Stephen S. Wu-- SL: Legal Writer,, (408) 573-5737, 50 W. San Fernando St., Ste. 750, San Jose, CA 95113

Delta Prevails in Privacy Lawsuit

I have been writing about the California Attorney General’s mobile app privacy lawsuit against Delta Airlines. The A.G. had complained that Delta failed to have a privacy policy for its mobile app. Last month, Delta prevailed in the suit, and the Court dismissed the A.G.’s complaint against it with prejudice, which means the A.G. can’t simply amend her complaint. More specifically, the Court sustained Delta’s “demurrer” in an order that dismissed the A.G.’s complaint. For a copy of the order, click here.
The order sustaining the demurrer was short and to the point. This a typical form of order proposed by the party seeking relief, Delta in this case. It does not explain the reasoning for the dismissal and so we need to look at Delta’s papers to understand the ruling.

Delta relied on two arguments in its reply brief in support of the demurrer, which you can download
here. Delta’s main argument is that federal law, namely the Airline Deregulation Act, preempts California’s Online Privacy Protection Act (OPPA). Delta said the Act regulates topics “related to” airline prices, routes, or services, including privacy.

Federal law prevails over (“preempts”) inconsistent state law under Article VI of the U.S. Constitution. Delta took the position that the Act gave only the U.S. Department of Transportation the right to regulate airline commercial practices. Thus, the Act preempts state law governing airline commercial practices, including OPPA. Thus, the A.G. could not assert state privacy violation claims against Delta.

Nonetheless, the effect of the ruling is not to gut the A.G.’s efforts to enforce OPPA broadly. The ruling was narrow, covering only airlines. For that reason, despite this setback for the A.G., other businesses should not assume the A.G. will stop her enforcement activities. Accordingly, my view that app developers should create and maintain a mobile app privacy policy still stands. For mobile app developers without a privacy policy, the time to act is now.