued its opinion in Party City v. Superior Court, (2008) 169 Cal.App.4th 497, holding that a zip code is not Personal Identification Information as the term is defined under Song-Beverly. Pineda appealed, arguing that Party City was distinguishable because she specifically alleged that her zip code was used to obtain her home address, and that Party City did not involve an invasion of privacy claim. The Court of Appeal affirmed the trial court’s dismissal of Pineda’s claim. It found that regardless of whether a zip code is used to look up a home address, the zip code is not Personal Identification Information and is not covered by Song-Beverly. As to the invasion of privacy claim, the Court of Appeal held that the alleged invasion – the looking up of a home address – was not sufficiently serious to constitute an invasion of the California Constitution’s right to privacy. The Court further explained that even if the address was sold after it was obtained, the invasion would not be sufficiently serious where the address was publicly available and where the plaintiff had not taken specific steps to keep it private.

In Powers v. Pottery Barn Inc., (2009) 177 Cal. App. 4th 1039, the trial court dismissed the only claim brought by plaintiff Powers, a Song-Beverly claim based upon a request for her email address, on the basis that it was preempted by the federal CAN-SPAM Act. Pottery Barn argued on demurrer, and the trial court agreed, that if Song-Beverly regulated the collection of email, then it is preempted by CAN-SPAM. Powers appealed and the Court of Appeal reversed the judgment against her, on the basis that Song-Beverly did not expressly regulate the sending of commercial email. The Court of Appeal distinguished this case from Facebook Inc. v. ConnectU, LLC, (2007) 489 F.Supp. 2d 1087, by asserting that the statute at issue in Facebook expressly regulated the collection of email for the purpose of sending unwanted commercial messages, whereas Song-Beverly does not expressly reference email. The Court of Appeal declined to affirm on the alternative grounds that an email address is not Personal Identification Information under Song-Beverly because the factual record regarding how email operates and how email addresses are used had not been sufficiently developed to make such a determination. Accordingly, the case now returns to the trial court where the factual record will be developed and a determination then made as to whether email addresses are covered by Song Beverly.

Both Williams-Sonoma and Pottery Barn were represented by Craig Cardon and Elizabeth Berman of Sheppard Mullin.