Archive | State Law RSS feed for this section

The California Consumer Privacy Act

15 Oct

Following closely on the heels of the EU’s General Data Protection Regulation (GDPR), California recently enacted its own consumer privacy law called the California Consumer Privacy Act of 2018 (CCPA).

The law, which requires protection of personal information of California residents, was passed in June and then amended in late September. Merchants and payment processors will be affected by the CCPA, even those that are not based in California. Businesses will need to think closely about what types of data they collect and how they store and transmit such data. They will also need to establish processes for dealing with consumer requests.

Below are some key provisions:

  1. The law protects the personal information of consumers, defined as natural persons who are residents of California.
  2. It gives consumers the right to know what types of personal information are being collected, and whether personal information is sold or disclosed and to whom.
  3. It authorizes consumers to opt out of the sale of personal information to third parties.
  4. It allows a consumer to request a copy of the specific pieces of information collected and an explanation of the business purposes for which they are used.
  5. It gives consumers the right to request the deletion of personal information collected.
  6. It requires businesses to provide equal service and pricing with respect to privacy, which means a business cannot charge a different price to a consumer who opts out.
  7. For individuals under 16, the CCPA requires an opt-in regime rather than opt-out. So the sale of such an individual’s personal information would require affirmative consent.
  8. The law applies to companies that conduct business in California, collect consumer personal information, and satisfy the following:
    1. Annual gross revenue exceeds $25 million; or
    2. Buys, sells, or shares/receives for commercial purposes (alone or in combination) personal info of 50,000 or more consumers, households, or devices; or
    3. Derives 50% or more of annual revenue from selling consumer personal information.
  9. The law becomes effective on July 1, 2020.

Personal information is defined broadly, encompassing many types of personal, professional, educational, and commercial information, biometric and geolocation data, as well as any inferences drawn from such information to create a consumer profile “reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.”

The law also introduces a private right of action against business in certain circumstances involving unauthorized access, theft, or disclosure of personal information that is stored in nonredacted or nonencrypted form.

Merchants and payment processors would be well advised to examine the law, determine its effect on their operations, and prepare well ahead of the effective date in 2020.

California Consumer Privacy Act

— Daniel Ungar and Nicole Meisner, Attorneys, Jaffe, Raitt, Heuer & Weiss, P.C. The above is intended as general information only and should not be construed as legal advice or as creating or soliciting an attorney-client relationship. You should consult your own attorney for guidance with respect to any particular issue or problem.

Daniel Ungar

Daniel Ungar

Daniel M. Ungar is a member of the firm's Electronic Payments Group and Privacy and Datasecurity Group. Daniel, a former patent examiner in the areas of crypto- and cybersecurity, holds an advance computer science degree from Johns Hopkins University and a J.D. from Harvard Law School.

dungar@jaffelaw.com

Texas Latest State to have Surcharge Ban Declared Unenforceable by Federal Courts

9 Oct

In March 2017, the United States Supreme Court issued its opinion in Expressions Hair Design v. Schneiderman, on a challenge to New York’s law prohibiting credit card surcharges. The Supreme Court held that the law restricts merchants’ speech by banning surcharges while allowing cash discounts—two similar business models that differ only by how a merchant’s pricing can be communicated to customers—and then sent the case back down for the lower court to determine whether this particular speech restriction is lawful or not. This case remains pending (the New York state court was consulted to interpret the state statute, and we are still awaiting its response), but other federal courts have already relied on this decision to invalidate equivalent laws in other states.

In the latest blow to state restrictions on surcharges, a federal court in Texas has declared Texas’s surcharge law unenforceable. What is particularly significant about Rowell v. Paxton, decided August 16, 2018, is that it represents a reversal of the previous controlling decision in the case (from 2016) upholding Texas’s surcharge law as an ordinary business regulation. After re-analyzing the law, pursuant to Expressions, as a regulation on speech, however, the court was forced to conclude that the state failed to meet the high standard required to impose such speech restrictions.

This is a significant win for merchants, and it makes Texas the third state to have its anti-surcharge law invalidated, after Florida and California (and when the New York case is finally resolved it will likely be the fourth). However, the issue is not completely settled. First, the legality of surcharges remains untested in all other states that have similar laws. Moreover, even when a federal court declares a state law unenforceable, the statute remains on the books as official state law until it is duly repealed by the state legislature.

To illustrate the problem, consider the Ninth Circuit’s ruling on California’s surcharge ban in January 2018, in Italian Colors v. Becerra. Following the Supreme Court’s guidance in Expressions, the court struck down the law. But then, surprisingly, California’s attorney general took the position that the court’s ruling was limited to the actual plaintiffs of the case but did not, however, prohibit “general enforcement.” This means that California only recognizes the law as invalid for the plaintiffs, but not for anybody else. Therefore, under current state policy, “each use of a credit card surcharge would need to be evaluated based on its own particular facts.”

In light of California’s stance, the Rowell decision appears similarly ambiguous. The court “permanently enjoin[ed] the State of Texas from enforcing the Anti-Surcharge law against the merchants” (emphasis added). But does this mean all merchants, or just the plaintiffs? State regulators have not weighed in.

Thus, while surcharge laws appear to be on their way out nationwide, the laws remain in flux in many jurisdictions, and caution is still warranted.

— Daniel Ungar, Attorney, Jaffe, Raitt, Heuer & Weiss, P.C. The above is intended as general information only and should not be construed as legal advice or as creating or soliciting an attorney-client relationship. You should consult your own attorney for guidance with respect to any particular issue or problem.

Daniel Ungar

Daniel Ungar

Daniel M. Ungar is a member of the firm's Electronic Payments Group and Privacy and Datasecurity Group. Daniel, a former patent examiner in the areas of crypto- and cybersecurity, holds an advance computer science degree from Johns Hopkins University and a J.D. from Harvard Law School.

dungar@jaffelaw.com