As owner of the Weather Channel app, IBM is fighting the contention made by the L.A. City Attorney's Office that it has violated California's unfair competition law by deceptively collecting private geolocation data from users and selling it for profit. On June 11, IBM submitted a motion for summary judgment that pointed to California's recent enactment of the nation's most stringent data privacy statute.
That would be the California Consumer Privacy Act, which gives consumers the right to know what personal information a business is collecting from them; the right to know who it shares it with or sells it to; the right to request that a business delete that information; and the right to stop the sale of their info. California's Attorney General has been busy issuing regulations clarifying the law while businesses including entertainment streamers are spending billions of dollars on compliance.
All for naught?
Perhaps, suggests IBM's attorneys.
The lawsuit alleges that when users of the Weather Channel app sign into figure out the day's temperature, a treasure trove of information about the users' locations throughout the day and night is collected. Eventually, that data is sold. The complaint even suggests that the operators of the Weather Channel app are selling the location data to hedge funds interested in analyzing consumer behavior.
Still, that's not necessarily illegal. The question may be whether there's anything that's fraudulent about what users of the Weather Channel app are being told.
According to defendants' summary judgment motion, users were informed that geolocation data was being collected for transmission to third parties. But those disclosures happened on an online privacy page.
"Plaintiff’s case boils down to a claim that the UCL requires additional disclosures in additional locations," IBM's lawyers at Quinn Emanuel write. "Specifically, Plaintiff contends that the UCL requires mobile app operators like Defendants to disclose 'all of [their] material practices regarding their users’ location [or other personal] data' in a 'mandatory screen or pop-up within the App, to which users are required to consent prior to the collection of any location [or other personal] data.'”
IBM says that's not the law — that such requirements significantly exceed the disclosures mandated by both the California Online Privacy Protection Act and the California Consumer Privacy Act. As such, the defendant says that what the L.A. City Attorney's Office is doing is attempting to legislate through litigation.
"The implications of Plaintiff’s claim are profound," continues the memorandum (read here). "CCPA and its implementing regulations are the result of an extensive and high-profile legislative and administrative process that involved gathering input from numerous experts and interest groups, including consumer privacy advocates and various sectors of the business community, in an effort to strike an 'appropriate balance' between consumer privacy and business needs. The Attorney General estimates that businesses will spend over $55 billion to bring their privacy disclosures and practices into compliance with CCPA. Yet, under Plaintiff’s view, these efforts and expenditures will all be for naught because even businesses whose disclosures were compliant with CCPA by the January 1, 2020 deadline (like Defendants) can still be held liable for 'fraud' and 'deception' for failing to satisfy Plaintiff’s far more rigorous UCL-implied disclosure requirements..."
Separately, the defendants in this case argue that the People of California can't prove a failure to disclose given what was on the Weather Channel's privacy page plus there's no showing of substantial injuries. As a second motion for summary judgment (read here) puts it, "[T]he Court should be skeptical of treating the alleged 'mental and subjective' injuries as 'substantial' injuries because there is no evidence that any significant population of consumers believe they are meaningfully harmed by the use or sharing of their location data for advertising."
