Antitrust Law Daily Wrap Up, TOP STORY—CalSCt: California Ban on Retailers’ Seeking of Personal Information Does Not Apply to Online Transactions, (Feb 5, 2013)

By E. Darius Sturmer, J.D.

A consumer could not maintain claims that Apple Inc. violated California’s Song-Beverly Credit Card Act of 1971 by requiring him to provide his address and telephone number as a condition of accepting his credit card as payment in an online transaction on its iTunes store, the California Supreme Court has ruled in a 4-3 decision (Apple Inc. v. The Superior Court of Los Angeles County, February 4, 2013, Liu, G.).

The provision of the Act prohibiting retailers from requiring or requesting that consumers write any personal identification information upon a credit card transaction, section 1747.08, did not apply to online purchases in which the product is downloaded electronically, in the majority’s view. A state appellate court’s denial of the retailer’s petition for writ of mandate or prohibition following a trial court’s overruling of demurrer was, therefore, reversed.

The supreme court acknowledged its recent conclusions, in Pineda v. Williams-Sonoma Stores, Inc. (2011) 51 Cal.4th 524, that a ZIP code constituted “personal identification information” within the meaning of the statute and that section 1747.08 of the Credit Card Act forbade a retailer from requesting or recording that information during a credit card transaction. However, it distinguished that ruling on the basis that online purchases of electronically downloadable products did not fit within the statutory scheme in the same manner that in-person transactions did.

At the outset, the court observed that the text of section 1747.08 made no reference to online transactions or the Internet. While the complaining consumer contended that the language of sec. 1747.08(a) “must be read as an all-inclusive prohibition on every businesses [sic] regardless of the form of the transaction,” Apple argued that the first sentence of sec. 1747.08(a) had to be construed in light of other language in the statute indicating that the legislature had in mind only in-person business transactions. The company cited verbiage such as the law’s prohibition on requesting or requiring a “cardholder to write any personal information transaction upon the credit card transaction form or otherwise” and its prohibition on utilizing “a credit card form which contains preprinted spaces.” (Italics added.)

The court first decided that the text of the law alone was not decisive on the question at hand. While it appeared that the state legislature had not contemplated commercial transactions conducted on the Internet at the time it enacted sec. 1747.8, the predecessor statute to sec. 1747.08—1990—it “[did] not seem awkward or improper to describe the act of typing characters into a digital display as ‘writing’ on a computerized ‘form.’” When “construing statutes that predated their possible applicability to new technology,” the court said, “courts have not relied on wooden construction of their terms.”

Risk of Fraud. While it was clear to the supreme court that the legislature enacted the Credit Card Act to protect consumer privacy, it was also clear that the legislature did not intend to achieve privacy protection without regard to exposing consumers and retailers to undue risk of fraud. That the subsequent addition of a provision to the statute allowing businesses to require cardholders to provide identification so long as none of the information contained thereon was recorded was described as “a clarifying, nonsubstantive change” further reflected that nothing in the statute prevented retailers from requiring customers to provide positive identification as a condition of accepting a credit card payment, the court said.

The safeguards against fraud that are provided in sec. 1747.08(d) of the Credit Card Act were not available to an online retailer selling an electronically downloadable product. An online retailer could not visually inspect a credit card, back-of-the-card signature, or the customer’s photo identification, the court reasoned. Thus, the key antifraud mechanism in the statutory scheme had no practical application to online transactions involving electronically downloadable products. Based on this, the court could not conclude that if the legislature had been prescient enough in 1990—before the Internet era—to anticipate these sorts of transactions, it would have intended sec. 1747.08(a)’s prohibitions to apply to such transactions despite the unavailability of sec. 1747.08(d)’s safeguards.

The consumer’s complaint only reinforced the court’s decision, insofar as it failed to allege that Apple did not require any personal identification information to verify the identity of the credit card user. Further, the consumer had expressly conceded at oral argument that Apple may need at least a valid billing address, if not a telephone number, to verify a credit card. Under the consumer’s theory of the case, there would be no way for Apple to collect this information under the statute.

The court rejected an argument by the consumer that requiring a customer to provide his or her name, credit card number, card expiration date, and credit card identification number sufficed to prevent fraud. It was clear from the statute’s provisions aimed at fraud prevention for in-person transactions that the legislature disagreed with that position, the court remarked.

Also rejected was an argument that a 2011 amendment to the Credit Card Act exempting certain “pay-at-the-pump” motor fuel transactions from the statute’s prohibitions showed that sec. 1747.08 applied on online transactions. A remote transaction conducted at a gas station did not stand on equal footing with an online transaction, and by addressing the former situation in 2011, the legislature was not signaling the statute’s applicability to the latter, in the court’s view. While there existed conflicting evidence and legally dubious inferences from the 2011 amendment’s legislative history as to whether the 1990 statute applied to online transactions, what was clear from that history was that the amendment was enacted to address a very specific problem, the court stated.

The court cited the California Online Privacy Protection Act of 2003 to demonstrate that the legislature knew how to make clear that it was regulating online privacy and that it did so by carefully balancing concerns unique to online commerce. COPPA, in the court’s view, also refuted the assertion put forth by the dissenting justices that the court’s decision left online retailers “free to require personal identification as a condition of credit card acceptance and to use such information for whatever purposes they wish.” COPPA was but one of a number of existing state and federal laws that provided consumers with a degree of protection against unwanted use or disclosure of personal identification information, the court explained. The accommodation of interests struck by the Legislature would not be achieved if section 1747.08 were read to apply to online transactions involving electronically downloadable products, the court concluded.

Dissenting Opinions. A dissenting opinion penned by Justice Joyce Kennard concluded that the statute contained no exemption, express or implied, for online sales of downloadable products. The dissent argued that the majority’s concern that a “plain-meaning construction of the statute [left] online sellers with no way to detect and prevent fraudulent purchases” was unjustified.

A dissent by Justice Marvin Baxter also concluded that the consumer’s complaint sufficiently stated a cause of action under the Credit Card Act. The opinion accused the majority of relying on “speculation and debatable factual assumptions to carve out an expansive exception to sec. 1747.08.” While acknowledging that the case posed a question of statutory construction, Justice Baxter contended that the majority reached a result that was contrary to the terms, purpose, and legislative history of section 1747.08.

Virtually all of the exceptions listed within the statute “could apply either in online credit card purchase transactions or in face-to-face purchase transactions occurring at brick-and-mortar establishments,” Justice Baxter noted, and nothing in subdivision (a), (b), or (c) suggested that “a literal construction of sec. 1747.08 would implicate due process or result in absurd consequences.” Sec. 1747.08(d) was merely permissive and thus posed no barrier or difficulty to an online retailer’s compliance with the entirety of the statute, the dissent added.

The case is No. S199384.

Attorneys: Daniel M. Kolkey (Gibson, Dunn & Crutcher) for Apple Inc. Edwin C. Schreiber (Schreiber & Schreiber), for real party in interest David Krescent.

Companies: Apple Inc.

MainStory: TopStory Privacy CaliforniaNews