SAN FRANCISCO – A California appeals court last month sided with Delta Air Line against the state's attorney general, ruling that the California Online Privacy Protection Act (OPPA) is superseded by the Airline Deregulation Act (ADA) and thus Delta can't be forced to post its privacy policy within the app itself.
The policy is available online.
Attorney General Kamala Harris brought the action against Delta in 2012, seeking an injunction banning the app until the privacy policy was added to it, and fines of up to $2,500 per download. The appellate court's ruling upholds a trial court's 2013 ruling, and according to Tyler Newby of Fenwick & West, the decision "was an easy one for both courts to make," due to the ADA's clear preemption clause and the broad way in which it's consistently been applied.
"One of the things that the court of appeals opinion addresses is one of the purposes of the ADA was to have a single law that applies to how the airlines can market fares and advertise fares nationwide," Newby told the Northern California Record. "If an airline like Delta needed to conform how its app works and how its app appears to the different laws of every state, that would impose such a burden that they may choose not to have an app at all, and that's not good for consumers."
Harris argued in her appeal that the Fly Delta app does not relate to the airline's services. The court rejected that argument because the app allows customers to check in, re-book canceled flights and view reservations, among other things.
Newby questioned why Harris brought this action in the first place. It is the first enforcement action taken since OPPA was passed in 2003, and given the nature of the ADA's preemption clause, the case seemed clear.
"This is a law that's largely been a paper tiger on the books," he said. "This is the sole enforcement action that the California AG's office has brought. And they didn't pick a very good defendant to enforce it against, because they picked a defendant covered by a broad preemption clause in federal regulation."
As to whether the ruling will negatively impact personal privacy for Californians, Newby said he doesn't think so, primarily because the scope of the case is narrow, applying only to the airline industry. OPPA was not struck down, and many companies still attempt to comply with it, according to Newby. And despite the absence of a federal privacy law, common law has developed that allows for enforcement when companies act against consumers' privacy interests.
"The FCC enforces Section 5 of the FCC Act, which prohibits unfair and deceptive business practices," Newby said. "And most of the privacy enforcement actions they've brought have been over companies' practices of not describing their data collection or data transfer use practices accurately, either through an incorrect privacy policy or just marketing their product or service one way and doing something else."