Tide Could Be Turning in Favor of Defendants in CIPA Cases, Lawyer Says
Though creative plaintiffs' counsel saw early success, the tide is beginning to turn in favor of defendants in California Invasion of Privacy Act (CIPA) cases, said Douglas Bonner in a blog post. The Potomac Law Group lawyer added that these developments may chill future litigation claims under the statute.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
"Corporate defendants have won several recent court decisions which, together with prior litigated decisions, and considering risk mitigation measures that many companies already take, should strengthen the confidence of corporate defendants that they have strong defenses to any CIPA liability for the use of standard online technologies," he said.
For example, the recent decision by the 9th U.S. Circuit Court of Appeals in Gutierrez v. Converse raised questions about whether CIPA even applied to Internet communications (see 2507210019). In Ramos v. Gap, the U.S. District Court for Northern California remained skeptical about what counts as a communication under CIPA, and dismissed the suit.
Both cases "also establish that claims brought ... for 'willfully attempting to learn the contents or meaning of a communication in transit over a wire' are not viable if the data are not accessed in transit (such as over a chat room feature) but rather after transit, such as in the case of access being requested for technical assistance after transit," Bonner said.
On the other hand, the California legislature also attempted to pass a measure limiting CIPA litigation -- SB-690 -- but it was turned into a two-year bill and held for further consideration next session (see 2507010057). As such, SB-690 will likely not be on the books until 2027 at the earliest and "the current wave of CIPA litigation will continue for at least another year."
If passed, SB-690 "would bar private lawsuits for the processing of personal information for a commercial business purpose, effectively eliminating the private right of action for a wide range of CIPA claims related to online business activities," and would not apply retroactively, Bonner noted.
To minimize CIPA risk, the lawyer recommended understanding what technologies are deployed on your company's website and what information they collect, as well as ensuring there are proper notice and consent procedures in place.