Subscribe
Share
Share
Embed
In That Case is a podcast from Shook, Hardy & Bacon featuring candid discussions between attorneys in the firm’s Orange County Office.
00;00;02;26 - 00;00;11;20
Unknown
You're listening to, in that case, a podcast series exploring timely court decisions that impact the business community.
00;00;11;20 - 00;00;15;26
Unknown
Let's listen in as Schook lawyers summarize the decision.
00;00;16;13 - 00;00;35;13
Unknown
So Briskin versus Shopify is a Ninth Circuit opinion. The actual three panel opinion, was handed down in November of 2023. But recently it was vacated for an in bank ruling, specifically May this year in the oral arguments.
00;00;35;16 - 00;00;38;20
Unknown
It's where every judge on the circuit will hear the case.
00;00;38;20 - 00;00;42;23
Unknown
was, vacated oral arguments or later this month, September 26th.
00;00;42;23 - 00;00;49;24
Unknown
So this is a lawsuit, where California consumers filed an action under the California Consumer Privacy Act.
00;00;49;24 - 00;01;14;24
Unknown
They allege that Shopify, who is an online e-commerce, financial backend software provider, they alleged that when any any transaction that used Shopify as a platform, those transactions were recorded by Shopify, the identities of the consumers were recorded, without Shopify disclosing it to the consumers.
00;01;14;24 - 00;01;25;03
Unknown
So, similar in fact, pattern we have in the Massachusetts case, this is also prohibited by California Statutory Privacy Act. They have to affirmatively disclose that they're recording information
00;01;25;03 - 00;01;39;06
Unknown
that contains site. Rosenthal. It's not, but more or less concurrent, a little bit different. This case primarily deals with the second element of the personal jurisdiction analysis, where Rosenthal was really the first.
00;01;39;06 - 00;02;05;23
Unknown
He used Rosenthal to sort of highlight that. That is a typical website case. This is, a little bit different, and I'll explain how soon. So again, the three judge panel's opinion, affirming the district court's dismissal. The three judge panel of opinion was handed down in November of 2023. It affirmed dismissal for lack of personal jurisdiction over Shopify.
00;02;05;25 - 00;02;33;12
Unknown
And again, like all of these cases, it really began with, factual analysis. These are really fact intensive questions. The court began Shopify, as a Canadian company, had two wholly owned subsidiaries based in the United States, incorporated in Delaware. One of them was headquartered in Canada, but one was also headquartered in Delaware. It the the different entities are not important for the analysis of the court, so I will just be referring to them all at Shopify.
00;02;33;14 - 00;02;37;20
Unknown
What Shopify would do as I described was collect consumer transaction data.
00;02;37;20 - 00;02;54;17
Unknown
It would then send this data to its subsidiary in Delaware, who would clean the data. It would then send that clean data to a contracted business partner named stripe, who's a basically a data brokerage advertising agency located in California.
00;02;54;17 - 00;03;04;07
Unknown
So under the first international law shoe element, the amount of connections Shopify has with California are fairly significant.
00;03;04;07 - 00;03;13;15
Unknown
It Shopify does have personal, purposeful contact with California readers registered to do business in the state. It has an office in Los Angeles,
00;03;13;15 - 00;03;16;29
Unknown
and it uses its office primarily to expand its business.
00;03;16;29 - 00;03;26;27
Unknown
It has its clients are retailers. So Shopify itself does not sell goods, but it contracts with retailers. So retailers can use its payment processing platform.
00;03;27;04 - 00;03;30;21
Unknown
There are 80,000 businesses in California that use Shopify.
00;03;30;21 - 00;03;38;27
Unknown
And as I mentioned, stripe, the company that Shopify ultimately sends the data to, is also headquartered in, based in California.
00;03;38;27 - 00;03;46;15
Unknown
So there's no question that the first element of International Shoe is mat. Shopify was intentionally acting and,
00;03;46;15 - 00;03;49;24
Unknown
retaining some benefits from acting within the state of California.
00;03;49;24 - 00;03;52;20
Unknown
Under the second element, the three judge panel,
00;03;52;20 - 00;03;54;23
Unknown
actually affirmed the dismissal.
00;03;54;23 - 00;04;01;15
Unknown
It ruled that there was no relatedness between the connections and the conduct alleged in the lawsuit.
00;04;01;15 - 00;04;13;12
Unknown
So keep in mind, the allegations in the lawsuit were the collection of the data, the undisclosed collection of the data, not the subsequent processing, not the sending the data to third parties.
00;04;13;14 - 00;04;24;29
Unknown
None of those actions are prohibited by the CcpA. The CcpA has a disclosure requirement, so it's only at the moment the data was collected that the violation of the CcpA allegedly occurred.
00;04;24;29 - 00;04;40;28
Unknown
So the question really is, did the collection of the data was that uniquely targeted to citizens of California? And the answer is no. Shopify, even though it is based, has large business connections in California.
00;04;41;00 - 00;04;57;10
Unknown
The fact its platform used by anyone, anywhere records data doesn't. That standard is from international. The relatedness. Yeah arise from a relatedness yes. So the the connections with the forum have to arise relate to the lawsuit essentially.
00;04;57;18 - 00;05;00;14
Unknown
So the court then discussed,
00;05;00;14 - 00;05;08;16
Unknown
again, the partnership with stripe. It seems a little strange that Shopify sends data it collected back into California.
00;05;08;16 - 00;05;13;24
Unknown
But that was under a contract. Really. It didn't matter that stripe was located in California.
00;05;13;24 - 00;05;24;24
Unknown
They could have been located anywhere. They were just a business partner with Shopify. So the fact that they're doing that doesn't evidence Shopify intending to collect more data from California consumers.
00;05;25;02 - 00;05;39;04
Unknown
But, you know, admittedly, there is some contact there, right? Like if you think of data as some type of transmission, they are sending it into California for, you know, ultimate use and processing, but again, not prohibited by the CcpA.
00;05;39;14 - 00;06;03;22
Unknown
Before there's a circuit split as to whether the language arise from or relate to what is, conjunctive or disjunctive, a lot of circuits interpreted the language as requiring a but for causal test. The Supreme Court made it clear, no, it's conjunctive. It can be causation, but in reality, the connections with the form can just relate to the conduct at issue in the lawsuit.
00;06;03;28 - 00;06;14;23
Unknown
What does relate to mean? The Supreme Court says exactly what it sounds like. So yeah, take that for what it is. So basically the panel said
00;06;14;23 - 00;06;23;10
Unknown
not applicable in the data collection and privacy context. Those are my words, not theirs. But really, they said the quiet part out loud
00;06;23;10 - 00;06;30;06
Unknown
and the Supreme Court's entire jurisprudence on products, as distinct.
00;06;30;14 - 00;07;05;21
Unknown
They said the physical shipment of products between states is distinct, which the Supreme Court has never said. That's clearly they're not wrong in characterizing the Supreme Court's jurisprudence like that. But the Supreme Court has never said that, especially not in a majority opinion. Most of the opinions are pluralities. So, quote, the sale of physical items through the internet is simply different from other forms of internet activity, based on the long held understandings about the jurisdictional significance of physical shipments into a forum.
00;07;05;24 - 00;07;36;07
Unknown
That traditional legal backdrop, however, does not extend to the extraction of consumer data through an online transaction. That's pretty significant. I think, you know, it could be one of the primary reasons that, the on bank, the cert for on bank was, was actually granted. So, you know, overall, I once again, I think the panel concluded ruled, correctly.
00;07;36;07 - 00;07;38;00
Unknown
It's a little bit ambiguous.
00;07;38;00 - 00;07;43;09
Unknown
Well, as to whether or not Shopify's activities in California were related to their collection of data,
00;07;43;09 - 00;07;56;05
Unknown
but ultimately, I think, you know, the court didn't clearly air this was a case of first impression, whether or not, e-commerce, software providers are subject to personal jurisdictions.
00;07;56;05 - 00;07;59;26
Unknown
It's actually the first time it had made it up to the circuit courts.
00;07;59;26 - 00;08;09;19
Unknown
But again, nothing inherently wrong with the court's reasoning. So perhaps the en banc, hearing is is really just to clarify clarify this.
00;08;09;19 - 00;08;21;11
Unknown
So, you know, you look at the Briskin case and you say, there seems to be an issue here in the last six years, 30 or so states have passed privacy protection laws.
00;08;21;16 - 00;08;28;15
Unknown
It seems a little strange that the state attorney general cannot enforce those laws in their own state.
00;08;28;15 - 00;08;41;08
Unknown
Especially, you know, where they're the class of individuals they're enforcing the action from is limited to citizens of their state. So, very clearly that's an outside you can override.
00;08;41;08 - 00;08;46;24
Unknown
So I think a companies like a company are subject to like, Delaware's, like privacy protection.
00;08;46;26 - 00;08;57;03
Unknown
Well, they would they would have to bring the suit in Delaware under the foreign states law. Yeah. And like every state's rights laws essentially can be
00;08;57;03 - 00;09;08;20
Unknown
useless because those, I would say, deterred from enforcement is probably the words I would use because who wants to what California attorney general wants to go litigate in Delaware.
00;09;08;20 - 00;09;34;13
Unknown
That just doesn't give a choice of answers to what your establish your personal jurisdiction in the state, that court to do a choice of non apply of whatever kind of state law even though there and and that's what it would be. It would be a lot of the volume. It would be a class of California citizens alleging a violation of the California law venue in Delaware District Court, which then Stranger Things on the Southern District of New York.
00;09;34;16 - 00;10;05;12
Unknown
I believe it. I, I think I think the volume of these types of statutory enforcement actions that's happening it it like if this opinion you know again Briskin first impression but if other circuits follow this reasoning, all 30 of the recently enacted state laws are essentially you know, you can you can see what I mean. The enforcement will be deterred is probably the correct to say the data collected company is only that jurisdiction exists where it's done.
00;10;05;12 - 00;10;31;06
Unknown
So as a matter where the servers or the collect the data, it's interesting. It really depends on the content, on the conduct they're alleging. So, you know, a hypothetical, that the issue of where servers are located has come up when dealing with whether or not an entirely foreign, company could be subject to enforcement in the United States.
00;10;31;12 - 00;10;38;01
Unknown
It is not really been raised in the, Federalist state to state context. So a little bit unclear.
00;10;38;01 - 00;10;43;10
Unknown
But you know, in, in this sort of comedy, personal jurisdiction analysis that happens in those,
00;10;43;10 - 00;10;55;03
Unknown
foreign cases in the United States for somewhere else. They do see servers located as evidence that they were trying to serve and trying to target the United States market.
00;10;55;06 - 00;11;01;14
Unknown
But again, the analysis is state by state usually. Yeah. Thank you counsel. Great job
00;11;01;21 - 00;11;10;27
Unknown
We hope you enjoyed this episode. Each month, we will be bringing you podcasts on a variety of topics. Join us next time for in that case,